0

I write a very simple program

//main.c
int main() {
        return 0;
}

and compile it into a 32-bit executable.

gcc main.c -m32 -o main

And then I check its base address with readelf -l main

root@acesrc:~# readelf -l main

Elf file type is DYN (Shared object file)
Entry point 0x3b0
There are 9 program headers, starting at offset 52

Program Headers:
  Type           Offset   VirtAddr   PhysAddr   FileSiz MemSiz  Flg Align
  PHDR           0x000034 0x00000034 0x00000034 0x00120 0x00120 R   0x4
  INTERP         0x000154 0x00000154 0x00000154 0x00013 0x00013 R   0x1
      [Requesting program interpreter: /lib/ld-linux.so.2]
  LOAD           0x000000 0x00000000 0x00000000 0x006b4 0x006b4 R E 0x1000
  LOAD           0x000edc 0x00001edc 0x00001edc 0x0012c 0x00130 RW  0x1000
  DYNAMIC        0x000ee4 0x00001ee4 0x00001ee4 0x000f8 0x000f8 RW  0x4
  NOTE           0x000168 0x00000168 0x00000168 0x00044 0x00044 R   0x4
  GNU_EH_FRAME   0x000590 0x00000590 0x00000590 0x0003c 0x0003c R   0x4
  GNU_STACK      0x000000 0x00000000 0x00000000 0x00000 0x00000 RW  0x10
  GNU_RELRO      0x000edc 0x00001edc 0x00001edc 0x00124 0x00124 R   0x1

It shows that the entry point is 0x3b0, instead of something like 0x8048xxx. I have also tested it on SUSE, the programs are based at 0x8048000. What's the reason for that?

Ubuntu Version:

root@acesrc:~# uname -a
Linux acesrc 4.15.0-45-generic #48-Ubuntu SMP Tue Jan 29 16:28:13 UTC 2019 x86_64 x86_64 x86_64 GNU/Linux

GCC Version:

root@acesrc:~# gcc -v
Using built-in specs.
COLLECT_GCC=gcc
COLLECT_LTO_WRAPPER=/usr/lib/gcc/x86_64-linux-gnu/7/lto-wrapper
OFFLOAD_TARGET_NAMES=nvptx-none
OFFLOAD_TARGET_DEFAULT=1
Target: x86_64-linux-gnu
Configured with: ../src/configure -v --with-pkgversion='Ubuntu 7.5.0-3ubuntu1~18.04' --with-bugurl=file:///usr/share/doc/gcc-7/README.Bugs --enable-languages=c,ada,c++,go,brig,d,fortran,objc,obj-c++ --prefix=/usr --with-gcc-major-version-only --program-suffix=-7 --program-prefix=x86_64-linux-gnu- --enable-shared --enable-linker-build-id --libexecdir=/usr/lib --without-included-gettext --enable-threads=posix --libdir=/usr/lib --enable-nls --enable-bootstrap --enable-clocale=gnu --enable-libstdcxx-debug --enable-libstdcxx-time=yes --with-default-libstdcxx-abi=new --enable-gnu-unique-object --disable-vtable-verify --enable-libmpx --enable-plugin --enable-default-pie --with-system-zlib --with-target-system-zlib --enable-objc-gc=auto --enable-multiarch --disable-werror --with-arch-32=i686 --with-abi=m64 --with-multilib-list=m32,m64,mx32 --enable-multilib --with-tune=generic --enable-offload-targets=nvptx-none --without-cuda-driver --enable-checking=release --build=x86_64-linux-gnu --host=x86_64-linux-gnu --target=x86_64-linux-gnu
Thread model: posix
gcc version 7.5.0 (Ubuntu 7.5.0-3ubuntu1~18.04)
4
  • What does it matter? Your programs run, right?
    – Shawn
    Commented Feb 4, 2021 at 1:30
  • It matters when I try to make some changes at the assembly level of the code. For example, I am writing a simple compiler wrapper that can instrument the x86 code. The instrumented code will read an function address(this function address can be found by nm or objdump) from some configurations (share memory, files, sockets, etc) and every time the corresponding function is called, the executable will provide some messages for me to analyze the behavior of the function. Here I need to understand how the code address changes when being executed.
    – Acesrc
    Commented Feb 4, 2021 at 6:34
  • Of course I can use other methods like using llvm-pass or the dynamic instrument tool intel-pin. But every method has its own disadvantages, understanding the system details helps me work better.
    – Acesrc
    Commented Feb 4, 2021 at 6:34
  • That sounds like a way to mimic the --wrap option of GCC's linker. Did you take a look at it? -- However, if you are now aware that the base address might vary, why don't you take it into account? Commented Feb 4, 2021 at 9:20

0

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Browse other questions tagged or ask your own question.