Injected by the kernel for both static and dynamic binaries, to accelerate the execution of certain system calls that do not necessarily have to run in kernel space.
With VDSO the system call interface is decided by the kernel:
- a stream of instructions to issue the system call is generated by the kernel in a special memory area (formatted as an ELF shared object)
- that memory area is mapped towards the end of the user address space
- libc searches for VDSO and if present will use it to issue the system call
The address printed by ldd is based on ldd attempting to load the binary at runtime and inspecting the real-time mappings, so the address is affected by ASLR.
vsyscalls
- “System calls” that run directly from user space, part of the VDSO
- Static data (e.g.
getpid()) - Dynamic data update by the kernel a in RW map of the VDSO (e.g.
gettimeofday(),time(), )