'The linkmap is a chained structure created by the loader at runtime
which contains information on the names and load addresses osf all
libraries.
For non-RELRO binaries, a pointer to this is stored in the .got.plt
area.
For RELRO binaries, a pointer is additionally stored in the DT_DEBUG
area.'

def _find_linkmap(self, pltgot=None, debug=None):

    w = self.waitfor('Finding    linkmap')
    Got = {32: elf.Elf_i386_GOT, 64: elf.Elf_x86_64_GOT}[self.elfclass]
    r_debug = {32: elf.Elf32_r_debug, 64: elf.Elf64_r_debug}[self.elfclass]
    result = None
    if (not pltgot):
        w.status('Finding    linkmap:    DT_PLTGOT')
        pltgot = self._find_dt(constants.DT_PLTGOT)
    if pltgot:
        w.status('GOT.linkmap')
        result = self.leak.field(pltgot, Got.linkmap)
        w.status(('GOT.linkmap    %#x' % result))
    if (not result):
        debug = (debug or self._find_dt(constants.DT_DEBUG))
        if debug:
            w.status('r_debug.linkmap')
            result = self.leak.field(debug, r_debug.r_map)
            w.status(('r_debug.linkmap    %#x' % result))
    if (not (pltgot or debug)):
        w.failure('Could    not    find    DT_PLTGOT    or    DT_DEBUG')
        return None
    result = self._make_absolute_ptr(result)
    w.success(('%#x' % result))
    return result
