Friday, December 20, 2013

Override function in shared library

Lets override write() in libc
#define _GNU_SOURCE /* for RTLD_NEXT */

static ssize_t (*libc_write)(int, const void *, size_t);

void init(void) __attribute__((constructor));
void init(void) {
    libc_write = dlsym(RTLD_NEXT, "write");
}

ssize_t write(int fd, const void *buf, size_t count) {
    // do what you want here
    return libc_write(fd, buf, count);
}
Then one needs to assemble .so and put it earlier than libc.so, something like
LD_PRELOAD=/path/to/so/with/our/write.so victim_program
See Function Attributes, dlsym(3).

No comments:

Post a Comment