The document discusses linkers and loaders, describing their functions in combining object files into executable files. It covers the ELF format, static vs dynamic linking, and how executable files are run using static or dynamic linkers. Key points include how static linkers resolve symbols and perform relocation, while dynamic linkers use shared libraries and handle relocation at runtime via the dynamic linker.

1. 1
Linker and Loader

2. 2
Agenda
• What is Linker and Loader
• ELF Format
• Static Linker vs Dynamic Linker
• Run An Executable File
• Backup

3. 3
What is Linker and Loader
A programming tool which
combines one or more
partial Object Files and libraries
into a (more) complete
executable object file.

4. 4
Compile Process

5. 5
ELF – Three Types

6. 6
ELF – Format

7. 7
ELF – Two Views

8. 8
ELF – Two Views

9. 9
ELF - Sections

10. 10
• Allocator Space
• Resolve symbols
• Relocation symbols
• Create sections
Static Linker
Using ld in binutils
Printf.o
Strlen.o
Rand.o
foo.o
foo2.o
foo3.o
Static
Linker
Main.o
Main.o
Printf.o
Foo.o
Test executable
file
Run
process
Main.o
Printf.o
Foo.o
Test executable
file

11. 11
Static Linker - Allocator Space

12. 12
Static Linker – Resolve symbols
Scans input relocatable files from left to right as
on command line
• Maintains Set E of object files req to form
executable.
Set U of unresolved symbols
Set D of symbols defined in prev files.
• Update E,U and D while scanning input
relocatable files
• U must be empty at the end – contents of E used
to form executable

13. 13
Static Linker - Relocation
A process of assigning
load addresses to
various parts of a
program and adjusting
the code and data in the
program to reflect the
assigned addresses

14. 14
Static Linker – Relocation
.rel .text .symtab .strtab
Find and iterate .rel sections.
Every entry includes of
Typedef struct {
Elf32_Addr r_offset;
Elf32_Word r_info;
} Elf32_Rel
Find the address in .text
section by r_offset
Find the symbol index
in .symbol section by
r_info
Find the symbol type by
r_info
Got information about
the responding symbol
in .symbol sectioin
Compute the latest
address by symbol type
1
2
3
4
5
6

15. 15
Static Linker – Linker script
Be passed to GNU ld to exercise greater control over the
linking process

16. 16
ld –static crt1.o crti.o crtbeginT.o XXX.o –start-
group –lgcc –lgcc_eh –lc-end-group crtend.o crtn.o
Static Linker –Init/Finit Sections
Object Definition Owner Runtime
Crt1.o _start Glibc C、C++
Crti.o .init and .finit section Glibc C
Crtn.o .init and .finit section Glibc C
crtbeginT.o .init_array and .finit_array
section
Gcc C++
Crtend.o .init_array and .finit_array
section
Gcc C++

17. 17
Static Linker –Init/Finit Sections
Crti.o
.init
.finit
a.o
.init
.finit
b.o
.init
.finit
Crtn.o
.init
.finit
A.out
.init
.finit
Linker
Contain the code
of beginning for
init function
Contain the code
of beginning for
finit function
Contain the code
of end for init
function
Contain code of to
init global variable
Contain code of to
de-init global
variable
Contain the code
of end for finit
function
Init function
FInit function

18. 18
Static Linker –Init_array/Finit_array Sections
CRTBeginT.o
.init_array
.finit_array
a.o
.init_array
.finit_array
b.o(b.cpp)
.init_array
.finit_array
CrtEnd.o
.init_array
.finit_array
A.out
.init_array
.finit_array
Linker
Contain the code
of beginning for
init_array function
Contain the code
of beginning for
finit_array
function
Contain the code
of end for
init_array function
Contain pointer to
point global
constructor
Contain the code
of end for
finit_array
function
Pointer table
.text
Global constructor
Global de-
constructor
Contain pointer to
point global de-
constructor
pointer1
pointer2
pointer3
Number
Collect all pointers
who point global
constructor into
an array

19. 19
Dynamic Linker
Printf.o
Strlen.o
Rand.o
Libc.so
foo.o
foo2.o
foo3.o
Libtest.so
Dynamic
Linker
Main.o
Main.o
Require
so
Test executable
file
Main.o
Require
so
Test executable file
Printf.o
Strlen.o
Rand.o
Libc.so
foo.o
foo2.o
foo3.o
Libtest.so
Run
process

20. 20
Dynamic Linker - PIC
Position-independent
code (PIC) or position-
independent executable
(PIE) is a body of machine
code that, being placed
somewhere in the primary
memory,
Compile option: -fpic
Code section can be un-
modified when load into
memory so that it can be
shared in different process

21. 21
Dynamic Linker - PLT
Stands for Procedure Linkage Table which is, put
simply, used to call external procedures/functions
whose address isn't known in the time of linking, and
is left to be resolved by the dynamic linker at run
time.
First Call Second Call

22. 22
Dynamic Linker - PIE
Compile option: -fpie

23. 23
• Implicit
Referred to as static load or load-time dynamic
linking.
• Explicit
Referred to as dynamic load or run-time
dynamic linking.
 Dlopen
 Dlsym
 Dlclose
Dynamic Linker – Two Mode

24. 24
Dynamic Linker vs Static Linker
Dynamic Static
Memory usage Small Bigger
Storage usage Small Bigger
Performance Low (But with PLT, 5%
down)
Update easy Hard
Compatibility Hard No

25. 25
• Implicit
Prelink

26. 26
Run Executable File – Static Linker
• Fork
• Exec
• Kernel load executable file
• Run from the start entry of
executable
Run a executable file
Load and Map
executable file
（load_elf_bina
ry)
Do_execve
system call
Kernel
Read header of
executable file
Read other
headers of
executable file
NO
User space
__libc_init
Do_execve system call
finished
Return address is set to
entry of executable file
Fork process
New Process
If .interp is existing, read
the
ld.so(system/bin/linker)
Run the
executable file
from entry
point(_start)
main
exit
Running and quit
Init main
thread
Init globals
system_pro
perties_init
Call
preinit_arra
y and
init_array
Set
__cxa_atexi
t

27. 27
Run Executable File – Dynamic Linker
• Fork
• Exec
• Kernel load executable file
• Kernel load ld.so
• Ld.so load the dependent so
• Relocation
• Run from the start entry of
executable
Run a executable file
who relies on other so
Load and Map
executable file
（load_elf_bina
ry)
Do_execve
system call
Kernel
Read header of
exe file
Got the path for
linker and map
it to get entry
point
Yes
User space
main
Return address is set to
entry of linker
Fork process
New Process
If .interp is existing, read the
ld.so(system/bin/linker)
Run the
executable file
from entry
point(_start)
exit
Running and quit
Do_execve system call
finished
_start ->
__linker_init t
Init main
thread
Init globals
call_constr
uctors(DT_I
NIT
DT_INIT_AR
RAY)
__libc_pr
einit
__libc_ini
t
prelink_ima
ge and
link_image
for linker
__linker_init_po
st_relocation
debuggerd
_init
Init globals
init_default
_namespac
e
__system_
properties_
init
Load
needed .So
one by one

28. 28
Process Memory Map

29. 29
Backup

30. 30
• Gcc drivers the compile process.
• Glibc provide runtime/libc/libm/libthread …
• Binutils provides as/ar/ld
Relation Between Gcc, Glibc and Binutils

31. 31
• GPL License
• 400K
• BinUtils
• Gcc
• Glibc
• Multi-thread
• LD(BinUtils)
• Loader
• System Call
Glibc vs Android Bionic
• APACHE License
• 200 K
• Ld
• Linker
• pThread
• System Call

32. 32
• Linker
Ld under Linux
• Loader
/system/bin/linker
Linker and Loader in Android

33. 33
Android Java loader
System.loadlibrary
Runtime.loadlibrary
Runtime.doLoad
JVM_NativeLoad
LoadNativeLibrary
dlopen
nativeLoad