devbox
花生_TL007
这个屌丝很懒，什么也没留下！
关注作者
热门标签
热门文章
当前位置:   article > 正文

Linux hook 技术一个简单demo分析_linux实现plt hook

作者：花生_TL007 | 2024-02-28 17:09:47

赞

踩

linux实现plt hook

  1. #include <stdio.h>
  2. #include <unistd.h>
  3.  
  4. int main(){
  5.     printf("the pid is %d\n",getpid());
  6.     return 0;
  7. }

gcc -o gotTest main.c

readelf -a gotTest

可以得到如下结果：

  1. ELF 头：
  2.   Magic：   7f 45 4c 46 02 01 01 00 00 00 00 00 00 00 00 00 
  3.   类别:                              ELF64
  4.   数据:                              2 补码，小端序 (little endian)
  5.   Version:                           1 (current)
  6.   OS/ABI:                            UNIX - System V
  7.   ABI 版本:                          0
  8.   类型:                              DYN (共享目标文件)
  9.   系统架构:                          Advanced Micro Devices X86-64
  10.   版本:                              0x1
  11.   入口点地址：               0x1080
  12.   程序头起点：          64 (bytes into file)
  13.   Start of section headers:          14760 (bytes into file)
  14.   标志：             0x0
  15.   Size of this header:               64 (bytes)
  16.   Size of program headers:           56 (bytes)
  17.   Number of program headers:         13
  18.   Size of section headers:           64 (bytes)
  19.   Number of section headers:         31
  20.   Section header string table index: 30
  21.  
  22. 节头：
  23.   [号] 名称              类型             地址              偏移量
  24.        大小              全体大小          旗标   链接   信息   对齐
  25.   [ 0]                   NULL             0000000000000000  00000000
  26.        0000000000000000  0000000000000000           0     0     0
  27.   [ 1] .interp           PROGBITS         0000000000000318  00000318
  28.        000000000000001c  0000000000000000   A       0     0     1
  29.   [ 2] .note.gnu.propert NOTE             0000000000000338  00000338
  30.        0000000000000020  0000000000000000   A       0     0     8
  31.   [ 3] .note.gnu.build-i NOTE             0000000000000358  00000358
  32.        0000000000000024  0000000000000000   A       0     0     4
  33.   [ 4] .note.ABI-tag     NOTE             000000000000037c  0000037c
  34.        0000000000000020  0000000000000000   A       0     0     4
  35.   [ 5] .gnu.hash         GNU_HASH         00000000000003a0  000003a0
  36.        0000000000000024  0000000000000000   A       6     0     8
  37.   [ 6] .dynsym           DYNSYM           00000000000003c8  000003c8
  38.        00000000000000c0  0000000000000018   A       7     1     8
  39.   [ 7] .dynstr           STRTAB           0000000000000488  00000488
  40.        000000000000008b  0000000000000000   A       0     0     1
  41.   [ 8] .gnu.version      VERSYM           0000000000000514  00000514
  42.        0000000000000010  0000000000000002   A       6     0     2
  43.   [ 9] .gnu.version_r    VERNEED          0000000000000528  00000528
  44.        0000000000000020  0000000000000000   A       7     1     8
  45.   [10] .rela.dyn         RELA             0000000000000548  00000548
  46.        00000000000000c0  0000000000000018   A       6     0     8
  47.   [11] .rela.plt         RELA             0000000000000608  00000608
  48.        0000000000000030  0000000000000018  AI       6    24     8
  49.   [12] .init             PROGBITS         0000000000001000  00001000
  50.        000000000000001b  0000000000000000  AX       0     0     4
  51.   [13] .plt              PROGBITS         0000000000001020  00001020
  52.        0000000000000030  0000000000000010  AX       0     0     16
  53.   [14] .plt.got          PROGBITS         0000000000001050  00001050
  54.        0000000000000010  0000000000000010  AX       0     0     16
  55.   [15] .plt.sec          PROGBITS         0000000000001060  00001060
  56.        0000000000000020  0000000000000010  AX       0     0     16
  57.   [16] .text             PROGBITS         0000000000001080  00001080
  58.        0000000000000185  0000000000000000  AX       0     0     16
  59.   [17] .fini             PROGBITS         0000000000001208  00001208
  60.        000000000000000d  0000000000000000  AX       0     0     4
  61.   [18] .rodata           PROGBITS         0000000000002000  00002000
  62.        0000000000000013  0000000000000000   A       0     0     4
  63.   [19] .eh_frame_hdr     PROGBITS         0000000000002014  00002014
  64.        0000000000000044  0000000000000000   A       0     0     4
  65.   [20] .eh_frame         PROGBITS         0000000000002058  00002058
  66.        0000000000000108  0000000000000000   A       0     0     8
  67.   [21] .init_array       INIT_ARRAY       0000000000003db0  00002db0
  68.        0000000000000008  0000000000000008  WA       0     0     8
  69.   [22] .fini_array       FINI_ARRAY       0000000000003db8  00002db8
  70.        0000000000000008  0000000000000008  WA       0     0     8
  71.   [23] .dynamic          DYNAMIC          0000000000003dc0  00002dc0
  72.        00000000000001f0  0000000000000010  WA       7     0     8
  73.   [24] .got              PROGBITS         0000000000003fb0  00002fb0
  74.        0000000000000050  0000000000000008  WA       0     0     8
  75.   [25] .data             PROGBITS         0000000000004000  00003000
  76.        0000000000000010  0000000000000000  WA       0     0     8
  77.   [26] .bss              NOBITS           0000000000004010  00003010
  78.        0000000000000008  0000000000000000  WA       0     0     1
  79.   [27] .comment          PROGBITS         0000000000000000  00003010
  80.        000000000000002b  0000000000000001  MS       0     0     1
  81.   [28] .symtab           SYMTAB           0000000000000000  00003040
  82.        0000000000000630  0000000000000018          29    46     8
  83.   [29] .strtab           STRTAB           0000000000000000  00003670
  84.        0000000000000218  0000000000000000           0     0     1
  85.   [30] .shstrtab         STRTAB           0000000000000000  00003888
  86.        000000000000011a  0000000000000000           0     0     1
  87. Key to Flags:
  88.   W (write), A (alloc), X (execute), M (merge), S (strings), I (info),
  89.   L (link order), O (extra OS processing required), G (group), T (TLS),
  90.   C (compressed), x (unknown), o (OS specific), E (exclude),
  91.   l (large), p (processor specific)
  92.  
  93. There are no section groups in this file.
  94.  
  95. 程序头：
  96.   Type           Offset             VirtAddr           PhysAddr
  97.                  FileSiz            MemSiz              Flags  Align
  98.   PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040
  99.                  0x00000000000002d8 0x00000000000002d8  R      0x8
  100.   INTERP         0x0000000000000318 0x0000000000000318 0x0000000000000318
  101.                  0x000000000000001c 0x000000000000001c  R      0x1
  102.       [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
  103.   LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000
  104.                  0x0000000000000638 0x0000000000000638  R      0x1000
  105.   LOAD           0x0000000000001000 0x0000000000001000 0x0000000000001000
  106.                  0x0000000000000215 0x0000000000000215  R E    0x1000
  107.   LOAD           0x0000000000002000 0x0000000000002000 0x0000000000002000
  108.                  0x0000000000000160 0x0000000000000160  R      0x1000
  109.   LOAD           0x0000000000002db0 0x0000000000003db0 0x0000000000003db0
  110.                  0x0000000000000260 0x0000000000000268  RW     0x1000
  111.   DYNAMIC        0x0000000000002dc0 0x0000000000003dc0 0x0000000000003dc0
  112.                  0x00000000000001f0 0x00000000000001f0  RW     0x8
  113.   NOTE           0x0000000000000338 0x0000000000000338 0x0000000000000338
  114.                  0x0000000000000020 0x0000000000000020  R      0x8
  115.   NOTE           0x0000000000000358 0x0000000000000358 0x0000000000000358
  116.                  0x0000000000000044 0x0000000000000044  R      0x4
  117.   GNU_PROPERTY   0x0000000000000338 0x0000000000000338 0x0000000000000338
  118.                  0x0000000000000020 0x0000000000000020  R      0x8
  119.   GNU_EH_FRAME   0x0000000000002014 0x0000000000002014 0x0000000000002014
  120.                  0x0000000000000044 0x0000000000000044  R      0x4
  121.   GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000
  122.                  0x0000000000000000 0x0000000000000000  RW     0x10
  123.   GNU_RELRO      0x0000000000002db0 0x0000000000003db0 0x0000000000003db0
  124.                  0x0000000000000250 0x0000000000000250  R      0x1
  125.  
  126.  Section to Segment mapping:
  127.   段节...
  128.    00     
  129.    01     .interp 
  130.    02     .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt 
  131.    03     .init .plt .plt.got .plt.sec .text .fini 
  132.    04     .rodata .eh_frame_hdr .eh_frame 
  133.    05     .init_array .fini_array .dynamic .got .data .bss 
  134.    06     .dynamic 
  135.    07     .note.gnu.property 
  136.    08     .note.gnu.build-id .note.ABI-tag 
  137.    09     .note.gnu.property 
  138.    10     .eh_frame_hdr 
  139.    11     
  140.    12     .init_array .fini_array .dynamic .got 
  141.  
  142. Dynamic section at offset 0x2dc0 contains 27 entries:
  143.   标记        类型                         名称/值
  144.  0x0000000000000001 (NEEDED)             共享库：[libc.so.6]
  145.  0x000000000000000c (INIT)               0x1000
  146.  0x000000000000000d (FINI)               0x1208
  147.  0x0000000000000019 (INIT_ARRAY)         0x3db0
  148.  0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
  149.  0x000000000000001a (FINI_ARRAY)         0x3db8
  150.  0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
  151.  0x000000006ffffef5 (GNU_HASH)           0x3a0
  152.  0x0000000000000005 (STRTAB)             0x488
  153.  0x0000000000000006 (SYMTAB)             0x3c8
  154.  0x000000000000000a (STRSZ)              139 (bytes)
  155.  0x000000000000000b (SYMENT)             24 (bytes)
  156.  0x0000000000000015 (DEBUG)              0x0
  157.  0x0000000000000003 (PLTGOT)             0x3fb0
  158.  0x0000000000000002 (PLTRELSZ)           48 (bytes)
  159.  0x0000000000000014 (PLTREL)             RELA
  160.  0x0000000000000017 (JMPREL)             0x608
  161.  0x0000000000000007 (RELA)               0x548
  162.  0x0000000000000008 (RELASZ)             192 (bytes)
  163.  0x0000000000000009 (RELAENT)            24 (bytes)
  164.  0x000000000000001e (FLAGS)              BIND_NOW
  165.  0x000000006ffffffb (FLAGS_1)            标志： NOW PIE
  166.  0x000000006ffffffe (VERNEED)            0x528
  167.  0x000000006fffffff (VERNEEDNUM)         1
  168.  0x000000006ffffff0 (VERSYM)             0x514
  169.  0x000000006ffffff9 (RELACOUNT)          3
  170.  0x0000000000000000 (NULL)               0x0
  171.  
  172. 重定位节 '.rela.dyn' at offset 0x548 contains 8 entries:
  173.   偏移量          信息           类型           符号值        符号名称 + 加数
  174. 000000003db0  000000000008 R_X86_64_RELATIVE                    1160
  175. 000000003db8  000000000008 R_X86_64_RELATIVE                    1120
  176. 000000004008  000000000008 R_X86_64_RELATIVE                    4008
  177. 000000003fd8  000100000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_deregisterTMClone + 0
  178. 000000003fe0  000400000006 R_X86_64_GLOB_DAT 0000000000000000 __libc_start_main@GLIBC_2.2.5 + 0
  179. 000000003fe8  000500000006 R_X86_64_GLOB_DAT 0000000000000000 __gmon_start__ + 0
  180. 000000003ff0  000600000006 R_X86_64_GLOB_DAT 0000000000000000 _ITM_registerTMCloneTa + 0
  181. 000000003ff8  000700000006 R_X86_64_GLOB_DAT 0000000000000000 __cxa_finalize@GLIBC_2.2.5 + 0
  182.  
  183. 重定位节 '.rela.plt' at offset 0x608 contains 2 entries:
  184.   偏移量          信息           类型           符号值        符号名称 + 加数
  185. 000000003fc8  000200000007 R_X86_64_JUMP_SLO 0000000000000000 getpid@GLIBC_2.2.5 + 0
  186. 000000003fd0  000300000007 R_X86_64_JUMP_SLO 0000000000000000 printf@GLIBC_2.2.5 + 0
  187.  
  188. The decoding of unwind sections for machine type Advanced Micro Devices X86-64 is not currently supported.
  189.  
  190. Symbol table '.dynsym' contains 8 entries:
  191.    Num:    Value          Size Type    Bind   Vis      Ndx Name
  192.      0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND 
  193.      1: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_deregisterTMCloneTab
  194.      2: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND getpid@GLIBC_2.2.5 (2)
  195.      3: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND printf@GLIBC_2.2.5 (2)
  196.      4: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@GLIBC_2.2.5 (2)
  197.      5: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
  198.      6: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_registerTMCloneTable
  199.      7: 0000000000000000     0 FUNC    WEAK   DEFAULT  UND __cxa_finalize@GLIBC_2.2.5 (2)
  200.  
  201. Symbol table '.symtab' contains 66 entries:
  202.    Num:    Value          Size Type    Bind   Vis      Ndx Name
  203.      0: 0000000000000000     0 NOTYPE  LOCAL  DEFAULT  UND 
  204.      1: 0000000000000318     0 SECTION LOCAL  DEFAULT    1 
  205.      2: 0000000000000338     0 SECTION LOCAL  DEFAULT    2 
  206.      3: 0000000000000358     0 SECTION LOCAL  DEFAULT    3 
  207.      4: 000000000000037c     0 SECTION LOCAL  DEFAULT    4 
  208.      5: 00000000000003a0     0 SECTION LOCAL  DEFAULT    5 
  209.      6: 00000000000003c8     0 SECTION LOCAL  DEFAULT    6 
  210.      7: 0000000000000488     0 SECTION LOCAL  DEFAULT    7 
  211.      8: 0000000000000514     0 SECTION LOCAL  DEFAULT    8 
  212.      9: 0000000000000528     0 SECTION LOCAL  DEFAULT    9 
  213.     10: 0000000000000548     0 SECTION LOCAL  DEFAULT   10 
  214.     11: 0000000000000608     0 SECTION LOCAL  DEFAULT   11 
  215.     12: 0000000000001000     0 SECTION LOCAL  DEFAULT   12 
  216.     13: 0000000000001020     0 SECTION LOCAL  DEFAULT   13 
  217.     14: 0000000000001050     0 SECTION LOCAL  DEFAULT   14 
  218.     15: 0000000000001060     0 SECTION LOCAL  DEFAULT   15 
  219.     16: 0000000000001080     0 SECTION LOCAL  DEFAULT   16 
  220.     17: 0000000000001208     0 SECTION LOCAL  DEFAULT   17 
  221.     18: 0000000000002000     0 SECTION LOCAL  DEFAULT   18 
  222.     19: 0000000000002014     0 SECTION LOCAL  DEFAULT   19 
  223.     20: 0000000000002058     0 SECTION LOCAL  DEFAULT   20 
  224.     21: 0000000000003db0     0 SECTION LOCAL  DEFAULT   21 
  225.     22: 0000000000003db8     0 SECTION LOCAL  DEFAULT   22 
  226.     23: 0000000000003dc0     0 SECTION LOCAL  DEFAULT   23 
  227.     24: 0000000000003fb0     0 SECTION LOCAL  DEFAULT   24 
  228.     25: 0000000000004000     0 SECTION LOCAL  DEFAULT   25 
  229.     26: 0000000000004010     0 SECTION LOCAL  DEFAULT   26 
  230.     27: 0000000000000000     0 SECTION LOCAL  DEFAULT   27 
  231.     28: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
  232.     29: 00000000000010b0     0 FUNC    LOCAL  DEFAULT   16 deregister_tm_clones
  233.     30: 00000000000010e0     0 FUNC    LOCAL  DEFAULT   16 register_tm_clones
  234.     31: 0000000000001120     0 FUNC    LOCAL  DEFAULT   16 __do_global_dtors_aux
  235.     32: 0000000000004010     1 OBJECT  LOCAL  DEFAULT   26 completed.8061
  236.     33: 0000000000003db8     0 OBJECT  LOCAL  DEFAULT   22 __do_global_dtors_aux_fin
  237.     34: 0000000000001160     0 FUNC    LOCAL  DEFAULT   16 frame_dummy
  238.     35: 0000000000003db0     0 OBJECT  LOCAL  DEFAULT   21 __frame_dummy_init_array_
  239.     36: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS main.c
  240.     37: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS crtstuff.c
  241.     38: 000000000000215c     0 OBJECT  LOCAL  DEFAULT   20 __FRAME_END__
  242.     39: 0000000000000000     0 FILE    LOCAL  DEFAULT  ABS 
  243.     40: 0000000000003db8     0 NOTYPE  LOCAL  DEFAULT   21 __init_array_end
  244.     41: 0000000000003dc0     0 OBJECT  LOCAL  DEFAULT   23 _DYNAMIC
  245.     42: 0000000000003db0     0 NOTYPE  LOCAL  DEFAULT   21 __init_array_start
  246.     43: 0000000000002014     0 NOTYPE  LOCAL  DEFAULT   19 __GNU_EH_FRAME_HDR
  247.     44: 0000000000003fb0     0 OBJECT  LOCAL  DEFAULT   24 _GLOBAL_OFFSET_TABLE_
  248.     45: 0000000000001000     0 FUNC    LOCAL  DEFAULT   12 _init
  249.     46: 0000000000001200     5 FUNC    GLOBAL DEFAULT   16 __libc_csu_fini
  250.     47: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_deregisterTMCloneTab
  251.     48: 0000000000004000     0 NOTYPE  WEAK   DEFAULT   25 data_start
  252.     49: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND getpid@@GLIBC_2.2.5
  253.     50: 0000000000004010     0 NOTYPE  GLOBAL DEFAULT   25 _edata
  254.     51: 0000000000001208     0 FUNC    GLOBAL HIDDEN    17 _fini
  255.     52: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND printf@@GLIBC_2.2.5
  256.     53: 0000000000000000     0 FUNC    GLOBAL DEFAULT  UND __libc_start_main@@GLIBC_
  257.     54: 0000000000004000     0 NOTYPE  GLOBAL DEFAULT   25 __data_start
  258.     55: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND __gmon_start__
  259.     56: 0000000000004008     0 OBJECT  GLOBAL HIDDEN    25 __dso_handle
  260.     57: 0000000000002000     4 OBJECT  GLOBAL DEFAULT   18 _IO_stdin_used
  261.     58: 0000000000001190   101 FUNC    GLOBAL DEFAULT   16 __libc_csu_init
  262.     59: 0000000000004018     0 NOTYPE  GLOBAL DEFAULT   26 _end
  263.     60: 0000000000001080    47 FUNC    GLOBAL DEFAULT   16 _start
  264.     61: 0000000000004010     0 NOTYPE  GLOBAL DEFAULT   26 __bss_start
  265.     62: 0000000000001169    39 FUNC    GLOBAL DEFAULT   16 main
  266.     63: 0000000000004010     0 OBJECT  GLOBAL HIDDEN    25 __TMC_END__
  267.     64: 0000000000000000     0 NOTYPE  WEAK   DEFAULT  UND _ITM_registerTMCloneTable
  268.     65: 0000000000000000     0 FUNC    WEAK   DEFAULT  UND __cxa_finalize@@GLIBC_2.2
  269.  
  270. Histogram for `.gnu.hash' bucket list length (total of 2 buckets):
  271.  Length  Number     % of total  Coverage
  272.       0  1          ( 50.0%)
  273.       1  1          ( 50.0%)    100.0%
  275. Version symbols section '.gnu.version' contains 8 entries:
  276.  地址：0x0000000000000514  Offset: 0x000514  Link: 6 (.dynsym)
  277.   000:   0 (*本地*)       0 (*本地*)       2 (GLIBC_2.2.5)   2 (GLIBC_2.2.5)
  278.   004:   2 (GLIBC_2.2.5)   0 (*本地*)       0 (*本地*)       2 (GLIBC_2.2.5)
  280. Version needs section '.gnu.version_r' contains 1 entry:
  281.  地址：0x0000000000000528  Offset: 0x000528  Link: 7 (.dynstr)
  282.   000000: Version: 1  文件：libc.so.6  计数：1
  283.   0x0010:   Name: GLIBC_2.2.5  标志：无  版本：2
  285. Displaying notes found in: .note.gnu.property
  286.   所有者            Data size 	Description
  287.   GNU                  0x00000010	NT_GNU_PROPERTY_TYPE_0
  288.       Properties: x86 feature: IBT, SHSTK
  290. Displaying notes found in: .note.gnu.build-id
  291.   所有者            Data size 	Description
  292.   GNU                  0x00000014	NT_GNU_BUILD_ID (unique build ID bitstring)
  293.     Build ID: c72301e0c49b0cd407f0056210312787d9224273
  295. Displaying notes found in: .note.ABI-tag
  296.   所有者            Data size 	Description
  297.   GNU                  0x00000010	NT_GNU_ABI_TAG (ABI version tag)
  298.     OS: Linux, ABI: 3.2.0

重点关注节头以下信息：

  1. [13] .plt              PROGBITS         0000000000001020  00001020
  2.        0000000000000030  0000000000000010  AX       0     0     16
  3. [14] .plt.got          PROGBITS         0000000000001050  00001050
  4.        0000000000000010  0000000000000010  AX       0     0     16
  5. [15] .plt.sec          PROGBITS         0000000000001060  00001060
  6.        0000000000000020  0000000000000010  AX       0     0     16
  7. [24] .got              PROGBITS         0000000000003fb0  00002fb0
  8.        0000000000000050  0000000000000008  WA       0     0     8

从以上表可以看出：

其中：

0X1020 是.plt表在程序中的偏移位置。

0X1050 是.plt.got表在程序中的偏移位置。

0X1060 是.plt.sec表在程序中的偏移位置。

0X3fb0 是.got表在程序中的偏移位置。

 我们可以看到，getpid和printf函数都在这个.got表中，其中偏移量是他们在表中的地址，信息是他们实际的地址，由于程序未启动，地址还没加载，所以显示的并不是程序的实际地址。

那么这个got表和got.plt表到底是怎么运作的呢?

首先，当一个程序第一次调用一个外部函数时，就会跳转到.plt表（注意，不是.got.plt），而这个表中包含有一些代码，这些代码总共有两个作用：

(1)调用链接器来解析某个外部函数的地址, 并填充到.got.plt中, 然后跳转到该函数。
(2)在.got.plt中查找并跳转到对应外部函数(如果已经填充过)。

相对的，.got.plt也同样具有两个功能：

 1)如果在之前查找过该符号,内容为外部函数的具体地址。

 2)如果没查找过, 则内容为跳转回.plt的代码。

所以当你首次调用某个外部函数时，其流程为code → .plt → .got.plt → .plt→.got.plt→target function

 结合上图可更好的理解整个过程。

接下来要hook函数就很简单了，只需要将运行中的got.plt表中对应的地址覆盖为我们自己的函数地址，当调用时，自然就调用到我们自己的函数了。

2.2.2 got/plt hook 实现

接下来我们来实现一下hook的过程

首先，将测试代码改造一下，改造后测试代码如下：

  1. #include <stdio.h>
  2. #include <unistd.h>
  3. #include <stdbool>
  4. int mygetpid(){
  5.     return 12306;
  6. }
  7.  
  8. int main(){
  9.  
  10.     while(true){
  11.         printf("the pid is %d\n",getpid());
  12.         sleep(1);
  13.     }
  14.     return 0;
  15. }

改造后的代码，每隔一段时间就会打印一下pid，然后我们还新增了一个函数，用于到时候替换用，我们再用readelf -a 来查看一下编译成的执行文件的elf情况如下：

首先是.got.plt表

接下来是.symtab，.symtab是c程序的符号表，其中包含有各种程序的符号，其内容如下:

我们可以看到，getpid函数和我们自己编写的mygetpid函数在这个表中都可以看到，由于getpid是外部引用函数，其地址是使用时动态加载，所以此时为0，接下来的内容就很明确了，我们只需要把.got.plt表中，位置为0X3fc0的值，覆写成我们自己的mygetpid函数的地址，就可以hook住getpid函数了。

那么我们应该怎么才能修改程序运行时候的内存地址呢，我们都知道，linux秉承的是万物皆文件的原则，程序在运行时候，其内存会映射为一个/proc/$pid/mem文件，修改这个文件，等于修改程序内存（其实这样说不够严谨，差不多是这个意思）。

于是我们可以编写个程序用来修改程序运行时候的内存，代码如下:

  1. vim inject.c
  2. --------------------------------------------
  3. #include <stdio.h>
  4. #include <unistd.h>
  5. #include <fcntl.h>
  6. int main(int argc,char* argv[]) {
  7.     int pid = atoi(argv[1]);
  8.     unsigned long offset = 0x601018;
  9.     unsigned long myfunctionaddr = 0x4005b6;
  10.     char filename[32];
  11.     snprintf(filename, sizeof(filename),"/proc/%d/mem",pid);
  12.     int fd = open(filename, O_RDWR|O_SYNC);
  13.     lseek(fd,offset,SEEK_SET);
  14.     write(fd,&myfunctionaddr, sizeof(unsigned long));
  15.     return 0;
  16. }
  17. -----------------------------------
  18. gcc -o inect inject.c

声明：本文内容由网友自发贡献，不代表【wpsshop博客】立场，版权归原作者所有，本站不承担相应法律责任。如您发现有侵权的内容，请联系我们。转载请注明出处：https://www.wpsshop.cn/w/花生_TL007/article/detail/160411
推荐阅读
相关标签

Copyright © 2003-2013 www.wpsshop.cn 版权所有，并保留所有权利。

  

闽ICP备14008679号