PowerPC 下动态链接库机制

1、PowerPC 下动态链接库机制考虑以下简单的程序：int main()    printf("f0 = %dn", 0x0);        printf("f0 = %dn", 0x8);        return 0;rootcomcat:/root> gdb ./test (gdb) disass mainDump of assembler code for function main:0x

2、1000044c <main+0>:    stwu    r1,-16(r1)0x10000450 <main+4>:    mflr    r00x10000454 <main+8>:    stw     r0,20(r1)0x10000458 <main+12>:    stw    

3、; r31,12(r1)0x1000045c <main+16>:    mr      r31,r10x10000460 <main+20>:    lis     r9,40960x10000464 <main+24>:    addi    r3,r9,20560x10000468 <main+28>:  

4、0; li      r4,00x1000046c <main+32>:    crclr   4*cr1+eq0x10000470 <main+36>:    bl      0x100109c0 <printfplt>0x10000474 <main+40>:    lis     r9,4096

5、0x10000478 <main+44>:    addi    r3,r9,20560x1000047c <main+48>:    li      r4,80x10000480 <main+52>:    crclr   4*cr1+eq0x10000484 <main+56>:    bl   

6、   0x100109c0 <printfplt>0x10000488 <main+60>:    li      r0,00x1000048c <main+64>:    mr      r3,r00x10000490 <main+68>:    lwz     r11,0(r1)0x1000049

7、4 <main+72>:    lwz     r0,4(r11)0x10000498 <main+76>:    mtlr    r00x1000049c <main+80>:    lwz     r31,-4(r11)0x100004a0 <main+84>:    mr   

8、0;  r1,r110x100004a4 <main+88>:    blrEnd of assembler dump.(gdb) b *0x10000468Breakpoint 1 at 0x10000468: file enum.c, line 13.(gdb) rStarting program: /root/test Breakpoint 1, 0x10000468 in main () at test.c:1313    test.c: No such file or directory. &

9、#160;  in test.c(gdb) x /6i 0x100109c00x100109c0 <printfplt>:    li      r11,80x100109c4 <printfplt+4>:    b       0x10010988 <_GLOBAL_OFFSET_TABLE_+44>0x100109c8 <printfplt+8>: 

10、60;  .long 0x00x100109cc <printfplt+12>:    .long 0x00x100109d0 <printfplt+16>:    .long 0x00x100109d4 <completed.6562>:    .long 0x0(gdb) x /10i 0x100109880x10010988 <_GLOBAL_OFFSET_TABLE_+44>:    rlwinm r12,r1

11、1,1,0,300x1001098c <_GLOBAL_OFFSET_TABLE_+48>:    add     r11,r12,r110x10010990 <_GLOBAL_OFFSET_TABLE_+52>:    li      r12,144680x10010994 <_GLOBAL_OFFSET_TABLE_+56>:    addis   r12,

12、r12,40930x10010998 <_GLOBAL_OFFSET_TABLE_+60>:    mtctr   r120x1001099c <_GLOBAL_OFFSET_TABLE_+64>:    li      r12,00x100109a0 <_GLOBAL_OFFSET_TABLE_+68>:    addis   r12,r12,122880x100109a4 &l

13、t;_GLOBAL_OFFSET_TABLE_+72>:    bctr0x100109a8 <_GLOBAL_OFFSET_TABLE_+76>:    .long 0x00x100109ac <_GLOBAL_OFFSET_TABLE_+80>:    .long 0x0(gdb) si0x1000046c    13    in enum.c(gdb) si0x10000470   

14、; 13    in enum.c(gdb) 0x100109c0 in printfplt ()(gdb) 0x100109c4 in printfplt ()(gdb) 0x10010988 in ? ()(gdb) 0x1001098c in ? ()(gdb) 0x10010990 in ? ()(gdb) 0x10010994 in ? ()(gdb) 0x10010998 in ? ()(gdb) 0x1001099c in ? ()(gdb) 0x100109a0 in ? ()(gdb) 0x100109a4 in ? ()(gdb) 0x0ffd

15、3884 in ? () from /lib/ld.so.1               -> 动态链接器解析 printf 符号，获得其函数实体地址，然后重写 0x100109c0 处的指令(gdb) b *0x1000047cBreakpoint 2 at 0x1000047c: file test.c, line 14.(gdb) cContinuing.f0 = 0Breakpoint 2, 0x1000047c in main () at test.c:1414 

16、60;  in test.c(gdb) x /6i 0x100109c00x100109c0 <printfplt>:    b       0xfeba210 <printf>    -> 第一次调用 printf 后，此处即被动态链接器 ld.so.1 重填0x100109c4 <printfplt+4>:    b       0

17、x10010988 <_GLOBAL_OFFSET_TABLE_+44>0x100109c8 <printfplt+8>:    .long 0x00x100109cc <printfplt+12>:    .long 0x00x100109d0 <printfplt+16>:    .long 0x00x100109d4 <completed.6562>:    .long 0x0(gdb) x /10i 0x10

18、0109880x10010988 <_GLOBAL_OFFSET_TABLE_+44>:    rlwinm r12,r11,1,0,300x1001098c <_GLOBAL_OFFSET_TABLE_+48>:    add     r11,r12,r110x10010990 <_GLOBAL_OFFSET_TABLE_+52>:    li      r12,144680x10010994 <_GLOBAL_OFFSET_TABLE_+56>:    addis   r12,r12,40930x10010998 <_GLOBAL_O