4

I want to alter a ELF executable function call and replace one of it's parameters. The executable calls dlopen() function and passes RTLD_NOW as the flag parameter. I want to change it to RTLD_LAZY.

What's the easiest way to detect the exact place where this call is done, and replacing the parameter.

I have to do it on production environment, so I only have GNU toolchain, gcc, gdb, etc.

3
  • 2
    Are you talking about permanently patching the executable or modifying at run time?
    – PSS
    Aug 3, 2013 at 14:28
  • Both. At runtime to test it. And then persist it. Aug 3, 2013 at 20:14
  • Theoretically LD_PRELOAD would be your friend, but given that dlopen is implemented within the loader, it's possible that this approach would fail.
    – 0xC0000022L
    Aug 4, 2013 at 20:07

1 Answer 1

2

The easiest way to do this is with . Put a breakpoint on the dlopen function, and change the parameters (likely passed on the stack). RTLD_NOW is defined as 2. Simply change it by 1 (RTLD_LAZY).

To sum up, in gdb

breakpoint dlopen
run
set stack_memory_address = 1
continue

Where stack_memory_address is the address of your mode parameter.

2
  • How do I save it, is it possible from gdb ? Aug 4, 2013 at 19:39
  • 1
    You can use an hex-editor, seek to the offset that you broke on in GDB, and change the 2 in a 1.
    – jvoisin
    Oct 26, 2013 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.