Skip to content

Commit

Permalink
Remove "How does ifunc work" for now
Browse files Browse the repository at this point in the history
  • Loading branch information
robertdfrench committed Jul 22, 2024
1 parent d29d480 commit 6d517fa
Showing 1 changed file with 1 addition and 42 deletions.
43 changes: 1 addition & 42 deletions README.md
Original file line number Diff line number Diff line change
Expand Up @@ -255,7 +255,7 @@ necessarily knowing where all of their symbols are ahead of time.


#### Partial RELRO
![](memes/boromor_got.png)
![](memes/boromir_got.png)

Updating the GOT at runtime means that the memory page containing the
GOT must always be writable. This isn't ideal from a security
Expand Down Expand Up @@ -408,47 +408,6 @@ fi



## How does IFUNC work?
IFUNC allows you to write functions that act sortof like plugins for the
dynamic loader [`ld.so`][kerrisk]. When your program is being loaded
into memory, every dynamic symbol (function or variable) needs to be
resolved to some *real* function in a dynamic library.

In the simplest case, the

### A Primer on Dynamic Loading

There are three things at play here:
* PLT
* GOT
* RELRO

![](memes/boromir_plt.png)

The PLT and the GOT enable lazy binding. That is what they are *for*.
Check out jasoncc's [GNU Indirect Function and x86 ELF ABIs][jasoncc]
for more on this.

To prevent code pages from needing to be modified at runtime, the PLT
jumps to addresses listed in the GOT, which resides in a data page.

[Partial RELRO][sidhpurwala] means that the GOT is marked read-only
after symbols are resolved, before `main` begins. It effectively
disables lazy binding, forcing all function resolution to occur at
program startup.

A lot of discussion of IFUNC will say things like "This updates the
PLT". That isn't true. The PLT is read-only. What is updated is the GOT,
and the PLT merely references entries in the GOT.

Another common bit of misinformation is that people will say IFUNC
resolvers run when the function is first invoked. This *could* be the
case, but because Partial RELRO is the default these days, it usually
isn't. If the executable specifies that it wants Partial RELRO, then all
of its indirect functions are resolved before `main`.




## IFUNC is Probably a Bad Idea
![](memes/ifunc_change_my_mind.png)
Expand Down

0 comments on commit 6d517fa

Please sign in to comment.