Symbols in shared objects can be either local or global. This is controlled by a flag in the symbol table. If the symbol is local, ld won't resolve to it.
Reverse engineering can often be aided by doing this, by linking a shared object and referencing its symbols (e.g. printf("%p", main_arena)
. Since all the information is there, and its only a flag telling ld to ignore this, it should be possible to tell ld to resolve a local symbol as well. How can I do this?
Note that a simple patch of the flag isn't enough:
objcopy --globalize-symbol=main_arena libc-2.30.so libc-2.30.global_symbols.so
even though the symbol is now listed as global, ld
still can't find it, because all global symbols must be before any local (see https://github.com/lief-project/LIEF/issues/112 ) and perhaps for other issues (see https://stackoverflow.com/questions/6527014/making-a-local-symbol-global ). It might be possible to rebuild the entire symbol table, but this will introduce other changes that we don't want. What we want is simply to tell ld
"Please break the rules and resolve local symbols as well, just like gdb does."
ld
's source, build and do whatever?ld
you meanld
(from Binutils, orlld.ld
from Clang) or you meanld.so
?ld.so