程序员的自我修养

本篇笔记全文摘自后面参考文献列出的地址，不过原文中有一些错别字，我这里把错别字改了改，然后也是按照自己机器上代码的结果来进行演示。再结合本书前面第6章“6.5 Linux内核装载ELF过程简介”来进行说明。 1、开始 The question is simple: how does linux execute my main()? Through this document, I'll use the following simple C program to illustrate how it works. It's called "execute_main.c"

int main()
{
   return 0;
}

2、编译 gcc -o execute_main execute_main.c 3、What's in the executable?

i4@i4:~/文档/tempfile$ objdump -f execute_main

execute_main:     file format elf32-i386
architecture: i386, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x08048300

4、What's at address "0x08048300", that is, starting address?

i4@i4:~/文档/tempfile$ objdump -d execute_main

The output is a little bit long so I'll not paste all the output from objdump. Our intention is see what's at address 0x08048300. Here is the output.

Disassembly of section .text:

08048300 <_start>:
 8048300:	31 ed                	xor    %ebp,%ebp
 8048302:	5e                   	pop    %esi
 8048303:	89 e1                	mov    %esp,%ecx
 8048305:	83 e4 f0             	and    $0xfffffff0,%esp
 8048308:	50                   	push   %eax
 8048309:	54                   	push   %esp
 804830a:	52                   	push   %edx
 804830b:	68 30 84 04 08       	push   $0x8048430
 8048310:	68 c0 83 04 08       	push   $0x80483c0
 8048315:	51                   	push   %ecx
 8048316:	56                   	push   %esi
 8048317:	68 b4 83 04 08       	push   $0x80483b4
 804831c:	e8 cf ff ff ff       	call   80482f0 <__libc_start_main@plt>
 8048321:	f4                   	hlt    

Looks like some kind of starting routine called "_start" is at the starting address. What it does is clear a register, push some values into stack and call a function. According to this instruction, the stack frame should look like this. ---------------- %eax ---------------- %esp ---------------- %edx ---------------- 0x8048430 ---------------- 0x80483c0 ---------------- %ecx ---------------- %esi ---------------- Stack Top 0x80483b4 ---------------- Now, as you already wonder,we've got a few questions regarding this stack frame. Q1: What are those hex values about? Q2: What's at address 80482f0, which is called by _start? (PS: 即上面反汇编代码中804831c: e8 cf ff ff ff call 80482f0 <__libc_start_main@plt>) Q3: Looks like the assembly instructions doesn't initialize any register with possibly meaningful values. Then who initializes the registers? (PS: 个人认为这个很重要，后面有较多篇幅来描述) A1: The hexa values. If you look at disassembled output from objdump carefully, you can answer this question easily.再把反汇编代码摘出来，然后给出答案：

08048430 <__libc_csu_fini>: ......
080483c0 <__libc_csu_init>: ......
080483b4 <main>: ......

Right now, let's not care about these stuffs. And basically, all those hexa values are function pointers. A2: What's at address 80482f0?

080482f0 <__libc_start_main@plt>:
 80482f0:	ff 25 04 a0 04 08    	jmp    *0x804a004
......

Here *0x804a004 is a pointer operation. It just jumps to an address stored at address 0x804a004.那么这里地址0x804a004处是什么呢？我们看下面代码(PS: 原文这里又说了说关于动态链接的内容，这些内容在书第7章已经讲了，我这里不再陈述。大家跟着看下代码就明白了。)

i4@i4:~/文档/tempfile$ objdump -R execute_main

execute_main:     file format elf32-i386

DYNAMIC RELOCATION RECORDS
OFFSET   TYPE              VALUE 
08049ff0 R_386_GLOB_DAT    __gmon_start__
0804a000 R_386_JUMP_SLOT   __gmon_start__
0804a004 R_386_JUMP_SLOT   __libc_start_main

看到没，上面0x804a004其实是__libc_start_main函数的地址，是动态链接里面动态重定位里的一种类型。即，其实我们是想调用__libc_start_main函数。 5、What's __libc_start_main? Now the ball is on libc's hand. __libc_start_main is a function in libc.so.6. If you look for __libc_start_main in glibc source code, the prototype looks like this.

int __libc_start_main(
                  int (*main) (int, char * *, char * *), 
                  int argc, 
                  char * * ubp_av, 
                  void (*init) (void), 
                  void (*fini) (void), 
                  void (*rtld_fini) (void), 
                  void (* stack_end)
);

总结： 到此我们知道： all the assembly instructions do is set up argument stack and call _libc_start_main. What this function does is setup/initialize some data structures/environments and call our main(). Let's look at the stack frame with this function prototype. ---------------- %eax this is 0 ---------------- %esp stack_end ---------------- %edx _rtlf_fini ---------------- 0x8048430 _libc_csu_fini ---------------- 0x80483c0 _libc_csu_init ---------------- %ecx argv ---------------- %esi argc ---------------- Stack Top 0x80483b4 main ---------------- According to this stack frame, esi, ecx, edx, esp, eax registers should be filled with appropriate values before __libc_start_main() is executed. And clearly this registers are not set by the startup assembly instructions shown before. Then, who sets these registers? Now I guess the only thing left. The kernel. Now let's go back to our third question. A3: What does the kernel do? When we execute a program by entering a name on shell, this is what happens on Linux.(PS: 下面的描述太长，其实描述的也就是书里第6章“6.5 Linux内核装载ELF过程简介”的内容。我在这段英文后面给出大概的执行流程) 1: The shell calls the kernel system call "execve" with argc/argv. The kernel system call handler gets control and start handling the system call. In kernel code, the handler is "sys_execve". On x86, the user-mode application passes all required parameters to kernel with the following registers. %ebx : pointer to program name string %ecx : argv array pointer %edx : environment variable array pointer. 2: The generic execve kernel system call handler, which is do_execve, is called. What it does is set up a data structure and copy some data from user space to kernel space and finally calls search_binary_handler(). Linux can support more than one executable file format such as a.out and ELF at the same time. For this functionality, there is a data structure "struct linux_binfmt", which has a function pointer for each binary format loader. And search_binary_handler() just looks up an appropriate handler and calls it. In our case, load_elf_binary() is the handler. To explain each detail of the function would be lengthy/boring work. So I'll not do that. If you are interested in it, read a book about it. As a picture tells a thousand words, a thousand lines of source code tells ten thousand words (sometimes). Here is the bottom line of the function. It first sets up kernel data structures for file operation to read the ELF executable image in. Then it sets up a kernel data structure: code size, data segment start, stack segment start, etc. And it allocates user mode pages for this process and copies the argv and environment variables to those allocated page addresses. Finally, argc, the argv pointer, and the envrioronment variable array pointer are pushed to user mode stack by create_elf_tables(), and start_thread() starts the process execution rolling. 这两段描述的大概流程是：shell ---> execve (同时传递argc, argv) ---> sys_execve (用户模式下的一些内容传递给内核模式里的一些寄存器，即%ebx, %ecx, %edx。这三个的具体内容上面1:里有) ---> search_binary_handler() ---> load_elf_binary()。最后这个load_elf_binary()设置了不少内容，设置完之后就是返回到用户模式下运行e_entry的入口函数。 在入口函数_start()执行之前，栈的内容如下： ---------------- env pointer ---------------- argv pointer ---------------- Stack Top argc ---------------- And the assembly instructions gets all information from stack by

pop %esi 		<--- get argc
mov %esp, %ecx		<--- get argv (actually the argv address is the same as the current stack pointer.)

And now we are all set to start executing. 6、What about the other registers? For %esp, this is used for stack end in application program. After popping all necessary information, the _start rountine simply adjusts the stack pointer (%esp) by turning off lower 4 bits from esp register. This perfectly makes sense since actually, to our main program, that is the end of stack. For edx, which is used for rtld_fini, a kind of application destructor, the kernel just sets it to 0 with the following macro. #define ELF_PLAT_INIT(_r) do { \ _r->ebx = 0; _r->ecx = 0; _r->edx = 0; \ _r->esi = 0; _r->edi = 0; _r->ebp = 0; \ _r->eax = 0; \ } while (0) The 0 means we don't use that functionality on x86 linux. 7、Summing up Here is what happens. 1: GCC build your program with crtbegin.o/crtend.o/gcrt1.o And the other default libraries are dynamically linked by default. Starting address of the executable is set to that of _start. 2: Kernel loads the executable and setup text/data/bss/stack, especially, kernel allocate page(s) for arguments and environment variables and pushes all necessary information on stack. 3: Control is pased to _start. _start gets all information from stack setup by kernel, sets up argument stack for __libc_start_main, and calls it. 4: __libc_start_main initializes necessary stuffs, especially C library(such as malloc) and thread environment and calls our main. 5: our main is called with main(argv, argv) Actually, here one interesting point is the signature of main. __libc_start_main thinks main's signature as main(int, char **, char **) If you are curious, try the following prgram.

main(int argc, char** argv, char** env)
{
    int i = 0;
    while(env[i] != 0)
    {
       printf("%s\n", env[i++]);
    }
    return(0);
}

8、Conclusion On Linux, our C main() function is executed by the cooperative work of GCC, libc and Linux's binary loader. 9、Reference [1] http://linuxgazette.net/issue84/hawk.html [2] http://www.fsl.cs.sunysb.edu/~siddhi/ELF.pdf

有必要补充一下，x86_64架构（这个更重要）、gcc7.5.0下的反汇编结果和书中MSVC9的有些不一样，有一些不能说是细节就一笔带过的差异。

反汇编调用return_test()的部分：

100000f5c: 48 83 c4 80 addq $-128, %rsp

100000f60: 48 8d 45 80 leaq -128(%rbp), %rax

100000f64: 48 89 c7 movq %rax, %rdi

100000f67: b8 00 00 00 00 movl $0, %eax

100000f6c: e8 45 ff ff ff callq -187 <_return_test>

100000f71: b8 00 00 00 00 movl $0, %eax

100000f76: c9 leave

100000f77: c3 retq

可以看到，调用return_test()函数后除了将寄存器eax的值置0，就直接退出了函数，并没有额外拷贝字节。这里也并没有把寄存器rax存储的地址压入栈中，而是把栈里的地址也就是-128(%rbp)传给了rdi（rdi里的值在这里作为隐含的形参）。

这一句并不严谨，需要依赖库的C源代码也可以没有main函数。

在x86_64-apple-darwin19.2.0的环境下、用gcc 7.5.0编译器做个实验（注：测试环境已经更改过，这里gcc调用的是真正的gcc而不是mac默认的clang）。 首先写一个入口函数为func的print_num.c：

#include <stdio.h>

int func() {

printf("%s\n", "Hello world!");

return 0;

}

执行gcc hello1.c -e _func，在链接时指定自定义程序入口，一样可以正常得到可执行文件。

再用objdump -d print_num查看.text段：

Disassembly of section __TEXT,__text:

0000000100000f5d _func:

...

段内只有_func函数，说明使用了库的函数也可以不需要main函数。