0

So I am learning about ELF, and am looking through a binary in Ghidra as I do. I've made sense of the ELF header, and now I am looking through the program header table.

My binary has a bunch of entries in the program header table, but I am hung up on one in particular...

From referencing...

http://www.sco.com/developers/gabi/latest/ch5.pheader.html#p_flags

...I can see what the different flags mean. Of relevance:

p_offset = 0xABCDEF
p_vaddr = 0x1BCDEF
p_filesz = <number>
p_memsz = <bigger number>

I am able to go to the p_vaddr value in the binary, and it brings me to the .ctors section. Where I do see what appears to be a list of pointers, but currently those pointers do not represent valid virtual addresses (by currently I mean they are not virtual addresses that I can "go" to in Ghidra). When I run the program dynamically in gdb though, I can run x addr_of_interest and it succeeds and says it is pointing to something in a library blah blah.

I found a relevant link from GCC too, but it did not answer my question as far as I could tell...

https://gcc.gnu.org/onlinedocs/gccint/Initialization.html

My question therefore is this: When/how are these pointers mapped to valid memory, and where in the ELF file is the information that would tell me how this happens?

Improve this question
2
  • Are you 100% sure you are looking at .ctors and not, for example, .got?
    – Igor Skochinsky ♦
    Nov 5, 2019 at 9:22
  • @igor thanks for clarifying, but yes, I'm sure. There is a (symbol I believe?) In Ghidra displayed as __CTOR_LIST__ and once you jump there an auto generated comment that says .ctors
    – pooley1994
    Nov 5, 2019 at 11:33

1 Answer 1

Reset to default
1

Duh. Stupid.

Importantly, the binary I am looking at is not a PIE (Position Independent Executable). I had Ghidra's image base set to 0x0, rather than 0x400000 (which is the p_vaddr of the loadable segment containing all of the code, and notably, the canonical value used here for x86_64 binaries). This is the only reason the function pointers listed in .ctors were not addresses Ghidra could go to. As soon as I set the image base to 0x400000 they were legitimate.

:facepalm:

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.