1

I talking about linux arch.

When I open program in Ida (statically ) I can see all instructions address like 0x20da mov r8 r2

When I want use that address to breakpoint (for example with ptrace or gdb ) Is there ant situation that this address will change?

I know the ASLR can change the base address of libraries that loaded , but is instruction's address that not include in library can change when the program is running?

All of process/binary that I see the address's instruction didn't change compare runtime and what you can see in Ida .

If this address can change, how can I know if is this address may change (maybe flag in binary or flag in system) and how can I find out what is the address when the process is already running.

Improve this question

2 Answers 2

Reset to default
0

Yes, this is called Position Independent Executable (PIE). It randomizes the base address of the executable. It is enabled by default nowadays in most cases by gcc/the linker.

There are several ways to statically determine whether a binary is built with PIE. One method is to use file; a PIE binary reports "shared object" (since that's what it is) compared to just "executable". Other tools e.g. checksec can tell you as well. You will certainly know when you open the program in your debugger and the program addresses look nothing like what you're used to.

If the binary is not stripped, you should be able to set breakpoints normally using function names after the executable has started. However, a stripped binary becomes much more difficult; I am not aware of a way to do that effectively.

You can do cat /proc/<PID>/maps on the process to view the memory mappings. The ones you want will show as mapped to the executable on disk. The first value should give you the starting offset.

Here's an example on my current process, cat:

$ cat /proc/self/maps
559912213000-559912215000 r--p 00000000 07:00 1191827                    /usr/bin/cat
559912215000-55991221a000 r-xp 00002000 07:00 1191827                    /usr/bin/cat
55991221a000-55991221d000 r--p 00007000 07:00 1191827                    /usr/bin/cat
55991221d000-55991221e000 r--p 00009000 07:00 1191827                    /usr/bin/cat
55991221e000-55991221f000 rw-p 0000a000 07:00 1191827                    /usr/bin/cat
559912b4c000-559912b6d000 rw-p 00000000 00:00 0                          [heap]
<snip>

In this case, 0x559912213000 would be your base address.

Improve this answer
2
  • 1) Is executed file can be Position Independent Executable ? Is not only for library? 2) when the process already running, is there any way to find this offset?
    – yfr24493AzzrggAcom
    May 15, 2020 at 14:54
  • @yfr24493AzzrggAcom 1. Yes, it is common for executables 2. Yes, see my edit
    – multithr3at3d
    May 15, 2020 at 14:56
0

It is possible that the address is relocated.

The relocation table, typically named .reloc contains address "translations" for the loader, placing bytes in file offsets in different addresses in runtime.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.