8 ms·

Using LD_PRELOAD to cheat, inject features and investigate programs

202 points by icyfox 3y ago

ale42 3y ago
This feature is used since ages by sudo to implement the noexec option, to prevent dynamically linked executables from executing further programs. At some point I took advantage of this (sudo allows specifying a custom .so file for the noexec function) to implement other restrictions in programs run by sudo (of course, there are always ways to go around them).
- Denvercoder9 3y ago
  Nowadays sudo uses seccomp filtering for its noexec option, which is enforced by the kernel and does not allow the workarounds that userspace-based solutions (including LD_PRELOAD) have.
  - ale42 3y ago
    Didn't know this, thanks for the info!
ranguna 3y ago
Amazing explanation, I've seen this env var in loads of places and I never really understood what it did. Thanks for this!
ghotli 3y ago
Worth mentioning that statically linked binaries prevent this attack vector. I won't weigh in on dynamic vs static in general but if you're shipping something you don't want fiddled with then maybe dynamic linking isn't what you're looking for. My favorite nasty hack along these lines was to inject a new implementation of gethostname via LD_PRELOAD as the simplest path to prevent a CI server from surfacing a hostname in a place it shouldn't be.
- klysm 3y ago
  I think this is a great entrypoint into the static/dynamic argument and I'd love to argue with some people about it. I believe dynamic used to make sense but no longer does in the vast majority of cases. Static binaries have their costs, but are so much easier to reason about.
  - kreetx 3y ago
    If dynamic libraries are compatible to what they did (when you developed the program) then why waste disk and RAM?
    - aidenn0 3y ago
      Because disk and RAM are cheap and that's a huge "If"
      - deleted 3y ago
        [deleted]
      - jonhohle 3y ago
        There’s also other security considerations. As an operator or builder, do you want to patch a library (say OpenSSL) to keep your system up to date or patch every binary. If changing a dependency requires rebuilding all consumers recursively, the there’s not a huge benefit.
        aidenn0 3y ago
        I think in the specific case of security issues, more bugs have been fixed by upgrading dynamic dependencies than introduced. That's just my gut feeling though, and I'd like to see data.
        rewmie 3y ago
        > I think in the specific case of security issues, more bugs have been fixed by upgrading dynamic dependencies than introduced. That's just your personal assertion, which is entirely baseless and unsubstantiated. It's ok to have beliefs, but instead of pushing them as truths you should at least start by doing some cursory research to see if they are even plausible. And yours isn't.
zX41ZdbW 3y ago
In ClickHouse, we forbid LD_PRELOAD and every similar variable: https://github.com/ClickHouse/ClickHouse/blob/master/programs/main.cpp#L336 https://github.com/ClickHouse/ClickHouse/blob/master/program... We also forbid dlopen - so even if some third-party library commits such an offense, it will be blocked: https://github.com/ClickHouse/ClickHouse/blob/master/programs/main.cpp#L410 https://github.com/ClickHouse/ClickHouse/blob/master/program...
- Racing0461 3y ago
  I get the first one but not the second one. Since you are just redirecting dlopen, aren't you just rewriting it for people that actually work on your codebase which then compiles? It doesn't actually block it from 3rd parties.
  - zX41ZdbW 3y ago
    It is the case when a library already uses dlopen in unusual code paths, but we want to make sure that code paths won't work. The examples are some authentication plugins.
    - blibble 3y ago
      all they have to do to beat your dlopen blocker is link against libdl statically one extra argument to the linker when they compile their plugin
      - Racing0461 3y ago
        I think p is just trying to prevent people from being shot in the foot as opposed to preventing malicious users ie hackers.
        josephcsible 3y ago
        You're not supposed to go to such lengths to stop people from shooting themselves in the foot, because when you do, you also stop people from doing clever things.
chatmasta 3y ago
Fun fact: proxychains uses LD_PRELOAD [0] to hook the necessary syscalls [1] for setting up a "proxy environment" for the wrapped program, e.g. `connect`, `gethostbyname`, `gethostbyaddr`, etc. (Note this also implies that it could be leaky in some cases when applied to a program that uses alternative syscalls to make an external connection, or a program that is not dynamically linked. I would not recommend depending on proxychains for any sort of opsec, even though it's often recommended as such a tool.) [0] https://github.com/haad/proxychains/blob/master/src/proxychains#L37 https://github.com/haad/proxychains/blob/master/src/proxycha... [1] https://github.com/haad/proxychains/blob/master/src/libproxychains.c https://github.com/haad/proxychains/blob/master/src/libproxy...
- autumn-antlers 3y ago
  The tup[1] build system also uses ldpreload injection as an aspect of its (additionally(?) FUSE-based) dependency-specification enforcement. 1: https://github.com/gittup/tup/blob/master/src/ldpreload/ldpreload.c https://github.com/gittup/tup/blob/master/src/ldpreload/ldpr...
- mamikk 3y ago
  There are a lot of small utilities which are built upon LD_PRELOAD, for example. - fakeroot: Gives the running program the impression that it is running as root, often used for example for building debian packages. This will let the build script create a directory tree which it believes is owned by root and then when that directory tree is packed by tar, tar will also see root as the owner and the .tar-archive will have root as the user/group for the files in the final debian package. - faketime: Gives the running program the impression that it is running at some specific time. Usefull for testing code during specific events like leap-years, etc. - eatmydata: Will ignore all fsync() and related system calls which ensures files are written to permanent storage. I have used this once for running a database during a testsuite, and databases are much faster when they do not have to wait for the data to reach permanent storage.
  - a-dub 3y ago
    tsocks: route all network traffic through a socks gateway with elegant per-process controls. (i guess a proxychains ancestor?)
pedrovhb 3y ago
A great framework for doing something along those lines is Frida (https://github.com/frida/frida https://github.com/frida/frida). Works on a bunch of stuff, including Android and iOS. Some global-ish certificate pinning bypasses work through Frida, by patching http libraries to not raise exceptions, accept system certificates, etc and just quietly hum along instead. Certificate unpinning in turn enables network MITM with mitmproxy, which makes it a lot quicker and easier to inspect, block, or modify network traffic. Funnily enough, I've seen much stronger obfuscation from reverse engineering from my cheap Tuya IoT devices app than from my bank app.
- LoganDark 3y ago
  > Funnily enough, I've seen much stronger obfuscation from reverse engineering from my cheap Tuya IoT devices app than from my bank app. IMHO, if the client-side of an IoT service is obfuscated, I'd take that as a sign that they're trying to hide some really insecure API endpoints.
spc476 3y ago
I used LD_PRELOAD to test system call failure code paths in a program (https://boston.conman.org/2022/12/21.1 https://boston.conman.org/2022/12/21.1) that would otherwise be difficult to test.
quags 3y ago
The first security program I remember when I started playing with Linux around 99 was called libsafe which used ld preload to intercept calls on the fly to prevent buffer overflows.
- Dwedit 3y ago
  Windows has "Application Verifier" which can turn out-of-bounds writes that are past the end of memory into access violation exceptions.
alaxapta7 3y ago
I used LD_PRELOAD for patching RCE vulnerability in PunkBuster[0]. They did patch the exploit, but that didn't involve many of the older games they dropped support for. The AC itself isn't effective or even operational for the most part in those, but it still serves as a reliable method of identifying players. Even their server libraries are obfuscated, and hooking open() turned out to be just easier than trying to patch the binaries themselves. [0] https://medium.com/@prizmant/hacking-punkbuster-e22e6cf2f36e https://medium.com/@prizmant/hacking-punkbuster-e22e6cf2f36e
Dwedit 3y ago
On Windows, you can start a process suspended, then inject a DLL into it before the entry point even loads. That DLL can basically do anything to override the behavior of the program.
ben0x539 3y ago
On unixy systems, they put a restriction into Nethack to limit the game's "wizard mode" (the fuck-around mode where you can't die and just create all kinds of stuff out of thin air, etc) to the unix user with the username "wizard": https://nethackwiki.com/wiki/Wizard_mode#Unix https://nethackwiki.com/wiki/Wizard_mode#Unix The wiki describes a bunch of ways around this, but they all seemed kinda finicky and annoying, so instead I LD_PRELOADed a shim that made getpwent(3) or whatever it used always return "wizard" as the user name.
coppsilgold 3y ago
LD_PRELOAD relies on a naive target. A target can be crafted to bypass LD_PRELOAD - it can be as simple as statically linking the target. Also, dynamically linked targets are not guaranteed to be naive. The target can still directly issue syscalls that LD_PRELOAD was intended to interdict (by displacing a higher level function in a library). ptrace or SECCOMP_RET_TRAP can be used to do syscall interception. But that would be somewhat complex in comparison to the ease of use of LD_PRELOAD. gVisor[1] is a project which intercepts every syscall with the method above and services the syscall by itself (no passthrough) for the purpose of sandboxing. You can also use eBPF to audit and meddle with syscalls. [1] https://gvisor.dev/blog/2023/04/28/systrap-release/ https://gvisor.dev/blog/2023/04/28/systrap-release/
- skitter 3y ago
  Similarly ldd – which is mentioned in the article – works by setting LD_TRACE_LOADED_OBJECTS, which then gets picked up by Linux's dynamic linker, so any program that doesn't use it can just do whatever instead.
Cloudef 3y ago
I used LD_PRELOAD to make things not crash on openpandora, and to make valid EGL context https://gist.github.com/Cloudef/5788729 https://gist.github.com/Cloudef/5788729
wyldfire 3y ago
Interesting blog post by Fangrui Song "ELF interposition and -Bsymbolic" [1] - talks about the real world cost of this feature that's imposed by ELF. On one hand it enables incredible extensibility, OTOH codegen is obligated to be pessimistic about resolving symbols. [1]https://maskray.me/blog/2021-05-16-elf-interposition-and-bsymbolic https://maskray.me/blog/2021-05-16-elf-interposition-and-bsy...
lifthrasiir 3y ago
Another use of LD_PRELOAD is to alter the shared object loading order. This is particularly useful for working around TLS shortage from shared objects [1]. [1] E.g. https://bugzilla.redhat.com/show_bug.cgi?id=1722181 https://bugzilla.redhat.com/show_bug.cgi?id=1722181
grishka 3y ago
The macOS equivalent is DYLD_INSERT_LIBRARIES. You can then use Objective C reflection from your library to patch someone else's app by replacing method implementations for example.
- lloeki 3y ago
  Note that darwin prevents dylib injection in certain scenarios. https://web.archive.org/web/20161007013145/http://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html https://web.archive.org/web/20161007013145/http://pewpewthes... IIRC it has been further tightened since the above was written. DYLD_INTERPOSE is now a thing, DYLD_LIBRARY_PATH and DYLD_INSERT_LIBRARIES may be silently ignored and dropped from the env. https://apple.stackexchange.com/questions/421306/exporting-dyld-insert-libraries-for-libgmalloc-not-working-on-big-sur https://apple.stackexchange.com/questions/421306/exporting-d...
kristopolous 3y ago
Used to use it all the time for debugging back in the day when I could write Linux apps in C professionally and not just build dumb webpages.
alex_smart 3y ago
This reminds me of the first internship I did. It was at an AI based anamoly detection startup. Their pipeline for the biggest client used to run in just under 3 hours, most of which was apparently spent extracting meaningful information from sensor data from a proprietary binary format using a shared library provided by the client. Ran it under perf and found that most of the time was spent calculating a bunch of sines and cosines. Used the LD_PRELOAD trick to log the sine and cosine calls and turns out that we were just calculating the sines and cosines of the same set of angles over and over again literally thousands of times. Wrote a wrapper to cache the values of sines and cosines in a table and return the cached value if it is already calculated and brought the running time of the pipeline to under 15 minutes. Which meant that the data science team could run their experiments and iterate on their model much faster and cheaper. Fun times.
- ditsuke 3y ago
  Wow, that sounds like a fun place to work at!
  - ahoka 3y ago
    Almost any workplace is like that if you can, want and allowed to create value.
    - rewmie 3y ago
      > Almost any workplace is like that if (...) Most people aren't that fortunate. There are good reasons why the word "job" is not synonymous with "fun".
      - ahoka 3y ago
        I have assumed a software development workplace here.
  - alex_smart 3y ago
    It was, and great colleagues too! Although this wasn't "assigned" work. Just me being curious/bored.
Slartie 3y ago
I've implemented some sort of "poor man's Docker" using LD_PRELOAD, back then in 2011 when Docker wasn't a thing. It works by overriding getaddrinfo (IIRC) and capturing name lookups of "localhost", which are then answered by an IP address that's taken from an env variable. The intended use is the parallelization of automated testing of a distributed system: by creating lots of loopback devices with individual IPs and assigning those to test processes (via the LD_PRELOAD hack), I could suddenly test as many instances of the software system next to each other as I wanted, on the same machine (the test machine was some beefy dual-socket server with lots of CPU cores and RAM). Each instance (which consists of clients and several processes that provide server services, thus they're by default configured to bind themselves to specific ports on localhost, as it is common for dev and test purposes) would then be able to route its traffic over its own loopback device, and I was spared of having to somehow untangle the server ports of all the different services just in order to be able to parallelize them on a single machine and of the configuration hell that would have come with this. It helped that processes by default inherit the env variables from their parents that spawned them - that made it a lot easier to propagate the preload path and the env variable containing the loopback IP to use. I just had to provide it to the top-most process, basically. Today, one would use Docker for this exact purpose, putting each test run into its own container (or even multiple containers).
H8crilA 3y ago
Inspecting library calls has been automated in `ltrace`. It works like ptrace, but tracks all dynamic symbol calls instead of all syscalls. Making your own LD_PRELOAD takes more time. Though it is more flexible. LD_PRELOAD can also be used to turn an executable binary into a library. You have to intercept __libc_start_main(), provide your own custom main(), then call whatever functions from the binary your heart desires. You may need to use raw function addresses taken from some IDA or other Ghidra, as the binary is not required to export symbols.
egberts1 3y ago
Use libmusl instead of libc, and LD_PRELOAD becomes no more; enough said. https://www.musl-libc.org/ https://www.musl-libc.org/
- menthe 3y ago
  Absolutely no relation to the topic whatsoever. Statically linked binaries also prevent this, that’s not the point. And musl is far from being a 1:1 replacement from glibc, by design - many of the options just aren’t supported, e.g only a subset of resolv.conf options (and not single-request-reopen which very typically was used to work around kernel race conditions on dns resolution in k8s envs)
anonymousDan 3y ago
On a related note, I recently came across this ingenious high-performance technique for system call hooking: https://www.usenix.org/conference/atc23/presentation/yasukata https://www.usenix.org/conference/atc23/presentation/yasukat...
maximaximal 3y ago
We've built a tool using LD_PRELOAD that speeds up SAT and QBF solvers (but the same idea could be used to speed up other programs too). The idea is to fork, then LD_PRELOAD the other program and overwrite its read functions (and equivalents to also capture inlined read functions). The child process loads some solver which will try to read its input from STDIN. The overwritten read is triggered and instead of just reading, our library shim connects to the parent process. The parent process feeds the child with data, the shim converting the data into text, feeding it to the solver as if it would be reading from a file. Now once we are finished with stating the problem and want to query it (i.e. send assumptions, in QBF or SAT solver speech), we issue a fork command, which lets the child process fork again into a second process, while the solver program thinks it is still in the read() call. We then feed the assumptions only to this grandchild, close its STDIN, and return the result to the calling parent process. When there's another assumption, we can issue the fork again and send assumptions to the new instance, never having to process the full problem again This is nice when the formula is large and the assumptions are small and numerous, which (e.g. for parallelization) was very useful in our research. The copy on write nature of fork() of course also helps, effectively reducing the required RAM to keep solvers in memory. The best of all this, it works remarkably well on Linux and is even (mostly) POSIX conforming! Check out our paper: https://ceur-ws.org/Vol-3201/paper1.pdf https://ceur-ws.org/Vol-3201/paper1.pdf Or just the code: https://github.com/maximaximal/quapi https://github.com/maximaximal/quapi
OnlyMortal 3y ago
I suspect the program you’re trying to crack would check that environment variable, refusing to run if it’s set. This assumes there’s some copy protection on it.
tinix 3y ago
one of my favorite hacks, which started as a joke, is using LD PRELOAD to generate audio from memory allocation and read calls. https://github.com/gordol/ld_preload-sounds https://github.com/gordol/ld_preload-sounds this started out as like 10-20 lines of terrible code originally, and a few people sent merge requests to improve it
_8j50 3y ago
I'll die on the hill that LD_PRELOAD not being optional is a glibc bug that should at least be fixed by distros.
aatharuv 3y ago
2 decades ago, when X windows support for Indian language display in Unicode was spotty at best, I'd created an LD_PRELOAD hack, libxindic, to do character reordering for mostly correct display (It really didn't do the right thing with Tamil as Tamil ligates the -u and -uu matras to the base characters. It was useful back then, and even worked with Mozilla (but was a bit unstable). http://www.mit.edu/afs/sipb/user/aatharuv/projects/xindic/ http://www.mit.edu/afs/sipb/user/aatharuv/projects/xindic/

202 points by icyfox 3y ago

This feature is used since ages by sudo to implement the noexec option, to prevent dynamically linked executables from executing further programs. At some point I took advantage of this (sudo allows specifying a custom .so file for the noexec function) to implement other restrictions in programs run by sudo (of course, there are always ways to go around them).

Denvercoder9 3y ago
Nowadays sudo uses seccomp filtering for its noexec option, which is enforced by the kernel and does not allow the workarounds that userspace-based solutions (including LD_PRELOAD) have.
- ale42 3y ago
  Didn't know this, thanks for the info!

ranguna 3y ago

Amazing explanation, I've seen this env var in loads of places and I never really understood what it did. Thanks for this!

ghotli 3y ago

Worth mentioning that statically linked binaries prevent this attack vector. I won't weigh in on dynamic vs static in general but if you're shipping something you don't want fiddled with then maybe dynamic linking isn't what you're looking for. My favorite nasty hack along these lines was to inject a new implementation of gethostname via LD_PRELOAD as the simplest path to prevent a CI server from surfacing a hostname in a place it shouldn't be.

klysm 3y ago
I think this is a great entrypoint into the static/dynamic argument and I'd love to argue with some people about it. I believe dynamic used to make sense but no longer does in the vast majority of cases. Static binaries have their costs, but are so much easier to reason about.
- kreetx 3y ago
  If dynamic libraries are compatible to what they did (when you developed the program) then why waste disk and RAM?
  - aidenn0 3y ago
    Because disk and RAM are cheap and that's a huge "If"
    - deleted 3y ago
      [deleted]
    - jonhohle 3y ago
      There’s also other security considerations. As an operator or builder, do you want to patch a library (say OpenSSL) to keep your system up to date or patch every binary. If changing a dependency requires rebuilding all consumers recursively, the there’s not a huge benefit.
      - aidenn0 3y ago
        I think in the specific case of security issues, more bugs have been fixed by upgrading dynamic dependencies than introduced. That's just my gut feeling though, and I'd like to see data.
        rewmie 3y ago
        > I think in the specific case of security issues, more bugs have been fixed by upgrading dynamic dependencies than introduced. That's just your personal assertion, which is entirely baseless and unsubstantiated. It's ok to have beliefs, but instead of pushing them as truths you should at least start by doing some cursory research to see if they are even plausible. And yours isn't.

zX41ZdbW 3y ago

In ClickHouse, we forbid LD_PRELOAD and every similar variable: https://github.com/ClickHouse/ClickHouse/blob/master/programs/main.cpp#L336 https://github.com/ClickHouse/ClickHouse/blob/master/program... We also forbid dlopen - so even if some third-party library commits such an offense, it will be blocked: https://github.com/ClickHouse/ClickHouse/blob/master/programs/main.cpp#L410 https://github.com/ClickHouse/ClickHouse/blob/master/program...

Racing0461 3y ago
I get the first one but not the second one. Since you are just redirecting dlopen, aren't you just rewriting it for people that actually work on your codebase which then compiles? It doesn't actually block it from 3rd parties.
- zX41ZdbW 3y ago
  It is the case when a library already uses dlopen in unusual code paths, but we want to make sure that code paths won't work. The examples are some authentication plugins.
  - blibble 3y ago
    all they have to do to beat your dlopen blocker is link against libdl statically one extra argument to the linker when they compile their plugin
    - Racing0461 3y ago
      I think p is just trying to prevent people from being shot in the foot as opposed to preventing malicious users ie hackers.
      - josephcsible 3y ago
        You're not supposed to go to such lengths to stop people from shooting themselves in the foot, because when you do, you also stop people from doing clever things.

chatmasta 3y ago

Fun fact: proxychains uses LD_PRELOAD [0] to hook the necessary syscalls [1] for setting up a "proxy environment" for the wrapped program, e.g. `connect`, `gethostbyname`, `gethostbyaddr`, etc. (Note this also implies that it could be leaky in some cases when applied to a program that uses alternative syscalls to make an external connection, or a program that is not dynamically linked. I would not recommend depending on proxychains for any sort of opsec, even though it's often recommended as such a tool.) [0] https://github.com/haad/proxychains/blob/master/src/proxychains#L37 https://github.com/haad/proxychains/blob/master/src/proxycha... [1] https://github.com/haad/proxychains/blob/master/src/libproxychains.c https://github.com/haad/proxychains/blob/master/src/libproxy...

autumn-antlers 3y ago
The tup[1] build system also uses ldpreload injection as an aspect of its (additionally(?) FUSE-based) dependency-specification enforcement. 1: https://github.com/gittup/tup/blob/master/src/ldpreload/ldpreload.c https://github.com/gittup/tup/blob/master/src/ldpreload/ldpr...
mamikk 3y ago
There are a lot of small utilities which are built upon LD_PRELOAD, for example. - fakeroot: Gives the running program the impression that it is running as root, often used for example for building debian packages. This will let the build script create a directory tree which it believes is owned by root and then when that directory tree is packed by tar, tar will also see root as the owner and the .tar-archive will have root as the user/group for the files in the final debian package. - faketime: Gives the running program the impression that it is running at some specific time. Usefull for testing code during specific events like leap-years, etc. - eatmydata: Will ignore all fsync() and related system calls which ensures files are written to permanent storage. I have used this once for running a database during a testsuite, and databases are much faster when they do not have to wait for the data to reach permanent storage.
- a-dub 3y ago
  tsocks: route all network traffic through a socks gateway with elegant per-process controls. (i guess a proxychains ancestor?)

pedrovhb 3y ago

A great framework for doing something along those lines is Frida (https://github.com/frida/frida https://github.com/frida/frida). Works on a bunch of stuff, including Android and iOS. Some global-ish certificate pinning bypasses work through Frida, by patching http libraries to not raise exceptions, accept system certificates, etc and just quietly hum along instead. Certificate unpinning in turn enables network MITM with mitmproxy, which makes it a lot quicker and easier to inspect, block, or modify network traffic. Funnily enough, I've seen much stronger obfuscation from reverse engineering from my cheap Tuya IoT devices app than from my bank app.

LoganDark 3y ago
> Funnily enough, I've seen much stronger obfuscation from reverse engineering from my cheap Tuya IoT devices app than from my bank app. IMHO, if the client-side of an IoT service is obfuscated, I'd take that as a sign that they're trying to hide some really insecure API endpoints.

spc476 3y ago

I used LD_PRELOAD to test system call failure code paths in a program (https://boston.conman.org/2022/12/21.1 https://boston.conman.org/2022/12/21.1) that would otherwise be difficult to test.

quags 3y ago

The first security program I remember when I started playing with Linux around 99 was called libsafe which used ld preload to intercept calls on the fly to prevent buffer overflows.

Dwedit 3y ago
Windows has "Application Verifier" which can turn out-of-bounds writes that are past the end of memory into access violation exceptions.

alaxapta7 3y ago

I used LD_PRELOAD for patching RCE vulnerability in PunkBuster[0]. They did patch the exploit, but that didn't involve many of the older games they dropped support for. The AC itself isn't effective or even operational for the most part in those, but it still serves as a reliable method of identifying players. Even their server libraries are obfuscated, and hooking open() turned out to be just easier than trying to patch the binaries themselves. [0] https://medium.com/@prizmant/hacking-punkbuster-e22e6cf2f36e https://medium.com/@prizmant/hacking-punkbuster-e22e6cf2f36e

Dwedit 3y ago

On Windows, you can start a process suspended, then inject a DLL into it before the entry point even loads. That DLL can basically do anything to override the behavior of the program.

ben0x539 3y ago

On unixy systems, they put a restriction into Nethack to limit the game's "wizard mode" (the fuck-around mode where you can't die and just create all kinds of stuff out of thin air, etc) to the unix user with the username "wizard": https://nethackwiki.com/wiki/Wizard_mode#Unix https://nethackwiki.com/wiki/Wizard_mode#Unix The wiki describes a bunch of ways around this, but they all seemed kinda finicky and annoying, so instead I LD_PRELOADed a shim that made getpwent(3) or whatever it used always return "wizard" as the user name.

coppsilgold 3y ago

LD_PRELOAD relies on a naive target. A target can be crafted to bypass LD_PRELOAD - it can be as simple as statically linking the target. Also, dynamically linked targets are not guaranteed to be naive. The target can still directly issue syscalls that LD_PRELOAD was intended to interdict (by displacing a higher level function in a library). ptrace or SECCOMP_RET_TRAP can be used to do syscall interception. But that would be somewhat complex in comparison to the ease of use of LD_PRELOAD. gVisor[1] is a project which intercepts every syscall with the method above and services the syscall by itself (no passthrough) for the purpose of sandboxing. You can also use eBPF to audit and meddle with syscalls. [1] https://gvisor.dev/blog/2023/04/28/systrap-release/ https://gvisor.dev/blog/2023/04/28/systrap-release/

skitter 3y ago
Similarly ldd – which is mentioned in the article – works by setting LD_TRACE_LOADED_OBJECTS, which then gets picked up by Linux's dynamic linker, so any program that doesn't use it can just do whatever instead.

Cloudef 3y ago

I used LD_PRELOAD to make things not crash on openpandora, and to make valid EGL context https://gist.github.com/Cloudef/5788729 https://gist.github.com/Cloudef/5788729

wyldfire 3y ago

Interesting blog post by Fangrui Song "ELF interposition and -Bsymbolic" [1] - talks about the real world cost of this feature that's imposed by ELF. On one hand it enables incredible extensibility, OTOH codegen is obligated to be pessimistic about resolving symbols. [1]https://maskray.me/blog/2021-05-16-elf-interposition-and-bsymbolic https://maskray.me/blog/2021-05-16-elf-interposition-and-bsy...

lifthrasiir 3y ago

Another use of LD_PRELOAD is to alter the shared object loading order. This is particularly useful for working around TLS shortage from shared objects [1]. [1] E.g. https://bugzilla.redhat.com/show_bug.cgi?id=1722181 https://bugzilla.redhat.com/show_bug.cgi?id=1722181

grishka 3y ago

The macOS equivalent is DYLD_INSERT_LIBRARIES. You can then use Objective C reflection from your library to patch someone else's app by replacing method implementations for example.

lloeki 3y ago
Note that darwin prevents dylib injection in certain scenarios. https://web.archive.org/web/20161007013145/http://pewpewthespells.com/blog/blocking_code_injection_on_ios_and_os_x.html https://web.archive.org/web/20161007013145/http://pewpewthes... IIRC it has been further tightened since the above was written. DYLD_INTERPOSE is now a thing, DYLD_LIBRARY_PATH and DYLD_INSERT_LIBRARIES may be silently ignored and dropped from the env. https://apple.stackexchange.com/questions/421306/exporting-dyld-insert-libraries-for-libgmalloc-not-working-on-big-sur https://apple.stackexchange.com/questions/421306/exporting-d...

kristopolous 3y ago

Used to use it all the time for debugging back in the day when I could write Linux apps in C professionally and not just build dumb webpages.

alex_smart 3y ago

This reminds me of the first internship I did. It was at an AI based anamoly detection startup. Their pipeline for the biggest client used to run in just under 3 hours, most of which was apparently spent extracting meaningful information from sensor data from a proprietary binary format using a shared library provided by the client. Ran it under perf and found that most of the time was spent calculating a bunch of sines and cosines. Used the LD_PRELOAD trick to log the sine and cosine calls and turns out that we were just calculating the sines and cosines of the same set of angles over and over again literally thousands of times. Wrote a wrapper to cache the values of sines and cosines in a table and return the cached value if it is already calculated and brought the running time of the pipeline to under 15 minutes. Which meant that the data science team could run their experiments and iterate on their model much faster and cheaper. Fun times.

ditsuke 3y ago
Wow, that sounds like a fun place to work at!
- ahoka 3y ago
  Almost any workplace is like that if you can, want and allowed to create value.
  - rewmie 3y ago
    > Almost any workplace is like that if (...) Most people aren't that fortunate. There are good reasons why the word "job" is not synonymous with "fun".
    - ahoka 3y ago
      I have assumed a software development workplace here.
- alex_smart 3y ago
  It was, and great colleagues too! Although this wasn't "assigned" work. Just me being curious/bored.

Slartie 3y ago

I've implemented some sort of "poor man's Docker" using LD_PRELOAD, back then in 2011 when Docker wasn't a thing. It works by overriding getaddrinfo (IIRC) and capturing name lookups of "localhost", which are then answered by an IP address that's taken from an env variable. The intended use is the parallelization of automated testing of a distributed system: by creating lots of loopback devices with individual IPs and assigning those to test processes (via the LD_PRELOAD hack), I could suddenly test as many instances of the software system next to each other as I wanted, on the same machine (the test machine was some beefy dual-socket server with lots of CPU cores and RAM). Each instance (which consists of clients and several processes that provide server services, thus they're by default configured to bind themselves to specific ports on localhost, as it is common for dev and test purposes) would then be able to route its traffic over its own loopback device, and I was spared of having to somehow untangle the server ports of all the different services just in order to be able to parallelize them on a single machine and of the configuration hell that would have come with this. It helped that processes by default inherit the env variables from their parents that spawned them - that made it a lot easier to propagate the preload path and the env variable containing the loopback IP to use. I just had to provide it to the top-most process, basically. Today, one would use Docker for this exact purpose, putting each test run into its own container (or even multiple containers).

H8crilA 3y ago

Inspecting library calls has been automated in `ltrace`. It works like ptrace, but tracks all dynamic symbol calls instead of all syscalls. Making your own LD_PRELOAD takes more time. Though it is more flexible. LD_PRELOAD can also be used to turn an executable binary into a library. You have to intercept __libc_start_main(), provide your own custom main(), then call whatever functions from the binary your heart desires. You may need to use raw function addresses taken from some IDA or other Ghidra, as the binary is not required to export symbols.

egberts1 3y ago

Use libmusl instead of libc, and LD_PRELOAD becomes no more; enough said. https://www.musl-libc.org/ https://www.musl-libc.org/

menthe 3y ago
Absolutely no relation to the topic whatsoever. Statically linked binaries also prevent this, that’s not the point. And musl is far from being a 1:1 replacement from glibc, by design - many of the options just aren’t supported, e.g only a subset of resolv.conf options (and not single-request-reopen which very typically was used to work around kernel race conditions on dns resolution in k8s envs)

anonymousDan 3y ago

On a related note, I recently came across this ingenious high-performance technique for system call hooking: https://www.usenix.org/conference/atc23/presentation/yasukata https://www.usenix.org/conference/atc23/presentation/yasukat...

maximaximal 3y ago

We've built a tool using LD_PRELOAD that speeds up SAT and QBF solvers (but the same idea could be used to speed up other programs too). The idea is to fork, then LD_PRELOAD the other program and overwrite its read functions (and equivalents to also capture inlined read functions). The child process loads some solver which will try to read its input from STDIN. The overwritten read is triggered and instead of just reading, our library shim connects to the parent process. The parent process feeds the child with data, the shim converting the data into text, feeding it to the solver as if it would be reading from a file. Now once we are finished with stating the problem and want to query it (i.e. send assumptions, in QBF or SAT solver speech), we issue a fork command, which lets the child process fork again into a second process, while the solver program thinks it is still in the read() call. We then feed the assumptions only to this grandchild, close its STDIN, and return the result to the calling parent process. When there's another assumption, we can issue the fork again and send assumptions to the new instance, never having to process the full problem again This is nice when the formula is large and the assumptions are small and numerous, which (e.g. for parallelization) was very useful in our research. The copy on write nature of fork() of course also helps, effectively reducing the required RAM to keep solvers in memory. The best of all this, it works remarkably well on Linux and is even (mostly) POSIX conforming! Check out our paper: https://ceur-ws.org/Vol-3201/paper1.pdf https://ceur-ws.org/Vol-3201/paper1.pdf Or just the code: https://github.com/maximaximal/quapi https://github.com/maximaximal/quapi

OnlyMortal 3y ago

I suspect the program you’re trying to crack would check that environment variable, refusing to run if it’s set. This assumes there’s some copy protection on it.

tinix 3y ago

one of my favorite hacks, which started as a joke, is using LD PRELOAD to generate audio from memory allocation and read calls. https://github.com/gordol/ld_preload-sounds https://github.com/gordol/ld_preload-sounds this started out as like 10-20 lines of terrible code originally, and a few people sent merge requests to improve it

_8j50 3y ago

I'll die on the hill that LD_PRELOAD not being optional is a glibc bug that should at least be fixed by distros.

aatharuv 3y ago

2 decades ago, when X windows support for Indian language display in Unicode was spotty at best, I'd created an LD_PRELOAD hack, libxindic, to do character reordering for mostly correct display (It really didn't do the right thing with Tamil as Tamil ligates the -u and -uu matras to the base characters. It was useful back then, and even worked with Mozilla (but was a bit unstable). http://www.mit.edu/afs/sipb/user/aatharuv/projects/xindic/ http://www.mit.edu/afs/sipb/user/aatharuv/projects/xindic/