A position independent ELF executable can be loaded and run from arbitrary address within the virtual address space.
I tried to build below simple program:
pie.c
#include <stdio.h> void main(void) { printf("hello, pie!\n"); } Build command:
gcc pie.c -o pie -pie The ELF header of the executable is:
pie:
ELF Header: Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Shared object file) Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x530 <================= FIXED entry point Start of program headers: 64 (bytes into file) Start of section headers: 6440 (bytes into file) Flags: 0x0 Size of this header: 64 (bytes) Size of program headers: 56 (bytes) Number of program headers: 9 Size of section headers: 64 (bytes) Number of section headers: 29 Section header string table index: 28 So the entry point address is fixed.
And it is the symbol _start there:
0000000000000530 T _start So it means the _start must be placed at 0x530.
Isn't this contradictory to being position independent?
ADD 1 - 10:44 AM 8/16/2021
I tried to build the same program without the -pie flag:
gcc pie.c -o pie_not The generated ELF header is:
pie_not:
ELF Header: Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: DYN (Shared object file) Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x530 <============ Still the same value as with -pie flag Start of program headers: 64 (bytes into file) Start of section headers: 6440 (bytes into file) Flags: 0x0 Size of this header: 64 (bytes) Size of program headers: 56 (bytes) Number of program headers: 9 Size of section headers: 64 (bytes) Number of section headers: 29 Section header string table index: 28 And I further compared the built results pie and pie_not. Their binaries are identical.
So how could the operating system tell which one should be treated as position independent code??
ADD 2 - 10:56 AM 8/16/2021
I guess I figured it out. It seems gcc use -pie by default. To avoid it, I have to add -no-pie flag explicitly.
gcc pie.c -o pie_not -no-pie And the generated ELF header is like this:
pie_not:
ELF Header: Magic: 7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 Class: ELF64 Data: 2's complement, little endian Version: 1 (current) OS/ABI: UNIX - System V ABI Version: 0 Type: EXEC (Executable file) <==== File type also changed!!! Machine: Advanced Micro Devices X86-64 Version: 0x1 Entry point address: 0x400400 <===== Entry point address changed! Start of program headers: 64 (bytes into file) Start of section headers: 6376 (bytes into file) Flags: 0x0 Size of this header: 64 (bytes) Size of program headers: 56 (bytes) Number of program headers: 9 Size of section headers: 64 (bytes) Number of section headers: 29 Section header string table index: 28 I believe the loader relies on the Type filed in ELF header to decide how to treat the binary.
