kubo / plthook

Hook function calls by replacing PLT(Procedure Linkage Table) entries.
745 stars 152 forks source link

Not found function "recv" and any functions from Socket API in libc #47

Closed ViacheslavN closed 1 year ago

ViacheslavN commented 1 year ago

@kubo Hello

Thanks for your project, I have a usage question, is it possible to intercept a function with STB_LOCAL binding, because it seems that these functions are not in PLT

Some code:

   plthook_t *plthook;
    if (plthook_open(&plthook, "libc.so.6") != 0) {
        printf("plthook_open error: %s\n", plthook_error());
        return -1;
    }
    if (plthook_replace(plthook, "recv", (void*)my_recv, NULL) != 0) {
        printf("plthook_replace error: %s\n", plthook_error());
        plthook_close(plthook);
        return -1;
    }
    plthook_close(plthook);
    return 0;
}
kubo commented 1 year ago

I have a usage question, is it possible to intercept a function with STB_LOCAL binding

No. In addition even if it is possible, the function will be intercepted only when the caller is in libc.so. It doesn't affect function calls by outside of libc. How about funchook instead?

ViacheslavN commented 1 year ago

How about funchook instead?

Yes, it works, thanks.