_dl_open in ld-2.13.so invoked

I would like to call _dl_open function from ld-2.13.so. I get the offset of this function from objdump and then I add it to library beginning address in order to get function address. Then I attach to the process by ptrace and inject my own binary code in which:

• I put into eax register address of the library's path.
• I put into ebx RLTD_LAZY
• I put into ecx NULL (it's a caller, but I don't get what's really is).

Then I call the function (which address is correctly calculated) and I get... nothing :) The library is not injected and I have no output. I found in ld-2.13.so also _dl_open_worker function which when I call I get:

./process: error while loading shared libraries: dlopen: invalid caller

What am I doing wrong?

Everythin开发者_如何转开发g what I've done was based on: http://nologin.org/Downloads/Papers/remote-library-injection.pdf

Thanks in advance for any help.

---

Linux uses address space layout randomization (ASLR) to thwart remote buffer overflow attacks that do exactly what you're talking about.

When asking questions like this, I seriously recommend that you describe your legitimate need for the information. SO users aren't going to provide much assistance with apparently illicit activities.

---

You can do this using "hotpatch" from https://github.com/vikasnkumar/hotpatch

The code does everything you need to do. It handles the relative addressing. Still need to figure out the _dl_open part but should get that done in a couple of days.

Works for 64-bit well.

---

(I know this is an old question, but I am recording the answer here for future developers)

The problem was trying to put the mode/flags value into ebx when it should have been placed into edx. The following article describes how to invoke _dl_open manually in the context of library injection:

http://www.ars-informatica.com/Root/Code/2010_04_18/LinuxPTrace.aspx

They define _dl_open as:

void * 
internal_function 
_dl_open(const char *file, int mode, const void *caller);

Although the symbol is exported by libc it is still defined as an internal function, meaning its parameters are passed via registers in the following manner:

EAX = const char *file
ECX = const void *caller
EDX = int mode