两种拦截方式1. LD_PRELOAD 如何实现拦截要想明白 LD_PRELOAD 如何实现拦截需要你对 linux 上的进程初始化时的链接器ld.so的工作过程有一个了解简单来说就是它的加载顺序为主程序的可执行文件 - LD_PRELOAD 指定的库 - glibc 标准库 - 其他依赖库。由于 LD_PRELOAD 指定的 so 文件优于 glibc.so 解析所以可以利用这种先入为主的方式覆盖后续的同名符号方法那 ld.so 长啥样呢在我的ubuntu上就是ld-linux-x86-64.so.2。rootubuntu2404:/data2# cat /proc/5322/maps 60c0f8687000-60c0f8688000 r--p 00000000 08:03 1966089 /data2/main 60c0f8688000-60c0f8689000 r-xp 00001000 08:03 1966089 /data2/main 60c0f8689000-60c0f868a000 r--p 00002000 08:03 1966089 /data2/main 60c0f868a000-60c0f868b000 r--p 00002000 08:03 1966089 /data2/main 60c0f868b000-60c0f868c000 rw-p 00003000 08:03 1966089 /data2/main 60c1266de000-60c1266ff000 rw-p 00000000 00:00 0 [heap] 7efd5c600000-7efd5c628000 r--p 00000000 08:03 2242169 /usr/lib/x86_64-linux-gnu/libc.so.6 7efd5c628000-7efd5c7b0000 r-xp 00028000 08:03 2242169 /usr/lib/x86_64-linux-gnu/libc.so.6 7efd5c7b0000-7efd5c7ff000 r--p 001b0000 08:03 2242169 /usr/lib/x86_64-linux-gnu/libc.so.6 7efd5c7ff000-7efd5c803000 r--p 001fe000 08:03 2242169 /usr/lib/x86_64-linux-gnu/libc.so.6 7efd5c803000-7efd5c805000 rw-p 00202000 08:03 2242169 /usr/lib/x86_64-linux-gnu/libc.so.6 7efd5c805000-7efd5c812000 rw-p 00000000 00:00 0 7efd5c964000-7efd5c967000 rw-p 00000000 00:00 0 7efd5c977000-7efd5c979000 rw-p 00000000 00:00 0 7efd5c979000-7efd5c97d000 r--p 00000000 00:00 0 [vvar] 7efd5c97d000-7efd5c97f000 r-xp 00000000 00:00 0 [vdso] 7efd5c97f000-7efd5c980000 r--p 00000000 08:03 2242166 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 7efd5c980000-7efd5c9ab000 r-xp 00001000 08:03 2242166 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 7efd5c9ab000-7efd5c9b5000 r--p 0002c000 08:03 2242166 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 7efd5c9b5000-7efd5c9b7000 r--p 00036000 08:03 2242166 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 7efd5c9b7000-7efd5c9b9000 rw-p 00038000 08:03 2242166 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2 7ffe03c95000-7ffe03cb6000 rw-p 00000000 00:00 0 [stack] ffffffffff600000-ffffffffff601000 --xp 00000000 00:00 0 [vsyscall]说了这么多接下来我们演示下如何对 openat 进行拦截首先定义一个 LD_PRELOAD 需要加载的共享库代码如下#define _GNU_SOURCE #include dlfcn.h #include stdio.h #include fcntl.h #include stdarg.h #include unistd.h #include sys/types.h static int (*real_openat)(int, const char *, int, ...) NULL; int openat(int dirfd, const char *pathname, int flags, ...) { mode_t mode 0; pid_t pid getpid(); pid_t tid gettid(); printf(hooked openat: PID%d, TID%d, path%s\n, pid, tid, pathname); if (!real_openat) { real_openat dlsym(RTLD_NEXT, openat); } if (flags O_CREAT) { return real_openat(dirfd, pathname, flags, mode); } else { return real_openat(dirfd, pathname, flags); } }将上面的 hook_openat.c 做成动态链接库其中的-ldl表示对外提供加载该库的api比如(dlopen,dlsym) 参考如下rootubuntu2404:/data2# gcc -shared -fPIC -o libhookopenat.so hook_openat.c -ldl rootubuntu2404:/data2# ls -lh total 24K -rw-r--r-- 1 root root 688 Jun 12 09:14 hook_openat.c -rwxr-xr-x 1 root root 16K Jun 12 09:20 libhookopenat.so -rw-r--r-- 1 root root 782 Jun 12 09:18 main.c共享库搞定之后接下来就是写 C 代码来调用了这里我们通过 openat 打开文件然后让 libhookopenat.so 拦截参考代码如下#define _GNU_SOURCE #include fcntl.h #include unistd.h #include stdio.h #include stdlib.h #include string.h int main() { // 在当前目录下创建一个新文件 int fd openat(AT_FDCWD, example.txt, O_WRONLY | O_CREAT | O_TRUNC, 0644); if (fd -1) { perror(openat failed); exit(EXIT_FAILURE); } // 写入一些内容到文件 const char *text This is a test file created with openat!\n; ssize_t bytes_written write(fd, text, strlen(text)); if (bytes_written -1) { perror(write failed); close(fd); exit(EXIT_FAILURE); } // 关闭文件 close(fd); printf(File created and written successfully! Wrote %zd bytes.\n, bytes_written); return 0; }rootubuntu2404:/data2# gcc -o main ./main.c rootubuntu2404:/data2# LD_PRELOAD./libhookopenat.so ./main hooked openat: PID4646, TID4646, pathexample.txt File created and written successfully! Wrote 41 bytes.从卦中可以清晰的看到 hook 成功2. funchook 如何实现拦截LD_PRELOAD 这种共享库的粒度还是太大如果粒度再小一点就更加灵活了比如函数级这就是本节要介绍到的 funchook源码在github上https://github.com/kubo/funchook 唯一麻烦一点的就是你需要通过源码编译来生成对应的头文件,静态链接文件,动态链接库参考如下rootubuntu2404:/data4# sudo apt install -y git gcc cmake make rootubuntu2404:/data4# git clone https://github.com/kubo/funchook.git rootubuntu2404:/data4# cd funchook rootubuntu2404:/data4# mkdir build cd build rootubuntu2404:/data4# cmake .. rootubuntu2404:/data4# make rootubuntu2404:/data4/funchook/build# sudo make install [ 25%] Built target distorm [ 42%] Built target funchook-shared [ 60%] Built target funchook-static [ 71%] Built target funchook_test [ 85%] Built target funchook_test_shared [100%] Built target funchook_test_static Install the project... -- Install configuration: -- Installing: /usr/local/include/funchook.h -- Installing: /usr/local/lib/libfunchook.so.2.0.0 -- Installing: /usr/local/lib/libfunchook.so.2 -- Installing: /usr/local/lib/libfunchook.so -- Installing: /usr/local/lib/libfunchook.a rootubuntu2404:/data4/funchook/build# ldconfig由于默认安装在了/usr/local/lib下一定要记得用ldconfig命令刷新下否则程序可能找不到新库最后就是 C 的调用代码参考如下#define _GNU_SOURCE #include stdio.h #include dlfcn.h #include fcntl.h #include unistd.h #include funchook.h // 原始函数指针 static int (*orig_openat)(int dirfd, const char *pathname, int flags, mode_t mode); // 钩子函数 int hooked_openat(int dirfd, const char *pathname, int flags, mode_t mode) { printf(Hooked openat called: path%s, flags0x%x\n, pathname, flags); // 调用原始函数 return orig_openat(dirfd, pathname, flags, mode); } int main() { // 获取原始 openat 函数地址 orig_openat dlsym(RTLD_NEXT, openat); if (!orig_openat) { fprintf(stderr, Failed to find openat: %s\n, dlerror()); return 1; }