2005-03-12 15:13:08

by gan_xiao_jun

[permalink] [raw]
Subject: The address displayed by ldd

Hi,

I have a small question,
I am not sure if it belongs to kernel.
I often use ldd to find librarys needed.
In some systems,the address display by ldd not
changes,
But in other systems, it changes.

What is the reason of the difference?
Is it cause by some setting in kernel?

Thanks in advance.
gan




__________________________________
Do you Yahoo!?
Yahoo! Mail - Find what you need with new enhanced search.
http://info.mail.yahoo.com/mail_250


2005-03-13 00:20:06

by Kevin Puetz

[permalink] [raw]
Subject: Re: The address displayed by ldd

It's the load address of the library, and it's basically not meant to be a
stable value. It will at least depend on the load order and size of the
libraries, and it may in fact be intentionally randomized each run as a
security measure against ret2libc type attacks (PaX, execshield, etc all do
this, as does prelink everytime it re-prelinks libraries). It's entirely
plausible for it to change from run to run, much less machine to machine.

[email protected] wrote:

> Hi,
>
> I have a small question,
> I am not sure if it belongs to kernel.
> I often use ldd to find librarys needed.
> In some systems,the address display by ldd not
> changes,
> But in other systems, it changes.
>
> What is the reason of the difference?
> Is it cause by some setting in kernel?
>
> Thanks in advance.
> gan
>
>
>
>
> __________________________________
> Do you Yahoo!?
> Yahoo! Mail - Find what you need with new enhanced search.
> http://info.mail.yahoo.com/mail_250