Easy as PIE: Creating Bare-Metal Position Independent Executables with ARM Compiler 6

Usually when you create a bare-metal image you specify the location in memory where the code and data will reside, and provide an entry point address where execution starts.

But what if you don't want to specify a fixed memory location at build time?

Security has become a crucial aspect of applications. One common attack to gain privilege on a system is through buffer overflows: this anomaly could potentially lead to the execution of malicious code, jeopardizing the security of the entire system through code injection.

Different techniques are used to make a hacker's life harder, including randomizing the address space layout (ASLR). This technique is widely used in several high-level Operating Systems like Android, iOS, Linux and Windows.

With ARM Compiler 6 you can extend this protection to bare-metal applications by creating Position Independent Executables (PIE), also known as Position Independent Code (PIC). A PIE is an executable that does not use fixed addresses to access memory. Rather, it can be executed at any suitably aligned address and the code automatically recalculates the required addresses.

ARM Compiler 6 provides the -fbare-metal-pie (armclang) and --bare_metal_pie (armlink) options to let you create a bare-metal PIE:

armclang -fbare-metal-pie -target armv8a-arm-none-eabi source.c 
armlink --bare_metal_pie source.o

Note: armclang automatically passes the --bare_metal_pie option to armlink when you compile with -fbare-metal-pie.

Note: Bare-metal PIE is currently only supported for 32-bit targets.

Worked Example Part 1: Creating a PIE

Let's take a look at how this works in practice.

This example creates a very simple "Hello World" program in DS-5, uses ARM Compiler 6 to create a PIE, then uses the DS-5 Debugger and the AEMv8-A model to run the executable at an arbitrary position in memory.

Step 1: Create a "Hello World" C project in DS-5 Debugger

1. Create a new C project in DS-5 called PIEdemo (Click File > New > Other... to start the New Project wizard), using Project type: Empty Project and Toolchain: ARM Compiler 6 (DS-5 built in).

2. Add a new source file pie.c to the new project (right-click the project, then click New > Source File) with the following content:

   #include <stdio.h> 
   const char *myString = "Hello World\n";
   int main() 
   { 
       puts(myString);
       return 0;
   }

Step 2: Compile the source code to create a PIE

1. Edit the project properties (right-click the project, then click Properties) and navigate to the ARM Compiler toolchain settings (C/C++ Build > Settings).

2. Add the following command-line options:

   • ARM C Compiler 6 > Target > Target: armv8a-arm-none-eabi (this compiles for AArch32)
   • ARM C Compiler 6 > Miscellaneous > Other flags: -fbare-metal-pie -mfpu=none
   • ARM Linker 6 > Miscellaneous > Other flags: --bare_metal_pie
3. Build the project (right-click the project, then click Build Project).

Step 3: Create a debug configuration for the AEMv8-A model

1. Create a new debug configuration (right-click in the Debug Control tab, then click Debug Configurations..., then click the New Launch Configuration button).
2. On the Connection tab:
   1. Select the VE_AEMv8x1 > Bare Metal Debug > Debug AEMv8-A target.

   2. Add the model parameter: -C cluster.cpu0.CONFIG64=0. This puts the model in AArch32 state, rather than the default AArch64 state.

      

1. On the Debugger tab, select Run control: connect only.

   We want to load the image manually so that we can specify the load address.

Step 4: Run the PIE on the AEMv8-A model

1. Double-click the debug configuration to connect to the AEMv8-A model target.

2. Load the PIE by running the following command on the Commands tab:

   loadfile PIEdemo/Debug/PIEdemo.axf 0x80000044

   This loads the PIE at the arbitrary address 0x80000044, performs all necessary address relocations, and automatically sets the entry point:

   
   

   Note: You can choose any address, but it must be suitably aligned and at a valid location in the AEMv8-A memory map. For more information about the AEMv8-A memory map, see AEMv8-A Base Platform - memory - map in the Fast Models Reference Manual

   Note: You can ignore the TAB180 error for the purposes of this tutorial. For more information, see ARM Compiler 6: Bare-metal Hello World C using the ARMv8 model | ARM DS-5 Development Studio.

3. Execute the PIE by running the following command on the Commands tab:

   run

   Check the Target Console tab to see the program output:

   

How Does It Work?

Position independent code uses PC-relative addressing modes where possible and otherwise accesses global data indirectly, via the Global Offset Table (GOT). When code needs to access global data it uses the GOT as follows:

• Evaluate the GOT base address using a PC-relative addressing mode.
• Get the address of the data item in the GOT by adding an offset index to the GOT base address.
• Look up the contents of that GOT entry to obtain the actual address of the data item.
• Access the actual address of the data item.

We'll see this process in action later.

At link time, the linker does the following:

• Creates the executable as if it will run at address 0x00000000.
• Generates a Dynamic Relocation Table (DRT), which is a list of addresses that need updating, specified as 4-byte offsets from the table entry.
• Creates a .preinit_array section, which will update relocated addresses (more about this later…).
• Converts function calls to direct calls.
• Generates the Image$$StartOfFirstExecRegion symbol.

At execution time:

• The entry code calls __arm_preinit_.
• __arm_preinit_ processes functions in the .preinit_array section, calling __arm_relocate_pie.
• __arm_relocate_pie uses Image$$StartOfFirstExecRegion (evaluated using a PC-relative addressing mode) to find the actual base address in memory where the image has been loaded, then processes each entry in the DRT adding the base address offset to each address entry in the GOT and initialized pointers in the data area.

Worked Example Part 2: Stepping through PIE execution with DS-5 Debugger

Our example from earlier contains the global string "Hello world". Let's see how relocation is used in the PIE to access this data regardless of where the image is loaded.

In the Project Explorer view, double-click on the .axf executable to see the sections it contains:

We can see that the GOT is located at address 0x00000EE0 in the original image.

Now load the image to address 0x80000044 by running the following command on the Commands tab:

loadfile PIEdemo/Debug/PIEdemo.axf 0x80000044

Use the Disassembly view to view address 0x80000F24 (0x80000044 + 0x00000EE0). We can see that the GOT has been loaded, but it still contains unrelocated addresses:

Now, set a breakpoint on main() and run the executable. This executes the setup code, including __arm_relocate_pie which relocates the addresses in the GOT. Run the following commands on the Commands tab:

b main
run

Look at the GOT again, and note that the addresses have been relocated:

Now we'll see how the code uses the GOT to access the "Hello World" string.

Step to the next source instruction by running the following command on the Commands tab:

next

Jump to address $pc in the Disassembly view to view the code in main():

The code to print "Hello World" starts at 0x800000E4 and does the following:

1. Load R1 with the GOT offset for our string (0xC), obtained by a PC-relative data lookup from address 0x80000118.
2. Load R2 with the PC-relative address of the GOT table (0xE30)
3. Update R2 with the actual base address of the GOT table, PC + 0xE30 (0x800000F4 + 0xEE0 = 0x80000F24 ).
4. Load R1 with the contents of address R1 + R2 (that is, address 0x80000F24 + 0xC = 0x80000F30). The contents of this address in the GOT is 0x80000F68, which is the address of the pointer to the "HelloWorld" string.
5. Load R1 with the target address of the pointer, copy it to R0, and call puts.

You can single-step through the code and use the Registers view to see this working in DS-5 Debugger.

Further Reading

• ARM Compiler 6 Software Development Guide, Read Bare-metal Position Independent Executables
• Building Hello World with ARM Compiler 6 and debugging it on the ARMv8 model
• Fast Models Reference Manual, AEMv8-A Base Platform - memory - map