Find the address of the PLT stub
I am working on Linux X86_64.
I need to define the address of a specific PLT record in an ELF file with the name of the dynamic function the record represents. I can determine the offset of the file from the address, but I need to determine the address.
If I parse the ELF file with objdump -D -z elffile
, I can see that objdump uses symbolic names for every PLT entry. (Where does objdump get the relationship between these addresses and symbol names?)
Example:
0000000000000041a2b0 fileno@plt:
If I use objdump -T elffile | grep fileno
, I get something like this:
0000000000000 DF *UND* 00000000000000000 GLIBC_2.2.5 fileno
What I need to do from "C" is to find the PLT entry in the ELF file for a specific dynamic function and get the address.
The background is that I am patching an existing ELF file and have to redirect the function call to another dynamic function. I manually fixed the ELF file using the addresses gathered from the objdump disassembly and proved that this would work for my particular application, I just have to be able to do it from the program. I hope I don't have to scan through the objdump disassembler code to figure out how it gets the PLT characters and input addresses.
source to share
I figured it out: You have to analyze the displacement table in the rela.plt section. These records contain a table row index that can be used to locate the function name by indexing into the dynamic symbols section. Each entry in the dynamic symbol section contains a dynamic row table offset that can be used to pull out the function name. When you find the appropriate function, the index in the relocation table (+1) matches the index in the .plt section for the PLT entry function. So to compute the address for a particular record, it's simple: .plt.sec address + ((relocation_index + 1) * .plt record size)
This method works for x86. It does not work for PPC, which has a completely different format for the .plt section. If anyone has information on how to do this for PPC, please post.
source to share