1
#include <stdio.h>
#include <stdlib.h>


int main(int argc, int *argv[])
{
size_t *p = (size_t *) strtol(argv[1], NULL, 16);

p[0] = 0xDEADBEEF;

printf("RELRO: %p\n", p);

return 0;
}

While compiling the above code with parameters
$ gcc -g -Wl,-z,relro -o test test.c

and running the checksec on generated binary
RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
Partial RELRO No canary found NX enabled No PIE No RPATH No RUNPATH 69 Symbols No 0 1 test

Running with following command
$ gcc -g -Wl,-z,relro,-z,now -o test test.c

and running the checksec on generated binary
RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
Full RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH 71 Symbols No 0 1 test-full

While compileing with command $ gcc -o test test.c
and running the checkseck on generated binary
RELRO STACK CANARY NX PIE RPATH RUNPATH Symbols FORTIFY Fortified Fortifiable FILE
Full RELRO No canary found NX enabled PIE enabled No RPATH No RUNPATH 66 Symbols No 0 1 test

My doubt was how to compile the binary without relro ? and why it is enabling full-relro when we are not providing any flags ?

2
  • In all likelihood gcc -dumpspecs has the answer as to why it happens when you don't give the linker flag explicitly to the compiler driver. For example the packaged GCC on Ubuntu 20.04 appears to behave that way. So why not try -Wl,-z,norelro instead? Also: this isn't exactly reverse engineering related, or where do you see the connection? Better to ask this on StackOverflow or so. – 0xC0000022L May 18 at 14:14
  • thanks for help!, it worked. – neeraj May 20 at 7:38
3

To enable full relro:

-Wl, -z,relro,-z,now

What does this do? - it provides -z,relro,-z,now flag to linker as an argument. This enables full relro (notice -z,now flag).

Partial relro is enabled by default on modern gcc compilers.

How to disable relro? Pass following flag

-Wl,-z,norelro

Difference between full and partial relro: partial relro makes partial .got section (non .plt) section read-only and changes the alignment order sections making .got section appear before and data sections (.bss, '.data') and makes , while full relro makes complete .got section read-only (including .got.plt) and also reorders sections like in partial relro (incurring startup overhead).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.