带有 0 `sh_link` 的 ELF SHT_RELA 部分是否有效?

逆向工程 小精灵
2021-07-05 19:20:39

我有一个 64 位 s390x ELF 二进制文件,其中有一个名为“.rela.plt”的 RELA 部分,其sh_link字段为 0。我的印象是这sh_link是一个必需的值,提供了重定位使用的符号的部分的 id被存储。

如果我objdump在二进制文件上运行,则不会发出有关任何重定位的信息,暗示可能没有要进行的重定位。以下由 报道readelf

There are 36 section headers, starting at offset 0xa91c8:

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  [ 0]                   NULL             0000000000000000  00000000
       0000000000000000  0000000000000000           0     0     0
  [ 1] .note.ABI-tag     NOTE             0000000080000190  00000190
       0000000000000020  0000000000000000   A       0     0     4
  [ 2] .note.gnu.build-i NOTE             00000000800001b0  000001b0
       0000000000000024  0000000000000000   A       0     0     4
  [ 3] .rela.plt         RELA             00000000800001d8  000001d8
       0000000000000018  0000000000000018  AI       0    23     8
  [ 4] .init             PROGBITS         00000000800001f0  000001f0
       000000000000004c  0000000000000000  AX       0     0     4
  [ 5] .plt              PROGBITS         000000008000023c  0000023c
       0000000000000020  0000000000000000  AX       0     0     4
  [ 6] .text             PROGBITS         0000000080000260  00000260
       000000000006c328  0000000000000000  AX       0     0     16
  [ 7] __libc_freeres_fn PROGBITS         000000008006c588  0006c588
       0000000000000f18  0000000000000000  AX       0     0     8
  [ 8] __libc_thread_fre PROGBITS         000000008006d4a0  0006d4a0
       00000000000000f0  0000000000000000  AX       0     0     8
  [ 9] .fini             PROGBITS         000000008006d590  0006d590
       0000000000000034  0000000000000000  AX       0     0     4
  [10] .rodata           PROGBITS         000000008006d5c8  0006d5c8
       000000000001d810  0000000000000000   A       0     0     8
  [11] __libc_subfreeres PROGBITS         000000008008add8  0008add8
       0000000000000058  0000000000000000   A       0     0     8
  [12] __libc_atexit     PROGBITS         000000008008ae30  0008ae30
       0000000000000008  0000000000000000   A       0     0     8
  [13] __libc_thread_sub PROGBITS         000000008008ae38  0008ae38
       0000000000000008  0000000000000000   A       0     0     8
  [14] .eh_frame         PROGBITS         000000008008ae40  0008ae40
       000000000000aa2c  0000000000000000   A       0     0     8
  [15] .gcc_except_table PROGBITS         000000008009586c  0009586c
       00000000000000c5  0000000000000000   A       0     0     1
  [16] .tdata            PROGBITS         0000000080096ed0  00095ed0
       0000000000000020  0000000000000000 WAT       0     0     8
  [17] .tbss             NOBITS           0000000080096ef0  00095ef0
       0000000000000034  0000000000000000 WAT       0     0     8
  [18] .fini_array       FINI_ARRAY       0000000080096ef0  00095ef0
       0000000000000008  0000000000000000  WA       0     0     8
  [19] .ctors            PROGBITS         0000000080096ef8  00095ef8
       0000000000000010  0000000000000000  WA       0     0     8
  [20] .dtors            PROGBITS         0000000080096f08  00095f08
       0000000000000010  0000000000000000  WA       0     0     8
  [21] .jcr              PROGBITS         0000000080096f18  00095f18
       0000000000000008  0000000000000000  WA       0     0     8
  [22] .data.rel.ro      PROGBITS         0000000080096f20  00095f20
       00000000000000e0  0000000000000000  WA       0     0     8
  [23] .got              PROGBITS         0000000080097000  00096000
       00000000000000c8  0000000000000008  WA       0     0     8
  [24] .data             PROGBITS         00000000800970c8  000960c8
       00000000000019c8  0000000000000000  WA       0     0     8
  [25] .bss              NOBITS           0000000080098a90  00097a90
       0000000000002070  0000000000000000  WA       0     0     8
  [26] __libc_freeres_pt NOBITS           000000008009ab00  00097a90
       0000000000000030  0000000000000000  WA       0     0     8
  [27] .comment          PROGBITS         0000000000000000  00097a90
       0000000000000034  0000000000000001  MS       0     0     1
  [28] .debug_aranges    PROGBITS         0000000000000000  00097ac4
       0000000000000030  0000000000000000           0     0     1
  [29] .debug_info       PROGBITS         0000000000000000  00097af4
       00000000000000ed  0000000000000000           0     0     1
  [30] .debug_abbrev     PROGBITS         0000000000000000  00097be1
       000000000000007f  0000000000000000           0     0     1
  [31] .debug_line       PROGBITS         0000000000000000  00097c60
       000000000000004c  0000000000000000           0     0     1
  [32] .debug_str        PROGBITS         0000000000000000  00097cac
       00000000000000d3  0000000000000001  MS       0     0     1
  [33] .shstrtab         STRTAB           0000000000000000  000a903e
       0000000000000186  0000000000000000           0     0     1
  [34] .symtab           SYMTAB           0000000000000000  00097d80
       000000000000ae00  0000000000000018          35   759     8
  [35] .strtab           STRTAB           0000000000000000  000a2b80
       00000000000064be  0000000000000000           0     0     1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  L (link order), O (extra OS processing required), G (group), T (TLS),
  C (compressed), x (unknown), o (OS specific), E (exclude),
  p (processor specific)

此外,在 stderr 上我看到:

readelf: Warning: [ 3]: Link field (0) should index a symtab section.

我应该sh_link将“.rela.plt”部分的零解释为没有工作要做的提示吗?

1个回答

从表面上看,这个文件确实不符合 ELF 规范。

我需要查看该文件,但我希望它确实有重定位,您不应该跳过它们。似乎标志已经SHF_INFO_LINK设置,这意味着应该在sh_info字段中查找索引,并且 23 指向该.got部分,这意味着重定位适用于它。

一种可能性是重定位不使用符号(例如仅IRELATIVE类型重定位),另一种是它使用SYMTAB文件中唯一存在的符号(索引 34)。

编辑:看来我的理论是正确的。的输出readelf -r

Relocation section '.rela.plt' at offset 0x1d8 contains 1 entries:
  Offset          Info           Type           Sym. Value    Sym. Name + Addend
000080097018  00000000003d R_390_IRELATIVE                      800174b0

*_IRELATIVE搬迁不是指一个符号,因此并不需要一个符号表。