阅读Elf Binary中的GOT条目

Question

我想写一个小函数的跟踪器.我用ptrace.我在ubuntu x86_64上.我想找到共享库函数的地址(比如printf).

但我有一些问题和一些关于全球抵消表的问题.我有以下代码:

size_t baseAddress = this->getBaseAddress();
Elf_Ehdr const * headerElf = static_cast<Elf_Ehdr const *> (this->_manager.readMemory((void*) baseAddress, sizeof (Elf_Ehdr)));
Elf_Phdr const * headerProgram = static_cast<Elf_Phdr const *> (this->_manager.readMemory((void*) (baseAddress + headerElf->e_phoff), headerElf->e_phentsize * headerElf->e_phnum));
unsigned int i = 0;
while (headerProgram[i].p_type != PT_DYNAMIC)
{
    ++i;
}
size_t addrToRead = headerProgram[i].p_vaddr;
Elf_Dyn const * dynSection = static_cast<Elf_Dyn const *> (this->_manager.readMemory((void*) addrToRead, sizeof (Elf_Dyn)));
while (dynSection->d_tag != DT_PLTGOT)
{
    addrToRead += sizeof (Elf_Dyn);
    dynSection = static_cast<Elf_Dyn const *> (this->_manager.readMemory((void*) addrToRead, sizeof (Elf_Dyn)));
}

size_t addrGot = dynSection->d_un.d_ptr/* + (4 * sizeof (Elf64_Word))*/;
std::cout << "addr got = " << std::hex << "0x" << dynSection->d_un.d_ptr << " 0x" << addrGot << std::endl;

Elf64_Word const * temp = (Elf64_Word const *) this->_manager.readMemory((void*) addrGot, sizeof (Elf64_Word));
struct link_map * linkList = (struct link_map *) this->_manager.readMemory((void*) *temp, sizeof (struct link_map));

该函数readMemory读取跟踪进程的内存.

当我尝试阅读时linkList->l_ld,它似乎没有指向动态部分.

我不确定我的代码是否正确.当我使用时readelf,GOT部分的地址与我找到的程序相同.

我必须只阅读GOT部分的第一个偏移量或更多？GOT入口点只包含指向的绝对地址struct link_map？

谢谢.

Answer 1

您可能应该查看 _DYNAMIC Elf 符号，这就是我所在的位置。