Hooking functions in Linux and/or OSX?

Question

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in Linux and Mac still have their symbols (function names and parameters).

API Monitor allows you hook exported functions from other libraries but only for windows, which is somewhat of what I need.

Basically I want to hook certain functions in either Linux or mac and see their parameters and order of calls.

Any help is appreciated!

Answer 1

You can simply export the environment variable LD_PRELOAD (on Linux) or DYLD_INSERT_LIBRARIES (on OS X) pointing to (the full path of) your library before running your target, like in this example:

https://stackoverflow.com/questions/6083337/overriding-malloc-using-the-ld-preload-mechanism

This is for hooking functions to do whatever you want (not to spy on function calls).

Answer 2

Check the trace family:

• ltrace: a library tracer

• strace: a kernel call (syscall) tracer

• ptrace: a programmable tracer

and also:

• radare's itrace

Answer 3

For OS X, dtrace should do the trick. dtrace is supposed to exist for Linux as well, though I don’t know how well it is supported, and I believe there are other equivalent tools there.