Questions tagged [pie]
position-independent executable or position-independent code is code compiled in a way so that it can run unchanged when loaded at an arbitrary memory address (i.e. it does not depend on being at a fixed position in memory). Such executables provide extra protection against code reuse and return-oriented programming attacks by minimizing the quantity of gadgets that can be found in a static memory area in the software.
9 questions
2
votes
1
answer
120
views
How is the data section dealt with in PIE?
According to my understanding, for the .rodata, the compiler can simply put it "next" to the .text section, because it shares the same page permissions, so wherever the binary is loaded, an ...
- 21
1
vote
1
answer
283
views
How does PIE mitigate exploits?
I read a tutorial where they compiled with the -no-pie option. Is it because the .text segment will be loaded at a random address, therefore making the address of gadgets founds inside it useless ?
- 11
0
votes
1
answer
1k
views
Convert PIE ELF binary into No-PIE
Is it possible changing few bytes for converting an elf binary from PIE to No-PIE (ELF)?
I know that in the header if e_type is:
- 3 then the program is PIE
- 2 then the program is No-PIE
So I ...
3
votes
1
answer
410
views
LD_BIND_NOW doesn’t seem to take effect on ELF PIE executable?
Observations
When the Linux executable is compiled as PIE (Position Independent Executable, default on Ubuntu 18.04), the symbols from shared libraries (e.g. libc) will be resolved when the program ...
- 95
2
votes
1
answer
560
views
Position-independent code dectection
Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?
- 437
4
votes
2
answers
2k
views
Why are there absolute jmps in disassembly of position independent code?
I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag.
It's my understanding that as a result, the executable base address will be ...
- 143
2
votes
0
answers
497
views
How do I resolve addresses relative to a register in IDA?
I am reversing an x86 ELF shared object library. Perhaps because of position independence, all functions begin with loading a constant offset into a register:
[... function prologue ...]
call $+5
...
- 121
2
votes
1
answer
538
views
iOS Position-independent code and relocations
I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (...
- 143
2
votes
0
answers
2k
views
Debugging a position independent executable ELF
I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that:
(gdb) info files
...
Entry point: 0xcf8
...
So I ...
- 1,410