Follow a thread-local variable from its ELF initialization template to the current thread's memory. Decode four access models, watch the linker replace general code with fixed offsets, and reproduce the static TLS limit encountered by dynamically loaded libraries.

A return address is only the beginning. Decode real CIEs and FDEs, follow a C++ exception through its two phases, and see how the linker makes unwind information survive garbage collection and become searchable at runtime.

Discover the runtime contract behind shared libraries: PIC, GOT and PLT entries, relocation classes, lazy binding, RELRO, interposition, symbol versions, and loader search paths. Native experiments show which decisions survive until a program actually starts.

A code-only program is of little use. This lab adds read-only constants, initialized globals, BSS, and COMMON storage, describes them with three load segments of different permissions, and lets the kernel check the result: writing constants or executing data must end in SIGSEGV.

Follow an ELF file through kernel mappings, zero-filled memory, demand paging, the initial stack, and C runtime startup. Then watch static PIE relocate itself and malformed images reveal the loader's validation boundaries.

The previous executable could come only from one object with no relocations. This lab lets an assembly entry point call a C function compiled in another file: merge code sections, compute S+A-P for every field, and never leave a half-written field behind on failure.

Build the bridge from input sections to loadable segments. Compare GNU ld and LLD layouts, calculate file offsets and virtual addresses, trace section garbage collection, and test what happens when a linker script gets page permissions wrong.

Four stages have only read input. This lab writes output for the first time: plan a minimal executable image, serialize the ELF header and two program headers by hand, and let the Linux kernel run it and return 42.