Static connection Analysis

We know that a program needs to be compiled, linked, and run when it executes. Here to analyze the content of static links.

Let's take a look at a program's execution process:

Under Linux, GCC will be directly linked to the executable file a.out, and Gcc-c is to compile each source file into the target file, which is the. O End of the file.

For example, we have such three simple functions:

Main () function

Add function

Sub function

Under Linux, we have constructed such three functions, named Main.c, ADD.C, SUB.C, respectively. In Main.c, three functions were called, add,sub,printf.

First we use the command:

Gcc-c MAIN.C

To compile MAIN.C this source program, get MAIN.O, and use the command:

Objdump-d MAIN.O

To see the assembly code for the MAIN.C compiled program:

The observation shows that there are three call commands in the main function, which is the invocation instruction of the three functions. As we had expected before, we were

18:e8 FC FF FF FF call <main+0x19>

30:e8 FC FF FF FF call <main+0x31>

50:e8 FC FF FF FF call Wuyi <main+0x51>

A closer look will find that the instructions for the three call instructions are the same, both E8 FC FF FF FF -4. This is the next command address minus 4, and back here. In fact, the 4 here is a marker effect. So we can unlock this topic: static links .

Under a static connection we compile the main.c with the command and get a target file as indicated:

This is MAIN.O, the target file starts with address 0x00000000, but does not know where it is when it encounters the Add function, it makes a token to tell that it is a function call, and the following calling sub is the same as called printf.

Compile add.c and sub.c into target files at the same time. We are linking. The linked command is LD. In fact, the link is to scan the entire MAIN.O code. When scanning to the instruction code E8 FC FF FF FF, the required files are added, and then the call function in MAIN.O is like a patch, waiting for the linker to patch, the linker does very dirty and tired. It needs to be one to find patches and need to load each library into the inside to find what is needed. So the link completion is as follows:

This completes the link. Of course, how does the system know which hole corresponds to which patch? This uses the symbol table . At the time of linking, there will be a symbol table, presumably this way:

That is, Key-value's pair to determine how to correspond to the link. Forms the executable file a.out. Take a look at A.out's assembly code.

As such, the three call in the linked a.out is the actual address in memory.

Reference documents:

"Self-cultivation of programmers"

UNIX Advanced Environment Programming

Static connection Analysis