3

I am working on a project where I need to use LD_PRELOAD to load some libraries into the memory space.

It's like:

 LD_PRELOAD="./libapp.so" ./my_app

Due to certain reasons (I am actually working on some binary hacking), I must know the memory address (not a symbol) of certain functions (let's say, foo) in libapp.so and instrument the binary code of my_app before execution.

However, due to ASLR (Address Space Layout Randomization), each time libapp.so would be loaded into different memory address, and I am unable to know the memory address of foo before execution.

I am thinking to somehow intercept the loading time, readout the memory address of libapp.so, perform some instrumentation on my_app with the memory address of foo, and then load my_app into the memory space.

So here is my question: how to intercept the loading process and acquire the memory address of libapp.so?

  • gdb does have pending bps , solib events break etc does none of them work. bp xxx pending on , set solibevents x,y etc or do you mean you want to do it standalone if you are using ptrace apis u should be able to intercept loading events too ala gdb – blabb Aug 1 '17 at 2:56
1

I think that one option could be to use ptrace, for example you can use _dl_open() instead of LD_PRELOAD. Look at this example:

Another option could be to use gdb for do that, for example you have the possibility to set a pending breakpoint to foo and then run the program.

Another option could be turn off the ASLR, you can do it using the /proc/sys/kernel/randomize_va_space

To disable it you can run:

echo 0 | sudo tee /proc/sys/kernel/randomize_va_space

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.