Elf Hello World • Hacker News Board

Re: Elf Hello World

#21

Post by theoh » Wed, May 17, 2017, 8:37 PM UTC

CalChris wrote: post #3

This tutorial should be read alongside his Address Relocation answer from Stack Overflow: http://stackoverflow.com/questions/12122446/how-does-c-linki... And then you might want to skim through An Evil Copy: How the Loader Betrays You : https://www.microsoft.com/en-us/research/publication/evil-co...

That new CoRev paper is interesting. I haven't had time to read it in detail but it sounds like an intriguing case for compiler/linker buffs.

Slightly OT, there was a very fun ActionScript exploit published by Mark Dowd of IBM in 2008. I'm reminded of it because it's about memory protection vulnerabilities.

"Application-Specific Attacks: Leveraging the ActionScript Virtual Machine"

https://www.cs.utexas.edu/~shmat/courses/cs6431/dowd.pdf

Re: Elf Hello World

#22

Post by znpy » Wed, May 17, 2017, 8:40 PM UTC

tonyg wrote: post #13

My favourite page on ELF executables of all time: http://www.muppetlabs.com/~breadbox/software/tiny/teensy.htm... , "A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (or, 'Size Is Everything')"

An interesting read, thanks a lot!

Re: Elf Hello World

#23

Post by rocky1138 » Wed, May 17, 2017, 8:42 PM UTC

kdunwoody wrote: post #18

rocky1138 wrote: post #17

Earlier quoted context omitted.

Thanks for the article! I'm really enjoying learning this stuff. One thing that came up which doesn't appear very clear is why `ld` continues to set the entrypoint for executables at 0x08048000 when that seems like such an arbitrary number held over from a version of Unix made decades ago. Wouldn't it be better to just get rid of that and start programs at 0x00000001? (leaving 0x0 open for NUL).

Definitely not. In rough order of importance: 1. Space for NULL should be big enough for at least a medium-sized structure, otherwise (*NULL)->field = blah will overwrite your code. 2. Because of (1), Linux (for example) doesn't even allow processes to map the first page or so of memory. 3. On many platforms the PC needs to be aligned to a word boundary.

I see. I've obviously got a lot more to learn. Thanks :)

One more question, though: how much space should be safe to leave for NULL? Is 128MB enough? Why not only as much as required?

I suppose it doesn't really matter anyway since the entry point location is virtual at this point anyway.

Re: Elf Hello World

#24

Post by laser » Wed, May 17, 2017, 8:48 PM UTC

cirosantilli wrote: post #15

laser wrote: post #10

Is it just me, or are the author's ears slightly pointed?

You've uncovered my secret: I'm an ELF!!! :-)

I knew it!! :P

Re: Elf Hello World

#25

Post by zmodem » Wed, May 17, 2017, 9:08 PM UTC

tonyg wrote: post #13

My favourite page on ELF executables of all time: http://www.muppetlabs.com/~breadbox/software/tiny/teensy.htm... , "A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (or, 'Size Is Everything')"

That one is awesome and inspired me to write http://www.hanshq.net/making-executables.html

Re: Elf Hello World

#26

Post by sigjuice » Thu, May 18, 2017, 12:22 AM UTC

Impressive work.

Anyone know of something equivalent for Mach-o?

Re: Elf Hello World

#27

Post by binarycrusader » Thu, May 18, 2017, 3:24 AM UTC

tonyg wrote: post #13

My favourite page on ELF executables of all time: http://www.muppetlabs.com/~breadbox/software/tiny/teensy.htm... , "A Whirlwind Tutorial on Creating Really Teensy ELF Executables for Linux (or, 'Size Is Everything')"

ELF is pretty generally applicable to all NIX and NIX-like platforms, so I often refer to the Solaris Libraries and Linkers guide which has a lot of generally useful information and guidance:

https://docs.oracle.com/cd/E53394_01/html/E54813/glcfv.html#...

Re: Elf Hello World

#28

Post by sgmansfield » Thu, May 18, 2017, 3:39 AM UTC

Fantastic article. I noticed a couple of TODO's around, though. Does this hint at a second installment? :)

Re: Elf Hello World

#29

Post by cirosantilli » Thu, May 18, 2017, 5:30 AM UTC

sgmansfield wrote: post #28

Fantastic article. I noticed a couple of TODO's around, though. Does this hint at a second installment? :)

If I need it for work at some point :-) Not in forseeable future :-( But you can send PRs or fork it: https://github.com/cirosantilli/cirosantilli.github.io/blob/...

Re: Elf Hello World

#30

Post by Ded7xSEoPKYNsDd » Thu, May 18, 2017, 10:03 AM UTC

rocky1138 wrote: post #23

kdunwoody wrote: post #18

Earlier quoted context omitted.

Definitely not. In rough order of importance: 1. Space for NULL should be big enough for at least a medium-sized structure, otherwise (*NULL)->field = blah will overwrite your code. 2. Because of (1), Linux (for example) doesn't even allow processes to map the first page or so of memory. 3. On many platforms the PC needs to be aligned to a word boundary.

I see. I've obviously got a lot more to learn. Thanks :) One more question, though: how much space should be safe to leave for NULL? Is 128MB enough? Why not only as much as required? I suppose it doesn't really matter anyway since the entry point location is virtual at this point anyway.

It's impossible to know how much exactly is required. (While structures are fixed size, arrays indices are not.)

Linux allows you to configure the limit at /proc/sys/vm/mmap_min_addr.