ELF转二进制(4/4)：动态计算并修改数据加载地址

# hello.s
#
# as --32 -o hello.o hello.s
# ld -melf_i386 -o hello hello.o
# objcopy -O binary hello hello.bin
#

    .text
.global _start
_start:
    xorl   %eax, %eax
    movb   $4, %al                  # eax = 4, sys_write(fd, addr, len)
    xorl   %ebx, %ebx
    incl   %ebx                     # ebx = 1, standard output
    movl   $.LC0, %ecx              # ecx = $.LC0, the addr of string
    xorl   %edx, %edx
    movb   $13, %dl                 # edx = 13, the length of .string
    int    $0x80
    xorl   %eax, %eax
    movl   %eax, %ebx               # ebx = 0
    incl   %eax                     # eax = 1, sys_exit
    int    $0x80

    .section .rodata
.LC0:
    .string "Hello World\xa\x0"

$ objdump -dr hello.o
hello.o:     file format elf32-i386

Disassembly of section .text:

00000000 <_start>:
   0:	31 c0                	xor    %eax,%eax
   2:	b0 04                	mov    $0x4,%al
   4:	31 db                	xor    %ebx,%ebx
   6:	43                   	inc    %ebx
   7:	b9 00 00 00 00       	mov    $0x0,%ecx
			8: R_386_32	.rodata
   c:	31 d2                	xor    %edx,%edx
   e:	b2 0d                	mov    $0xd,%dl
  10:	cd 80                	int    $0x80
  12:	31 c0                	xor    %eax,%eax
  14:	89 c3                	mov    %eax,%ebx
  16:	40                   	inc    %eax
  17:	cd 80                	int    $0x80

$ readelf -S hello.o  | egrep " .text|Size"
  [Nr] Name              Type            Addr     Off    Size   ES Flg Lk Inf Al
  [ 1] .text             PROGBITS        00000000 000034 000019 00  AX  0   0  1

/* dynamic linking: update the data address */
/* offset are gotten from this command: $ objdump -dr hello.o */
#define inst_offset 8
#define data_offset 0x19
*(unsigned int *)(addr + inst_offset) = (uint)addr + data_offset;

$ diff --git a/mmap.orig.c b/mmap.any.c
index 640bcb0..87358d9 100644
--- a/mmap.orig.c
+++ b/mmap.any.c
@@ -11,7 +11,7 @@
 int
 main(int argc, char *argv[])
 {
-    char *addr;
+    char *addr = NULL;
     int fd;
     struct stat sb;
     off_t offset, pa_offset;
@@ -19,7 +19,7 @@ main(int argc, char *argv[])
     ssize_t s;

     if (argc < 3 || argc > 4) {
-        fprintf(stderr, "%s file offset [length]\n", argv[0]);
+        fprintf(stderr, "%s file offset [addr]\n", argv[0]);
         exit(EXIT_FAILURE);
     }

@@ -40,20 +40,25 @@ main(int argc, char *argv[])
     }

     if (argc == 4) {
-        length = atoi(argv[3]);
-        if (offset + length > sb.st_size)
-            length = sb.st_size - offset;
-                /* Can't display bytes past end of file */
-
-    } else {    /* No length arg ==> display to end of file */
-        length = sb.st_size - offset;
+        sscanf(argv[3], "%p", &addr);
     }
+    length = sb.st_size - offset;

-    addr = mmap(NULL, length + offset - pa_offset, PROT_READ,
-                MAP_PRIVATE, fd, pa_offset);
+    addr = mmap((void *)addr, length + offset - pa_offset, PROT_READ|PROT_WRITE|PROT_EXEC,
+                MAP_PRIVATE|MAP_FIXED|MAP_POPULATE, fd, pa_offset);
     if (addr == MAP_FAILED)
         handle_error("mmap");

+    /* dynamic linking: update the data address */
+    /* offset are gotten from this command: $ objdump -dr hello.o */
+    #define inst_offset 8
+    #define data_offset 0x19
+    *(unsigned int *)(addr + inst_offset) = (uint)addr + data_offset;
+
+    /* flush icache: Using the GNU Compiler Collection (GCC): Other Bui... */
+    __builtin___clear_cache(addr, addr + length + offset - pa_offset);
+
+#if 0
     s = write(STDOUT_FILENO, addr + offset - pa_offset, length);
     if (s != length) {
         if (s == -1)
@@ -62,6 +67,9 @@ main(int argc, char *argv[])
         fprintf(stderr, "partial write");
         exit(EXIT_FAILURE);
     }
+#else
+    ((void (*)(void))addr)();
+#endif

     exit(EXIT_SUCCESS);
 }

$ gcc -m32 -o mmap.any mmap.any.c
$ sudo ./mmap.any ./hello.bin 0
Hello World
$ ./mmap.any ./hello.bin 0 0x8042000
Hello World