It's a way to get code fixups without having to maintain a separate copy of the code for each process. The PLT is the procedure linkage table, one of the structures which makes dynamic loading easier to use.
printf@plt
is actually a small stub which calls the real printf
function. This real function may be mapped into any location in a given virtual address space so, in order to allow proper code sharing of your own code (left side below), you don't want to apply the fixups to it directly since it too can be mapped anywhere in the virtual address space.The
plt
variant is a smaller process-specific area which isn't shared so a given process can change that however it wants to.In other words:
Mapped to: 0x12345678 0x90000000 0x88888888
+-------------------------+ +----------+ +---------------------+
| | | Private | | |
ProcA | | | PLT/GOT | | |
| | | area | | |
| | +----------+ | |
========| Shared application code |==============| Shared library code |========
| | +----------+ | |
| | | Private | | |
ProcB | | | PLT/GOT | | |
| | | area | | |
+-------------------------+ +----------+ +---------------------+
Mapped to: 0x20202020 0x90000000 0x66666666
This is a simple case where the PLT maps to a known location. In your scenario, it appears to be located relative to the current program counter so it's probably a separate section following the shared application code.Example:<printf@plt+0>: jmpq *0x2004c2(%rip) # 0x600860 <_GLOBAL_OFFSET_TABLE_+24>
It's clearly using a program-counter-relative lookup to find the actual printf
function. That _GLOBAL_OFFSET_TABLE_
will hold fix-ups for as many functions as needed.Another good article can be found here, detailing how glibc is loaded at runtime.
Basically, the original way in which libraries were made meant that they had to be loaded at the same memory location in the virtual address space of every process that used them. Either that or they couldn't be shared, since the act of fixing up the single shared copy for one process would totally stuff up another process where it was mapped to a different location.
By using position independent code, along with a global offset table (GOT) and the PLT, the first call to
printf@plt
(in the PLT) is a multi-stage operation, in which:- you call
printf@plt
in the PLT. - it calls the GOT version which initially points back to some set-up code in the PLT.
- that set-up code modifies the GOT so that subsequent calls don't use the setup code (instead they go directly to the real
printf
).
On subsequent calls, because the GOT has been modified:
- you call
printf@plt
in the PLT. - it calls the GOT version which points to the real
printf
.
Comments
Post a Comment