2

I build very simple hello world code with sh4 gcc compiler as shared library:

#include <stdio.h>
void hello()
{
    printf("Hello world!\n");
}

But when I load .so file into the disassembler(IDA or Ghidra), I can't actually find where puts is being called. Even though hello() function exists: hello() function in IDA But at the point where it should actually call printf/puts there's some address load operation which points to non existing address: enter image description here I can see puts in the import section, but there's no code that references besides some data reference from .LOAD section.

Nevertheless case I build the code as the executable, not the shared library. puts thunk becomes visible among the functions: enter image description here

As if import thunks are not propagated for shared libraries, but propagated for the executables.

I've tried to find the issue myself so I ran readelf on both binaries. And it appears that it depends on relocation data. Here's executable file dump:

'PLT' relocation section at offset 0x4002d0 contains 48 bytes:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
0041103c  000002a4 R_SH_JMP_SLOT     00400380   puts@GLIBC_2.2 + 0
00411040  000001a4 R_SH_JMP_SLOT     00000000   __gmon_start__ + 0
00411044  000005a4 R_SH_JMP_SLOT     004003b8   __libc_start_main@GLIBC_2.2 + 0
00411048  000003a4 R_SH_JMP_SLOT     004003d4   abort@GLIBC_2.2 + 0

And here's how it looks for shared module:

'PLT' relocation section at offset 0x364 contains 36 bytes:
 Offset     Info    Type            Sym.Value  Sym. Name + Addend
00011010  000001a4 R_SH_JMP_SLOT     00000000   __cxa_finalize@GLIBC_2.2 + 0
00011014  000003a4 R_SH_JMP_SLOT     00000000   puts@GLIBC_2.2 + 0
00011018  000004a4 R_SH_JMP_SLOT     00000000   __gmon_start__ + 0

Sym.Value is zero, and both Ghidra and IDA fails to determine where the thunks point. So the question are:

  1. What is so special about shared modules, that Sym.Value is zero?
  2. How do the import thunks are propagated when the OS load so file?
  3. Is there any way to map the imported functions into such thunks to make them have appropriate names in IDA or Ghidra?

The way the shared library was built:

sh4-linux-gnu-gcc -c -g -fPIC hello.c -o hello.o
sh4-linux-gnu-gcc hello.o -shared -o libhello.so
3
  • 1
    How did you compile it, using what toolchain and what switches? I'm seeing different results.
    – Igor Skochinsky
    Sep 24 '21 at 17:44
  • I've used gcc-sh4-linux-gnu toolchain. I've added the build command line in the main post. I can provide my binaries if needed. Sep 27 '21 at 12:10
  • Here are my binaries if needed: ufile.io/e9pscn0u Sep 27 '21 at 12:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.