如何在IDA中将其他库连接到二进制文件

时间:2016-02-26 09:21:17

标签: c assembly disassembly ida

test.c的

#include <stdio.h>
void libtest1();  //from libtest1.so

int main()
{
    libtest1();  //calls puts() from libtest1.so twice
    libtest1(); 
    puts("-----------------------------");
    return 0;
}

libtest1.c

#include <stdio.h>

void libtest1()
{
    puts("libtest1: 1st call to the original puts()");
    puts("libtest1: 2nd call to the original puts()");
}

libfaketest1.c

#include <stdio.h>
void func1()
{
    puts("func 1 fakelib");

}
void libtest1()
{
    puts("libfaketest1:1st call to the fake puts()");
    puts("libfaketest1:2nd call to the fake puts()");
}

我将libtest1.c和libfaketest1.c编译为共享库:libtest1.so,libfaketest1.so。

test.c到Linux二进制文件与dependents libtest1.so,而不是libfaketest1.so!

在IDA中打开测试二进制文件

导入表:

Address                  Name                           
-------                  ----                           
0000000000600AD8         puts@@GLIBC_2.2.5                     
0000000000600ADC         libtest1                              
0000000000600AE0         __libc_start_main@@GLIBC_2.2.5        
0000000000600AE4         puts                                  
0000000000600AE8         __libc_start_main                     
0000000000600AEC         _ITM_deregisterTMCloneTable           
0000000000600AF0         __gmon_start__                        
0000000000600AF4         _Jv_RegisterClasses                   
0000000000600AF8         _ITM_registerTMCloneTable 

主:

.plt:0000000000400570 _libtest1       proc near               ; CODE XREF: main+9p
.plt:0000000000400570                                         ; main+13p
.plt:0000000000400570                 jmp     cs:off_600AB0
.plt:0000000000400570 _libtest1       endp
......
.text:0000000000400696 ; int __cdecl main(int argc, const char **argv, const char **envp)
.text:0000000000400696                 public main
.text:0000000000400696 main            proc near               ; DATA XREF: _start+1Do
.text:0000000000400696                 push    rbp
.text:0000000000400697                 mov     rbp, rsp
.text:000000000040069A                 mov     eax, 0
.text:000000000040069F                 call    _libtest1
.text:00000000004006A4                 mov     eax, 0
.text:00000000004006A9                 call    _libtest1
.text:00000000004006AE                 mov     edi, offset s   ; "-----------------------------"
.text:00000000004006B3                 call    _puts
.text:00000000004006B8                 mov     eax, 0
.text:00000000004006BD                 pop     rbp
.text:00000000004006BE                 retn
.text:00000000004006BE main            endp
......
.got.plt:0000000000600AB0 off_600AB0      dq offset libtest1      ; DATA XREF: _libtest1r
......
extern:0000000000600ADC                 extrn libtest1:near     ; DATA XREF: .got.plt:off_600AB0o

如何在不更换IDA中的原始lib libtest1.so的情况下连接二进制libfaketest1.so? 我想从libfaketest1.so调用函数.text:00000000004006A9 call _libtest1

0 个答案:

没有答案