You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
The Linux function for loading binaries [load_elf_binary] treats the e_phoff field in two ways:
It is an offset from the beginning of the file used to locate the phdr table.
It is used to calculate the virtual address of the program header table that is passed into the binary in the AT_PHDR field of the auxillary structure used to initialize the binary.
Existing libc implementations will parse the program header table in (2) to initialize TLS and other state. If this address is incorrect, then the program may crash.
Relevant to this is that the Linux kernel makes certain assumptions about the layout of the Elf file. In particular, it computes the "load address" load_addr of the program. In the common case, this is the virtual address of the first program segment. It then adds the value of e_phoff to this see.
To check binaries will run, the simplest check would be to verify that the program header table in executables appears within the first segment.
The text was updated successfully, but these errors were encountered:
The Linux function for loading binaries [
load_elf_binary
] treats thee_phoff
field in two ways:AT_PHDR
field of the auxillary structure used to initialize the binary.Existing
libc
implementations will parse the program header table in (2) to initialize TLS and other state. If this address is incorrect, then the program may crash.Relevant to this is that the Linux kernel makes certain assumptions about the layout of the Elf file. In particular, it computes the "load address"
load_addr
of the program. In the common case, this is the virtual address of the first program segment. It then adds the value ofe_phoff
to this see.To check binaries will run, the simplest check would be to verify that the program header table in executables appears within the first segment.
The text was updated successfully, but these errors were encountered: