search

vfsfitvnm / intruducer

A Rust crate to load a shared library into a Linux process without using ptrace.
MIT License
126 stars 14 forks source link

Not possible to insert a library in a process started by a static linked executable. #4

Closed przemyslaw0 closed 4 months ago

przemyslaw0 commented 4 months ago

When the process is started by a static executable, libraries cannot be injected by intruducer.

$ PID="291769"
$ ./intruducer ${PID} --lib-path /home/me/Temp/preeny/build/lib/libensock.so
Error: LibraryNotFound("libc.so.6")

Is it a sane behavior? Any way to fix this?

vfsfitvnm commented 4 months ago

intruducer attempts to locate libc.so because of dlopen. If the target binary is linked statically (or it doesn't depend on libc), we cannot retrieve the base address of libc.so - just take a look at cat /proc/${PID}/maps.

I cannot think of an effective workaround unfortunately, but here are few ideas:

  1. Do not rely on dlopen and let intruducer dynamically link and load the target library ( :exploding_head: :gun: );
  2. (I don't even know whether it's possible, but here's the broad idea) If intruducer and the target share the same instruction set (= the processes are of the same class, 32 or 64 bit), make intruducer load libc.so and make it copy itself into the target memory. Now we have dlopen within the target process ( :exploding_head: :gun: );
  3. If the target depends on libc.so, we could scan the memory and look for dlopens signature(s) pattern (hoping it has not been stripped) ( :exploding_head: :gun: ).

PS: intruducer was a project for my bachelor's thesis, please consider it as a baby :sob:

przemyslaw0 commented 4 months ago

Ok, I got.