0

I am working on ELF-injector, which given some payload (currently it's an assembly file with .text section only) will inject it into ELF binary. I had related post here.

Now I would like to make it more usable and allow the payload call library functions linked by the victim (at least libc functions).

Note: I am changing first instructions of the entry point to execute my code first. Does it mean I cannot yet use dynamically linked functions?

1

For any external functions used (e.g. libc functions), there will exist a stub in the binary's PLT for said function. When the program calls the function, it jumps to the PLT stub, which correctly handles finding the address of the function the first time it is called.

For your purposes, you can read the PLT addresses or offsets from the binary, and use that for calling the library function. You could even use offsets to calculate addresses of and call functions that are not imported into the PLT.

Even if you are injecting at the entry point of the program before any boilerplate initialization code, the program is still only run after the runtime dynamic linker/interpreter (ld.so) has set up the dynamically linked libraries, so I think you should be fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.