04 - ELF Hooking

The objective of this tutorial is to hook a library function

Scripts and materials are available here: materials

By Romain Thomas - @rh0main


In the previous tutorial we saw how to swap symbols names from a shared library, we will now see the mechanism to hook a function in a shared library.

The targeted library is the standard math library (libm.so) and we will insert a hook on the exp function so that \(\exp(x) = x + 1\). The source code of the sample that uses this function is given in the following listing:

#include <stdio.h>
#include <stdlib.h>
#include <math.h>

int main(int argc, char **argv) {
  if (argc != 2) {
    printf("Usage: %s <a> \n", argv[0]);
    exit(-1);
  }

  int a = atoi(argv[1]);
  printf("exp(%d) = %f\n", a, exp(a));
  return 0;
}

The hooking function is as simple as:

double hook(double x) {
  return x + 1;
}

Compiled with gcc -Os -nostdlib -nodefaultlibs -fPIC -Wl,-shared hook.c -o hook.

To inject this hook into the library, we use the add() (segment) method

Binary.add(*args, **kwargs)

Overloaded function.

  1. add(self: lief.ELF.Binary, arg0: LIEF::ELF::DynamicEntry) -> LIEF::ELF::DynamicEntry

dynamic_entry

  1. add(self: lief.ELF.Binary, section: LIEF::ELF::Section, loaded: bool = True) -> LIEF::ELF::Section

    Add the given Section to the binary.

    If the section does not aim at being loaded in memory, the loaded parameter has to be set to False (default: True)

  2. add(self: lief.ELF.Binary, Add a new Segment in the binarysegment: LIEF::ELF::Segment, base: int = 0) -> LIEF::ELF::Segment

  3. add(self: lief.ELF.Binary, note: LIEF::ELF::Note) -> LIEF::ELF::Note

Add a new Note in the binary

First, we find the code for our hook function, and add it to the library:

import lief

libm = lief.parse("/usr/lib/libm.so.6")
hook = lief.parse("hook")

exp_symbol  = libm.get_symbol("exp")
hook_symbol = hook.get_symbol("hook")

code_segment = hook.segment_from_virtual_address(hook_symbol.value)
segment_added = libm.add(code_segment)

Once the stub is injected we just have to calculate the new address for the exp symbol, and update it:

new_address = segment_added.virtual_address + hook_symbol.value - code_segment.virtual_address
exp_symbol.value = new_address

Finally, we write out the patched library to a file in the current folder:

libm.write("libm.so.6")

To test the patched library:

$ ./do_math.bin 1
exp(1) = 2.718282
$ LD_LIBRARY_PATH=. ./do_math.bin 1
exp(1) = 2.000000