‫Hello and welcome to part two of this hour, FLOTUS series, All I want us to do now is I want us to
‫create a new file called El Stazi in formats.
‫So just go after C and we're going to include after the Hajj and we're going to make two functions.
‫So here comes the first one void helfgot entry point to struct.
‫Elfreda, Elfreda.
‫And that's going to return void Ilford e e entry.
‫OK, stop returns the entry to us as a pointer, OK.
‫As a void pointer, we're going to make another function that returns a unit thirty two and it's going
‫to be called alphabet entry.
‫That's going to take an F header.
‫And it's just going to return the entry.
‫OK, so it's not going to cast it to a vote pointer, so I'll just copy and paste those prototypes here
‫and we're going to put them in after the Hajj.
‫Like that, and that's it for the actual effort file.
‫As you can see, they just returned the entry, that is.
‫So when now going to create the outflow, the parts of this lecture.
‫So just in the formats, we're going to go Noufal, outflow the Hajj hashtag and death, outflow the
‫Hajj to find our flow to Hajj and death.
‫And we're going to go include as the Hajj includes, as the death toll, the Hajj.
‫So this is the loader itself.
‫OK, we're going to include after the Hajj and confect at the Hajj.
‫OK, so then we're going to have a structure of el-Fadl and that's going to have a file name, Soochow
‫file name and the file name will be the Peatross.
‫Oh, check this typo here, guys.
‫Convicted Hajj should look like that.
‫So the file name size is going to be Pacho as Max Path.
‫And we can see that 108, that's fine, we're going to go in it in memory size, so that'll be the size
‫of this alpha when it's loaded into memory and we're going to go void of memory, OK?
‫And what this will be is a pointer to the physical memory address, where this Elfa file is loaded,
‫the physical memory address that this file is loaded.
‫And so that includes the el-Fadl entirely.
‫OK, this is a pointer to it in memory.
‫So it'll have the header loads of different things.
‫We load the entire file into memory, as I've said before, and EMAP solution will be better.
‫But we don't have a map yet.
‫And if we had a memory map solution, then it would allow us to access the files.
‫If it was already loaded, even though it wasn't, we'll be able to point to it.
‫And every byte that we access will be that page will be loaded into memory.
‫That's how the map works.
‫Very, very useful.
‫But for now, we're just going to load everything into memory, the whole file.
‫So when I was going to say void virtual base address, OK, and what this will be is the virtual based
‫address of this binary.
‫OK, that'll be the lowest virtual based address.
‫Remember I showed you in the presentation how we calculate the lowest address and the highest address?
‫Well, that's what's going on here, guys.
‫OK, so simply put, the virtual based address is the base address of the start of this alpha memory
‫here.
‫OK.
‫So don't worry too much by this, because more will be explained later on.
‫So here we're going to go, viewpoint, virtue and address.
‫OK, the ending virtual address.
‫So here we're going to go void physical base address.
‫OK, and this will be the physical base address.
‫All right.
‫So, uh, yeah, when I said earlier about the virtual base address points to the memory, that's not
‫what I meant.
‫Essentially, the virtual base dress will point to the first loadable section in memory, OK, or segment,
‫if you will, and the physical base address will point to the well, the same thing essentially apart
‫from this is the physical address.
‫This is the virtual address.
‫OK, so then what we can do is when we want a memory map, the whole thing, if we don't care about
‫flags or whatever, we can just map from the virtual base address to the end to understand.
‫So these values are important for that reason.
‫However, a better implementation would be to loop through all of the sections and take the flags into
‫account.
‫But more on that later.
‫So here we're going to go, void, physical and address.
‫OK, and this will be the physical and address of this binary.
‫OK.
‫So I know it might be a bit confusing, but just bear with me, because there is a function that we
‫create that calculates all of these and it'll make much more sense to you.
‫So that's the end of our flow, the our file.
‫OK, so we're now going to create a new file called L Floated Out, see where we'll start implementing
‫these things.
‫Suggestion formats go our flow that see and we're going to include our float adult page.
‫So we're also going to want to include AIFS file that we're going to want to include the status start
‫page.
‫We're going to want to include as we pulled out the Hajj, we're going to want to include memory, memory,
‫Hajj memory.
‫Keep keep that Hajj string Hajj.
‫Memory paging paging Dr. Hajj, Colonel, Dr. Hajj, I'm finally convict the Hajj.
‫OK, so that's what we want to be, including when I was going to create a Arae for the signature.
‫So we're going to go const char.
‫Our signature equals zero seven f e l f.
‫And the greater understand the 067, if you just look in the manual, so the first thing we're going
‫to do is we're going to make a function, the checks, if the lf signature is valid.
‫So we're going to go static bool al-Faraj signature and then that's going to upset above.
‫So now we're just going to go with 10 men, compare Buffa boy point to our signature size of our signature.
‫OK, equals zero.
‫OK, so if it equals zero, then the signature matches.
‫So basically we passed the header in here, a Savoy Pointer, and it will check that signature for us,
‫OK?
‫And it will say, does the memory in the AFL match the bites here?
‫And if it does, then we have a valid signature and we can continue because it's a nail file.
‫If it doesn't have a valid signature, then we're trying to load.
‫A father is an elf.
‫So now we're going to go Statik Bowl of a class structure had a header.
‫So here we're just going to return header ident II class equals Alpha Class None.
‫Or had to identify a high class equals health class 32, so we only want to accept 32, but essentially,
‫guys, OK.
‫To be honest, we may get rid of class none.
‫But now we'll keep it for now, just in case.
‫We only support three to bit binaries.
‫Because don't forget, we can load 64 bedfast guys because we're in protected mode, which is a 32 bit
‫more.
‫We need to go along mode to execute 64 bit code.
‫So now we're going to be a static bull alpha encoding struct.
‫Elfreda had a.
‫Return had ident it data equals e i e f, I mean data none or header ident it data equals health data.
‫To LSP, OK, now let's just go to the manual here and we're going to search that up.
‫Yes, so this is the data encoding, essentially, guys.
‫OK, and I believe this is responsible for letting us know about whether the values are stored as Big
‫Endino Little Endian.
‫OK, so that's what's going on here.
‫And we don't really want to support this encoding the MSB because it's more effort, you understand,
‫whereas here we'll support LSP because that's what the machine's default is.
‫Little endian.
‫OK, so that's why we all support Big Endian our files here.
‫OK, it's just the way they format data essentially in the fall, we only care about data to LSP.
‫OK, now here we're going to go static bull Alfa's excludable.
‫This is a very important function in our implementation because we don't want to support Qaid libraries
‫at the moment, so we're only going to load executables, not shared libraries.
‫So all we do is we go return had e type equals executable and had a key entry above our equal Peatross
‫program virtual address.
‫Now what we're doing here is we don't want someone compiling their own executable file and setting the
‫entry point to point to, let's say, somewhere it shouldn't be OK, because that's a security hole,
‫because what that will mean is, is that they can load their program anywhere they like.
‫And we don't want that, OK?
‫Because if they can load that program anywhere that they liked, then they could end up loading it in
‫places they shouldn't.
‫And this could lead to vulnerabilities or it could lead to bugs in their program.
‫So we don't want that.
‫OK, so I know it's virtual memory.
‫So even if they did specify a place they shouldn't, it probably wouldn't do much damage.
‫But still, it might cause errors in the program if we were planning to put stuff there for the use
‫of program at a later time.
‫So absolutely, we need to check that they put in the correct entry address.
‫We're not allowing them to load wherever they like.
‫So here we're going to go static.
‫Paul Elf has a program header because don't forget, these are virtual addresses.
‫OK, so it doesn't necessarily mean it's loaded at zero x 400000.
‫Right.
‫But you understand what I mean?
‫We might want to give them a virtual address somewhere lower in memory or higher in memory, while technically
‫somewhere lower in memory, because here we make sure it's above 400000 hex.
‫But, you know, if they load over that, then it's going to cause problems, you understand?
‫So we can't allow that.
‫For example, if they load below this address and they're actually loaded over over their stack or no,
‫that's no good.
‫So we have to do that check.
‫So Alfa's program header.
‫OK, so this just ensures that the binary has a well, the file has a program header.
‫So all that we do here is we say return had EPC offset.
‫Does not equal zero.
‫OK, and that tells us if there's a program ahead or not, we're only loading files with program headers.
‫So if they if they don't have one, we're not going to bother.
‫There's many ways to load a nail file.
‫You can load it to the sections as well, but we will be loading it through the program ahead.
‫So here we're going to go.
‫Void of memory struct.
‫I'll file file.
‫So this will return the alpha memory pointer essentially.
‫OK, I know we can access this directly, but having a nice little ghetto method is very clean.
‫So now we're just going to go struct of head of header, structure of file file.
‫So this just returns the alpha header.
‫OK guys, essentially and the alpha header is actually the alpha memory because remember the very start
‫of the alpha file is the header.
‫OK, so we just return the alpha memory here, but the return type is an Alpha had a OK, you guys should
‫understand enough about pointers and C to understand how that would be a thing.
‫So please, please revise.
‫My point is if you're confused why this is possible.
‫So here we're going to go struct of 32 SAHD Alpha s header struct Elfreda header.
‫OK, so what we're going to do here is we're going to return the section head so we go return and we're
‫going to cast this off, 32 SAHD are.
‫And we're going to cast in it here, head plus head E S.H. Offset.
‫OK, so essentially that is how we get the section had to hear, OK, so it's the start of the file,
‫which is the header, OK, plus the offset.
‫And that gives us the actual address we cast in it here, guys, because if we don't, then it's going
‫to take into account the size of a header.
‫And when we plus on that, it's going to incremented almost like a multiplication of the size of the
‫alphabet when we don't want that.
‫That's why we cast that, OK.
‫In fact, it probably makes even more sense to just cast off our memory will not cast I mean, Koloff
‫memory.
‫So if we just go off memory, but we need the file for our memory.
‫OK, no worries.
‫Just put it back to what it was.
‫So in it head plus head S.H. Offset.
‫OK, make sure you have that and it cast or it's not going to work properly.
‫OK, so that gives us the start of the section headers.
‫So if you just read this code, you can see how this works, OK.
‫Essentially the S.H. offset gives us the absolute offset of the section header.
‫And because we've already loaded the binary at this point when we're calling these functions, the whole
‫outfalls being loaded, OK, the whole outfalls being loaded into memory, we know that by casting the
‫header to to an integer that will give us the the start of the file that's been loaded in memory.
‫OK, so then so then we just sat on the offset which were which is an absolute offset by the way, which
‫will take us straight to the section headers, OK, because literally if we go to F a moment.
‫The Alfandary address here, the void pointer, it contains everything, the whole foul loaded into
‫memory, the whole file.
‫OK, so that's why we're doing this.
‫What makes you say that to that's why we're doing this.
‫Plus stuff going on here had a plus offset because we know the head is one constituency to introduce
‫the start of the file.
‫OK, loaded into memory.
‫OK, so now we're going to go struct of the two header of P header struct Elfreda header and if the
‫EPA offset is equal to zero, then we're just going to return zero because there's no program header
‫unfortunately.
‫Otherwise we're going to return struct of 30 to program header and we're going to cast again the header
‫and we're going to be a plus header EP offset.
‫So similar sort of thing.
‫Apart from this time, we're checking that we actually have a program header because the program had
‫is optional.
‫OK, so now we're going to make another function that returns a program header based on index.
‫So we go struct of 32, program header alpha program header struct, Elfreda in its index and all we
‫do here is we go return the address of using the ampersand here.
‫P had had an index, OK, and that will return a particular program header entry based on the index
‫provided and we're going to do the same for sections.
‫So we're going to go struct Alpha 32 SAHD Alpha Section struct Elfreda header and index return ampersand.
‫Lf hadda hadda.
‫Index, so it's not very difficult.
‫You can see why we're making all these functions now, it's so it's much easier to write the code later
‫on.
‫So now we're going to write some functions for the string table.
‫So we're going to char elf string table struct.
‫Elfreda had a return and cast to a guy's head plus elf section, Hedda Hedda E SHC index and we're going
‫to take the offset out of that.
‫OK, so it should look like that.
‫So as I said before, the SHC index here in the Elfreda, that is the index of the section for the string
‫table, the whole section names.
‫OK, so we get the offset, the S.H. offset.
‫OK, so once again, why are we doing had a plus.
‫Because when we cast to another type for the header that gives us the first bite of the el-Fadl in memory
‫because it's completely loaded.
‫So that's why we keep casting the header and plussing from it, because these are absolute offsets.
‫However, because, because we've loaded this file straight into memory, it's actually relative from
‫the address of the header.
‫OK, so that's that's why because the header is the first thing in the alphabet.
‫So that's why we do had a plus.
‫OK, so just don't forget that because that's important to understand why, why that's happening.
‫So now we're going to go void our virtual base, struct our file file and this will just return the
‫virtual based address of our file.
‫So we just return virtual based address and we have to calculate this one up one way, going through
‫the file as well.
‫Guys, it's not part of the file itself.
‫So here we're going to go void elf virtual and struct file file.
‫We're just going to go return file virtual and address and we're going to do the same for the base.
‫So we're going to go void elf base while our physical base, I should say.
‫Obstruct our file file, return file, physical based address.
‫Now we're going to go void of physical and structural file file, return file, physical and address.
‫And now we have one more function to create that handles these things, and then we can actually start
‫writing the functions where we load the file into memory processing and so on.
‫These little helper function is very important.
‫That's why we need to get them out of the way first.
‫So this is the last helper function we need.
‫So just go in it.
‫Elf Validate Loaded and we're going to go struct Elfreda header and this is going to validate that we
‫can actually load this file provided to us because you remember we don't we don't support the entire
‫ELF format, so we need to check for these things.
‫So we're going to go return our file, its signature.
‫So firstly is the nail file.
‫That's the first thing.
‫The next thing we care about is if it has a valid class that we support, we're not loading 64 bit our
‫files.
‫So we just pass in the head of there.
‫And it has valid encoding and it has a program header because remember, we're only loading through
‫the program ahead and not the actual sections.
‫So there's no program.
‫How do we can't load the files?
‫Simple as that.
‫And yeah, that's actually it.
‫OK, so now we're going to use a tannery and we're going to go Peko ASOL.
‫OK, otherwise minus E in Val there.
‫So it shouldn't look like that.
‫I am vagy.
‫OK, so that's for two guys.
‫In the next lecture we will actually be able to stop making the file load.
‫I appreciate this has been a bit of a tedious task for you all.
‫Quite repetitive as always.
‫You can find the code in the lecture.
‫OK, a link to the comments essentially.
‫But I recommend that you follow the videos and write the code as I do, because it teaches you and it
‫gets you thinking, oh, what does that do?
‫Oh, what does that do?
‫And then you can ask me questions or check the manual or or I further clarify it.
‫OK, whereas if you skip the video, you might be missing some important details that I'm telling you.
‫So just always bear that in mind.
‫If you if you choose to take the code, then you're going to miss some education.
‫Now, obviously, I appreciate sometimes people rent problems, so they just want to copy and paste
‫the code.
‫That's fine.
‫But I do suggest you always follow the videos first just so you have an understanding of what's going
‫on.
‫OK, so that's the end.
‫Part two, thanks for watching.