Note that there are some explanatory texts on larger screens.

plurals
  1. PO
    primarykey
    data
    text
    <p>PIE (and PIC) code needs a <em>relocation</em> process after loading at some address (different from default) and before it will be runned. I suggest you consult the code of <code>ld.so</code>. Also, you should check the relocations table in your binary (e.g. using <code>readelf -r</code>).</p> <p>Here is a good presentation on PIE (it is about OpenBSD, but the process is same). <a href="http://www.openbsd.org/papers/nycbsdcon08-pie/" rel="noreferrer">http://www.openbsd.org/papers/nycbsdcon08-pie/</a> or <a href="http://www.dcbsdcon.org/speakers/slides/miller_dcbsdcon2009.pdf" rel="noreferrer">http://www.dcbsdcon.org/speakers/slides/miller_dcbsdcon2009.pdf</a> </p> <p>I guess you should not only to change a GOT, but to also to find all Relocations and to do them.</p> <p>Basically, processing of PIE binary by ld.so is almost the same as processing a dynamic library with PIC, with relocating not a library, but the executable image itself.</p> <p>The "Wrong addresses" you see is a place, where an actual value would be written by relocation solving. As for i386 <a href="http://books.google.com/books?id=Id9cYsIdjIwC&amp;pg=PA174" rel="noreferrer">http://books.google.com/books?id=Id9cYsIdjIwC&amp;pg=PA174</a> there are relocations:</p> <ul> <li>R_386_GOTPC</li> <li>R_386_GOT32</li> <li>R_386_GOTOFF</li> <li>R_386_RELATIVE</li> </ul> <p>Linker should resolve all of them before the code can access a global data.</p> <p>Readelf -r sample:</p> <p>Dynamically linked one </p> <pre><code>$ readelf -r fdyn Relocation section '.rel.dyn' at offset 0x27c contains 1 entries: Offset Info Type Sym.Value Sym. Name 08049ff0 00000106 R_386_GLOB_DAT 00000000 __gmon_start__ Relocation section '.rel.plt' at offset 0x284 contains 2 entries: Offset Info Type Sym.Value Sym. Name 0804a000 00000107 R_386_JUMP_SLOT 00000000 __gmon_start__ 0804a004 00000207 R_386_JUMP_SLOT 00000000 __libc_start_main </code></pre> <p>PIE:</p> <pre><code>$ readelf -r fPIE Relocation section '.rel.dyn' at offset 0x388 contains 6 entries: Offset Info Type Sym.Value Sym. Name 00001fe8 00000008 R_386_RELATIVE 00001ff0 00000008 R_386_RELATIVE 00002010 00000008 R_386_RELATIVE 00001fe0 00000106 R_386_GLOB_DAT 00000000 __gmon_start__ 00001fe4 00000206 R_386_GLOB_DAT 00000000 _Jv_RegisterClasses 00001fec 00000406 R_386_GLOB_DAT 00000000 __cxa_finalize Relocation section '.rel.plt' at offset 0x3b8 contains 3 entries: Offset Info Type Sym.Value Sym. Name 00002000 00000107 R_386_JUMP_SLOT 00000000 __gmon_start__ 00002004 00000307 R_386_JUMP_SLOT 00000000 __libc_start_main 00002008 00000407 R_386_JUMP_SLOT 00000000 __cxa_finalize </code></pre>
    singulars
    1. This table or related slice is empty.
    plurals
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. This table or related slice is empty.
    1. VO
      singulars
      1. This table or related slice is empty.
    2. VO
      singulars
      1. This table or related slice is empty.
    3. VO
      singulars
      1. This table or related slice is empty.
 

Querying!

 
Guidance

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload