linux ld so 源码分析,ld.so分析2

小灰灰 2023-01-21 11:15 254阅读 0赞

ld.so分析2

内核是如何执行程序的,本分析基于内核版本2.4.0

1.用户空间接口

man execve显示如下的函数原型

execve - execute program

SYNOPSIS

\#include int  execve(const  char  \*filename,  char  \*const  argv \[\], char \*const

envp\[\]);

2.glibc中实现

在glibc中,execve对应的文件是

sysdeps/unix/sysv/linux/execve.c

int

\_\_execve (file, argv, envp)

const char \*file;

char \*const argv\[\];

char \*const envp\[\];

/\* If this is a threaded application kill all other threads.  \*/

if (\_\_pthread\_kill\_other\_threads\_np)

\_\_pthread\_kill\_other\_threads\_np ();

\#if \_\_BOUNDED\_POINTERS\_\_ //该宏未定义

char \*const \*v;

int i;

char \*\_\_unbounded \*\_\_unbounded ubp\_argv;

char \*\_\_unbounded \*\_\_unbounded ubp\_envp;

char \*\_\_unbounded \*\_\_unbounded ubp\_v;

for (v = argv; \*v; v++)

;

i = v - argv + 1;

ubp\_argv = (char \*\_\_unbounded \*\_\_unbounded) alloca (sizeof (\*ubp\_argv) \* i);

for (v = argv, ubp\_v = ubp\_argv; --i; v++, ubp\_v++)

\*ubp\_v = CHECK\_STRING (\*v);

\*ubp\_v = 0;

for (v = envp; \*v; v++)

;

i = v - envp + 1;

ubp\_envp = (char \*\_\_unbounded \*\_\_unbounded) alloca (sizeof (\*ubp\_envp) \* i);

for (v = envp, ubp\_v = ubp\_envp; --i; v++, ubp\_v++)

\*ubp\_v = CHECK\_STRING (\*v);

\*ubp\_v = 0;

return INLINE\_SYSCALL (execve, 3, CHECK\_STRING (file), ubp\_argv, ubp\_envp);

\#else

return INLINE\_SYSCALL (execve, 3, file, argv, envp);//所以这行有效

\#endif

INLINE\_SYSCALL的定义在

sysdeps/unix/sysv/linux/i386/sysdeps.h

\#define INLINE\_SYSCALL(name, nr, args...) \\

(\{                                          \\

unsigned int resultvar;                              \\

asm volatile (                                  \\

LOADARGS\_\#\#nr                                  \\

"movl %1, %%eax\\n\\t"                              \\

"int $0x80\\n\\t"                                  \\

RESTOREARGS\_\#\#nr                                  \\

: "=a" (resultvar)                                  \\

: "i" (\_\_NR\_\#\#name) ASMFMT\_\#\#nr(args) : "memory", "cc");              \\

if (resultvar >= 0xfffff001)                          \\

\{                                          \\

\_\_set\_errno (-resultvar);                          \\

resultvar = 0xffffffff;                              \\

\}                                          \\

(int) resultvar; \})

3.手工展开看看

(\{

unsigned int resultvar;

asm volatile (

LOADARGS\_3

"movl %1, %%eax\\n\\t"

"int $0x80\\n\\t"

RESTOREARGS\_3

: "=a" (resultvar)

: "i" (\_\_NR\_execve) ASMFMT\_3(args) : "memory", "cc");

if (resultvar >= 0xfffff001)

\_\_set\_errno (-resultvar);

resultvar = 0xffffffff;

(int) resultvar; \})

其中\_\_NR\_execve是execve的系统调用号,为11，定义在头文件unistd.h中

这其中又涉及到三个宏

\#define LOADARGS\_1 \\

"bpushl .L\_\_X'%k2, %k2\\n\\t"                              \\

"bmovl .L\_\_X'%k2, %k2\\n\\t"

\#define LOADARGS\_3    LOADARGS\_1

\#define RESTOREARGS\_1 \\

"bpopl .L\_\_X'%k2, %k2\\n\\t"

\#define RESTOREARGS\_3    RESTOREARGS\_1

\#define ASMFMT\_3(arg1, arg2, arg3) \\

, "aCD" (arg1), "c" (arg2), "d" (arg3)

展开

(\{

unsigned int resultvar;

asm volatile (

"bpushl .L\_\_X'%k2, %k2\\n\\t"

"bmovl .L\_\_X'%k2, %k2\\n\\t"

"movl %1, %%eax\\n\\t"

"int $0x80\\n\\t"

"bpopl .L\_\_X'%k2, %k2\\n\\t"

: "=a" (resultvar)

: "i" (11) , "aCD" (arg1), "c" (arg2), "d" (arg3) : "memory", "cc");

if (resultvar >= 0xfffff001)

\_\_set\_errno (-resultvar);

resultvar = 0xffffffff;

(int) resultvar; \})

这里又涉及到三个asm宏,bpushl,bmovl,bpopl

定义如下(也在该文件sysdeps.h中)

asm (".L\_\_X'%ebx = 1\\n\\t"

".L\_\_X'%ecx = 2\\n\\t"

".L\_\_X'%edx = 2\\n\\t"

".L\_\_X'%eax = 3\\n\\t"

".L\_\_X'%esi = 3\\n\\t"

".L\_\_X'%edi = 3\\n\\t"

".L\_\_X'%ebp = 3\\n\\t"

".L\_\_X'%esp = 3\\n\\t"

".macro bpushl name reg\\n\\t"

".if 1 - \\\\name\\n\\t"

".if 2 - \\\\name\\n\\t"

"pushl %ebx\\n\\t"

".else\\n\\t"

"xchgl \\\\reg, %ebx\\n\\t"

".endif\\n\\t"

".endm\\n\\t"

".macro bpopl name reg\\n\\t"

".if 1 - \\\\name\\n\\t"

".if 2 - \\\\name\\n\\t"

"popl %ebx\\n\\t"

".else\\n\\t"

"xchgl \\\\reg, %ebx\\n\\t"

".endif\\n\\t"

".endm\\n\\t"

".macro bmovl name reg\\n\\t"

".if 1 - \\\\name\\n\\t"

".if 2 - \\\\name\\n\\t"

"movl \\\\reg, %ebx\\n\\t"

".endif\\n\\t"

".endm\\n\\t");

根据约束条件

%eax分配给resultvar

%ecx分配给argv

%edx分配给envp

则约束条件"aCD"中,a(%eax)已分配,C无效,因此分配%edi给file

手工展开

mov     file,%edi

mov     argv,%ecx

mov     envp,%edx

bpushl     .L\_\_X'%edi, %edi

bmovl     .L\_\_X'·%edi, %%edi

movl     11, %%eax

int     $0x80

bpopl     .L\_\_X'%edi, %edi

手工展开

mov     file,%edi

mov     argv,%ecx

mov     envp,%edx

.if 1 - .L\_X'%edi

.if 2 - .L\_X'%edi

pushl %ebx

.else

xchgl %edi, %ebx

.endif

.if 1 - .L\_X'%edi

.if 2 - .L\_X'%edi

movl %edi, %ebx

.endif

movl     11, %%eax

int     $0x80

.if 1 - .L\_X'%edi

.if 2 - .L\_X'%edi

popl %ebx

.else

xchgl %edi, %ebx

.endif

由于L\_\_X'%edi = 3,展开

mov     file,%edi

mov     argv,%ecx

mov     envp,%edx

.if 1 - 3

.if 2 - 3

pushl %ebx

.else

xchgl %edi, %ebx

.endif

.if 1 - 3

.if 2 - 3

movl %edi, %ebx

.endif

movl     11, %%eax

int     $0x80

.if 1 - 3

.if 2 - 3

popl %ebx

.else

xchgl %edi, %ebx

.endif

.if为真的条件是不等于0,展开

mov     file,%edi

mov     argv,%ecx

mov     envp,%edx

pushl %ebx

movl %edi, %ebx

movl     11, %%eax

int     $0x80

popl %ebx

最终编译结果是

mov    0x8(%ebp),%edi

mov    0xc(%ebp),%ecx

mov    0x10(%ebp),%edx

push   %ebx

mov    %edi,%ebx

mov    $0xb,%eax

int    $0x80

pop    %ebx

正好一致

系统调用传参使用%ebx,%ecx,%edx,%esi,%edi这五个寄存器，因此最多只能传五个参数.

4.返回值的处理

\#  define \_\_set\_errno(val) (\*\_\_errno\_location ()) = (val)

if (resultvar >= 0xfffff001)//如果返回值>=0xfffff001,则出错

\_\_set\_errno (-resultvar);// 预处理时被替换成(\*\_\_errno\_location ()) = (-resultvar);设置errno为-resultvar

resultvar = 0xffffffff;    //-1

\_\_errno\_location的定义是

sysdeps/generic/errno-loc.c

int \* \_\_errno\_location (void)

return &errno;

5.也可使用如下宏生成调用系统调用execve的代码

linux/include/asm-i386/unistd.h

\#define \_syscall3(type,name,type1,arg1,type2,arg2,type3,arg3) \\

type name(type1 arg1,type2 arg2,type3 arg3) \\

\{ \\

long \_\_res; \\

\_\_asm\_\_ volatile ("int $0x80" \\

: "=a" (\_\_res) \\

: "0" (\_\_NR\_\#\#name),"b" ((long)(arg1)),"c" ((long)(arg2)), \\

"d" ((long)(arg3))); \\

\_\_syscall\_return(type,\_\_res); \\

例如

\_syscall3(int,execve,const char \*,file,char \*const,argv\[\],char \*const,envp\[\])

能生成和glibc相似的代码

6.sys\_execve

linux/arch/i386/kernel/process.c

/\*

\* sys\_execve() executes a new program.

\*/

asmlinkage int sys\_execve(struct pt\_regs regs)

int error;

char \* filename;

filename = getname((char \*) regs.ebx);

error = PTR\_ERR(filename);

if (IS\_ERR(filename))

goto out;

//do\_execve成功替换掉执行影像后，在返回到用户空间时，执行权才交给新的影像

error = do\_execve(filename, (char \*\*) regs.ecx, (char \*\*) regs.edx, &regs);

if (error == 0)

current->ptrace &= ~PT\_DTRACE;//取消单步跟踪

putname(filename);

out:

return error;

7.do\_execve(sys\_execve->do\_execve)

fs/exec.c

/\*

\* sys\_execve() executes a new program.

\*/

int do\_execve(char \* filename, char \*\* argv, char \*\* envp, struct pt\_regs \* regs)

struct linux\_binprm bprm;

struct file \*file;

int retval;

int i;

file = open\_exec(filename);

retval = PTR\_ERR(file);

if (IS\_ERR(file))

return retval;

bprm.p = PAGE\_SIZE\*MAX\_ARG\_PAGES-sizeof(void \*);//参数最多占32个页面,最后一个字存放NULL

memset(bprm.page, 0, MAX\_ARG\_PAGES\*sizeof(bprm.page\[0\]));//清空页指针

bprm.file = file;

bprm.filename = filename;

bprm.sh\_bang = 0;

bprm.loader = 0;

bprm.exec = 0;

//计算argv数组的长度,该数组是0结束

if ((bprm.argc = count(argv, bprm.p / sizeof(void \*))) < 0) \{

allow\_write\_access(file);

fput(file);

return bprm.argc;

//计算envp数组的长度

if ((bprm.envc = count(envp, bprm.p / sizeof(void \*))) < 0) \{

allow\_write\_access(file);

fput(file);

return bprm.envc;

retval = prepare\_binprm(&bprm);

if (retval < 0)

goto out;

retval = copy\_strings\_kernel(1, &bprm.filename, &bprm);//复制文件名

if (retval < 0)

goto out;

bprm.exec = bprm.p;

retval = copy\_strings(bprm.envc, envp, &bprm);//复制envp

if (retval < 0)

goto out;

retval = copy\_strings(bprm.argc, argv, &bprm);//复制argv

if (retval < 0)

goto out;

retval = search\_binary\_handler(&bprm,regs);

if (retval >= 0)

/\* execve success \*/

return retval;

out:

/\* Something went wrong, return the inode and free the argument pages\*/

allow\_write\_access(bprm.file);

if (bprm.file)

fput(bprm.file);

for (i = 0 ; i < MAX\_ARG\_PAGES ; i++) \{

struct page \* page = bprm.page\[i\];

if (page)

\_\_free\_page(page);

return retval;

8.copy\_strings(sys\_execve->do\_execve->copy\_strings)

fs/exec.c

/\*

\* 'copy\_strings()' copies argument/envelope strings from user

\* memory to free pages in kernel mem. These are in a format ready

\* to be put directly into the top of new user memory.

\*/

//从用户空间拷贝数据到空闲页

int copy\_strings(int argc,char \*\* argv, struct linux\_binprm \*bprm)

while (argc-- > 0) \{//argc--

char \*str;

int len;

unsigned long pos;

//上面argc--

if (get\_user(str, argv+argc) || !str || !(len = strnlen\_user(str, bprm->p)))

return -EFAULT;

if (bprm->p < len) //空间不够

return -E2BIG;

bprm->p -= len;//从后往前考

/\* XXX: add architecture specific overflow check here. \*/

pos = bprm->p;

while (len > 0) \{

char \*kaddr;

int i, new, err;

struct page \*page;

int offset, bytes\_to\_copy;

offset = pos % PAGE\_SIZE;//页内偏移

i = pos/PAGE\_SIZE;//页号

page = bprm->page\[i\];

new = 0;

if (!page) \{

page = alloc\_page(GFP\_HIGHUSER);

bprm->page\[i\] = page;

if (!page)

return -ENOMEM;

new = 1;

kaddr = kmap(page);

if (new && offset)//是新页，offset>0,清\[0,offset)

memset(kaddr, 0, offset);

bytes\_to\_copy = PAGE\_SIZE - offset;

if (bytes\_to\_copy > len) \{

bytes\_to\_copy = len;

if (new)//清\[offset+len,PAGE\_SIZE)

memset(kaddr+offset+len, 0, PAGE\_SIZE-offset-len);

err = copy\_from\_user(kaddr + offset, str, bytes\_to\_copy);

kunmap(page);

if (err)

return -EFAULT;

pos += bytes\_to\_copy;//可能跨页

str += bytes\_to\_copy;

len -= bytes\_to\_copy;

return 0;

执行到这里bprm->p内存空间布局如下

\[ argument ASCIIZ strings \]   >= 0

\[ environment ASCIIZ str. \]   >= 0

\[filename\]

(0xbffffffc)      \[ end marker \]                4   (= NULL)

(0xc0000000)      < top of stack >              0   (virtual)

写一个程序验证一下

系统redhat7.2

\[root@proxy ~\]\# uname -a

Linux proxy 2.4.7-10smp \#1 SMP Thu Sep 6 17:09:31 EDT 2001 i686 unknown

\[root@proxy ~\]\#

root@proxy ~\]\# cat 1.c

\#include int main(int argc,char \* argv\[\],char \* envp\[\])

unsigned char \* p;

printf("%d,%p,%p\\n",argc,argv,envp);

p=(unsigned char \*)argv;

for(;pif(isprint(\*p))

printf("%c",\*p);

else

printf("\\\\%x",\*p);

return 0;

\[root@proxy ~\]\# ./a.out

1,0xbffffb04,0xbffffb0c

\\3\\fc\\ff\\bf\\0\\0\\0\\0\\b\\fc\\ff\\bf\\15\\fc\\ff\\bf$\\fc\\ff\\bf

9.search\_binary\_handler(sys\_execve->do\_execve->search\_binary\_handler)

fs/exec.c

/\*

\* cycle the list of binary formats handler, until one recognizes the image

\*/

int search\_binary\_handler(struct linux\_binprm \*bprm,struct pt\_regs \*regs)

int try,retval=0;

struct linux\_binfmt \*fmt;

\#ifdef \_\_alpha\_\_

/\* handle /sbin/loader.. \*/

struct exec \* eh = (struct exec \*) bprm->buf;

if (!bprm->loader && eh->fh.f\_magic == 0x183 &&

(eh->fh.f\_flags & 0x3000) == 0x3000)

char \* dynloader\[\] = \{ "/sbin/loader" \};

struct file \* file;

unsigned long loader;

allow\_write\_access(bprm->file);

fput(bprm->file);

bprm->file = NULL;

loader = PAGE\_SIZE\*MAX\_ARG\_PAGES-sizeof(void \*);

file = open\_exec(dynloader\[0\]);

retval = PTR\_ERR(file);

if (IS\_ERR(file))

return retval;

bprm->file = file;

bprm->loader = loader;

retval = prepare\_binprm(bprm);

if (retval<0)

return retval;

/\* should call search\_binary\_handler recursively here,

but it does not matter \*/

\#endif

for (try=0; try<2; try++) \{

read\_lock(&binfmt\_lock);

for (fmt = formats ; fmt ; fmt = fmt->next) \{

int (\*fn)(struct linux\_binprm \*, struct pt\_regs \*) = fmt->load\_binary;

if (!fn)

continue;

if (!try\_inc\_mod\_count(fmt->module))

continue;

read\_unlock(&binfmt\_lock);

retval = fn(bprm, regs);//调用该文件格式的load\_binary

if (retval >= 0) \{//成功

put\_binfmt(fmt);

allow\_write\_access(bprm->file);//allow write

if (bprm->file)

fput(bprm->file);

bprm->file = NULL;

current->did\_exec = 1;//可以执行了

return retval;

read\_lock(&binfmt\_lock);

put\_binfmt(fmt);

if (retval != -ENOEXEC)

break;

if (!bprm->file) \{

read\_unlock(&binfmt\_lock);

return retval;

read\_unlock(&binfmt\_lock);

if (retval != -ENOEXEC) \{

break;

\#ifdef CONFIG\_KMOD

\}else\{

\#define printable(c) (((c)=='\\t') || ((c)=='\\n') || (0x20<=(c) && (c)<=0x7e))

char modname\[20\];

if (printable(bprm->buf\[0\]) &&

printable(bprm->buf\[1\]) &&

printable(bprm->buf\[2\]) &&

printable(bprm->buf\[3\]))

break; /\* -ENOEXEC 不允许都是可打印字符\*/

sprintf(modname, "binfmt-%04x", \*(unsigned short \*)(&bprm->buf\[2\]));

request\_module(modname);

\#endif

return retval;

elf文件的相关处理结构在fs/binfmt\_elf.c中

static int \_\_init init\_elf\_binfmt(void)

return register\_binfmt(&elf\_format);

static struct linux\_binfmt elf\_format = \{

NULL, THIS\_MODULE, load\_elf\_binary, load\_elf\_library, elf\_core\_dump, ELF\_EXEC\_PAGESIZE

\};

因此elf的load\_binary函数是load\_elf\_binary

阅读(1327) | 评论(0) | 转发(0) |

linux ld so 源码分析,ld.so分析2

发表评论取消回复

还没有评论，来说两句吧...

相关阅读

相关（源码分析）StringBuilder源码分析

相关（源码分析）StringBuffer源码分析

相关 Retrofit2源码分析

相关 linux ld so 源码分析,ld.so分析2

相关【Java源码分析】HashMap源码分析

相关【Java源码分析】Vector源码分析

相关【Java源码分析】LinkedList源码分析

相关【Spring启动过程分析】（2）源码分析

相关 Retrofit2源码分析

相关 JDK源码分析－－Properties源码分析