Android Native Program Reverse entry (i)--native program start-up process

The August Sun is yellow, who said the world is not gold? The Little sparrow dozed in the shade, and the children rolled in the meadow. The August Sun is yellow, who said the world is not gold? The Golden Woods, the Golden Meadow, the small birds ensemble The cheerful voiceless: the Golden Cottage, the Golden Wheat Tun, the golden is the old farmer's laughter. --Xu Zhimo's August Sun

Ilocker: Focus on Android Security (new entry, 0 Basics) qq:2597294287

When the native program is generated, a link script is passed in during the link phase, in which the entry function for the program is specified.

As you can see, in the default link script armelf_linux_eabi.x, the entry function is specified as "_start".

Search for ldscripts in the NDK directory, and all of the link scripts are in that directory.

The _start function is defined in CRTBEGIN.C (under the Bionic Directory of libc).

In _start, the __libc_init is called, and the address of the main function is passed in as a parameter.

Look at the source code of the __libc_init (in the Libc_init_static.cpp file in the libc bionic directory):

Do some initialization work in __libc_init, then call Preinit_array, Init_array, and finally call the main function passed in by the parameter slingshot.

The above description is for statically linked programs and is slightly different for dynamically linked programs.

For dynamic linking (specified-bdynamic on the GCC command line), the file path of the program interpreter is saved in the. Interp of the generated executable file, and the default is "/system/bin/linker".

When executing a dynamically linked program, the system resolves the ELF file and finds the program interpreter saved in the. Interp, which is the Android linker. Then execution linker,linker will load the program's dependent series so, and finally call the executable program.

The entry function of linker _start is not in CRTBEGIN.C, but in linker source code's begin. S file.

Call the __linker_init function to complete the linker "bootstrap" and do some initialization work, and finally return the address of the original native program's entry function (found in the ELF Header of the native program).

mov pc, r0, jumps to the native program's entry function (_start) to execute, and the next execution process is the same as above. _start calls __libc_init. The __libc_init definition of a dynamically linked program is defined in the Libc_init_dynamic.cpp file (the static linker's __libc_init is defined in the Libc_init_static.cpp file).

It looks simpler than static linker __libc_init, because some initialization work is done by linker.

Summary: The entry function for static links and dynamically linked native programs is _start. Dynamically linked programs need to load the dependent libraries by linker and do some initialization before executing the _start.

Learning materials: "Android software security and reverse analysis"

Android Native Program Reverse entry (i)--native program start-up process