ELF Loading & Process Image

exec is the system call that turns a file on disk into a running program. The kernel must read the file, decide whether it is something it can run, and build an address space from it, without trusting a single byte, because the file is attacker-supplied. In this lesson your program is the validation and planning half of Linux's ELF loader: given the bytes of an ELF64 executable, it checks the header and the program headers and reports the memory image the kernel would build.

The ELF header

An ELF file starts with a fixed 64-byte header (little-endian on x86-64):

The first bytes of a real binary read 7f 45 4c 46 02 01 01 00 ...: magic, 64-bit, little-endian, version 1.

Program headers: what to map

The loader ignores sections (those are for linkers and debuggers) and walks the program headers, 56 bytes each:

For each LOAD segment the kernel allocates pages covering p_vaddr to p_vaddr + p_memsz, maps them with permissions from the flags (R-X for code, RW- for data), copies p_filesz bytes from the file, and zero-fills the rest. That tail is the .bss: variables initialised to zero take no space on disk, only p_memsz - p_filesz bytes in memory. Flags map directly to page-table bits: a segment without W is a read-only page, one without X gets NX. Security-conscious loaders refuse W+X.

What can be wrong

A loader must check each of these before using the file:

• p_filesz larger than p_memsz, or p_offset + p_filesz past the end of the file (it would read garbage or beyond the buffer);
• alignment: p_vaddr and p_offset must agree modulo p_align, because the kernel maps whole file pages at whole memory pages;
• the segment lies in user space: it must not reach kernel addresses, and p_vaddr + p_memsz must not wrap around 64 bits;
• segments must not overlap in pages;
• the entry point must lie in an executable segment.

Interpreters and the stack

A dynamically linked program has a PT_INTERP segment holding a path such as /lib64/ld-linux-x86-64.so.2: the kernel loads that interpreter too and starts it, and it loads the shared libraries. PT_GNU_STACK states whether the stack may be executable (it should not be). After mapping, exec builds the user stack with argc, argv and envp, sets the stack pointer and jumps to the entry point in ring 3.

Your exercise

The starter turns the hex input into bytes and prints your report. You write the analysis: the header checks, the program header walk, the segment checks and the page count.