Thursday, March 11, 2010

Linux functions hooking using LD_PRELOAD - for fun and profit

 Well... I had to log some calls for a specific function which calls some binary.
So, instead of doing it in the proper way, I've replaced the binary to call another binary and then to switch between them. It did work, 90% of the time, but some race conditions sometimes made it not effective.
That's when I've decided to use LD_PRELOAD and do a proper hook instead of binary replacing with shell script, which caused race conditions in about 10% of calls to that binary.

Well? It's sort of the same for any function. Take the function and its variables from the declaration do whatever you want and call the original function (if you want to have the original functionality).

Easy to write, and much better solution

Here's a piece of example

taken from : http://www.technovelty.org/code/c/override.html. Life saver!


Lesson learned, don't be lazy, do a proper hooks to avoid race conditions :)

3 comments:

Anonymous said...

izik wrote about it ages ago....check neworder for his full paper dude..

Zuk said...

haha.. I know it's not new/unique. just wanted to show my use of it when I thought to be lazy and not use it (and it caused me some race conditions). thanks anyways

Anonymous said...

Izik also came out with Smack the Stack before ROP was even a term. I mean, since we're felating him and all.

Post a Comment