ElfW(Dyn) *fini_array = map->l_info[DT_FINI_ARRAY];if (fini_array !=NULL){ElfW(Addr)*array = (ElfW(Addr)*) (map->l_addr +fini_array->d_un.d_ptr);size_t sz = (map->l_info[DT_FINI_ARRAYSZ]->d_un.d_val /sizeof (ElfW(Addr)));while (sz-->0)((fini_t) array[sz]) ();}[...]// This is the d_un structureptype l->l_info[DT_FINI_ARRAY]->d_untype =union {Elf64_Xword d_val; // address of function that will be called, we put our onegadget hereElf64_Addr d_ptr; // offset from l->l_addr of our structure}
/* Call all functions registered with `atexit' and `on_exit',in the reverse of the order in which they were registeredperform stdio cleanup, and terminate program execution with STATUS. */voidattribute_hidden__run_exit_handlers (int status,struct exit_function_list **listp,bool run_list_atexit,bool run_dtors){/* First, call the TLS destructors. */#ifndefSHAREDif (&__call_tls_dtors !=NULL)#endifif (run_dtors)__call_tls_dtors ();
__call_tls_dtors() のコード:
typedefvoid (*dtor_func) (void*);struct dtor_list //struct added{dtor_func func;void*obj;struct link_map *map;struct dtor_list *next;};[...]/* Call the destructors. This is called either when a thread returns from theinitial function or when the process exits via the exit function. */void__call_tls_dtors (void){while (tls_dtor_list) // parse the dtor_list chained structures{struct dtor_list *cur = tls_dtor_list; // cur point to tls-storage dtor_listdtor_func func =cur->func;PTR_DEMANGLE (func); // demangle the function ptrtls_dtor_list =tls_dtor_list->next; // next dtor_list structurefunc (cur->obj);[...]}}
while (true){struct exit_function_list *cur;restart:cur =*listp;if (cur ==NULL){/* Exit processing complete. We will not allow any moreatexit/on_exit registrations. */__exit_funcs_done =true;break;}while (cur->idx >0){struct exit_function *const f =&cur->fns[--cur->idx];constuint64_t new_exitfn_called = __new_exitfn_called;switch (f->flavor){void (*atfct) (void);void (*onfct) (int status,void*arg);void (*cxafct) (void*arg,int status);void*arg;case ef_free:case ef_us:break;case ef_on:onfct =f->func.on.fn;arg =f->func.on.arg;PTR_DEMANGLE (onfct);/* Unlock the list while we call a foreign function. */__libc_lock_unlock (__exit_funcs_lock);onfct (status, arg);__libc_lock_lock (__exit_funcs_lock);break;case ef_at:atfct =f->func.at;PTR_DEMANGLE (atfct);/* Unlock the list while we call a foreign function. */__libc_lock_unlock (__exit_funcs_lock);atfct ();__libc_lock_lock (__exit_funcs_lock);break;case ef_cxa:/* To avoid dlclose/exit race calling cxafct twice (BZ 22180),we must mark this function as ef_free. */f->flavor = ef_free;cxafct =f->func.cxa.fn;arg =f->func.cxa.arg;PTR_DEMANGLE (cxafct);/* Unlock the list while we call a foreign function. */__libc_lock_unlock (__exit_funcs_lock);cxafct (arg, status);__libc_lock_lock (__exit_funcs_lock);break;}if (__glibc_unlikely (new_exitfn_called != __new_exitfn_called))/* The last exit function, or another thread, has registeredmore exit functions. Start the loop over. */goto restart;}*listp =cur->next;if (*listp !=NULL)/* Don't free the last element in the chain, this is the staticallyallocate element. */free (cur);}__libc_lock_unlock (__exit_funcs_lock);
変数 f は initial 構造体を指しており、f->flavor の値に応じて異なる関数が呼び出されます。
値に応じて、呼び出す関数のアドレスは異なる場所にありますが、常に demangled されています。
さらに、オプション ef_on と ef_cxa では 引数 を制御することも可能です。
デバッグセッションで GEF を実行して gef> p initial で initial 構造体 を確認することができます。
