diff --git a/elf/rtld.c b/elf/rtld.c
index 4abc6dd4..5b2e0583 100644
--- a/elf/rtld.c
+++ b/elf/rtld.c
@@ -861,6 +861,329 @@ handle_ld_preload (const char *preloadlist, struct link_map *main_map)
   return npreloads;
 }
 
+
+// zk---
+struct elf_info {
+        Elf64_Ehdr *hdr;
+        Elf64_Shdr *sechdrs;
+        Elf64_Shdr *strhdr;
+        Elf64_Shdr *symsec;
+        char *secstrings;
+        char *strtab;
+        void *text_vhdr;
+        void *rodata_vhdr;
+	struct link_map *lmap;
+};
+
+#define BYTES_NOP1      0x90
+
+#define CALL_INSN_SIZE          5
+#define CALL_INSN_OPCODE        0xE8
+
+#define JMP32_INSN_SIZE         5
+#define JMP32_INSN_OPCODE       0xE9
+
+#define POKE_MAX_OPCODE_SIZE    10
+
+union text_poke_insn {
+        unsigned char text[POKE_MAX_OPCODE_SIZE];
+        struct {
+                unsigned char opcode;
+                int disp;
+        } __attribute__ ((packed));
+};
+
+static int text_gen_insn(const void *loc, const void *dest)
+{
+        union text_poke_insn *insn;
+
+        // ff 15 00 00 00 00       callq  *0x00(%rip)
+        if ((*(unsigned char *)(loc - 2) == 0xff) && (*(unsigned char *)(loc - 1) == 0x15)) {
+                insn = (union text_poke_insn *)(loc - 2);
+                insn->opcode = CALL_INSN_OPCODE;
+                insn->disp = (long)dest - (long)(loc - 2 + CALL_INSN_SIZE);
+                insn->text[5] = BYTES_NOP1;
+                return 0;
+        }
+	return -1;
+}
+
+static int rewrite_section_headers(struct elf_info *info)
+{
+        unsigned int i;
+        Elf64_Ehdr *hdr = info->hdr;
+        Elf64_Shdr *sechdrs = info->sechdrs;
+
+        /* This should always be true, but let's be sure. */
+        sechdrs[0].sh_addr = 0;
+
+        for (i = 1; i < hdr->e_shnum; i++) {
+                Elf64_Shdr *shdr = &sechdrs[i];
+                shdr->sh_addr = (size_t) hdr + shdr->sh_offset;
+        }
+
+        return 0;
+}
+
+static int resolve_symbol(struct link_map *l, const char *name, Elf64_Sym *sym)
+{
+	const ElfW(Sym) *ref = sym;
+	struct link_map *sym_map = NULL;
+        char buf[256] = {0};
+        for (int i = 0; ; i++) {
+                if (name[i] == '\0' || name[i] == '@')
+                        break;
+                buf[i] = name[i];
+        }
+        sym_map = _dl_lookup_symbol_x(buf, l, &ref, l->l_scope, 0, ELF_RTYPE_CLASS_EXTERN_PROTECTED_DATA, DL_LOOKUP_ADD_DEPENDENCY, NULL);
+	// TODO: use vhdr
+	if (ref != NULL) {
+        	sym->st_value = (Elf64_Addr)sym_map->l_addr + ref->st_value;
+	}
+        _dl_debug_printf("symbol: 0x%lx %s\n", (long)sym->st_value, name);
+        return 0;
+}
+
+static int simplify_symbols(struct elf_info *info)
+{
+        char *strtab = info->strtab;
+        Elf64_Shdr *symsec = info->symsec;
+        Elf64_Sym *syms = (void *)symsec->sh_addr;
+        unsigned long secbase = 0;
+        unsigned int i;
+        int ret = 0;
+
+        // .symtab
+        for (i = 1; i < symsec->sh_size / sizeof(Elf64_Sym); i++) {
+                Elf64_Sym *sym = syms + i;
+                const char *name = strtab + sym->st_name;
+
+                switch (sym->st_shndx) {
+                case SHN_COMMON:
+                case SHN_ABS:
+                        /* Don't need to do anything */
+                        break;
+
+                case SHN_UNDEF:
+                        ret = resolve_symbol(info->lmap, name, sym);
+                        break;
+
+                default:
+                        if ((ELF64_ST_TYPE(sym->st_info) == STT_SECTION) || (ELF64_ST_TYPE(sym->st_info) == STT_NOTYPE)) {
+                                break;
+                        }
+                        // local ELF FUNC
+                        if (ELF64_ST_TYPE(sym->st_info) == STT_FUNC) {
+                                secbase = (unsigned long)info->text_vhdr;
+                        }
+                        // TODO: rodata
+                        // local ELF OBJECT
+                        if (ELF64_ST_TYPE(sym->st_info) == STT_OBJECT) {
+                                secbase = (unsigned long)info->rodata_vhdr;
+                        }
+                        sym->st_value += secbase;
+                        _dl_debug_printf("symbol: 0x%lx %s 0x%x local\n", (long)sym->st_value, name, sym->st_info);
+
+                        break;
+                }
+        }
+
+        return ret;
+}
+
+static void relocate_rewrite_value(struct elf_info *info, Elf64_Rela *rel, void *loc)
+{
+        unsigned long val;
+
+        // GOT data offset to elf hdr
+        val = *(int *)loc - rel->r_addend + rel->r_offset;
+        val = (unsigned long)info->rodata_vhdr + val;
+        val = val - (unsigned long)loc + rel->r_addend;
+        memcpy(loc, &val, 4);
+}
+
+#if __has_attribute(__fallthrough__)
+# define fallthrough                    __attribute__((__fallthrough__))
+#else
+# define fallthrough                    do {} while (0)  /* fallthrough */
+#endif
+
+static int apply_relocate_add(Elf64_Shdr *shdr, struct elf_info *info)
+{
+        unsigned int i;
+        Elf64_Rela *rel_tab = (void *)shdr->sh_addr;
+        Elf64_Sym *sym;
+        void *loc;
+        int ret;
+
+        for (i = 0; i < shdr->sh_size / sizeof(Elf64_Rela); i++) {
+                Elf64_Rela *rel = rel_tab + i;
+                /* This is where to make the change */
+                loc = info->text_vhdr + rel->r_offset;
+                sym = (Elf64_Sym *)info->symsec->sh_addr + ELF64_R_SYM(rel->r_info);
+
+                _dl_debug_printf("type %x st_value %lx r_addend %lx loc %lx\n", (int)ELF64_R_TYPE(rel->r_info), sym->st_value,
+                       rel->r_addend, (unsigned long)loc);
+
+                switch (ELF64_R_TYPE(rel->r_info)) {
+                case R_X86_64_NONE:
+                case R_X86_64_PLT32:
+                        break;
+                case R_X86_64_GOTPCRELX:
+                        // ff 15 00 00 00 00       callq  *0x00(%rip)
+                        ret = text_gen_insn(loc, (const void *)sym->st_value);
+                        if (ret == 0)
+                                break;
+                        // 48 83 3d d2 fe 5f 00    cmpq   $0x0,0x5ffed2(%rip)
+			relocate_rewrite_value(info, rel, loc);
+                        break;
+                case R_X86_64_PC32:
+                        // SHN_COMMON STT_FUNC no need reloc
+                        if (ELF64_ST_TYPE(sym->st_info) == STT_FUNC)
+                                break;
+                        // STT_OBJECT
+                        // TODO: direct mov, do not use lea
+                        fallthrough;
+                case R_X86_64_GOTPCREL:
+                case R_X86_64_REX_GOTPCRELX:
+                        // sym may not exist, change data offset
+			relocate_rewrite_value(info, rel, loc);
+                        break;
+                default:
+                        _dl_debug_printf("invalid relocation target, type %x, loc %lx\n",
+                               (int)ELF64_R_TYPE(rel->r_info), (unsigned long)loc);
+                        return -1;
+                }
+        }
+        return 0;
+}
+
+static int apply_relocations(struct elf_info *info)
+{
+        Elf64_Shdr *sechdrs = info->sechdrs;
+        char *secstrings = info->secstrings;
+        unsigned int shnum = info->hdr->e_shnum;
+        unsigned int i;
+        int err = 0;
+
+        for (i = 1; i < shnum; i++) {
+                Elf64_Shdr *shdr = &sechdrs[i];
+
+                /* Not a valid relocation section? */
+                if (shdr->sh_info >= shnum)
+                        continue;
+
+                if (shdr->sh_type == SHT_RELA) {
+                        const char *name = secstrings + shdr->sh_name;
+                        if ((strcmp(name, ".rela.text") != 0) && (strcmp(name, ".rela.init") != 0))
+                                continue;
+                        _dl_debug_printf("relocation %s\n", name);
+                        err = apply_relocate_add(shdr, info);
+                }
+                if (err < 0)
+                        break;
+        }
+        return err;
+}
+
+static int read_elf_info(struct link_map *lmap, struct elf_info *info)
+{
+	int fd = -1;
+        int ret;
+        unsigned int i;
+        unsigned int index_str;
+        Elf64_Ehdr *hdr = NULL;
+        Elf64_Shdr *sechdrs = NULL;
+        Elf64_Shdr *strhdr;
+        void *buf;
+
+	_dl_debug_printf("\nzk--- relocation: %s, elf_info 0x%lx, link_map 0x%lx\n", DSO_FILENAME(lmap->l_name), (unsigned long)info, (unsigned long)lmap);
+	info->lmap = lmap;
+	fd = __open(DSO_FILENAME(lmap->l_name), O_RDONLY);
+	if (fd == -1) {
+		_dl_debug_printf("\nopen %s fail\n", DSO_FILENAME(lmap->l_name));
+		return -1;
+	}
+
+        ret = __lseek(fd, 0, SEEK_END);
+        buf = __mmap(0, ret, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_PRIVATE, fd, 0);
+        _dl_debug_printf("\nELF len %u, addr 0x%lx\n", ret, (unsigned long)buf);
+
+        hdr = (Elf64_Ehdr *) buf;
+        sechdrs = (void *)hdr + hdr->e_shoff;
+
+        // session header name string table
+        strhdr = &sechdrs[hdr->e_shstrndx];
+        info->secstrings = (void *)hdr + strhdr->sh_offset;
+
+        // .symtab
+        for (i = 1; i < hdr->e_shnum; i++) {
+                if (sechdrs[i].sh_type == SHT_SYMTAB) {
+                        info->symsec = &sechdrs[i];
+                        index_str = sechdrs[i].sh_link;
+                        info->strtab = (char *)hdr + sechdrs[index_str].sh_offset;
+                        break;
+                }
+        }
+
+        info->hdr = hdr;
+        info->sechdrs = sechdrs;
+        info->strhdr = strhdr;
+
+	close(fd);
+        return 0;
+}
+
+// zk---
+void dl_map_new_addr(struct link_map *main_map, ElfW(Addr) *user_entry)
+{
+	ElfW(Addr) text_layout, rodata_layout;
+	struct elf_info info_buf = {0};
+	struct elf_info *info = &info_buf;
+        int i;
+        Elf64_Phdr *elf_ppnt, *elf_phdata;
+	void *load_addr;
+
+	text_layout = (ElfW(Addr)) __mmap(0, 0x40000000, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_NORESERVE|MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB|(21 << MAP_HUGE_SHIFT), -1, 0);
+	rodata_layout = (ElfW(Addr)) __mmap(0, 0x40000000, PROT_READ|PROT_WRITE|PROT_EXEC, MAP_NORESERVE|MAP_PRIVATE|MAP_ANONYMOUS|MAP_HUGETLB|(21 << MAP_HUGE_SHIFT), -1, 0);
+
+	// cp text from ELF
+	read_elf_info(main_map, info);
+        load_addr = (void*)info->hdr;
+        elf_phdata = (Elf64_Phdr *)(load_addr + info->hdr->e_phoff);
+        for (i = 0, elf_ppnt = elf_phdata; i < info->hdr->e_phnum; i++, elf_ppnt++) {
+                if (elf_ppnt->p_type != PT_LOAD)
+                        continue;
+
+                // skip first LOAD segment
+                elf_ppnt++;
+                // text
+                info->text_vhdr = (void*)text_layout - elf_ppnt->p_offset;
+        	_dl_debug_printf("\n old user_entry 0x%lx\n", (unsigned long)*user_entry);
+		*user_entry = (ElfW(Addr))info->text_vhdr + info->hdr->e_entry;
+        	_dl_debug_printf("\n user_entry 0x%lx\n", (unsigned long)*user_entry);
+        	_dl_debug_printf("\n text 0x%lx\n", (unsigned long)text_layout);
+                memcpy((void*)text_layout, load_addr + elf_ppnt->p_offset, elf_ppnt->p_filesz);
+		//main_map->l_text_end = text_layout + elf_ppnt->p_memsz;
+                // rodata
+                elf_ppnt++;
+                info->rodata_vhdr = (void*)rodata_layout - elf_ppnt->p_offset;
+        	_dl_debug_printf("\n rodata dst 0x%lx src 0x%lx len 0x%lx\n", (unsigned long)rodata_layout, (unsigned long)main_map->l_addr + elf_ppnt->p_paddr, (unsigned long)elf_ppnt->p_memsz);
+                memcpy((void*)rodata_layout, (void*)main_map->l_addr + elf_ppnt->p_paddr, elf_ppnt->p_memsz);
+                // data
+                elf_ppnt++;
+                void *data_begin = (void*)rodata_layout + (elf_ppnt->p_paddr - (elf_ppnt - 1)->p_paddr);
+        	_dl_debug_printf("\n data dst 0x%lx src 0x%lx len 0x%lx\n", (unsigned long)data_begin, (unsigned long)main_map->l_addr + elf_ppnt->p_paddr, (unsigned long)elf_ppnt->p_memsz);
+                memcpy(data_begin, (void*)main_map->l_addr + elf_ppnt->p_paddr, elf_ppnt->p_memsz);
+
+                break;
+        }
+
+        rewrite_section_headers(info);
+        simplify_symbols(info);
+        apply_relocations(info);
+}
+
 static void
 dl_main (const ElfW(Phdr) *phdr,
 	 ElfW(Word) phnum,
@@ -2296,6 +2619,9 @@ ERROR: ld.so: object '%s' cannot be loaded as audit interface: %s; ignored.\n",
   _dl_unload_cache ();
 #endif
 
+// zk---
+dl_map_new_addr(main_map, user_entry);
+
   /* Once we return, _dl_sysdep_start will invoke
      the DT_INIT functions and then *USER_ENTRY.  */
 }
