When linux execve() an ELF, it will mmap that ELF into the process's memory space and start to run code from the entry point. But how does the kernel decide the load address and entry point of the ELF?

If ASLR is disabled, it looks up the .p_vaddr of each PT_LOAD segment and use .e_entry of ELF header as entry point.

But what if ASLR is enabled? Will the kernel simply add an random shift to all the aboves but keeps their relative position?

Will the content of ELF affect kernel's behavior? Like if the least .p_vaddr of PT_LOAD segment is zero or non-zero? Like the .e_type of ELF header is ET_DYN or ET_EXEC?

I'm talking about x86_64, especially.

  • Very interesting question, I'd like to learn about this as well Jun 4, 2019 at 2:16


You must log in to answer this question.

Browse other questions tagged .