Why GCC compiled C program needs .eh_frame section?

First of all, the original reason for this was largely political – the people who added DWARF-based unwinding (.eh_frame) wanted it to be a feature that’s always there so it could be used for implementing all kinds of stuff other than just C++ exceptions, including: backtrace() __attribute__((__cleanup__(f))) __builtin_return_address(n), for n>0 pthread_cleanup_push, implemented in terms of … Read more

Why does the PLT exist in addition to the GOT, instead of just using the GOT?

The problem is that replacing call printf@PLT with call [printf@GOTPLT] requires that the compiler knows that the function printf exists in a shared library and not a static library (or even in just a plain object file). The linker can change call printf into call printf@PLT, jmp printf into jmp printf@PLT or even mov eax, … Read more

What exactly does `-rdynamic` do and when exactly is it needed?

Here is a simple example project to illustrate the use of -rdynamic. bar.c extern void foo(void); void bar(void) { foo(); } main.c #include <dlfcn.h> #include <stdio.h> #include <stdlib.h> void foo(void) { puts(“Hello world”); } int main(void) { void * dlh = dlopen(“./libbar.so”, RTLD_NOW); if (!dlh) { fprintf(stderr, “%s\n”, dlerror()); exit(EXIT_FAILURE); } void (*bar)(void) = dlsym(dlh,”bar”); … Read more

How can I examine contents of a data section of an ELF file on Linux?

objdump -s -j .rodata exefile gives a side-by-side hex/printable ASCII dump of the contents of the rodata section like: Contents of section .rodata: 0000 67452301 efcdab89 67452301 efcdab89 gE#…..gE#….. 0010 64636261 68676665 64636261 68676665 dcbahgfedcbahgfe It doesn’t look like there’s anything in there to control formatting, but it’s a start. You could always undump the … Read more