What I have so far:

  • Application that injects my shared object into another process via ptrace
  • shared object hook that can hook functions like strcmp

What I'm trying to do:

  • call non-exported internal functions of the shared library
  • hook these functions

So far I've tried using tools like nm/objdump to dump the assembly. I've grabbed the mangled function names, and I'm attempting to call some of these functions. I've attempted to locate the function by using dlsym inside the hook, and it gives me an address. I've tried assigning the function pointer directly to that address, as well as adding that address to the shared object offset, but neither is returning properly.

I guess my first question is am I even going down the right path here trying to use dlsym? If I don't know the correct return type, and call the function what behavior would i be expecting to see? I was expecting an app crash but I'm not seeing that, which is making me wonder if the function is actually being called.

There's no java involved in this if it matters. Everything is c and the shared library is c++ app using a common framework.

  • Is the address returned by dlsym actually correct? – Igor Skochinsky Jul 8 '16 at 9:34
  • "I was expecting an app crash but I'm not seeing that, which is making me wonder if the function is actually being called." - Have you considered using adb to verify that the function is actually being called? – Jason Geffner Jul 8 '16 at 13:26
  • @IgorSkochinsky I guess I'm not entirely sure how to verify the address is correct other than the function being called like I expected. I guess my question is why would the address be wrong? I would expect the address returned to be either the correct address, or the correct address minus an offset, but if I'm missing something please enlighten me – Brett Thomas Jul 8 '16 at 20:03
  • @JasonGeffner I am connected and viewing logs via adb/android studio. I have log lines inserted all around the function setup and call, everything is good until i attempt to invoke the memory address returned from dlsym as a function and print the value I'm expecting to be returned. When I say I'm expecting an app crash, I guess I'm expecting that the error in the shared object injected into the application should cause a complete app crash. Is it possible everything is working as expected then and my return type is just wrong? – Brett Thomas Jul 8 '16 at 20:06
  • Try using adb/jdb to set a breakpoint on the target function to see if it gets called. – Jason Geffner Jul 8 '16 at 20:25

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Browse other questions tagged or ask your own question.