Dynamic linking is ubiquitously used, but it's hard to find
a detailed, accurate description of how it works. Nevertheless,
it is a remarkable example of advanced software engineering,
and no modern system is possible without it.

Why Solaris abandoned static linking:
http://blogs.oracle.com/rie/entry/static_linking_where_did_it

== Reading

Read the "Dynamic linking and loading" chapter in John Levine's
"Linkers and Loaders" (http://www.iecc.com/linker/). Concentrate
on ELF linking and loading, but have a look at the Microsoft  
section if you are curious.

Read your dynamic linker's man page. On Linux and Solaris: ld.so

== Addtional reading:

"Cheating the ELF. Subversive Dynamic Linking to Libraries" by the grugq. 
http://althing.cs.dartmouth.edu/local/subversiveld.pdf

"Modern Day ELF Runtime infection via GOT poisoning" by Ryan O'Neill
http://vxheavens.com/lib/vrn00.html
[This link may be down. This valuable paper and others were unavailable
 for a time due to an overzealous and clueless prosecutor in Ukraine, where
 vxheavens.com was hosted. If not available, try instead:
http://web.archive.org/web/20111222005751/http://vxheavens.com/lib/vrn00.html
]. 

"Linux x86 Program Start Up, or - How the heck do we get to main()?" by Patrick Horgan
http://dbp-consulting.com/tutorials/debugging/linuxProgramStartup.html

== Suggested homework:

Use a dynamically compiled executable on your system (which, say,
prints "Hello world" in a loop 10 times) and a debugger to observe
the stack and GOT just before and after dynamic linking. 

What are the arguments that the dynamic linker entry point receives
when entered through GOT[]? What else is stored in GOT?

Observe how the symbol to be linked is referenced from the PLT stub.

Observe the PLT section with "objdump -d " on the executable (pipe to "less").
Find the number of the .got and .got.plt sections.
Observe the GOT section with "objdump -s " -- you will see where the 
the GOT table entries point initially. These GOT entries
will be overwritten by the dynamic linker, so that the following
reference through GOT to the dynamically linked function points to its 
actual address in the loaded library.



Useful GDB tips:
http://www.unknownroad.com/rtfm/gdbtut/gdbadvanced.html

Remember that /proc/<PID>/maps will show you the process' memory
layout with all of its currently mapped code, libraries and stack.


