1 /* i386-bsd.elf-main.c -- stub loader for Linux x86 ELF executable
2 
3    This file is part of the UPX executable compressor.
4 
5    Copyright (C) 1996-2020 Markus Franz Xaver Johannes Oberhumer
6    Copyright (C) 1996-2020 Laszlo Molnar
7    Copyright (C) 2000-2020 John F. Reiser
8    All Rights Reserved.
9 
10    UPX and the UCL library are free software; you can redistribute them
11    and/or modify them under the terms of the GNU General Public License as
12    published by the Free Software Foundation; either version 2 of
13    the License, or (at your option) any later version.
14 
15    This program is distributed in the hope that it will be useful,
16    but WITHOUT ANY WARRANTY; without even the implied warranty of
17    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
18    GNU General Public License for more details.
19 
20    You should have received a copy of the GNU General Public License
21    along with this program; see the file COPYING.
22    If not, write to the Free Software Foundation, Inc.,
23    59 Temple Place - Suite 330, Boston, MA 02111-1307, USA.
24 
25    Markus F.X.J. Oberhumer              Laszlo Molnar
26    <markus@oberhumer.com>               <ezerotven+github@gmail.com>
27 
28    John F. Reiser
29    <jreiser@users.sourceforge.net>
30  */
31 
32 
33 #include "include/bsd.h"
34 
35 
36 /*************************************************************************
37 // configuration section
38 **************************************************************************/
39 
40 // In order to make it much easier to move this code at runtime and execute
41 // it at an address different from it load address:  there must be no
42 // static data, and no string constants.
43 
44 #if 1  /*{*/
45 #define DPRINTF(a) /* empty: no debug drivel */
46 #else  /*}{*/
47 #include "stdarg.h"
48 
49 static int
unsimal(unsigned x,char * ptr,int n)50 unsimal(unsigned x, char *ptr, int n)
51 {
52     if (10<=x) {
53         n = unsimal(x/10, ptr, n);
54         x %= 10;
55     }
56     ptr[n] = '0' + x;
57     return 1+ n;
58 }
59 
60 static int
decimal(int x,char * ptr,int n)61 decimal(int x, char *ptr, int n)
62 {
63     if (x < 0) {
64         x = -x;
65         ptr[n++] = '-';
66     }
67     return unsimal(x, ptr, n);
68 }
69 
70 extern char const *STR_hex();
71 
72 static int
heximal(unsigned x,char * ptr,int n)73 heximal(unsigned x, char *ptr, int n)
74 {
75     if (16<=x) {
76         n = heximal(x>>4, ptr, n);
77         x &= 0xf;
78     }
79     ptr[n] = STR_hex()[x];
80     return 1+ n;
81 }
82 
83 
84 #define DPRINTF(a) dprintf a
85 extern char const *STR_0x();
86 extern char const *STR_xread();
87 extern char const *STR_unpackExtent();
88 extern char const *STR_make_hatch_arm();
89 extern char const *STR_auxv_up();
90 extern char const *STR_xfind_pages();
91 extern char const *STR_do_xmap();
92 extern char const *STR_upx_main();
93 
94 static int
dprintf(char const * fmt,...)95 dprintf(char const *fmt, ...)
96 {
97     char c;
98     int n= 0;
99     char *ptr;
100     char buf[20];
101     va_list va; va_start(va, fmt);
102     ptr= &buf[0];
103     while (0!=(c= *fmt++)) if ('%'!=c) goto literal;
104     else switch (c= *fmt++) {
105     default: {
106 literal:
107         n+= write(2, fmt-1, 1);
108     } break;
109     case 0: goto done;  /* early */
110     case 'u': {
111         n+= write(2, buf, unsimal(va_arg(va, unsigned), buf, 0));
112     } break;
113     case 'd': {
114         n+= write(2, buf, decimal(va_arg(va, int), buf, 0));
115     } break;
116     case 'p':  /* same as 'x'; relies on sizeof(int)==sizeof(void *) */
117     case 'x': {
118         buf[0] = '0';
119         buf[1] = 'x';
120         n+= write(2, buf, heximal(va_arg(va, int), buf, 2));
121     } break;
122     }
123 done:
124     va_end(va);
125     return n;
126 }
127 #endif  /*}*/
128 
129 #define MAX_ELF_HDR 512  // Elf32_Ehdr + n*Elf32_Phdr must fit in this
130 
131 
132 /*************************************************************************
133 // "file" util
134 **************************************************************************/
135 
136 struct Extent {
137     size_t size;  // must be first to match size[0] uncompressed size
138     char *buf;
139 };
140 
141 
142 static void
143 #if (ACC_CC_GNUC >= 0x030300) && defined(__i386__)  /*{*/
144 __attribute__((__noinline__, __used__, regparm(3), stdcall))
145 #endif  /*}*/
xread(struct Extent * x,char * buf,size_t count)146 xread(struct Extent *x, char *buf, size_t count)
147 {
148     char *p=x->buf, *q=buf;
149     size_t j;
150     DPRINTF((STR_xread(), x, x->size, x->buf, buf, count));
151     if (x->size < count) {
152         exit(127);
153     }
154     for (j = count; 0!=j--; ++p, ++q) {
155         *q = *p;
156     }
157     x->buf  += count;
158     x->size -= count;
159 }
160 
161 
162 /*************************************************************************
163 // util
164 **************************************************************************/
165 
166 #if 1  //{  save space
167 #define ERR_LAB error: exit(127);
168 #define err_exit(a) goto error
169 #else  //}{  save debugging time
170 #define ERR_LAB /*empty*/
171 static void
172 err_exit(int a) __attribute__ ((__noreturn__));
173 {
174     (void)a;  // debugging convenience
175     exit(127);
176 }
177 #endif  //}
178 
179 static void *
do_brk(void * addr)180 do_brk(void *addr)
181 {
182     return brk(addr);
183 }
184 
185 /*************************************************************************
186 // UPX & NRV stuff
187 **************************************************************************/
188 
189 typedef void f_unfilter(
190     nrv_byte *,  // also addvalue
191     nrv_uint,
192     unsigned cto8, // junk in high 24 bits
193     unsigned ftid
194 );
195 typedef int f_expand(
196     const nrv_byte *, nrv_uint,
197           nrv_byte *, nrv_uint *, unsigned );
198 
199 static void
unpackExtent(struct Extent * const xi,struct Extent * const xo,f_expand * const f_decompress,f_unfilter * f_unf)200 unpackExtent(
201     struct Extent *const xi,  // input
202     struct Extent *const xo,  // output
203     f_expand *const f_decompress,
204     f_unfilter *f_unf
205 )
206 {
207     DPRINTF((STR_unpackExtent(),
208         xi, xi->size, xi->buf, xo, xo->size, xo->buf, f_decompress, f_unf));
209     while (xo->size) {
210         struct b_info h;
211         //   Note: if h.sz_unc == h.sz_cpr then the block was not
212         //   compressible and is stored in its uncompressed form.
213 
214         // Read and check block sizes.
215         xread(xi, (char *)&h, sizeof(h));
216         if (h.sz_unc == 0) {                     // uncompressed size 0 -> EOF
217             if (h.sz_cpr != UPX_MAGIC_LE32)      // h.sz_cpr must be h->magic
218                 err_exit(2);
219             if (xi->size != 0)                 // all bytes must be written
220                 err_exit(3);
221             break;
222         }
223         if (h.sz_cpr <= 0) {
224             err_exit(4);
225 ERR_LAB
226         }
227         if (h.sz_cpr > h.sz_unc
228         ||  h.sz_unc > xo->size ) {
229             err_exit(5);
230         }
231         // Now we have:
232         //   assert(h.sz_cpr <= h.sz_unc);
233         //   assert(h.sz_unc > 0 && h.sz_unc <= blocksize);
234         //   assert(h.sz_cpr > 0 && h.sz_cpr <= blocksize);
235 
236         if (h.sz_cpr < h.sz_unc) { // Decompress block
237             nrv_uint out_len = h.sz_unc;  // EOF for lzma
238             int const j = (*f_decompress)((unsigned char *)xi->buf, h.sz_cpr,
239                 (unsigned char *)xo->buf, &out_len, *(int *)(void *)&h.b_method );
240             if (j != 0 || out_len != (nrv_uint)h.sz_unc)
241                 err_exit(7);
242             // Skip Ehdr+Phdrs: separate 1st block, not filtered
243             if (h.b_ftid!=0 && f_unf  // have filter
244             &&  ((512 < out_len)  // this block is longer than Ehdr+Phdrs
245               || (xo->size==(unsigned)h.sz_unc) )  // block is last in Extent
246             ) {
247                 (*f_unf)((unsigned char *)xo->buf, out_len, h.b_cto8, h.b_ftid);
248             }
249             xi->buf  += h.sz_cpr;
250             xi->size -= h.sz_cpr;
251         }
252         else { // copy literal block
253             xread(xi, xo->buf, h.sz_cpr);
254         }
255         xo->buf  += h.sz_unc;
256         xo->size -= h.sz_unc;
257     }
258 }
259 
260 #if defined(__i386__)  /*{*/
261 // Create (or find) an escape hatch to use when munmapping ourselves the stub.
262 // Called by do_xmap to create it; remembered in AT_NULL.d_val
263 static void *
make_hatch_x86(Elf32_Phdr const * const phdr,unsigned const reloc)264 make_hatch_x86(Elf32_Phdr const *const phdr, unsigned const reloc)
265 {
266     unsigned *hatch = 0;
267     if (phdr->p_type==PT_LOAD && phdr->p_flags & PF_X) {
268         // The format of the 'if' is
269         //  if ( ( (hatch = loc1), test_loc1 )
270         //  ||   ( (hatch = loc2), test_loc2 ) ) {
271         //      action
272         //  }
273         // which uses the comma to save bytes when test_locj involves locj
274         // and the action is the same when either test succeeds.
275 
276         // Try page fragmentation just beyond .text .
277         if ( ( (hatch = (void *)(phdr->p_memsz + phdr->p_vaddr + reloc)),
278                 ( phdr->p_memsz==phdr->p_filesz  // don't pollute potential .bss
279                 &&  4<=(~PAGE_MASK & -(int)hatch) ) ) // space left on page
280         // Try Elf32_Ehdr.e_ident[12..15] .  warning: 'const' cast away
281         ||   ( (hatch = (void *)(&((Elf32_Ehdr *)phdr->p_vaddr + reloc)->e_ident[12])),
282                 (phdr->p_offset==0) ) ) {
283             // Omitting 'const' saves repeated literal in gcc.
284             unsigned /*const*/ escape = 0xc3c980cd;  // "int $0x80; leave; ret"
285             // Don't store into read-only page if value is already there.
286             if (* (volatile unsigned*) hatch != escape) {
287                 * hatch  = escape;
288             }
289         }
290     }
291     return hatch;
292 }
293 #elif defined(__arm__)  /*}{*/
294 static void *
make_hatch_arm(Elf32_Phdr const * const phdr,unsigned const reloc)295 make_hatch_arm(Elf32_Phdr const *const phdr, unsigned const reloc)
296 {
297     unsigned *hatch = 0;
298     DPRINTF((STR_make_hatch_arm(),phdr,reloc));
299     if (phdr->p_type==PT_LOAD && phdr->p_flags & PF_X) {
300         // The format of the 'if' is
301         //  if ( ( (hatch = loc1), test_loc1 )
302         //  ||   ( (hatch = loc2), test_loc2 ) ) {
303         //      action
304         //  }
305         // which uses the comma to save bytes when test_locj involves locj
306         // and the action is the same when either test succeeds.
307 
308         // Try page fragmentation just beyond .text .
309         if ( ( (hatch = (void *)(phdr->p_memsz + phdr->p_vaddr + reloc)),
310                 ( phdr->p_memsz==phdr->p_filesz  // don't pollute potential .bss
311                 &&  8<=(~PAGE_MASK & -(int)hatch) ) ) // space left on page
312         // Try Elf32_Ehdr.e_ident[8..15] .  warning: 'const' cast away
313         ||   ( (hatch = (void *)(&((Elf32_Ehdr *)phdr->p_vaddr + reloc)->e_ident[8])),
314                 (phdr->p_offset==0) ) )
315         {
316             hatch[0]= 0xef90005b;  // syscall __NR_unmap
317             hatch[1]= 0xe1a0f00e;  // mov pc,lr
318         }
319     }
320     return hatch;
321 }
322 #endif  /*}*/
323 
324 static void
325 #if defined(__i386__)  /*{*/
326 __attribute__((regparm(2), stdcall))
327 #endif  /*}*/
upx_bzero(char * p,size_t len)328 upx_bzero(char *p, size_t len)
329 {
330     if (len) do {
331         *p++= 0;
332     } while (--len);
333 }
334 #define bzero upx_bzero
335 
336 
337 static void
338 #if defined(__i386__)  /*{*/
339 __attribute__((regparm(3), stdcall))
340 #endif  /*}*/
auxv_up(Elf32_auxv_t * av,unsigned const type,unsigned const value)341 auxv_up(Elf32_auxv_t *av, unsigned const type, unsigned const value)
342 {
343     DPRINTF((STR_auxv_up(),av,type,value));
344     if (av
345 #if defined(__i386__)  /*{*/
346     && 0==(1&(int)av)  /* PT_INTERP usually inhibits, except for hatch */
347 #endif  /*}*/
348     )
349     for (;; ++av) {
350         if (av->a_type==type || (av->a_type==AT_IGNORE && type!=AT_NULL)) {
351             av->a_type = type;
352             av->a_un.a_val = value;
353             return;
354         }
355         if (av->a_type==AT_NULL) {
356             // We can't do this as part of the for loop because we overwrite
357             // AT_NULL too.
358             return;
359         }
360     }
361 }
362 
363 // The PF_* and PROT_* bits are {1,2,4}; the conversion table fits in 32 bits.
364 #define REP8(x) \
365     ((x)|((x)<<4)|((x)<<8)|((x)<<12)|((x)<<16)|((x)<<20)|((x)<<24)|((x)<<28))
366 #define EXP8(y) \
367     ((1&(y)) ? 0xf0f0f0f0 : (2&(y)) ? 0xff00ff00 : (4&(y)) ? 0xffff0000 : 0)
368 #define PF_TO_PROT(pf) \
369     ((PROT_READ|PROT_WRITE|PROT_EXEC) & ( \
370         ( (REP8(PROT_EXEC ) & EXP8(PF_X)) \
371          |(REP8(PROT_READ ) & EXP8(PF_R)) \
372          |(REP8(PROT_WRITE) & EXP8(PF_W)) \
373         ) >> ((pf & (PF_R|PF_W|PF_X))<<2) ))
374 
375 
376 #define MAP_ANON_FD -1
377 
378 // Find convex hull of PT_LOAD (the minimal interval which covers all PT_LOAD),
379 // and mmap that much, to be sure that a kernel using exec-shield-randomize
380 // won't place the first piece in a way that leaves no room for the rest.
381 static unsigned long  // returns relocation constant
382 #if defined(__i386__)  /*{*/
383 __attribute__((regparm(3), stdcall))
384 #endif  /*}*/
xfind_pages(unsigned mflags,Elf32_Phdr const * phdr,int phnum,char ** const p_brk)385 xfind_pages(unsigned mflags, Elf32_Phdr const *phdr, int phnum,
386     char **const p_brk
387 )
388 {
389     size_t lo= ~0, hi= 0, szlo= 0;
390     char *addr;
391     DPRINTF((STR_xfind_pages(), mflags, phdr, phnum, p_brk));
392     mflags += MAP_PRIVATE | MAP_ANONYMOUS;  // '+' can optimize better than '|'
393     for (; --phnum>=0; ++phdr) if (PT_LOAD==phdr->p_type) {
394         if (phdr->p_vaddr < lo) {
395             lo = phdr->p_vaddr;
396             szlo = phdr->p_filesz;
397         }
398         if (hi < (phdr->p_memsz + phdr->p_vaddr)) {
399             hi =  phdr->p_memsz + phdr->p_vaddr;
400         }
401     }
402     szlo += ~PAGE_MASK & lo;  // page fragment on lo edge
403     lo   -= ~PAGE_MASK & lo;  // round down to page boundary
404     hi    =  PAGE_MASK & (hi - lo - PAGE_MASK -1);  // page length
405     szlo  =  PAGE_MASK & (szlo    - PAGE_MASK -1);  // page length
406     addr = mmap((void *)lo, hi, PROT_NONE, mflags, MAP_ANON_FD, 0);
407     *p_brk = hi + addr;  // the logical value of brk(0)
408     //mprotect(szlo + addr, hi - szlo, PROT_NONE);  // no access, but keep the frames!
409     return (unsigned long)addr - lo;
410 }
411 
412 static Elf32_Addr  // entry address
do_xmap(int const fdi,Elf32_Ehdr const * const ehdr,struct Extent * const xi,Elf32_auxv_t * const av,unsigned * p_reloc,f_unfilter * const f_unf)413 do_xmap(int const fdi, Elf32_Ehdr const *const ehdr, struct Extent *const xi,
414     Elf32_auxv_t *const av, unsigned *p_reloc, f_unfilter *const f_unf)
415 {
416     Elf32_Phdr const *phdr = (Elf32_Phdr const *) (ehdr->e_phoff +
417         (void const *)ehdr);
418     char *v_brk;
419     unsigned const reloc = xfind_pages(
420         ((ET_EXEC==ehdr->e_type) ? MAP_FIXED : 0), phdr, ehdr->e_phnum, &v_brk);
421     int j;
422     DPRINTF((STR_do_xmap(),
423         fdi, ehdr, xi, (xi? xi->size: 0), (xi? xi->buf: 0), av, p_reloc, f_unf));
424     for (j=0; j < ehdr->e_phnum; ++phdr, ++j)
425     if (PT_PHDR==phdr->p_type) {
426         if (xi) {
427             auxv_up(av, AT_PHDR, phdr->p_vaddr + reloc);
428         }
429     }
430     else if (PT_LOAD==phdr->p_type) {
431         unsigned const prot = PF_TO_PROT(phdr->p_flags);
432         struct Extent xo;
433         size_t mlen = xo.size = phdr->p_filesz;
434         char  *addr = xo.buf  =  (char *)(phdr->p_vaddr + reloc);
435         char *haddr =           phdr->p_memsz + addr;
436         size_t frag  = (int)addr &~ PAGE_MASK;
437         mlen += frag;
438         addr -= frag;
439 
440         if (addr != (xi
441             ? mmap(addr, mlen
442 #if defined(__i386__)  /*{*/
443                     // Decompressor can overrun the destination by 3 bytes.
444                     + 3
445 #endif  /*}*/
446                 , prot | PROT_WRITE, MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS,
447                 MAP_ANON_FD , 0 )
448             : mmap(addr, mlen
449                 , prot,              MAP_FIXED | MAP_PRIVATE,
450                 fdi,          phdr->p_offset - frag) ))
451         {
452             err_exit(8);
453         }
454         if (xi) {
455             unpackExtent(xi, &xo, (f_expand *)fdi,
456                 ((PROT_EXEC & prot) ? f_unf : 0) );
457         }
458         // Linux does not fixup the low end, so neither do we.
459         //if (PROT_WRITE & prot) {
460         //    bzero(addr, frag);  // fragment at lo end
461         //}
462         frag = (-mlen) &~ PAGE_MASK;  // distance to next page boundary
463         if (PROT_WRITE & prot) { // note: read-only .bss not supported here
464             bzero(mlen+addr, frag);  // fragment at hi end
465         }
466         if (xi) {
467 #if defined(__i386__)  /*{*/
468             void *const hatch = make_hatch_x86(phdr, reloc);
469             if (0!=hatch) {
470                 /* always update AT_NULL, especially for compressed PT_INTERP */
471                 auxv_up((Elf32_auxv_t *)(~1 & (int)av), AT_NULL, (unsigned)hatch);
472             }
473 #elif defined(__arm__)  /*}{*/
474             void *const hatch = make_hatch_arm(phdr, reloc);
475             if (0!=hatch) {
476                 auxv_up((Elf32_auxv_t *)(void *)av, AT_NULL, (unsigned)hatch);
477             }
478 #endif  /*}*/
479             if (0!=mprotect(addr, mlen, prot)) {
480                 err_exit(10);
481 ERR_LAB
482             }
483         }
484         addr += mlen + frag;  /* page boundary on hi end */
485         if (addr < haddr) { // need pages for .bss
486             if (addr != mmap(addr, haddr - addr, prot,
487                     MAP_FIXED | MAP_PRIVATE | MAP_ANONYMOUS, MAP_ANON_FD, 0 ) ) {
488                 err_exit(9);
489             }
490         }
491 #if defined(__i386__)  /*{*/
492         else if (xi) { // cleanup if decompressor overrun crosses page boundary
493             mlen = ~PAGE_MASK & (3+ mlen);
494             if (mlen<=3) { // page fragment was overrun buffer only
495                 munmap(addr, mlen);
496             }
497         }
498 #endif  /*}*/
499     }
500     if (!xi) { // 2nd call (PT_INTERP); close()+check is smaller here
501         if (0!=close(fdi)) {
502             err_exit(11);
503         }
504     }
505     else { // 1st call (main); also have (0!=av) here
506         if (ET_DYN!=ehdr->e_type) {
507             // Needed only if compressed shell script invokes compressed shell.
508             do_brk(v_brk);
509         }
510     }
511     if (0!=p_reloc) {
512         *p_reloc = reloc;
513     }
514     return ehdr->e_entry + reloc;
515 }
516 
517 
518 /*************************************************************************
519 // upx_main - called by our entry code
520 //
521 // This function is optimized for size.
522 **************************************************************************/
523 
524 void *upx_main(
525     Elf32_auxv_t *const av,
526     unsigned const sz_compressed,
527     f_expand *const f_decompress,
528     f_unfilter */*const*/ f_unfilter,
529     struct Extent xo,
530     struct Extent xi,
531     unsigned const volatile dynbase
532 ) __asm__("upx_main");
533 
upx_main(Elf32_auxv_t * const av,unsigned const sz_compressed,f_expand * const f_decompress,f_unfilter * f_unf,struct Extent xo,struct Extent xi,unsigned const volatile dynbase)534 void *upx_main(
535     Elf32_auxv_t *const av,
536     unsigned const sz_compressed,
537     f_expand *const f_decompress,
538     f_unfilter */*const*/ f_unf,
539     struct Extent xo,  // {sz_unc, ehdr}    for ELF headers
540     struct Extent xi,  // {sz_cpr, &b_info} for ELF headers
541     unsigned const volatile dynbase  // value+result: compiler must not change
542 )
543 {
544     Elf32_Ehdr *const ehdr = (Elf32_Ehdr *)(void *)xo.buf;  // temp char[MAX_ELF_HDR+OVERHEAD]
545     Elf32_Phdr const *phdr = (Elf32_Phdr const *)(1+ ehdr);
546     Elf32_Addr reloc;
547     Elf32_Addr entry;
548 
549     // sizeof(Ehdr+Phdrs),   compressed; including b_info header
550     size_t const sz_pckhdrs = xi.size;
551 
552     DPRINTF((STR_upx_main(),
553         av, sz_compressed, f_decompress, f_unf, &xo, xo.size, xo.buf,
554         &xi, xi.size, xi.buf, dynbase));
555 #if defined(__i386__)  /*{*/
556     f_unf = (f_unfilter *)(2+ (long)f_decompress);
557 #endif  /*}*/
558 
559     // Uncompress Ehdr and Phdrs.
560     unpackExtent(&xi, &xo, f_decompress, 0);
561 
562     // Prepare to decompress the Elf headers again, into the first PT_LOAD.
563     xi.buf  -= sz_pckhdrs;
564     xi.size  = sz_compressed;
565 
566     // Some kernels omit AT_PHNUM,AT_PHENT,AT_PHDR because this stub has no PT_INTERP.
567     // That is "too much" optimization.  Linux 2.6.x seems to give all AT_*.
568     auxv_up(av, AT_PAGESZ, PAGE_SIZE);
569     auxv_up(av, AT_PHNUM , ehdr->e_phnum);
570     auxv_up(av, AT_PHENT , ehdr->e_phentsize);
571     auxv_up(av, AT_PHDR  , dynbase + (unsigned)(1+(Elf32_Ehdr *)phdr->p_vaddr));
572     // AT_PHDR.a_un.a_val  is set again by do_xmap if PT_PHDR is present.
573     // This is necessary for ET_DYN if|when we override a prelink address.
574 
575     entry = do_xmap((int)f_decompress, ehdr, &xi, av, &reloc, f_unf);
576     auxv_up(av, AT_ENTRY , entry);  // might not be necessary?
577 
578   { // Map PT_INTERP program interpreter
579     int j;
580     for (j=0; j < ehdr->e_phnum; ++phdr, ++j) if (PT_INTERP==phdr->p_type) {
581         int const fdi = open(reloc + (char const *)phdr->p_vaddr, O_RDONLY, 0);
582         if (0 > fdi) {
583             err_exit(18);
584         }
585         if (MAX_ELF_HDR!=read(fdi, (void *)ehdr, MAX_ELF_HDR)) {
586 ERR_LAB
587             err_exit(19);
588         }
589         entry = do_xmap(fdi, ehdr, 0, 0, &reloc, 0);
590         auxv_up(av, AT_BASE, reloc);
591         break;
592     }
593   }
594 
595     return (void *)entry;
596 }
597 
598 /* vim:set ts=4 sw=4 et: */
599