On Monday I went to Hacker School, and as always it was the most fun time. I hung out with Chase and we had fun with dynamic linkers!
I'd been hearing for a while that you can override arbitrary function
calls in a program using an environment variable called
But I didn't realize how easy it was! Chase and I started using it and
we got it working in, like, 5 minutes!
I googled "LD_PRELOAD hacks", clicked on Dynamic linker tricks: Using LD_PRELOAD to cheat, inject features and investigate programs, and we were up and running.
The first example on that page has you write a new random function that always returns 42.
That is LITERALLY ALL THE CODE YOU HAVE TO WRITE. Then you
and now every program you run will always return 42 for rand()!
We did a bunch of investigations into how tmux works, which was super fun. Chase wrote it up on his blog, and now I understand about daemonization way better.
We very quickly ran into the question of "okay, what if you want to call
printf?" from your hacked printf? That's also explained
in the "Dynamic linker tricks" article! (in the "Being transparent"
Somebody explained to me at some point that if you work for the NSA and you're trying to spy on what information a program is using internally, tools like LD_PRELOAD are VERY USEFUL.
How it works
There is a very wonderful 20 part series about linkers that I am going to keep recommending to everyone forever.
When you start a dynamically linked program, it doesn't have all the code for the functions it needs! So what happens is:
- the program gets loaded into memory
- the dynamic linker figures out which other libraries that program
needs to run (
- it loads them into memory, too!
- it connects everything up
LD_PRELOAD is an environment variable that says "Whenever you look for
a function name, look in me first!". So if you didn't want your program
to be attacked like this, you could:
- statically link your program
- check for the
LD_PRELOADenvironment variable, and complain (though the attacker could also LD_PRELOAD the function that lets you read environment variables... :) )
I'm sure there will be more Exciting Stories about LD_PRELOAD for you all in the future, but this is all the stories I have for today.