StackOverflow2013

Note that there are some explanatory texts on larger screens.

plurals

PO
text
Body
copied!<p>You can try <a href="https://github.com/j0k/fp" rel="nofollow">FILE_PRELOAD utility</a> which generate C++ code with hooks, compile and LD_PRELOAD it. After short look at it you can feel how easy to hook linux. Start point is <a href="https://github.com/j0k/fp/blob/master/docs/tut.sh" rel="nofollow">this tutorial</a>.</p> <p>For example, if you want to change 'open call' of file /tmp/some with /tmp/replace_with:</p> <pre><code>#: FILE_PRELOAD -C "A+f:/tmp/some:/tmp/replace_with" -- bash #: echo "HaHa" >> /tmp/some #: ll /tmp/some ls: cannot access /tmp/some: No such file or directory #: cat /tmp/replace_with HaHa </code></pre> <p>If you want to see the source of generated code just add "-p" to options.</p> <pre><code>#: FILE_PRELOAD -p -C "A+f:/tmp/some:/tmp/replace_with" -- bash </code></pre> <p>In additional all generated.cpp files you can find in /tmp/$USER/FILE_PRELOAD/cpp.</p> <p>Have a nice play with linux hooks)</p> <p>Generated code looks like this:</p> <pre><code>#include <sys/types.h> #include <dlfcn.h> #include <stdio.h> #include <map> #include <string> #define I int #define C char #define S string #define P printf #define R return using std::map; using std::string; typedef map<S,S> MAP; static I (*old_open)(const C *p, I flags, mode_t mode); extern "C" I open (const C *p, I flags, mode_t mode){ old_open = dlsym(RTLD_NEXT, "open"); P("open hook\n"); MAP files; files[p]=p; files["/tmp/some"]="/tmp/replace_with"; S newpath = files[S(p)]; R old_open(newpath.c_str(), flags, mode); } # &compile gcc -w -fpermissive -fPIC -c -Wall file.cpp gcc -shared file.o -ldl -lstdc++ -o wrap_loadfile.so LD_PRELOAD=./wrap_loadfile.so bash nm -D /lib/libc.so.6 | grep open # we hook this syscall </code></pre>

Querying!

Guidance

An individual column

Larger individual text columns get their own page to allow for proper reading.

SQuiL has stopped working due to an internal error.

If you are curious you may find further information in the browser console, which is accessible through the devtools (F12).

Reload