Changing parameter of function call in ELF executable

Question

I want to alter a ELF executable function call and replace one of it's parameters. The executable calls dlopen() function and passes RTLD_NOW as the flag parameter. I want to change it to RTLD_LAZY.

What's the easiest way to detect the exact place where this call is done, and replacing the parameter.

I have to do it on production environment, so I only have GNU toolchain, gcc, gdb, etc.

Answer 1

The easiest way to do this is with gdb. Put a breakpoint on the dlopen function, and change the parameters (likely passed on the stack). RTLD_NOW is defined as 2. Simply change it by 1 (RTLD_LAZY).

To sum up, in gdb

breakpoint dlopen
run
set stack_memory_address = 1
continue

Where stack_memory_address is the address of your mode parameter.