Questions tagged [pie]

position-independent executable or position-independent code is code compiled in a way so that it can run unchanged when loaded at an arbitrary memory address (i.e. it does not depend on being at a fixed position in memory). Such executables provide extra protection against code reuse and return-oriented programming attacks by minimizing the quantity of gadgets that can be found in a static memory area in the software.

Filter by
Sorted by
Tagged with
2
votes
1answer
92 views

LD_BIND_NOW doesn’t seem to take effect on ELF PIE executable?

Observations When the Linux executable is compiled as PIE (Position Independent Executable, default on Ubuntu 18.04), the symbols from shared libraries (e.g. libc) will be resolved when the program ...
2
votes
1answer
207 views

Position-independent code dectection

Is it possible to detect whether a given executable is a PIC by looking at the disassembler's output? If not, what are other valid ways to go about this?
4
votes
2answers
1k views

Why are there absolute jmps in disassembly of position independent code?

I'm playing around with Hopper and am looking at the disassembly of a binary that otool reports as having the PIE flag. It's my understanding that as a result, the executable base address will be ...
1
vote
0answers
156 views

How do I resolve addresses relative to a register in IDA?

I am reversing an x86 ELF shared object library. Perhaps because of position independence, all functions begin with loading a constant offset into a register: [... function prologue ...] call $+5 ...
1
vote
1answer
270 views

iOS Position-independent code and relocations

I'm reversing few iOS Mach-O application executables these days and all of them use Position-independent code (PIC; the MH_PIC flag is set). I've been expecting a large number of relocation entries (...
2
votes
0answers
1k views

Debugging a position independent executable ELF

I am trying to follow the write-up about hackercalc (a challenge for DEFCON 2015 quals). First, by loading the challenge into gdb, I observe that: (gdb) info files ... Entry point: 0xcf8 ... So I ...