Skip to main content
Reverse Engineering

Return to Answer

added 3 characters in body
Source Link
user1743
user1743

The ELF filesbinaries have in them headers named "program headers". When the kernel loads up a binary into memory, it only cares about 3 types of headers. PT_LOAD indicating whether or not the content corresponding to the header needs to be loaded into memory, PT_GNU_STACK indicating whether or not the stack needs to be made executable and PT_INTERP for determining the interpreter used to execute the binary.

So yes, the kernel sets the stack as non-executable or executable depending on whether or not a program header is present in the ELF. The ELF process can later use mmap/mmap2/mprotect libc/system calls to give executable privileges to specific pages in memory.

The ELF files have in them headers named "program headers". When the kernel loads up a binary into memory, it only cares about 3 types of headers. PT_LOAD indicating whether or not the content corresponding to the header needs to be loaded into memory, PT_GNU_STACK indicating whether or not the stack needs to be made executable and PT_INTERP for determining the interpreter used to execute the binary.

So yes, the kernel sets the stack as non-executable or executable depending on whether or not a program header is present in the ELF. The ELF process can later use mmap/mmap2/mprotect libc/system calls to give executable privileges to specific pages in memory.

The ELF binaries have in them headers named "program headers". When the kernel loads up a binary into memory, it only cares about 3 types of headers. PT_LOAD indicating whether or not the content corresponding to the header needs to be loaded into memory, PT_GNU_STACK indicating whether or not the stack needs to be made executable and PT_INTERP for determining the interpreter used to execute the binary.

So yes, the kernel sets the stack as non-executable or executable depending on whether or not a program header is present in the ELF. The ELF process can later use mmap/mmap2/mprotect libc/system calls to give executable privileges to specific pages in memory.

Source Link
user1743
user1743

The ELF files have in them headers named "program headers". When the kernel loads up a binary into memory, it only cares about 3 types of headers. PT_LOAD indicating whether or not the content corresponding to the header needs to be loaded into memory, PT_GNU_STACK indicating whether or not the stack needs to be made executable and PT_INTERP for determining the interpreter used to execute the binary.

So yes, the kernel sets the stack as non-executable or executable depending on whether or not a program header is present in the ELF. The ELF process can later use mmap/mmap2/mprotect libc/system calls to give executable privileges to specific pages in memory.