Skip to content

Commit

Permalink
Add some documentation, some raionale.
Browse files Browse the repository at this point in the history
  • Loading branch information
bediger4000 committed Jan 14, 2017
1 parent 919d9ea commit 5c4520a
Showing 1 changed file with 31 additions and 2 deletions.
33 changes: 31 additions & 2 deletions README.md
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
# userlandexec
# userlandexec-arm
## userland exec for Linux ARMv7

This code emulates an `exec()` system call. That is, it reads an ELF format file,
Expand All @@ -10,8 +10,16 @@ For starters, the userland exec unmaps the currently-executing ELF file,
so as to be able to put the new ELF file's contents in the right place
in memory.

I was inspired to do this by The Grugq. I did start with his [userland exec](https://github.com/grugq/grugq.github.com/blob/master/docs/ul_exec.txt) to do the x86_64 version.

This code works with 32-bit Rasberry Pi 2 Linux ELF files, compiled with
GCC and linked against glibc.
GCC and linked against glibc. Specifically, I used Rasberry Pi Arch Linux,
kernel 4.4.41, GCC 6.2.1, GNU binutils 2.27.

I started out with my own [userland exec for x86_64](https://github.com/bediger4000/userlandexec),
v1.0 and modified for ARM. I found it easier to do assembly language `crt.o` and system calls
in ARM assembly, rather than do the `asm()` GCC directives I used for x86_64 `userlandexec`.
A better programmer than I could have just interwoven ARM and x86_64 into the same project.

### Building

Expand All @@ -30,6 +38,27 @@ Show the ELF auxiliary vectors:
The first program uses glibc extension `getauxval(3)`, and has the dynamic linker
dump out the auxiliary vectors, for your inspection.

This project has a corresponding completely statically-linked program, `elfauxv`. It's easier
to do a userland exec for statically linked programs.

Try out `open(2)`, setting `errno` and `close(2)`:

$ make oc
$ ./oc somegibberish

It's easy to get `open(2)` to fail in a variety of ways by trying to open non-existent
files, removing read permissions, etc. The actual userland exec code has to be position
independent, so setting `errno` in ARM assembly became harder.

Find the environment variables:

$ make env_test
$ ./env_test

The userland exec creates copies of `argv` and `envp`. This just prints addresses
and environment variables to ensure that the "C run time" code in `libstatic/crt.s`
does `argc`, `argv` and `envp` correctly.

### Fun

`./example ./ulexec.so `./example ./ulexec.so `./example ./ulexec.so /usr/bin/cat /proc/self/maps`
Expand Down

0 comments on commit 5c4520a

Please sign in to comment.