仓库源文，站点原文

layout: post title: "Software Security Notes 2 (Compilation, ELF)" date: 2021-2-24 09:00:00 +0800

categories: [Notes, Software Security]

Compilation

ISA: RISC VS CISC

• RISC:
  ARM
  Single cycle instructions
  Small number of instructions

• CISC: Intel x86
  An instruction can take several clock cycles
  Microcode
  Large number of instructions

Assembly x86-64

Side effect flags
32-bits: arguments in the stack
64-bits: registers used for arguments then the stack
eip(32bit)/rip(64bit) program counter/instruction pointer

Assembler

Input: Assembly files
Output Object files(Machine code)/modules
use -c to generate
Relocatable
Position Independent Code

Linker

Input: Object files
Output: Binary code

Static Library

Merged into binary executable
References resolved entirely

Dynamic Library

Shared in memory Symbolic references in the final executable, resolved when loaded to memory.

Libc

Shared library
Provide core functionalities to GNU system

Symbols

Symbolic names and record which binary code and data correspond to each symbol

Disassembly

Translate machine instructions back into assembly
Has a lot more code
contains sections
resolces incomplete code and data reference

Tools

GDB (GNU Debugger):
See inside a program during execution
GEF:
exploit dev and reverse-engineering
Ghidra:
software analysis tools and features

<br />

<br />

ELF Format

Executable and Linkable Format  

Used for executable files, object files, shared libraries and core dumps.

Components:

• Executable headers
• Program headers (op) - used by linker
• Sections
• Section headers (op) - used by linker

Executable Header

Information about the binary

Sections and Section Headers

Depending on the contents
Not all used during execution

NULL: a section without entry, name, nor bytes; mark the first section header.
.init: Run before others execute.
.fini: Run after program completes.
.text: Main code; Executable not writable; SHT_PROGBITS: contains user-defined code; Usually point to _start and __libc_start_main.
.rodata: read only data; constant values.
.data: Default values; Writable.
.bss: Block started by symbol. Reserve space for uninitialized variables. Writable.