This is an excellent read for using LD_PRELOAD on various platforms

http://neworder.box.sk/newsread.php?newsid=13857

and this also

http://datafarm.apgrid.org/software/latest/README.hook.en.txt

Read More...

Debug your applications without recompilation

Scenario:
You wanna debug an application but you dont have the code for it?
You suspect some functions that are failing, you dont feel like recompiling whole stuff in debug mode or put in print statements.

Solution:
Hook the APIs using LD_PRELOAD. (refer to my earlier post on hooking Linux)

Here is the code that I compiled into a .so which help me debug an issue in a binary. I wanted to get debug prints of a function that copies files to a directory. I needed to put print statements in the function, rather than that I used this method to get all copy commands being executed.

#include
#include
#include

#if defined(RTLD_NEXT)
#define REAL_LIBC RTLD_NEXT
#else
#define REAL_LIBC ((void *) -1L)
#endif

int system(char * command){
printf("Vij: system called - hacked\n");
static int (*o_dlconnect) ( char *command )=0;
o_dlconnect = (int(*)( char * )) dlsym(REAL_LIBC,"system"); printf("\n%s",command);
return (*o_dlconnect)( command );
}

Read More...

Linux API Hooking

Had some success today hooking APIs on linux.
Don't think that this is going to be a techy blog-site. Just pasting here for later references. Looks like blog site is quite handy repository.

Keywords: LD_PRELOAD, dlsym
http://sourceware.org/ml/libc-alpha/2001-05/msg00321.html

One more note:
LD_PRELOAD is supported for most of the UNIX flavors. I had tried it on HPUX in patni and it worked there.
read that it will work for SOLARIS and AIX also.

-----------------------------------------------------------

follow these 3 simple steps to hook APIs in Linux.

Step1: create a file with following code..say preload.c

//the blogger treats < as tags..removing < from include statements
#include dlfcn.h
#include stdio.h
#include sys/types.h
#include sys/socket.h

#if defined(RTLD_NEXT)
#define REAL_LIBC RTLD_NEXT
#else
#define REAL_LIBC ((void *) -1L)
#endif


int connect(int sockfd, const struct sockaddr *serv_addr, socklen_t
addrlen)
{
printf("NEOACCEL: connect hacked\n");
static int (*o_dlconnect) ( int sockfd, const struct sockaddr *serv_addr, socklen_t addrlen )=0;

printf( "dlopen was called\n" );
o_dlconnect = (int(*)( int sockfd, const struct sockaddr *serv_addr, socklen_t addrlen )) dlsym(REAL_LIBC,"connect");
return (*o_dlconnect)( sockfd, serv_addr, addrlen );

}

Step2: compile it using cmd line
gcc -Wall -fPIC -shared -o preload.so preload.c -ldl

Step3: Define env variable LD_PRELOAD as:
export LD_PRELOAD=absolute file-path of preload.so, inclding filename

and you are done....


some good respources:
http://neworder.box.sk/newsread.php?newsid=13857

http://www.security.nnov.ru/articles/reveng/

www.phrack.org

Read More...