Linux C program: How to find the library to which a function belongs

Question

Say at runtime, I want to find out where a function "printf" is defined. How would I do this? My first attempt was to print out the address of "printf" and compare it against the virtual address mapping of the process:

my program:

#include <stdio.h>
#include <unistd.h>

void main()
{
    printf("address of printf is 0x%X\n", printf);
    printf("pid is  %d\n", getpid());
    while (1);
}

output:

-bash-4.1$ ./a &
[1] 28837
-bash-4.1$ address of printf is 0x4003F8
pid is  28837

However, this says the function is defined in my own program!

-bash-4.1$ head /proc/28837/maps 
00400000-00401000 r-xp 00000000 08:06 6946857                            /data2/temp/del/a      <<<<<<< Address 0x4003F8 is in my own program?
00600000-00601000 rw-p 00000000 08:06 6946857                            /data2/temp/del/a
397ec00000-397ec20000 r-xp 00000000 08:11 55837039                       /lib64/ld-2.12.so
397ee1f000-397ee20000 r--p 0001f000 08:11 55837039                       /lib64/ld-2.12.so
397ee20000-397ee21000 rw-p 00020000 08:11 55837039                       /lib64/ld-2.12.so
397ee21000-397ee22000 rw-p 00000000 00:00 0 
397f000000-397f18a000 r-xp 00000000 08:11 55837204                       /lib64/libc-2.12.so
397f18a000-397f38a000 ---p 0018a000 08:11 55837204                       /lib64/libc-2.12.so
397f38a000-397f38e000 r--p 0018a000 08:11 55837204                       /lib64/libc-2.12.so
397f38e000-397f38f000 rw-p 0018e000 08:11 55837204                       /lib64/libc-2.12.so

Shouldnt it be a call into libc? How do I find out where this "printf" or any other function came from?

Answer 1

The address you observe is located in the Procedure Linkage Table (PLT). This mechanism is used, when the location of an external (dynamically linked) symbol is not known at the time, when your binary is compiled and linked.

The purpose is, that the external linkage happens only at one place, the PLT, and not on all places throughout your code where a call to the symbol happens. So, if printf() is called, the way is:

main -> printf@PLT -> printf@libc

At runtime, you cannot find out easily in which external library the function you call is located; you would have to parse the opcodes at the destination (the PLT), which usually fetches the address from the .dynamic section and jumps there, then look, where the symbol is really located and finally, parse /proc/pid/maps to get the external library.

Answer 2

At runtime, you can use gdb for this:

(terminal 1)$ ./a
pid is  16614
address of printf is 0x400450

(terminal 2)$ gdb -p 16614
(...)
Attaching to process 16614
(...)
0x00000000004005a4 in main ()
(gdb)

(gdb) info sym printf
printf in section .text of /lib/x86_64-linux-gnu/libc.so.6

If you don't want to interrupt your program or are reluctant to use gdb, you may also ask ld.so to output some debugging info:

(terminal 1)$ LD_DEBUG=bindings LD_DEBUG_OUTPUT=syms ./a
pid is  17180
address of printf is 0x400450

(terminal 2)$ fgrep printf syms.17180
    17180:  binding file ./a [0] to /lib/x86_64-linux-gnu/libc.so.6 [0]: normal symbol `printf' [GLIBC_2.2.5]

Answer 3

1. pointers are printfed using %p, not %X:

   printf("address of printf is 0x%p\n", printf);
   

2. If you compile against static libc printf will be linked into your binary

3. when compiled with

   gcc -fPIC a.c # (older gccs)
   ...
   gcc -fno-plt a.c # (gcc 6 and above)
   

   outputs:

   address of printf is 0x0x7f40acb522a0
   

   which is inside of

   7f40acaff000-7f40accc2000 r-xp 00000000 fd:00 100687388                  /usr/lib64/libc-2.17.so
   

Read What does @plt mean here? to find more about this.

Answer 4

Say at runtime, I want to find out where a function "printf" is defined.

In general and absolute terms, you probably cannot (at least not easily). A given function might be defined in several libraries (for printf, that is unlikely; since it is inside the C standard library).

If you build your Linux system from scratch, you could dream of something processing every library at build time (for instance, when building every shared library, you could get all its public names with nm(1) and put them in some database). This is not really done yet today, but some research projects are going in that direction (notably softwareheritage, and other ones in 2019).

BTW, you could have several libraries defining printf. For example, if you install both GNU glibc and musl-libc on your computer (or more likely, if you have several variants of glibc). A particular program is unlikely to use both (but could still, in theory, dlopen both of them).

Maybe you want the Linux specific dladdr(3) function. From some given address, it tells you the shared object having it.

the function is defined in my own program

Yes. Read much more about dynamic linking. In particular, read Drepper's How to Write Shared Libraries paper. Understand what is the purpose of procedure linkage table.

Answer 5

Parse the elf file for the dynamically linked libraries needed. Then you can parse them searching for the required symbol

Answer 6

You can deduce this statically. No need to execute:

$ readelf -Ws a.out | grep printf
      1: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND printf@GLIBC_2.2.5 (2)
     51: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND printf@@GLIBC_2.2.5