In part one we explored a way of hooking
libc functions with deliberately aliased symbol names. This time we will look at a more generic technique.
Consider the following code.
Similar to Part 1, we can hook the write function by creating our own shared library and using the
LD_PRELOAD trick to load it before
Lets start off simple and just shadow the original function. It won’t do anything useful but it is a first step.
We can compile and run the code as so.
That’s cool. But how do we use the original
write function from within our hooking function?
Fortunately there is a standard library function called
dlsym which will find the address of a symbol at runtime. We can use this function to find the address of the other
write function and then call it from within our hooking code.
This is slightly more complicated than it needs to be. We define the
real_write function pointer as
static so that if this hooking function is called multiple times, the symbol lookup is done only once.
The function call to
dlsym with the
RTLD_NEXT argument is how we acquire the address of the real
write function. Unfortunately
RTLD_NEXT is considered a
GNU extension to the language so we must define
_GNU_SOURCE at the top.