Android上可執行ELF文件中的段不能有基址

時間 2020-06-20

原文原文鏈接

Android上可執行ELF文件中的段不能有基址

@(Android研究)[android]android

[TOC]shell

場景

我使用Android NDK的編譯工具交叉編譯qemu項目（編譯可在Android上運行的qemu user mode），將編譯出來的qemu-arm可執行文件放到Android上執行時發生了"Segmentation fault"，經過分析錯誤日誌（Android linker加載庫失敗時輸出更詳細調試信息），發現是linker加載qemu-arm時出錯，簡要錯誤日誌見下：tcp

01-30 20:36:10.376 2078-2078/? A/libc: Fatal signal 11 (SIGSEGV), code 1, fault addr 0xc0011c80 in tid 2078 (the_exe)
01-30 20:36:10.377 197-197/? I/DEBUG: property debug.db.uid not set; NOT waiting for gdb.
01-30 20:36:10.377 197-197/? I/DEBUG: HINT: adb shell setprop debug.db.uid 100000
01-30 20:36:10.377 197-197/? I/DEBUG: HINT: adb forward tcp:5039 tcp:5039
01-30 20:36:10.482 197-197/? I/DEBUG: *** *** *** *** *** *** *** *** *** *** *** *** *** *** *** ***
01-30 20:36:10.482 197-197/? I/DEBUG: Build fingerprint: 'google/hammerhead/hammerhead:5.1.1/LMY48M/2167285:user/release-keys'
01-30 20:36:10.482 197-197/? I/DEBUG: Revision: '11'
01-30 20:36:10.482 197-197/? I/DEBUG: ABI: 'arm'
01-30 20:36:10.483 197-197/? I/DEBUG: pid: 2078, tid: 2078, name: the_exe  >>> ./the_exe <<<
01-30 20:36:10.483 197-197/? I/DEBUG: signal 11 (SIGSEGV), code 1 (SEGV_MAPERR), fault addr 0xc0011c80
01-30 20:36:10.491 26449-26682/system_process W/NativeCrashListener: Couldn't find ProcessRecord for pid 2078
01-30 20:36:10.558 197-197/? I/DEBUG:     r0 00000000  r1 b6fa83bf  r2 c0011c81  r3 b6fad714
01-30 20:36:10.558 197-197/? E/DEBUG: AM write failure (32 / Broken pipe)
01-30 20:36:10.558 197-197/? I/DEBUG:     r4 c0011c80  r5 b6fa83bf  r6 b6f9b004  r7 b6fa8486
01-30 20:36:10.558 197-197/? I/DEBUG:     r8 00000010  r9 b6fad714  sl 00000001  fp 6011fdb8
01-30 20:36:10.558 197-197/? I/DEBUG:     ip b6fa8486  sp bec6d7a8  lr b6f9f5b7  pc c0011c80  cpsr 800f0010
01-30 20:36:10.559 197-197/? I/DEBUG:     #00 pc c0011c80  <unknown>
01-30 20:36:10.559 197-197/? I/DEBUG:     #01 pc 000015b5  /system/bin/linker (__dl__ZN6soinfo12CallFunctionEPKcPFvvE+44)
01-30 20:36:10.559 197-197/? I/DEBUG:     #02 pc 00001689  /system/bin/linker (__dl__ZN6soinfo9CallArrayEPKcPPFvvEjb+140)
01-30 20:36:10.559 197-197/? I/DEBUG:     #03 pc 0000185f  /system/bin/linker (__dl__ZN6soinfo16CallConstructorsEv+142)
01-30 20:36:10.559 197-197/? I/DEBUG:     #04 pc 00003ae7  /system/bin/linker (__dl___linker_init+1594)
01-30 20:36:10.559 197-197/? I/DEBUG:     #05 pc 00000a98  /system/bin/linker (_start+4)
01-30 20:36:10.559 197-197/? I/DEBUG:     #06 pc 00000a98  /system/bin/linker (_start+4)
01-30 20:36:10.559 197-197/? I/DEBUG:     #07 pc 00000a98  /system/bin/linker (_start+4)

......

上面錯誤日誌中有這麼一行"#00 pc c0011c80 <unknown>"。依據Linux的知識，內存的低3G地址是用戶空間高1G地址是內核空間，內核空間地址範圍是0xc0000000~0xffffffff，也就是說此時的pc指向了內核內存範圍，這確定是有問題的。ionic

問題詳解

下面是qemu-arm的段信息：ide

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        60000134 000134 000013 00   A  0   0  1
  [ 2] .dynsym           DYNSYM          60000148 000148 001b50 10   A  3   1  4
  [ 3] .dynstr           STRTAB          60001c98 001c98 0012d7 00   A  0   0  1
  [ 4] .hash             HASH            60002f70 002f70 000af8 04   A  2   0  4
  [ 5] .gnu.version      VERSYM          60003a68 003a68 00036a 02   A  2   0  2
  [ 6] .gnu.version_r    VERNEED         60003dd4 003dd4 000040 00   A  3   2  4
  [ 7] .rel.dyn          REL             60003e14 003e14 000050 08   A  2   0  4
  [ 8] .rel.plt          REL             60003e64 003e64 000d40 08   A  2   0  4
  [ 9] .plt              PROGBITS        60004ba4 004ba4 0013f4 00  AX  0   0  4
  [10] .text             PROGBITS        60005f98 005f98 0d3f00 00  AX  0   0  4
  [11] .note.android.ide PROGBITS        600d9e98 0d9e98 000018 00   A  0   0  4
  [12] .rodata           PROGBITS        600d9eb0 0d9eb0 0236c4 00   A  0   0  8
  [13] .ARM.extab        PROGBITS        600fd574 0fd574 00003c 00   A  0   0  4
  [14] .ARM.exidx        ARM_EXIDX       600fd5b0 0fd5b0 0000b8 08  AL 10   0  4
  [15] .data.rel.ro.loca PROGBITS        600fe690 0fd690 00b7e8 00  WA  0   0  8
  [16] .fini_array       FINI_ARRAY      60109e78 108e78 000008 00  WA  0   0  4
  [17] .init_array       INIT_ARRAY      60109e80 108e80 000040 00  WA  0   0  4
  [18] .preinit_array    PREINIT_ARRAY   60109ec0 108ec0 000008 00  WA  0   0  4
  [19] .data.rel.ro      PROGBITS        60109ec8 108ec8 004f30 00  WA  0   0  8
  [20] .dynamic          DYNAMIC         6010edf8 10ddf8 000128 08  WA  3   0  4
  [21] .got              PROGBITS        6010ef24 10df24 0010dc 00  WA  0   0  4
  [22] .data             PROGBITS        60110000 10f000 004164 00  WA  0   0  8
  [23] .bss              NOBITS          60114170 113170 10359f8 00  WA  0   0 16
  [24] .comment          PROGBITS        00000000 113164 000026 01  MS  0   0  1
  [25] .debug_info       PROGBITS        00000000 11318a 1efbce 00      0   0  1
  [26] .debug_abbrev     PROGBITS        00000000 302d58 01a79e 00      0   0  1
  [27] .debug_loc        PROGBITS        00000000 31d4f6 15fb92 00      0   0  1
  [28] .debug_aranges    PROGBITS        00000000 47d088 0010e8 00      0   0  8
  [29] .debug_ranges     PROGBITS        00000000 47e170 02c4e8 00      0   0  1
  [30] .debug_line       PROGBITS        00000000 4aa658 05d16e 00      0   0  1
  [31] .debug_str        PROGBITS        00000000 5077c6 02d269 01  MS  0   0  1
  [32] .debug_frame      PROGBITS        00000000 534a30 019bac 00      0   0  4
  [33] .note.gnu.gold-ve NOTE            00000000 54e5dc 00001c 00      0   0  4
  [34] .ARM.attributes   ARM_ATTRIBUTES  00000000 54e5f8 00002b 00      0   0  1
  [35] .symtab           SYMTAB          00000000 54e624 021dc0 10     36 5874  4
  [36] .strtab           STRTAB          00000000 5703e4 015378 00      0   0  1
  [37] .shstrtab         STRTAB          00000000 58575c 000195 00      0   0  1

觀察上面的段信息能夠發現，這些段都是有基址的，基址是0x60000000。段有基址，那麼存在於段中的函數和變量也都是有基址的。函數

經過分析Android linker的源碼發現，0xc0011c80地址值是linker對qemu-arm的構造函數進行重定位後的地址，該構造函數在ELF文件中顯示的虛擬地址值是0x60011c80，0xc0011c80與0x60011c80之間差0x60000000，這裏的0x60000000是linker將qemu-arm加載到內存時的基址。此時就不難理解0xc0011c80的值是怎麼來的了，0xc0011c80等於"0x60000000 + 0x60011c80"，工具

下面是ndk-build編譯出的可執行文件的段信息：ui

Section Headers:
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 0]                   NULL            00000000 000000 000000 00      0   0  0
  [ 1] .interp           PROGBITS        00000134 000134 000013 00   A  0   0  1
  [ 2] .dynsym           DYNSYM          00000148 000148 0000d0 10   A  3   1  4
  [ 3] .dynstr           STRTAB          00000218 000218 0000bf 00   A  0   0  1
  [ 4] .hash             HASH            000002d8 0002d8 000048 04   A  2   0  4
  [ 5] .rel.dyn          REL             00000320 000320 000060 08   A  2   0  4
  [ 6] .rel.plt          REL             00000380 000380 000040 08  AI  2   7  4
  [ 7] .plt              PROGBITS        000003c0 0003c0 000074 00  AX  0   0  4
  [ 8] .text             PROGBITS        00000434 000434 001608 00  AX  0   0  4
  [ 9] .note.android.ide PROGBITS        00001a3c 001a3c 000018 00   A  0   0  4
  [10] .ARM.exidx        ARM_EXIDX       00001a54 001a54 000110 08  AL  8   0  4
  [11] .rodata           PROGBITS        00001b64 001b64 000016 01 AMS  0   0  1
  [12] .ARM.extab        PROGBITS        00001b7c 001b7c 00003c 00   A  0   0  4
  [13] .fini_array       FINI_ARRAY      00002e84 001e84 000008 00  WA  0   0  4
  [14] .init_array       INIT_ARRAY      00002e8c 001e8c 000010 00  WA  0   0  4
  [15] .preinit_array    PREINIT_ARRAY   00002e9c 001e9c 000008 00  WA  0   0  4
  [16] .dynamic          DYNAMIC         00002ea4 001ea4 000100 08  WA  3   0  4
  [17] .got              PROGBITS        00002fa4 001fa4 00005c 00  WA  0   0  4
  [18] .bss              NOBITS          00003000 002000 000004 00  WA  0   0  4
  [19] .comment          PROGBITS        00000000 002000 000023 01  MS  0   0  1
  [20] .note.gnu.gold-ve NOTE            00000000 002024 00001c 00      0   0  4
  [21] .ARM.attributes   ARM_ATTRIBUTES  00000000 002040 00002d 00      0   0  1
  [22] .shstrtab         STRTAB          00000000 00206d 0000dd 00      0   0  1
Key to Flags:
  W (write), A (alloc), X (execute), M (merge), S (strings)
  I (info), L (link order), G (group), T (TLS), E (exclude), x (unknown)
  O (extra OS processing required) o (OS specific), p (processor specific)

觀察上面的段信息能夠發現，經過ndk-build編譯出來的可執行文件中的段是沒有基址的。google

0xc0011c80地址造成的印證.net

下面的代碼摘自Android linker源碼"android/system/bionic/linker/linker.cpp"文件（源自Android5.1.1源碼）：

#if defined(__arm__)
      case R_ARM_RELATIVE:
#elif defined(__i386__)
      case R_386_RELATIVE:
#endif
        count_relocation(kRelocRelative);
        MARK(rel->r_offset);
        if (sym) {
          DL_ERR("odd RELATIVE form...");
          return -1;
        }
        TRACE_TYPE(RELO, "[R_ARM_RELATIVE/R_386_RELATIVE] RELO RELATIVE %p <- +%p",
                   reinterpret_cast<void*>(reloc), reinterpret_cast<void*>(base));
        *reinterpret_cast<ElfW(Addr)*>(reloc) += base;
        break;

*reinterpret_cast<ElfW(Addr)*>(reloc) += base;語句可知，被重定位函數的最終地址等於ELF文件中的虛擬地址加上內存基址。這條語句印證了上面對於0xc0011c80地址造成的分析，同時也印證了Android上可執行ELF文件中的段不能有基址，若是段中有基址那麼內存基址與ELF中虛擬地址相加後一般將會產生一個很大的數值。