How the Linux kernel loads and launches an executable program

Concept Summary

1. How can I get the executable program?

C code--preprocessing--assembly code--Target code--executable file

The format of the executable file

The executable was originally in a.out format and later evolved into the COFF format, which later became a PE (Windows system) and Elf (Linux system). Elf:executable and linkable format, you can perform the linked formats.

Executable Environment for executable programs

• command-line arguments and shell environments, typically we execute a shell environment for a program, and our experiment directly uses the EXECVE system call.

• $ ls-l/usr/bin Listing directory information under/usr/bin

• The shell itself does not limit the number of command-line arguments, the number of command-line arguments is limited by the command itself

• For example, int main (int argc, char *argv[])

• Also, int main (int argc, char *argv[], char *envp[])

• The shell calls Execve to pass command-line arguments and environment parameters to the main function of the executable program.

• int Execve (const char * filename,char * CONST argv[],CHAR * Const envp[]);

• The library function exec* are EXECVE encapsulation routines

Answers to a few questions

1. Where do the new executable programs start?
The default Elf file is loaded from 0x8048000, preceded by Elf header information, which is generally different in size. The actual entry is in 0x8048x000 (x is indeterminate), which is the entry point address of the program.

2. Why does the new executable program execute smoothly after the EXECVE system call returns?

When creating a new user-state stack, the content of the command-line arguments and the contents of the environment variable are actually passed through the pointer to the system call to the kernel handler, and the kernel handler initializes the new executable's context by copying the parameters to the home stack when creating a new executable program's user-state stack. The function call parameter is passed before the system invokes the parameter.

command-line arguments and environment strings are placed in the user-state stack

Execve and fork are special system calls that fall into the kernel state in return to the user state to continue execution. Fork is special, as the parent process and the normal system call, the child process starts from ret_from_fork to return to the user state. Execve falls into the kernel state and overwrites the current process's executable program with the loaded new executables, and when it returns, it is not the original runnable program, but is the new executor.

3. What is the difference between a static-linked executable program and a dynamically-linked executable program EXECVE system call returns?

Static linking method: #pragma comment (lib, "Test.lib"), static link, loading code will be used by the program's dynamic code or the address of the dynamic code to determine down
Links to static libraries can use static links, and dynamic-link libraries can also use this method to link import libraries

The function start_thread is called in Load_elf_binary, where the parameter pt_regs is the stack bottom of the kernel stack.
Start_thread (regs, Elf_entry, bprm->p)
Statically linked Elf_entry is the entry of the executable, and the new program needs to modify the EIP of the int 0x80 kernel stack before returning to the user state

Dynamic linking methods: LoadLibrary ()/getprocessaddress () and FreeLibrary (), programs that use this method do not complete dynamic links in the first place, but until the dynamic library code is actually called, the loader computes (the part that is called) The logical address of the dynamic code, and then at some point, the program needs to call another block of dynamic code, loading the program to calculate the logical address of this part of the code, so this way to make the program initialization time is short, but the performance of the run compared to statically linked programs.

How the Linux kernel loads and launches an executable program