Ditto. Any technique that allows to intercept sys calls issued from a shared object file? At runtime, the shared object is dlopen'ed by main().

One candidate is to use static binary rewriting (e.g. dyninst). But as I tried, it throws an error (saying about r_debugCheck() failed). Wondering if anyone had experiences in this task.

  • What about pin and frida ? – w s Jul 21 '15 at 7:48
  • Can you name an example binary and shared object (including an exemplary syscall) from Ubuntu 14? It would help me to verify my solution before posting it. – langlauf.io Jul 22 '15 at 16:12
  • @ws pin and frida are dynamic rewriting techniques which work at runtime. but OP prefers static rewriting tools... – Richard Jul 22 '15 at 17:16
  • @stackoverflowwww one simple example is to have a main() calling dlopen to open the shared object and call its function after dlsym. In the shared object, for instance, it calls malloc which might further call brk() and mmap(); which are what I want to intercept. – Richard Jul 22 '15 at 17:19
  • @Richard could you point me to a concrete specific binary? I tried to find one but the dynamically loaded libs of my samples did not call malloc (or any other functions calling mmap or brk). Alternatively, you could give a link to a custom-made sample (source code + a coplete command or Makefile to compile and link it.). – langlauf.io Jul 22 '15 at 19:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.