Module 5: Position-Independent Code (PIC)

Code that doesn't know where it lives - and doesn't need to.

The GetIp Trick

The foundation of PIC: "Where am I right now?" On x64, you can use RIP-relative addressing natively, but AceLdr uses a classic technique that has been a staple of shellcode development for decades:

ASM - from misc.asmGetIp:
    call   get_ret_ptr    ; CALL pushes the address of the next instruction

get_ret_ptr:
    pop    rax            ; RAX = address of get_ret_ptr (= our current location)
    sub    rax, 5         ; Adjust back to GetIp's address (CALL is 5 bytes)
    ret                   ; Return with RAX = address of GetIp()

The OFFSET Macro

With GetIp() giving us a known runtime anchor point, the OFFSET macro calculates the runtime address of any symbol:

C - from include.h// "Where is X right now, in this process's memory?"
#define OFFSET( x ) ( ULONG_PTR )( GetIp() - ( (ULONG_PTR)&GetIp - (ULONG_PTR)x ) )

// At compile time: &GetIp - x = distance between GetIp and x
// At runtime:      GetIp() returns actual address of GetIp
// So:              GetIp() - distance = actual address of x

Breaking Down the Math

Let's trace through a concrete example. Suppose at compile time:

• &GetIp = 0x1000 (compile-time address of GetIp)
• &Stub = 0x0800 (compile-time address of Stub)
• Distance = 0x1000 - 0x0800 = 0x200

At runtime, the code is loaded at a completely different location:

• GetIp() returns 0x7FFE3000 (actual runtime address)
• OFFSET(Stub) = 0x7FFE3000 - 0x200 = 0x7FFE2E00 (actual runtime address of Stub)

The Custom Linker Script

For the OFFSET macro to work correctly, AceLdr must control the exact layout of code in memory. Without a custom linker script, the linker is free to reorder functions, which would break all the distance calculations. AceLdr uses a linker script that assigns each component to a named subsection:

LD - from link.ldSECTIONS
{
    .text :
    {
        *( .text$A )    /* start.asm - Entry point (Start) */
        *( .text$B )    /* ace.c     - Loader/Ace functions */
        *( .text$C )    /* misc.asm  - Stub data + GetIp */
        *( .text$D )    /* hooks     - Sleep_Hook, Spoof hooks, Heap hook */
        *( .text$E )    /* util.c    - HashString, FindModule, etc. */
        *( .rdata* )    /* Read-only data (strings, etc.) */
        *( .text$F )    /* misc.asm  - GetIp impl + "ACELDR" marker */
    }
}

The SECTION() Macro

Each C function uses the SECTION() macro to declare which subsection it belongs to:

C - Section assignment macro#define SECTION( x ) __attribute__(( section( ".text$" #x ) ))

// Usage:
SECTION( B ) VOID Loader( VOID ) { ... }      // Goes into .text$B
SECTION( D ) VOID Sleep_Hook( ... ) { ... }    // Goes into .text$D
SECTION( E ) PVOID FindModule( ... ) { ... }   // Goes into .text$E

The __attribute__((section(...))) is a GCC/Clang extension that tells the compiler to place the function's code into the specified section instead of the default .text. The #x uses the C preprocessor's stringification operator to convert the argument to a string, so SECTION(B) becomes __attribute__((section(".text$B"))).

The ACELDR End Marker

After compilation, the extraction script needs to know where the shellcode ends. AceLdr places the string "ACELDR" at the very end of .text$F to serve as a delimiter:

ASM - from misc.asm[SECTION .text$F]
GetIp:
    call    get_ret_ptr
get_ret_ptr:
    pop    rax
    sub    rax, 5
    ret

Leave:
    db 'A', 'C', 'E', 'L', 'D', 'R'   ; End marker

The Python extraction script (extract.py) then finds this marker and extracts everything before it as the final shellcode blob:

Python - from extract.py# Find the marker and extract everything before it
PeSec = PeExe.sections[0].get_data()
ScRaw = PeSec[ : PeSec.find( b'ACELDR' ) ]  # Shellcode = bytes before marker