I want to alter a ELF executable function call and replace one of it's parameters. The executable calls dlopen() function and passes RTLD_NOW as the flag parameter. I want to change it to RTLD_LAZY.

What's the easiest way to detect the exact place where this call is done, and replacing the parameter.

I have to do it on production environment, so I only have GNU toolchain, gcc, gdb, etc.

  • 2
    Are you talking about permanently patching the executable or modifying at run time?
    – PSS
    Aug 3 '13 at 14:28
  • Both. At runtime to test it. And then persist it. Aug 3 '13 at 20:14
  • Theoretically LD_PRELOAD would be your friend, but given that dlopen is implemented within the loader, it's possible that this approach would fail.
    – 0xC0000022L
    Aug 4 '13 at 20:07

The easiest way to do this is with . Put a breakpoint on the dlopen function, and change the parameters (likely passed on the stack). RTLD_NOW is defined as 2. Simply change it by 1 (RTLD_LAZY).

To sum up, in gdb

breakpoint dlopen
set stack_memory_address = 1

Where stack_memory_address is the address of your mode parameter.

  • How do I save it, is it possible from gdb ? Aug 4 '13 at 19:39
  • 1
    You can use an hex-editor, seek to the offset that you broke on in GDB, and change the 2 in a 1.
    – jvoisin
    Oct 26 '13 at 14:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.