3

I know modern OSs such as Linux don't always execute an application at the same address it was originally linked. When a debugger starts looking around though, it needs to know the relationship between the original link address and the final executing address. How does GDB calculate the offset?

Clarifications: I'm not talking about virtual memory. That is, I have (what I believe to be) a reasonable understanding of how Virtual memory works and am operating entirely with in that address space. I have symbols that are at one location when I dump the symbol table from the ELF, but at another location when I get their address out of memory.

In this particular case, I have a string which in the linked executable is at address 0x0E984141. In a dump of memory from that process, it is at address 0x0E3F2781. Everything in the .rodata section at least has been shifted by 0x5919C0. It appears to be something like Address Space Layout Randomization.

Elros
  • 313
  • 1
  • 3
  • 10

3 Answers3

5

I know modern OSs such as Linux don't always execute an application at the same address it was originally linked.

This is only possible for position-independent executables (linked with -pie flag).

When a debugger starts looking around though, it needs to know the relationship between the original link address and the final executing address.

Correct.

How does GDB calculate the offset?

The same way GDB calculates the offset for shared libraries (a PIE executable is really a special case of a shared library). There is a defined interface between ld.so and GDB, consisting of _dl_debug_state() function (on which GDB sets an internal breakpoint, and which ld.so calls whenever it maps a new ELF image into the process), and struct r_debug. The latter points to a linked list of struct link_maps, and l_addr member of that struct is the offset between linked-at and loaded-at address.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362
0

If i understand what you are getting at, I think what you are actually referring to is Virtual Memory addressing This is not handled by GDB, it is handled by the operating system.

http://www.cs.utexas.edu/users/witchel/372/lectures/15.VirtualMemory.pdf

Zerp
  • 874
  • 2
  • 8
  • 18
  • I don't think this question is about virtual memory, but the fact that ELF segments can get loaded at different locations (in virtual memory) than the addresses (in virtual memory) the ELF file specifies for those segments. For an executable, this happens for instance when you have ASLR. – knatten Sep 22 '21 at 19:34
-2

On Linux, every process has its own address space in virtual memory.

The ELF executable contains a header describing the segments in memory (and their corresponding sections in the executable).

Basile Starynkevitch
  • 223,805
  • 18
  • 296
  • 547