test.c的
#include <stdio.h>
void libtest1(); //from libtest1.so
int main()
{
libtest1(); //calls puts() from libtest1.so twice
libtest1();
puts("-----------------------------");
return 0;
}
libtest1.c
#include <stdio.h>
void libtest1()
{
puts("libtest1: 1st call to the original puts()");
puts("libtest1: 2nd call to the original puts()");
}
libfaketest1.c
#include <stdio.h>
void func1()
{
puts("func 1 fakelib");
}
void libtest1()
{
puts("libfaketest1:1st call to the fake puts()");
puts("libfaketest1:2nd call to the fake puts()");
}
我将libtest1.c和libfaketest1.c编译为共享库:libtest1.so,libfaketest1.so。
test.c到Linux二进制文件与dependents libtest1.so,而不是libfaketest1.so!
在IDA中打开测试二进制文件
导入表:
Address Name
------- ----
0000000000600AD8 puts@@GLIBC_2.2.5
0000000000600ADC libtest1
0000000000600AE0 __libc_start_main@@GLIBC_2.2.5
0000000000600AE4 puts
0000000000600AE8 __libc_start_main
0000000000600AEC _ITM_deregisterTMCloneTable
0000000000600AF0 __gmon_start__
0000000000600AF4 _Jv_RegisterClasses
0000000000600AF8 _ITM_registerTMCloneTable
主:
.plt:0000000000400570 _libtest1 proc near ; CODE XREF: main+9p
.plt:0000000000400570 ; main+13p
.plt:0000000000400570 jmp cs:off_600AB0
.plt:0000000000400570 _libtest1 endp
......
.text:0000000000400696 ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:0000000000400696 public main
.text:0000000000400696 main proc near ; DATA XREF: _start+1Do
.text:0000000000400696 push rbp
.text:0000000000400697 mov rbp, rsp
.text:000000000040069A mov eax, 0
.text:000000000040069F call _libtest1
.text:00000000004006A4 mov eax, 0
.text:00000000004006A9 call _libtest1
.text:00000000004006AE mov edi, offset s ; "-----------------------------"
.text:00000000004006B3 call _puts
.text:00000000004006B8 mov eax, 0
.text:00000000004006BD pop rbp
.text:00000000004006BE retn
.text:00000000004006BE main endp
......
.got.plt:0000000000600AB0 off_600AB0 dq offset libtest1 ; DATA XREF: _libtest1r
......
extern:0000000000600ADC extrn libtest1:near ; DATA XREF: .got.plt:off_600AB0o
如何在不更换IDA中的原始lib libtest1.so的情况下连接二进制libfaketest1.so?
我想从libfaketest1.so调用函数.text:00000000004006A9 call _libtest1
。