4

I'm not sure, whether the dynamic linker /usr/bin/ld is automatically invoked by the operating system, when the ELF file is loaded, or whether it's invoked by code embedded in the ELF file?

When I use r2 to debug an ELF file, it stops at first instruction to be executed, which should be dynamic linker code, but I don't know if this code is part of the ELF file.

Shuzheng
  • 4,023
  • 1
  • 31
  • 71

1 Answers1

5

The kernel loads the dynamic loader (which isn’t /usr/bin/ld; see what are the executable ELF files respectively for static linker, dynamic linker, loader and dynamic loader?).

When you run an ELF binary, the kernel uses its specific ELF binary loader; for dynamically-linked binaries, this looks for the interpreter specified in the ELF headers, loads that and instructs it to run the target binary. The interpreter is the dynamic loader, which loads any required libraries, resolves the undefined symbols, and jumps to the programs start address. (See What types of executable files exist on Linux? for details of the binary loads in the kernel.)

LWN has an article which goes into the details, How programs get run: ELF binaries.

Stephen Kitt
  • 411,918
  • 54
  • 1,065
  • 1,164
  • I meant if the "specific ELF binary loader" that looks for the "interpreter specified in the ELF headers" is the same as the loader that loads an ELF binary without dynamic linking? – Shuzheng Sep 06 '19 at 12:25
  • Yes, it’s the same, [`binfmt_elf.c`](https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/fs/binfmt_elf.c). – Stephen Kitt Sep 06 '19 at 12:41
  • @Shuzheng no, whatever _interpreter_ in specified as a (possible relative!) path in the elf headers will be loaded in the address space of the process, and when returning to the user mode, the control will be passed to the entry point of the interpreter, which from that point on could do _whatever it likes_, including not running any code from the original binary at all. –  Sep 06 '19 at 14:01