10

I want to hook functions in a library (lib.so or lib.dylib) from another process. I know that unlike windows libraries, libraries in linux and mac still have their symbols (function names and parameters).

API Monitor(http://www.rohitab.com/apimonitor) allows you hook exported functions from other libraries but only for windows, which is somewhat of what i need.

Basically i want to hook certain functions in either linux or mac and see their parameters and order of calls.

Any help is appreciated!

  • That apimonitor software looks amazing. I did search apimonitor in google and came back with Valgrind – johndpope Jan 26 '16 at 13:31
9

You can simply export the environment variable LD_PRELOAD (on Linux) or DYLD_INSERT_LIBRARIES (on OS X) pointing to (the full path of) your library before running your target, like in this example:

https://stackoverflow.com/questions/6083337/overriding-malloc-using-the-ld-preload-mechanism

This is for hooking functions to do whatever you want (not to spy on function calls).

8

Check the trace family:

  • ltrace: a library tracer

  • strace: a kernel call (syscall) tracer

  • ptrace: a programmable tracer

and also:

6

For OS X, dtrace should do the trick. dtrace is supposed to exist for Linux as well, though I don’t know how well it is supported, and I believe there are other equivalent tools there.

  • i see examples of dtrace with system calls but none on other libraries. can dtrace be used for a game to see which functions are being called in a specific library (ex. engine.dylib) and perhaps its parameters as well. – TerryW May 27 '13 at 5:56
  • Yes, the pid provider can do this: dtrace.org/guide/chapter30.html – microtherion May 27 '13 at 15:01

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.