零散的基础知识

本文最后更新于:2024年1月14日 下午

Jmp.Cliff也曾幻想能有人手把手系统地教他学CTF……

ELF文件基础

start/main/_libc_start_main

我们都知道,main函数是我们编写的程序的起点,但是一个程序的入口点并不是main函数。

程序实际上是由start函数启动的,而start函数负责执行的是_libc_start_main函数:

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
void __fastcall __noreturn start(__int64 a1, __int64 a2, void (*a3)(void))
{
__int64 v3; // rax
int v4; // esi
__int64 v5; // [rsp-8h] [rbp-8h] BYREF
char *retaddr; // [rsp+0h] [rbp+0h] BYREF

v4 = v5;
v5 = v3;
_libc_start_main(
(int (__fastcall *)(int, char **, char **))main,
v4,
&retaddr,
_libc_csu_init,
_libc_csu_fini,
a3,
&v5);
__halt();
}

众所周知我们知道_libc_start_main函数负责启动main函数,但是我们注意这个函数传递进来的其他参数,会发现两个带csu的函数(pwn题中常见技巧ret2csu就是拜他们所赐),说明_libc_start_main并不是套个壳子那么简单。

从它们的名字可以大致猜出来,_libc_csu_init会在main函数之前执行,_libc_csu_fini会在main函数之后执行。

1
2
3
4
5
6
7
8
9
10
11
12
13
void __fastcall _libc_csu_init(unsigned int a1, __int64 a2, __int64 a3)
{
signed __int64 v4; // rbp
__int64 i; // rbx

init_proc();
v4 = &_do_global_dtors_aux_fini_array_entry - &_frame_dummy_init_array_entry;
if ( v4 )
{
for ( i = 0LL; i != v4; ++i )
((void (__fastcall *)(_QWORD, __int64, __int64))*(&_frame_dummy_init_array_entry + i))(a1, a2, a3);
}
}

简要来说,这段代码执行了_do_global_dtors_aux_fini_array_entry - _frame_dummy_init_array_entry中的所有函数,这两个标号是两个函数指针数组。

这里就不得不提到两个段:init.array和fini.array,两个段中保存的就是一系列的函数指针。上面两个标号则对应着两个段。

也就是说_libc_csu_init负责的工作,是把_init.array中的每一个函数指针依次执行一遍。

_libc_csu_fini在一般程序中是空的(不过似乎有的版本的编译器编译出来也是类似于_libc_csu_init一样执行一遍fini.array),但是_libc_main_start在结束时会执行exit相关函数,会形成如下的函数调用栈。

1
2
3
4
0   0x7fa6164edf68 _dl_fini+520
1 0x7fa6163158a7 __run_exit_handlers+247
2 0x7fa616315a60 on_exit
3 0x7fa6162f308a __libc_start_main+250

而对于dl_fini函数,其内部就有一个类似的执行fini.array数组中所有函数的行为

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
/* Type of the constructor functions.  */
typedef void (*fini_t) (void);


void
_dl_fini (void)
{
/* Lots of fun ahead. We have to call the destructors for all still
loaded objects, in all namespaces. The problem is that the ELF
specification now demands that dependencies between the modules
are taken into account. I.e., the destructor for a module is
called before the ones for any of its dependencies.

To make things more complicated, we cannot simply use the reverse
order of the constructors. Since the user might have loaded objects
using `dlopen' there are possibly several other modules with its
dependencies to be taken into account. Therefore we have to start
determining the order of the modules once again from the beginning. */

/* We run the destructors of the main namespaces last. As for the
other namespaces, we pick run the destructors in them in reverse
order of the namespace ID. */
#ifdef SHARED
int do_audit = 0;
again:
#endif
for (Lmid_t ns = GL(dl_nns) - 1; ns >= 0; --ns)
{
/* Protect against concurrent loads and unloads. */
__rtld_lock_lock_recursive (GL(dl_load_lock));

unsigned int nloaded = GL(dl_ns)[ns]._ns_nloaded;
/* No need to do anything for empty namespaces or those used for
auditing DSOs. */
if (nloaded == 0
#ifdef SHARED
|| GL(dl_ns)[ns]._ns_loaded->l_auditing != do_audit
#endif
)
__rtld_lock_unlock_recursive (GL(dl_load_lock));
else
{
#ifdef SHARED
_dl_audit_activity_nsid (ns, LA_ACT_DELETE);
#endif

/* Now we can allocate an array to hold all the pointers and
copy the pointers in. */
struct link_map *maps[nloaded];

unsigned int i;
struct link_map *l;
assert (nloaded != 0 || GL(dl_ns)[ns]._ns_loaded == NULL);
for (l = GL(dl_ns)[ns]._ns_loaded, i = 0; l != NULL; l = l->l_next)
/* Do not handle ld.so in secondary namespaces. */
if (l == l->l_real)
{
assert (i < nloaded);

maps[i] = l;
l->l_idx = i;
++i;

/* Bump l_direct_opencount of all objects so that they
are not dlclose()ed from underneath us. */
++l->l_direct_opencount;
}
assert (ns != LM_ID_BASE || i == nloaded);
assert (ns == LM_ID_BASE || i == nloaded || i == nloaded - 1);
unsigned int nmaps = i;

/* Now we have to do the sorting. We can skip looking for the
binary itself which is at the front of the search list for
the main namespace. */
_dl_sort_maps (maps, nmaps, (ns == LM_ID_BASE), true);

/* We do not rely on the linked list of loaded object anymore
from this point on. We have our own list here (maps). The
various members of this list cannot vanish since the open
count is too high and will be decremented in this loop. So
we release the lock so that some code which might be called
from a destructor can directly or indirectly access the
lock. */
__rtld_lock_unlock_recursive (GL(dl_load_lock));

/* 'maps' now contains the objects in the right order. Now
call the destructors. We have to process this array from
the front. */
for (i = 0; i < nmaps; ++i)
{
struct link_map *l = maps[i];

if (l->l_init_called)
{
/* Make sure nothing happens if we are called twice. */
l->l_init_called = 0;

/* Is there a destructor function? */
if (l->l_info[DT_FINI_ARRAY] != NULL
|| (ELF_INITFINI && l->l_info[DT_FINI] != NULL))
{
/* When debugging print a message first. */
if (__builtin_expect (GLRO(dl_debug_mask)
& DL_DEBUG_IMPCALLS, 0))
_dl_debug_printf ("\ncalling fini: %s [%lu]\n\n",
DSO_FILENAME (l->l_name),
ns);

/* First see whether an array is given. */
if (l->l_info[DT_FINI_ARRAY] != NULL)
{
ElfW(Addr) *array =
(ElfW(Addr) *) (l->l_addr
+ l->l_info[DT_FINI_ARRAY]->d_un.d_ptr);
unsigned int i = (l->l_info[DT_FINI_ARRAYSZ]->d_un.d_val
/ sizeof (ElfW(Addr)));
while (i-- > 0)
((fini_t) array[i]) ();
}

/* Next try the old-style destructor. */
if (ELF_INITFINI && l->l_info[DT_FINI] != NULL)
DL_CALL_DT_FINI
(l, l->l_addr + l->l_info[DT_FINI]->d_un.d_ptr);
}

#ifdef SHARED
/* Auditing checkpoint: another object closed. */
_dl_audit_objclose (l);
#endif
}

/* Correct the previous increment. */
--l->l_direct_opencount;
}

#ifdef SHARED
_dl_audit_activity_nsid (ns, LA_ACT_CONSISTENT);
#endif
}
}

#ifdef SHARED
if (! do_audit && GLRO(dl_naudit) > 0)
{
do_audit = 1;
goto again;
}

if (__glibc_unlikely (GLRO(dl_debug_mask) & DL_DEBUG_STATISTICS))
_dl_debug_printf ("\nruntime linker statistics:\n"
" final number of relocations: %lu\n"
"final number of relocations from cache: %lu\n",
GL(dl_num_relocations),
GL(dl_num_cache_relocations));
#endif
}

这是一个库函数,但是它可以从link_map结构中读取到elf地址并且拿到fini.array的信息,关键执行代码如下。

1
2
3
4
5
6
7
8
9
10
if (l->l_info[DT_FINI_ARRAY] != NULL)
{
ElfW(Addr) *array =
(ElfW(Addr) *) (l->l_addr
+ l->l_info[DT_FINI_ARRAY]->d_un.d_ptr);
unsigned int i = (l->l_info[DT_FINI_ARRAYSZ]->d_un.d_val
/ sizeof (ElfW(Addr)));
while (i-- > 0)
((fini_t) array[i]) ();
}

因此我们可以通过劫持fini.array结构来实现程序执行流的劫持。

但是fini.array在题目为动态链接时,很多时候是不可写的,除非这题开启的是NO RELRO。也许利用堆攻击劫持link_map相关结构来控制这里获得到的array数组的地址以实现攻击也不是不行,但是显然在能进行libc写字节的情况下,使用house_of_cat更加方便。

同时这个细节也有可能被用于逆向题目,在fini里注册一些函数给你挖坑。

我们在编译时可以在函数声明处添加选项指定将这个函数加入init.array或者fini.array:

1
2
3
4
5
6
7
8
//init.array
void nop(void)__attribute__((destructor));
//fini.array
void nop(void)__attribute__((constructor));

void nop(){
;
}

零散的基础知识
http://example.com/2023/10/14/Blog/CTF-Basic/零散的基础知识/
作者
Jmp.Cliff
发布于
2023年10月14日
许可协议