#define PREV_INUSE 0x1
#define IS_MMAPPED 0x2 
#define NON_MAIN_ARENA 0x4

struct malloc_state
{
  __libc_lock_define (, mutex);   /* 并发锁用于多线程顺序访问..  */
  int flags; /* Flags (formerly in max_fast).  */

  /* Set if the fastbin chunks contain recently inserted free blocks.  */
  /* Note this is a bool but not all targets support atomics on booleans.  */
  int have_fastchunks;

  mfastbinptr fastbinsY[NFASTBINS];  /* Fastbins */
  mchunkptr top; /* Base of the topmost chunk -- not otherwise kept in a bin */
  mchunkptr last_remainder;  /* The remainder from the most recent split of a small request */
  mchunkptr bins[NBINS * 2 - 2];  /* Normal bins packed as described above */
  unsigned int binmap[BINMAPSIZE];  /* Bitmap of bins */
  struct malloc_state *next;  /* Linked list */

  /* Linked list for free arenas.  Access to this field is serialized
     by free_list_lock in arena.c.  */
  struct malloc_state *next_free;

  /* Number of threads attached to this arena.  0 if the arena is on
     the free list.  Access to this field is serialized by
     free_list_lock in arena.c.  */
  INTERNAL_SIZE_T attached_threads;

  /* Memory allocated from the system in this arena.  */
  INTERNAL_SIZE_T system_mem;
  INTERNAL_SIZE_T max_system_mem;
};

typedef struct dynamic{
  Elf32_Sword d_tag;  // 类型，如.rel.plt .got .got.plt等
  union{
    Elf32_Sword d_val;  // 根据类型，有不同含义，如STRSZ型此处为.dynstr表的大小
    Elf32_Addr  d_ptr;  // 而STRTAB型为.dynstr的位置
  } d_un;
} Elf32_Dyn;

root@kali:~# objdump -j .plt -d test

Disassembly of section .plt:

000003e0 <.plt>:
 3e0:   ff b3 04 00 00 00       pushl  0x4(%ebx)  # link_map
 3e6:   ff a3 08 00 00 00       jmp    *0x8(%ebx) # _dl_runtime_resolve
 3ec:   00 00                   add    %al,(%eax)
  ...

000003f0 <printf@plt>:
 3f0:   ff a3 0c 00 00 00       jmp    *0xc(%ebx) # got位置
 3f6:   68 00 00 00 00          push   $0x0             # 重定位索引
 3fb:   e9 e0 ff ff ff          jmp    3e0 <.plt> 

00000400 <__libc_start_main@plt>:
 400:   ff a3 10 00 00 00       jmp    *0x10(%ebx)
 406:   68 08 00 00 00          push   $0x8
 40b:   e9 d0 ff ff ff          jmp    3e0 <.plt>

got[0] : .dynamic 
got[1] : link_map , 它是动态链接器加载每个对象会生成一个并链接在一起，含基址等信息
got[2] : _dl_runtime_resolve , 动态链接器的函数，用于查找真实地址
plt[1]->got[3] : 函数1地址
plt[2]->got[4] : 函数2地址
...

typedef struct elf32_rel {
  Elf32_Addr    r_offset;         //地址，其实是在.got.plt表中，解析后会修改它，之后就不必重新解析了
  Elf32_Word    r_info;           //type与index 
} Elf32_Rel;

#define ELF32_R_SYM(i)    ((i)>>8)  // 符号表中的下标
#define ELF32_R_TYPE(i)   ((unsigned char)(i))  // 类型

typedef struct elf32_sym{
  Elf32_Word    st_name;    //在.dynstr中的偏移
  Elf32_Addr    st_value;   //符号值,根据类型不同可能是绝对值，地址什么的
  Elf32_Word    st_size;    //符号大小
  unsigned char st_info;  //28Binding:4Type 绑定指示符号是局部全局弱符号，类型指示符号为对象函数节区文件等
  unsigned char st_other; //符号可见性
  Elf32_Half    st_shndx;   //符号所在段下标，或者是特殊常量，如未定义的引用或者未初始化的全局符号等
} Elf32_Sym;

struct link_map{
    ElfW(Addr) l_addr;    //加载基址
    char *l_name;                   // 文件绝对地址
    ElfW(Dyn) *l_ld;          // .dynamic节，它含上面提到的所有和动态链接相关的节信息
    struct link_map *l_next, *l_prev;   // 链表指针
}

//获取符号表的首地址  
const ElfW(Sym) *const symtab = (const void *) D_PTR (l, l_info[DT_SYMTAB]);    
//获取字符串表的首地址
const char *strtab = (const void *) D_PTR (l, l_info[DT_STRTAB]);               
//该函数在.rel.plt中的地址
const PLTREL *const reloc = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_offset); 
//该函数在符号表中的地址
const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];          
//该函数在.got.plt表中的绝对地址，等下解析出真实地址可修复它
void *const rel_addr = (void *)(l->l_addr + reloc->r_offset);             
//关键部分，此函数是遍历link_map，根据符号名查找符号地址
_dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope, version, ELF_RTYPE_CLASS_PLT, flags, NULL);

(gdb) x/5i 0xffffffffff600000
   0xffffffffff600000:  mov    $0x60,%rax
   0xffffffffff600007:  syscall
   0xffffffffff600009:  retq
   0xffffffffff60000a:  int3
   0xffffffffff60000b:  int3
(gdb) x/5i 0xffffffffff600400
   0xffffffffff600400:  mov    $0xc9,%rax
   0xffffffffff600407:  syscall
   0xffffffffff600409:  retq
   0xffffffffff60040a:  int3
   0xffffffffff60040b:  int3
(gdb) x/5i 0xffffffffff600800
   0xffffffffff600800:  mov    $0x135,%rax
   0xffffffffff600807:  syscall
   0xffffffffff600809:  retq
   0xffffffffff60080a:  int3
   0xffffffffff60080b:  int3
(gdb)

...
local variables of main
saved registers of main
return address of main          ;; main函数返回地址，为libc地址 
argc                                                ;; 参数个数
argv                                                ;; **argv，指向argv数组，见下面，可知栈地址
envp                                                ;; **envp，指向envp数组，见下面
stack from startup code
argc
argv pointers                               ;; *argv数组，直到空指针为结束
NULL that ends argv[]
environment pointers                ;; *envp数组，直到空指针为结束
NULL that ends envp[]
ELF Auxiliary Table         ;; 辅助信息表，它是{key,value}数组，直到空项为结束
argv strings                                ;; 原始的参数字符串
environment strings                 ;; 原始的环境变量字符串
program name                                ;; 进程名称
NULL

➜  ~ LD_SHOW_AUXV=1 ls
AT_SYSINFO:      0x7fffb7dcfc80                     #__kernel_vsyscall  32位
AT_SYSINFO_EHDR: 0x7fffb7dcf000                     #vdso
AT_HWCAP:        1fabfbff                     #arch dependent hints at CPU capabilities
AT_PAGESZ:       4096                         #system page size
AT_CLKTCK:       100                          #frequency at which times() increments
AT_PHDR:         0x55a7f773b040               #program headers for program
AT_PHENT:        56                           #size of program header entry
AT_PHNUM:        9                            #number of program headers
AT_BASE:         0x7f3140848000                     #libcbase
AT_FLAGS:        0x0                          #flags
AT_ENTRY:        0x55a7f7740430               #entry point of program
AT_UID:          0                            #real uid
AT_EUID:         0                            #effective uid
AT_GID:          0                            #real gid
AT_EGID:         0                            #effective gid
AT_SECURE:       0                            #secure mode boolean
AT_RANDOM:       0x7fffb7ca7ee9                     #stackcannry
AT_EXECFN:       /bin/ls                      #filename of program 
AT_PLATFORM:     x86_64

...
leave ret       // leave=mov esp,ebp&&pop ebp 即完成SP=BSS
bss addr        // 新栈的地址
pop ebp ret     // 修改BP为新栈地址
0x1000              
bss addr        // 已知的BSS的地址
0               
pop3ret         // 弹出参数 
read            // read(0,bss,0x10000) 这里先部署新栈，便于迁移后继续ROP

commit_creds(prepare_kernel_cred (0));

static inline int
call_usermodehelper(char *path, char **argv, char **envp, enum umh_wait wait)
{
    struct subprocess_info *info;
    gfp_t gfp_mask = (wait == UMH_NO_WAIT) ? GFP_ATOMIC : GFP_KERNEL;

    info = call_usermodehelper_setup(path, argv, envp, gfp_mask);
    if (info == NULL)
        return -ENOMEM;
    return call_usermodehelper_exec(info, wait);
}

SYSCALL_DEFINE5(prctl, int, option, unsigned long, arg2, unsigned long, arg3, unsigned long, arg4, unsigned long arg5)
{
    error = security_task_prctl(option, arg2, arg3, arg4, arg5);
    ...
}
int security_task_prctl(int option, unsigned long arg2, unsigned long arg3, unsigned long arg4, unsigned long arg5)
{
    struct security_hook_list *hp;
    list_for_each_entry(hp, &security_hook_heads.task_prctl, list) {
        thisrc = hp->hook.task_prctl(option, arg2, arg3, arg4, arg5);
        ...
        }
    }
}

struct security_hook_list {
    struct list_head        list;
    struct list_head        *head;
    union security_list_options hook;
    char                *lsm;
} __randomize_layout;