Locating ELF shared library exports at runtime

2
votes

It is possible to extract exported symbols of a loaded shared library using only its memory image?

I'm talking about the symbols listed in .dynsym section. As I understand, we can go this way:

  1. Locate the base address of the library.
    For example, by reading /proc/<pid>/maps it is possible to find memory areas which are mapped from the library on disk, and then we can look for ELF magic bytes to find the ELF header which gives us the base address.

  2. Find the PT_DYNAMIC segment from the program headers.
    Parse the ELF header, then iterate over the program headers to find the segment which contains the .dynamic section.

  3. Extract the location of the dynamic symbol table.
    Iterate over the ElfN_Dyn structs to find the ones with d_tags DT_STRTAB and DT_SYMTAB. These will give us addresses of the string table (with symbol names) and the dynamic symbol table itself.

And this is where I stumbled. .dynamic section has a tag for the size of the string table (DT_STRSZ), but there is no indication of the symbol table size. It only contains the size of a single entry (DT_SYMENT). How can I retrieve the number of symbol entries in the table?

It should be possible to infer that from the size of the .dynsym section, but ELF files are represented as segments in memory. The section table is not required to be loaded into memory and can only be (reliably) accessed by reading the corresponding file.

I believe it is possible because the dynamic linker has to know the size of the symbol table. However, the dynamic loader may have stored it somewhere when the file had been loaded, and the linker is just using the cached value. Though it seems somewhat stupid to load the symbol table into memory, but to not load a handful of bytes with its size alongside.

1
elfdynamic-linking

1 Answers

3
votes

The size of the dynamic symbol table must be inferred from the symbol hash table (DT_HASH or DT_GNU_HASH): this answer gives some code which does that.

The standard hash table (which is not used on GNU systems anymore) is quite simple. The first entry is nchain which is:

The number of symbol table entries should equal nchain

The GNU hash table is more complicated.