got/plt之_dl_runtime_resolve

/* 
Structure describing a loaded shared object. 
The `l_next' and `l_prev' members form a chain of all the shared objects loaded at startup. 
These data structures exist in space used by the run-time dynamic linker; modifying them may have disastrous results. 
*/

struct link_map
  {
    /* These first few members are part of the protocol with the debugger. This is the same format used in SVR4. */

    ElfW(Addr) l_addr;          /* Difference between the address in the ELF file and the addresses in memory. */
    char *l_name;               /* Absolute file name object was found in. */
    ElfW(Dyn) *l_ld;            /* Dynamic section of the shared object. */
    struct link_map *l_next, *l_prev; /* Chain of loaded objects. */
  };

_dl_runtime_resolve:
        cfi_adjust_cfa_offset (8)
        pushl %eax                # Preserve registers otherwise clobbered.
        cfi_adjust_cfa_offset (4)
        pushl %ecx
        cfi_adjust_cfa_offset (4)
        pushl %edx
        cfi_adjust_cfa_offset (4)
        movl 16(%esp), %edx        # Copy args pushed by PLT in register.  Note
        movl 12(%esp), %eax        # that `fixup' takes its parameters in regs.
        call _dl_fixup                # Call resolver.
        popl %edx                # Get register content back.
        cfi_adjust_cfa_offset (-4)
        movl (%esp), %ecx
        movl %eax, (%esp)        # Store the function address.
        movl 4(%esp), %eax
        ret $12                        # Jump to function address.

// 函数声明，reloc_arg其实是我们 push 进来的 0x0
_dl_fixup (struct link_map *l, ElfW(Word) reloc_arg)
｛
	// 得到 symtab 符号表
	const ElfW(Sym) *const symtab = (const void *) D_PTR (l, l_info[DT_SYMTAB]);
    // 取出 offset 在.rel.plt表中的Elf32_Rel数据结构
    // DT_JMPREL 就是 JMPREL .rel.plt 的起始地址
    // 以 read 为例，那么 reloc->r_offset = 0x0804a00c， reloc->r_info = 0x107
    const PLTREL *const reloc = (const void *) (D_PTR (l, l_info[DT_JMPREL]) + reloc_arg);
    
    const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];

	// ELF_MACHINE_JMP_SLOT == R_386_JUMP_SLOT这是一种寻址方式，表示被修正的位置只需要填入符号的地址即可。
    assert (ELFW(R_TYPE)(reloc->r_info) == ELF_MACHINE_JMP_SLOT);
    // 下面单独解释
    result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,version, ELF_RTYPE_CLASS_PLT, flags, NULL);
    // 下面单独解释
    value = DL_FIXUP_MAKE_VALUE (result, sym ? (LOOKUP_VALUE_ADDRESS (result) + sym->st_value) : 0);
    
    //将已经解析完的函数地址写入相应的GOT表中
    return elf_machine_fixup_plt (l, result, reloc, rel_addr, value);
｝

const ElfW(Sym) *sym = &symtab[ELFW(R_SYM) (reloc->r_info)];

typedef struct
{
  Elf32_Word    st_name;                /* Symbol name (string tbl index) */
  Elf32_Addr    st_value;               /* Symbol value */
  Elf32_Word    st_size;                /* Symbol size */
  unsigned char st_other;               /* Symbol visibility */
  Elf32_Section st_shndx;               /* Section index */
} Elf32_Sym;

/* Search loaded objects' symbol tables for a definition of the symbol
   UNDEF_NAME, perhaps with a requested version for the symbol.*/
result = _dl_lookup_symbol_x (strtab + sym->st_name, l, &sym, l->l_scope,version, ELF_RTYPE_CLASS_PLT, flags, NULL);

// 将要解析的函数的偏移地址加上libc基址，就可以获取函数的实际地址
value = DL_FIXUP_MAKE_VALUE (result, sym ? (LOOKUP_VALUE_ADDRESS (result) + sym->st_value) : 0);