search

kubo / plthook

Hook function calls by replacing PLT(Procedure Linkage Table) entries.
745 stars 152 forks source link

plthook_elf.c: plthook_open() fails on executables with local hint symbols (__INIT_ARRAY, _end) #29

Closed smichaku closed 4 years ago

smichaku commented 4 years ago

We came across an executable in which the plthook_open_by_handle() fails as dlsym() can't find the __INIT_ARRAY__ and _end symbols. The _end symbol seems to be local in the file:

micha ~/temp/plthook $ nm -CD example | egrep -w "__INIT_ARRAY__|_end"
0111ab6c b _end

It might be because this is executable was extracted from a UPX packed executable. Unlike _end the _start symbol is exported:

001b3d48 T _start

We currently added a call to dlsym(hndl, "_start") in order to make it work.

kubo commented 4 years ago

Thanks. _start is also checked in plthook_open_by_handle() now.