:£ £ £  push£  %ebp
0x80483d1 :£ £  mov£ £ %esp,%ebp
0x80483d3 :£ £  push£  $0x8048440
0x80483d8 :£ £  call£  0x8048308
0x80483dd :£ £ add£ £ $0x4,%esp
0x80483e0 :£ £ xor£ £ %eax,%eax
0x80483e2 :£ £ jmp£ £ 0x80483e4
0x80483e4 :£ £ leave
0x80483e5 :£ £ ret
...
0x80483ef :£ £ nop
end of assembler dump.
(gdb) b * 0x80483d8
breakpoint 1 at 0x80483d8
(gdb) r
starting program: /home/alert7/test

breakpoint 1, 0x80483d8 in main ()
(gdb) disass 0x8048308£ £ £ £ £ £ £ £ ¢Ù£ £ ¢Å
dump of assembler code for function printf:
/****************************************/£ £ //plt4£º
0x8048308 :£ £  jmp£ £ *0x8049488£ £ £  //jmp got[6]
?£ £ £ £ £ £ £ £ £ £ £  //´Ëʱ£¬got[6]ÖдæÔÚµÄÊÇ0x804830e
0x804830e :£  push£  $0x18£ £ £ £ //$0x18ΪprintfÖض¨Î»Èë¿ÚÔÚjmprel sectionÖеÄÆ«ÒÆÁ¿
0x8048313 :£ jmp£ £ 0x80482c8 <_init+48> //jmp plt0
?£ £ £ £ £ £ £ £ £ £ £  //plt0´¦´æ·Å×ŵ÷ÓÃrtldº¯ÊýµÄÖ¸Áî
?£ £ £ £ £ £ £ £ £ £ £  //µ±º¯Êý·µ»Øʱºò£¬°Ñgot[6]ÐÞ¸ÄΪÕæÕýµÄ
?£ £ £ £ £ £ £ £ £ £ £  //printfº¯ÊýµØÖ·£¬È»ºóÖ±½ÓÌøµ½printfº¯Êý
?£ £ £ £ £ £ £ £ £ £ £  //Ö´ÐС£
¸Ã²¿·ÖΪpltµÄÒ»²¿·Ö
/****************************************/
end of assembler dump.
(gdb) x 0x8049488£ £ £ £ £ £ £ £ 
0x8049488 <_global_offset_table_+24>:£  0x0804830e
080482c8 <.plt>:£ £ £ £ £ £ £ £ ¢Ú£ £ £ £ //plt0£º
80482c8:£ £ £  ff 35 74 94 04 08£ £ £  pushl£ 0x8049474£ £ //pushl got[1]µØÖ·
?£ £ £ £ £ £ £ £ £ £ £ £ £ £ £  //got[1]ÊÇÒ»¸ö¼ø±ðÐÅÏ¢£¬ÊÇlink_mapÀàÐ͵ÄÒ»¸öÖ¸Õë

80482ce:£ £ £  ff 25 78 94 04 08£ £ £  jmp£ £ *0x8049478£ £ //jmp got[2]
?£ £ £ £ £ £ £ £ £ £ £ £ £ £ £  //Ìøµ½¶¯Ì¬Á¬½ÓÆ÷½âÎöº¯ÊýÖ´ÐÐ
80482d4:£ £ £  00 00£ £ £ £ £ £ £ £ £  add£ £ %al,(%eax)
80482d6:£ £ £  00 00£ £ £ £ £ £ £ £ £  add£ £ %al,(%eax)

80482d8:£ £ £  ff 25 7c 94 04 08£ £ £  jmp£ £ *0x804947c£ £ //plt1£º
80482de:£ £ £  68 00 00 00 00£ £ £ £ £ push£  $0x0
80482e3:£ £ £  e9 e0 ff ff ff£ £ £ £ £ jmp£ £ 80482c8 <_init+0x30>

80482e8:£ £ £  ff 25 80 94 04 08£ £ £  jmp£ £ *0x8049480£ £ //plt2£º
80482ee:£ £ £  68 08 00 00 00£ £ £ £ £ push£  $0x8
80482f3:£ £ £  e9 d0 ff ff ff£ £ £ £ £ jmp£ £ 80482c8 <_init+0x30>

80482f8:£ £ £  ff 25 84 94 04 08£ £ £  jmp£ £ *0x8049484£ £ //plt3£º
80482fe:£ £ £  68 10 00 00 00£ £ £ £ £ push£  $0x10
8048303:£ £ £  e9 c0 ff ff ff£ £ £ £ £ jmp£ £ 80482c8 <_init+0x30>

8048308:£ £ £  ff 25 88 94 04 08£ £ £  jmp£ £ *0x8049488£ £ //plt4£º
804830e:£ £ £  68 18 00 00 00£ £ £ £ £ push£  $0x18
8048313:£ £ £  e9 b0 ff ff ff£ £ £ £ £ jmp£ £ 80482c8 <_init+0x30>

(gdb) b * 0x80482c8
breakpoint 2 at 0x80482c8
(gdb) c
continuing.

breakpoint 2, 0x80482c8 in _init ()
(gdb) x/8x 0x8049470
0x8049470 <_global_offset_table_>:£ £ £ 0x08049490£ £ £ 0x40013ed0£ £ £ 0x4000a960£ £ £ 0x400fa550
0x8049480 <_global_offset_table_+16>:£  0x080482ee£ £ £ 0x400328cc£ £ £ 0x0804830e£ £ £ 0x00000000
(gdb) x/50x 0x40013ed0 ( * link_mapÀàÐÍ)
0x40013ed0:£ £  0x00000000£ £ £ 0x40010c27£ £ £ 0x08049490£ £ £ 0x400143e0
0x40013ee0:£ £  0x00000000£ £ £ 0x40014100£ £ £ 0x00000000£ £ £ 0x08049490
0x40013ef0:£ £  0x080494e0£ £ £ 0x080494d8£ £ £ 0x080494a8£ £ £ 0x080494b0
0x40013f00:£ £  0x080494b8£ £ £ 0x00000000£ £ £ 0x00000000£ £ £ 0x00000000
0x40013f10:£ £  0x080494c0£ £ £ 0x080494c8£ £ £ 0x08049498£ £ £ 0x080494a0
0x40013f20:£ £  0x00000000£ £ £ 0x00000000£ £ £ 0x00000000£ £ £ 0x080494f8
0x40013f30:£ £  0x08049500£ £ £ 0x08049508£ £ £ 0x080494e8£ £ £ 0x080494d0
0x40013f40:£ £  0x00000000£ £ £ 0x080494f0£ £ £ 0x00000000£ £ £ 0x00000000
0x40013f50:£ £  0x00000000£ £ £ 0x00000000£ £ £ 0x00000000£ £ £ 0x00000000
0x40013f60:£ £  0x00000000£ £ £ 0x00000000£ £ £ 0x00000000£ £ £ 0x00000000
(gdb) disass 0x4000a960£ £ £ £ £ £ £ £ ¢Û
dump of assembler code for function _dl_runtime_resolve:
0x4000a960 <_dl_runtime_resolve>:£ £ £  push£  %eax
0x4000a961 <_dl_runtime_resolve+1>:£ £  push£  %ecx
0x4000a962 <_dl_runtime_resolve+2>:£ £  push£  %edx
0x4000a963 <_dl_runtime_resolve+3>:£ £  mov£ £ 0x10(%esp,1),%edx
0x4000a967 <_dl_runtime_resolve+7>:£ £  mov£ £ 0xc(%esp,1),%eax
0x4000a96b <_dl_runtime_resolve+11>:£ £ call£  0x4000a740
?£ £ £ £ £ £ £ £ £  //µ÷ÓÃÕæÕýµÄ½âÎöº¯Êýfixup()£¬ÐÞÕýgot[6]£¬Ê¹ËüÖ¸ÏòÕæÕýµÄprintfº¯ÊýµØÖ·
0x4000a970 <_dl_runtime_resolve+16>:£ £ pop£ £ %edx
0x4000a971 <_dl_runtime_resolve+17>:£ £ pop£ £ %ecx
0x4000a972 <_dl_runtime_resolve+18>:£ £ xchg£  %eax,(%esp,1)
0x4000a975 <_dl_runtime_resolve+21>:£ £ ret£ £ $0x8£ £ //Ìøµ½printfº¯ÊýµØÖ·Ö´ÐÐ
0x4000a978 <_dl_runtime_resolve+24>:£ £ nop
0x4000a979 <_dl_runtime_resolve+25>:£ £ lea£ £ 0x0(%esi,1),%esi
end of assembler dump.
(gdb) b * 0x4000a972
breakpoint 4 at 0x4000a972: file dl-runtime.c, line 182.
(gdb) c
continuing.

breakpoint 4, 0x4000a972 in _dl_runtime_resolve () at dl-runtime.c:182
182£ £  in dl-runtime.c
(gdb) i reg $eax $esp
eax£ £ £ £ £ £ 0x4006804c£ £ £  1074167884
esp£ £ £ £ £ £ 0xbffffb64£ £ £  -1073743004
(gdb) b *0x4000a975
breakpoint 5 at 0x4000a975: file dl-runtime.c, line 182.
(gdb) c
continuing.

breakpoint 5, 0x4000a975 in _dl_runtime_resolve () at dl-runtime.c:182
182£ £  in dl-runtime.c
(gdb) si
printf (format=0x1

) at printf.c:26
26£ £ £ printf.c: no such file or directory.
(gdb) disass£ £ £ £ £ £ £ £ £ £ ¢Ü£ £ ¢Æ
dump of assembler code for function printf:
0x4006804c :£ £ push£  %ebp
0x4006804d :£ mov£ £ %esp,%ebp
0x4006804f :£ push£  %ebx
0x40068050 :£ call£  0x40068055
0x40068055 :£ pop£ £ %ebx
0x40068056 : add£ £ $0xa2197,%ebx
0x4006805c : lea£ £ 0xc(%ebp),%eax
0x4006805f : push£  %eax
0x40068060 : pushl£ 0x8(%ebp)
0x40068063 : mov£ £ 0x81c(%ebx),%eax
0x40068069 : pushl£ (%eax)
0x4006806b : call£  0x400325b4
0x40068070 : mov£ £ 0xfffffffc(%ebp),%ebx
0x40068073 : leave
0x40068074 : ret
end of assembler dump.
(gdb) x/8x 0x8049470
0x8049470 <_global_offset_table_>:£ £ £ 0x08049490£ £ £ 0x40013ed0£ £ £ 0x4000a960£ £ £ 0x400fa550
0x8049480 <_global_offset_table_+16>:£  0x080482ee£ £ £ 0x400328cc£ £ £ 0x4006804c£ £ £ 0x00000000

got[6]ÒѾ­±»ÐÞÕýΪ0x4006804cÁË

µÚÒ»´Îµ÷ÓÃprintf()µÄʱºòÐèÒª¾­¹ý¢Ù->¢Ú->¢Û->¢Ü
ÒÔºóµ÷ÓÃprintf()µÄʱºò¾Í²»ÐèÒªÕâô¸´ÔÓÁË£¬Ö»Òª¾­¹ý¢Å->¢Æ¾Í¿ÉÒÔÁË

ÎÒÃÇÀ´¿´¿´µ½µ×ÊÇÈçºÎÐÞÕýgot[6]µÄ£¬Ò²ÊǾÍ˵ÈçºÎÕÒµ½ÒªÐÞÕýµÄµØÖ·µÄ
(ÒÔÇ°ÎÒÔÚÕâµãÀí½âÉÏ·¢ÉúÁËһЩ±È½Ï´óµÄÎó½â£¬Î󵼸÷λµÄµØ·½»¹Çë°üº­:) )

1£º
½øÈëplt4µÄʱºò push£  $0x18 £¬¸Ã$0x18ΪprintfÖض¨Î»Èë¿ÚÔÚjmprel sectionÖеÄÆ«ÒÆÁ¿
2£º
printfÖض¨Î»µØַΪjmprel+$0x18£ /* elf32_rel * reloc = jmprel + reloc_offset; */
(gdb) x/8x 0x8048278+0x18
0x8048290:£ £ £ £ 0x08049488£ £ £ 0x00000407£ £ £ 0x53e58955£ £ £ 0x000000e8
0x80482a0 <_init+8>:£ £ 0xc3815b00£ £ £ 0x000011cf£ £ £ 0x001cbb83£ £ £ 0x74000000
typedef struct {
?£ £  elf32_addr£ £ r_offset;
?£ £  elf32_word£ £ r_info;
? } elf32_rel;
Ò²¾ÍÊÇ˵printfÖض¨Î»printf_retloc.r_offset=0x08049488;
?£ £ £ £  printf_retloc.r_info=0x00000407;
ÔÙ¿´¿´0x08049488ÊÇʲôµØ·½
(gdb) x 0x08049488
0x8049488 <_global_offset_table_+24>:£  0x4006804c
Ò²¾ÍÊÇgot[6]
3:
void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);
¶ÔÒ»¸ö¿ÉÖ´ÐÐÎļþ »òÒ»¸ö¹²ÏíÄ¿±ê¶øÑÔ,rel_addr¾ÍµÈÓÚreloc->r_offset
ËùÒÔrel_addr=0x08049488=got[6]£»
4£º
*reloc_addr = value;
ÐÞÕýÁËrel_addrÒ²¾ÍÊÇgot[6]
ÖÁÓÚvalueÊÇÈçºÎ¼ÆËãµÄ£¬Çë²Î¿¼ÏÂÃæµÄÔ´´úÂë

ͬʱr_infoÓÖ¹ØÁª×ÅÒ»¸ö·ûºÅ
elf32_sym * sym = &symtab[ elf32_r_sym (reloc->r_info) ];
sym=0x8048158+0x00000407;
? typedef struct {
?£ £  elf32_word£ £ st_name;
?£ £  elf32_addr£ £ st_value;
?£ £  elf32_word£ £ st_size;
?£ £  unsigned char£ £ st_info;
?£ £  unsigned char£ £ st_other;
?£ £  elf32_half£ £ st_shndx;
? } elf32_sym;
(gdb) x/10x 0x8048158+0x00000407
0x804855f:£ £ £ 0x00003a00£ £ £ 0x00008000£ £ £ 0x00000000£ £ £ 0x00006900
0x804856f:£ £ £ 0x00008000£ £ £ 0x00000000£ £ £ 0x00008300£ £ £ 0x00008000
0x804857f:£ £ £ 0x00000000£ £ £ 0x0000b700

link_map½á¹¹ËµÃ÷ÈçÏ£º
/* structure describing a loaded shared object.£ the `l_next' and `l_prev'
?£ members form a chain of all the shared objects loaded at startup.

?£ these data structures exist in space used by the run-time dynamic linker;
?£ modifying them may have disastrous results.

?£ this data structure might change in future, if necessary.£ user-level
?£ programs must avoid defining objects of this type.£ */


¡ï¡ï glibcÖж¯Ì¬½âÎö·ûºÅµÄÔ´´úÂ루glibc 2.1.3µÄʵÏÖ£©

?£  .text
?£  .globl _dl_runtime_resolve
?£  .type _dl_runtime_resolve, @function
?£  .align 16
_dl_runtime_resolve:
?£  pushl %eax£ £ £ £ # preserve registers otherwise clobbered.
?£  pushl %ecx
?£  pushl %edx
?£  movl 16(%esp), %edx£ £ # copy args pushed by plt in register.£ note
?£  movl 12(%esp), %eax£ £ # that `fixup' takes its parameters in regs.
?£  call fixup£ £ £ £ # call resolver.
?£  popl %edx£ £ £ £ # get register content back.
?£  popl %ecx
?£  xchgl %eax, (%esp)£ £ # get %eax contents end store function address.
?£  ret $8£ £ £ £ £ £ # jump to function address.

static elfw(addr) __attribute__ ((unused))
fixup (
# ifdef elf_machine_runtime_fixup_args
?£ £ £  elf_machine_runtime_fixup_args,
# endif
?£ £ £ struct link_map *l, elfw(word) reloc_offset)
{
? const elfw(sym) *const symtab
?£  = (const void *) l->l_info[dt_symtab]->d_un.d_ptr;
? const char *strtab = (const void *) l->l_info[dt_strtab]->d_un.d_ptr;

? const pltrel *const reloc£ /*¼ÆË㺯ÊýÖض¨Î»ÈË¿Ú*/
?£  = (const void *) (l->l_info[dt_jmprel]->d_un.d_ptr + reloc_offset);
?£ £ £ £ £ £ £ £ £ £  /*l->l_info[dt_jmprel]->d_un.d_ptr Ϊjmprel sectionµÄµØÖ·*/

? const elfw(sym) *sym = &symtab[elfw(r_sym) (reloc->r_info)];/*¼ÆË㺯ÊýsymtabÈë¿Ú*/
? void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);/*Öض¨Ïò·ûºÅµÄ¾ø¶ÔµØÖ·*/
?£ £ £ £ £ £ £ 
? elfw(addr) value;

? /* the use of `alloca' here looks ridiculous but it helps.£ the goal is
?£ £ to prevent the function from being inlined and thus optimized out.
?£ £ there is no official way to do this so we use this trick.£ gcc never
?£ £ inlines functions which use `alloca'.£ */
? alloca (sizeof (int));

? /* sanity check that we're really looking at a plt relocation.£ */
? assert (elfw(r_type)(reloc->r_info) == elf_machine_jmp_slot);/*½¡×³ÐÔ¼ì²é*/

?£ /* look up the target symbol.£ */
? switch (l->l_info[versymidx (dt_versym)] != null)
?£  {
?£  default:
?£ £  {
?£  const elfw(half) *vernum =
?£ £  (const void *) l->l_info[versymidx (dt_versym)]->d_un.d_ptr;
?£  elfw(half) ndx = vernum[elfw(r_sym) (reloc->r_info)];
?£  const struct r_found_version *version = &l->l_versions[ndx];

?£  if (version->hash != 0)
?£ £  {
?£ £ £  value = _dl_lookup_versioned_symbol(strtab + sym->st_name,
?£ £ £ £ £ £ £ £ £ £ £  &sym, l->l_scope, l->l_name,
?£ £ £ £ £ £ £ £ £ £ £  version, elf_machine_jmp_slot);
?£ £ £  break;
?£ £  }
?£ £  }
?£  case 0:
?£ £  value = _dl_lookup_symbol (strtab + sym->st_name, &sym, l->l_scope,
?£ £ £ £ £ £ £ £ l->l_name, elf_machine_jmp_slot);
?£  }
?£ /*´ËʱvalueΪobject×°ÔصĻùµØÖ·*/
? /* currently value contains the base load address of the object
?£ £ that defines sym.£ now add in the symbol offset.£ */

? value = (sym ? value + sym->st_value : 0);/*º¯ÊýµÄ¾ø¶ÔµØÖ·*/

? /* and now perhaps the relocation addend.£ */
? value = elf_machine_plt_value (l, reloc, value);/*¿ÉÄÜ»¹ÐèÒªÒ»ÏÂÖض¨Î»*/

? /* finally, fix up the plt itself.£ */
? elf_machine_fixup_plt (l, reloc, rel_addr, value);/*ÐÞÕýrel_addr£¬Ò»°ãÀ´ËµÊÇgot[n]*/

? return value;
}


static inline elf32_addr
elf_machine_plt_value (struct link_map *map, const elf32_rela *reloc,
?£ £ £ £ £ £ £ elf32_addr value)
{
? return value + reloc->r_addend;
}


/* fixup a plt entry to bounce directly to the function at value.£ */
static inline void
elf_machine_fixup_plt (struct link_map *map, const elf32_rel *reloc,
?£ £ £ £ £ £ £ elf32_addr *reloc_addr, elf32_addr value)
{
? *reloc_addr = value;
}


²Î¿¼×ÊÁÏ£º

1.glibc 2.1.3 src
2.<>
3.<> write by the grugq
4.linux¶¯Ì¬Á´½Ó¼¼Êõ
? http://www.linuxforum.net/forum/showflat.php?cat=&;board=kstudy&number=102793&page=1&view=collapsed&sb=5&o=31&part=
5.p58-0x04£ by nergal
? << the advanced return-into-lib(c) exploits >>