2

Basically I am trying to re-use some asm code disassembled from a binary on x86 32bit Linux.

I am facing some trouble when references of GOT/GOT.PLT involved like these.

  ....
  804c460:       53                      push   %ebx
  804c461:       e8 ec ff ff ff          call   804c452 <__i686.get_pc_thunk.bx>
  804c466:       81 c3 8e 2b 00 00       add    $0x2b8e,%ebx   // %ebx has the beginning address of GOT table
  804c46c:       83 ec 18                sub    $0x18,%esp
  ....

If I want to re-use these asm code, I have to lift concrete address into symbols, and it seems that in the above code, I have to find a way to let ebx store the begin address of GOT table.

Well... then do I have to modify the linker...? Because the begin address of GOT table can't be decided until link time..

So my questions are:

  1. Is modifying linker a right way to do this ..? Is there any other way?

  2. How to modify the linker in this issue..? I basically have no experiences before..

3
  • Are you trying to do ROP?
    – drum
    Jul 1, 2014 at 20:35
  • @drum , No, I am not. I am trapped in how to re-use this asm code.. Jul 1, 2014 at 20:39
  • 1
    Or maybe can you write a postprocessor that modifies the binary after linking, with disassembly and binary as input? The postprocessor could alternatively modify the assembly code or create 2nd/3rd generation assembly code to be assembled again, using binary and disassembly as source. Probably it could be done by modifying (or rewriting) the code of my answer to your SO question: stackoverflow.com/questions/20506524/…
    – nrz
    Jul 1, 2014 at 23:19

1 Answer 1

3

If you're using GAS or a compatible assembler, you can use special modifiers to have it emit relocation info for GOT-based addressing.

Here's the gcc -S output of a typical prolog of a function compiled with -fPIC:

call    __i686.get_pc_thunk.bx
addl    $_GLOBAL_OFFSET_TABLE_, %ebx
leal    .LC0@GOTOFF(%ebx), %eax
movl    %eax, (%esp)
call    puts@PLT

As you can see, you can replace the %ebx addendum with $_GLOBAL_OFFSET_TABLE_, and other GOT-relative offsets with symbol@GOTOFF. In some cases you may also need @GOTPLT or @GOTPCREL modifiers. See here for more info (mostly x64-specific, but still useful).

If your file is relocatable or a shared object, disassembling it with -dr (so you see relocation info) can be useful to see places where you may need to add back the symbol modifiers.

2
  • It works!! This is very helpful, thank you a lot Igor! Jul 2, 2014 at 12:52
  • For one thing I think it is necessary to point out for future readers is that " I wonder whether all incarnations of gcc compile GLOBAL_OFFSET_TABLE to be the same as the start-address of .got.plt" from that article Jul 2, 2014 at 13:17

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.