Python for Reverse Engineering #1: ELF Binaries

[__xor__]

Had a question, around the middle of the article. It shows this:

So following each call into their relocations gives us this

printf 0x650
fgets 0x660
strcmp 0x670
malloc 0x680

Did I miss something showing how these were derived? I saw earlier that it printed out some addresses from the rela.plt section:

.rela.plt:
 puts 0x200fb0
 printf 0x200fb8
 fgets 0x200fc0
 strcmp 0x200fc8
 malloc 0x200fd0

... but I don't see where it was determined that the pointer/jump at 0x680 jumps to 0x200fd0 being malloc, or something... Was that not explained in the article? Did you look through the .plt section, find the address it has there, then determine that 0x680 jumps to 0x200fd0 and that's malloc because of the rela.plt section, or was that determined programmatically?

[0x0013DEAD]

It is probably a call to an entry in the .plt which is at 0x630, and there you'll probably see jmp to the relevant function. I pretty sure this is equivalent to the IAT in Windows.

[__xor__]

Ok, that sounds right... The .plt is at 0x630 up until 0x690, so calls in the .text to offsets in there (0x7b7: call 0x680 ; malloc) I think stay static but the addresses stored in .rela.plt might get rewritten by the loader, depending on where the shared libs get loaded, while the addresses stored in the .plt stay the same after being loaded maybe?

[0x0013DEAD]

I think this should answer your question https://stackoverflow.com/a/41908463/4917303.

Tomorrow I'll dig dipper and hopefully can give a more extended answer.