精通solaris的，来讨论讨论solaris sparc的共享库重定向技术

e4gle

Shared Library Injection and Redirection

---| 简介

Phrack 56-9 Backdooring binary objects 一文中介绍了利用BFD向Shared Library中插入代码,并修改Shared Library中的一个函数地址指向插入的代码. 但是,插入的代码必须以汇编书写,并且要手工计算一些地址. 本文描述如何在SPARC Solaris 8下实现这种技术. 而且进一步做了重定向工作,使插入代码可以用 c 书写. 考虑到BFD接口复杂,文档混乱, 我们不使用BFD做ELF文件操作.

---| 准备工作

本文中程序的编译和调试都在如下环境进行:
bash-2.03$ uname -a
SunOS LabSolaris 5.8 Generic_108528-09 sun4u sparc SUNW,Ultra-5_10
bash-2.03$ gcc -v
Reading specs from /opt/gnu32/lib/gcc-lib/sparc-sun-solaris2.8/3.0/specs
Configured with: ./configure --prefix=/opt/gnu32 : (reconfigured) ./configure --prefix=/opt/gnu32 --enable-languages=c,c++
Thread model: posix
gcc version 3.0
bash-2.03$ objdump -V
GNU objdump 2.11.2
Copyright 1997, 98, 99, 2000, 2001 Free Software Foundation, Inc.
This program is free software&#59; you may redistribute it under the terms of the GNU General Public License. This program has absolutely no warranty.

需要准备如下程序:
/* haha.c */
#include <stdio.h>;
void haha(void)
{
printf(&quot;haha\n&quot&#59;
}

/* huhu.c */
void huhu(void)
{
printf(&quot;huhu\n&quot&#59;
}
编译成动态库：
bash-2.03$ gcc -fPIC -G -nostdlib -o libtst.so haha.c huhu.c

再准备如下 c 程序：
/* hehe.c */
void hehe(void)
{
haha()&#59;
}
编译成 object 文件：
bash-2.03$ gcc -fpic -c hehe.c

准备如下测试程序：
/* t.c */
int main(int argc,char **argv)
{
huhu()&#59;
return 0&#59;
}

---| SPARC下的ELF

一个ELF动态库(SPARC)通常包括以下区(Section)：
.hash : hash table
.interp: ELF interpreter
.dynsym : dynamic symbol table
.dynstr : dynamic string table
.rela.* : relocation section
.text : code section
.rodata : readonly data section
上面几个区共同组成了代码段(text segment)，在内存中映象可读，可执行，
但不可写。而且，代码段被进程共享。
.got : 全局偏移表(Global Offset Table)，是PIC(Position Independent
Code) 的重要组成部分，.text区中对绝对地址的引用被转换成对.got中偏移
的引用，dynamic linker修改.got使其指向绝对地址。
.plt : 程序联接表(Procedure Linkage Table)，是PIC的重要组成部分。
.plt和.got类似，不过是把函数调用转换成对.plt的调用。在SPARC下，每个
.plt表项为12字节长，也就是说，可以容纳 3 条指令。.plt的前 4 个表项为
系统保留。dynamic linker会修改plt表项使其指向实际的函数地址。
.dynamic : 保存动态连接信息

---| 第一步：插入代码到动态库中

这一步要实现插入代码到动态库中，同时保证不影响该动态库的使用。第一
个问题是：应该插入动态库的哪个位置？Phrack 56-9 <<Backdooring binary
objects>;>;建议插入.got中，这样容易实现，但也使插入的代码可能被用户修改。
合理的插入位置应该是.text中。我们采用插入.got中的做法。具体步骤如下：

1. 从ELF头中找到区头表的偏移和区名区的索引。
2. 在动态库的区头表中(Section Header Table)中找到.got和紧跟.got的
区（假设是.dynamic)的区头项。
3. 修改.got区的大小，加上插入代码的长度(要求是 4 的倍数).
4. 修改.got后面区的偏移，加上插入代码的长度。
5. 修改程序头表中相应段的偏移和大小。
6. 修改ELF头中区头表的偏移，加上插入代码的长度。
7. 将代码从.dynamic的偏移处插入。

这样，尽管一些符号的偏移还没有修改，但被修改的动态库依然可以正常
使用。

测试(假设修改后的动态库文件名为libnew.so)：
bash-2.03$ gcc -o t t.c -L . -lnew
bash-2.03$ export LD_LIBRARY_PATH=.
bash-2.03$ ./t
huhu
bash-2.03$

---| 第二步：动态库符号重定向

这一步实现修改原动态库中的的一个函数指向新插入的代码。动态库&quot;export&quot;出的函数都在动态符号表(.dynsym)中描述，包括函数地址，代码长度等信息。修改原函数的地址，大小为新插入代码的地址，大小等属性即可。对有近2000个符号的标准 C 库，通过符号名找到符号比较耗时，这可以通过符号名hash表(.hash区)加快查询。

通常，只修改动态符号表中的符号就可以完成重定位，保证连接该动态库的
程序正常运行，虽然这时候符号表中的相应符号地址没有修改。但是，一些程序
可能依靠符号表中的符号工作，例如gdb，它的disass sym指令就从符号表中符号指向地址处开始反汇编。因此，修改动态符号表中符号后，也应该修改符号表中的相应符号。

---| 第三步：重定位

如果插入的代码调用了动态库中的函数，那么这个函数调用会被编译成0x40000000，即call 0，因此必需对call的偏移做重定位。对用-fpic编译出的代码，被调用函数的重定位类型是R_SPARC_WPLT30，它指示连接器生成.plt表项，并计算该.plt表项到call指令偏移作为call指令的偏移；对不用-fpic编译出的代码，被调用函数的重定位类型是R_SPARC_WDISP30，这通过计算调用函数相对call指令的偏移得到。注意这个偏移值单位为指令长度(4个字节)。

测试：
bash-2.03$ gcc -fpic -c hehe.c
bash-2.03$ ./redir hehe.o libtst.so
bash-2.03$ gcc -o t t.c -L . -lnew
bash-2.03$ export LD_LIBRARY_PATH=.
bash-2.03$ ./t
haha
bash-2.03$

---| 总结

这种插入方式只能插入一个.o文件到.so中，而且插入的.o要满足如下条件：
1. 不能有.rodata区，data,bss大小为0。
2. 只能调用要插入动态库中的函数。

---| 参考资料

1. ELF Specification 1.2
2. SYSTEM V ABI: SPARC Processor Supplyment
3. The SPARC Architecture Manual,version 8
4. Phrack 56-9: Backdooring binary objects
5. nsfocus: <<如何修改动态库符号表>;>;,author:wangdb

---| 实现程序
/*
* redir.c
* expand .got section of a shared library
*
* copyright (c) 2002, lgx@venuslab
*
* Compile: gcc -o redir redir.c
* Usage: redir code.o libtest.so
*
* history:
* 1. Insert code to .got section
*
*/

#include <stdio.h>;
#include <sys/types.h>;
#include <sys/stat.h>;
#include <fcntl.h>;
#include <unistd.h>;
#include <elf.h>;
#include <sys/mman.h>;
#ifdef sun
#include <sys/elf_SPARC.h>;
#include <sys/elf_386.h>;
#endif
#include <stdlib.h>;
#include <limits.h>;

#define DEBUG

/* 符号名hash表 */
static unsigned long nbucket = 0,nchain = 0,*buckets = NULL,*chains = NULL&#59;

/* 需要做重定位的特殊符号 */
static const char *spsym[] = {&quot;_DYNAMIC&quot;,&quot;__bss_start&quot;,&quot;_edata&quot;,&quot;_end&quot;,NULL}&#59;

/* 符号名 ==>; hash值 */
static unsigned long elf_hash(const unsigned char *name)
{
unsigned long h = 0, g&#59;

while (*name){
h = (h << 4) + *name++&#59;
if (g = h &amp; 0xf0000000)
h ^= g >;>; 24&#59;
h &amp;= ~g&#59;
}
return h&#59;
}

/* hash符号搜索 */
static unsigned long lookup_sym(Elf32_Sym *libsym,const char *libstr,
const char *symname)
{
unsigned long hash = elf_hash(symname)&#59;
unsigned long idx = buckets[hash % nbucket]&#59;

#ifdef DEBUG
fprintf(stderr,&quot;Lookup sym for: %s\n&quot;,symname)&#59;
#endif

if (!strcmp(libsym[idx].st_name + libstr,symname)) {
#ifdef DEBUG
fprintf(stderr,&quot;lookup_sym: Found sym: %s,idx=%d\n&quot;,symname,idx)&#59;
return idx&#59;
#endif
}

while (1) {
idx = chains[idx]&#59;
if (idx == STN_UNDEF) {
#ifdef DEBUG
fprintf(stderr,&quot;lookup_sym: sym: %s undef\n&quot;,symname,idx)&#59;
#endif
break&#59;
}
if (!strcmp(libsym[idx].st_name + libstr,symname)) {
#ifdef DEBUG
fprintf(stderr,&quot;lookup_sym: Found sym: %s,idx=%d\n&quot;,symname,idx)&#59;
#endif
break&#59;
}
}
return idx&#59;
}

int main(int argc,char **argv)
{
/*
* 变量命名规则:
* 对象前缀(obj:要插入的.o文件&#59; lib:被插入的动态库&#59; tmp:生成的动态库)
* + 变量描述属性(eh:ELF头；sh:区头；sym:符号表；sn:区名表；
* ph:程序头表；str:字符串表；data:文件原始数据；
*/
Elf32_Ehdr *libeh = NULL,*tmpeh = NULL,*objeh = NULL&#59;
char *libfile = NULL,*objfile = NULL,*tmpfile = &quot;libnew.so&quot;&#59;
Elf32_Shdr *libsh = NULL,*tmpsh = NULL,*objsh = NULL&#59;
Elf32_Phdr *ph = NULL,*tmpph = NULL&#59;
Elf32_Rela *obj_rela_text = NULL&#59;
Elf32_Sym *objsym = NULL,*libsym = NULL,*tmpsym = NULL&#59;
struct stat objst,libst&#59;
unsigned char *libdata = NULL,*objdata = NULL,*tmpdata = NULL&#59;
char *libsn = NULL,*objstr = NULL,*objsn = NULL,*libstr = NULL&#59;
int i=0,objoff = 0,objlen = 0,fd,nobj_rela_text = 0&#59;
int lib_got_ndx = 0,lib_plt_ndx = 0,lib_dynsym_ndx = 0,
lib_dynstr_ndx = 0,lib_hash_ndx = 0&#59;
int obj_rela_text_ndx = 0,obj_symtab_ndx = 0,obj_strtab_ndx = 0,
obj_text_ndx = 0&#59;
char *p = NULL&#59;
unsigned long idx = 0&#59;

if (argc < 3) {
fprintf(stderr,&quot;Usage: %s objfile libfile\n&quot;,argv[0])&#59;
fprintf(stderr,&quot; objfile : code will be inserted into libfile\n&quot&#59;
fprintf(stderr,&quot; libfile : Library file name\n&quot&#59;
return -1&#59;
}

/* Open &amp; mmap object file */
objfile = argv[1]&#59;
if ((fd=open(objfile,O_RDONLY)) < 0) {
perror(&quot;Open object file&quot&#59;
return 1&#59;
}
fstat(fd,&amp;objst)&#59;
if ((objdata=mmap(NULL,objst.st_size,PROT_READ,MAP_SHARED,fd,0)) == NULL){
perror(&quot;mmap&quot&#59;
return -1&#59;
}
close(fd)&#59;

/* Open &amp; mmap library file */
libfile = argv[2]&#59;
if ((fd=open(libfile,O_RDONLY)) < 0) {
perror(&quot;Open Library file&quot&#59;
return 1&#59;
}
fstat(fd,&amp;libst)&#59;
if ((libdata=mmap(NULL,libst.st_size,PROT_READ,MAP_SHARED,fd,0)) == NULL){
perror(&quot;mmap library file&quot&#59;
return -1&#59;
}
close(fd)&#59;

/* Now get objfile infomation */
fprintf(stderr,&quot;\nNow collecting obj file infomation .....\n&quot&#59;
objeh = (Elf32_Ehdr*)objdata&#59;
#ifdef DEBUG
printf(&quot;obj: e_shoff:%#x,e_shnum:%d,e_shentsize:%d\n&quot;,
objeh->;e_shoff,objeh->;e_shnum,objeh->;e_shentsize)&#59;
printf(&quot;obj: e_shstrndx:%d,e_phoff:%#x\n&quot;,
objeh->;e_shstrndx,objeh->;e_phoff)&#59;
#endif
objsh = (Elf32_Shdr*)(objdata + objeh->;e_shoff)&#59;
objsn = (char*)(objdata + objsh[objeh->;e_shstrndx].sh_offset)&#59;
{
Elf32_Shdr *tmp = objsh&#59;
for (i=0&#59; i<objeh->;e_shnum&#59; i++,tmp++) {
printf(&quot;%d off:%#10x size:%#10x entsize:%#10x %s\n&quot;,
i,tmp->;sh_offset,tmp->;sh_size,
tmp->;sh_entsize,objsn + tmp->;sh_name)&#59;
#ifdef sun
if (!strncmp(objsn + tmp->;sh_name,&quot;.rela.text&quot;,10)) {
#else
if (!strncmp(objsn + tmp->;sh_name,&quot;.rel.text&quot;,9)) {
#endif
obj_rela_text_ndx = i&#59;
}
else if (!strncmp(objsn + tmp->;sh_name,&quot;.symtab&quot;,7)) {
obj_symtab_ndx = i&#59;
}
else if (!strncmp(objsn + tmp->;sh_name,&quot;.strtab&quot;,7)) {
obj_strtab_ndx = i&#59;
}
else if (!strncmp(objsn + tmp->;sh_name,&quot;.text&quot;,5)) {
obj_text_ndx = i&#59;
}
}
}
if (!obj_rela_text_ndx || !obj_symtab_ndx ||
!obj_strtab_ndx || !obj_text_ndx) {
fprintf(stderr,
&quot;obj:One of .text,.rela.text,.symtab,.strtab not found.\n&quot&#59;
return -1&#59;
}
printf(&quot;obj: .text index is : %d\n&quot;,obj_text_ndx)&#59;
objoff = objsh[obj_text_ndx].sh_offset&#59;
objlen = objsh[obj_text_ndx].sh_size&#59;
printf(&quot;obj: objoff:%#x, objlen:%#x\n&quot;,objoff,objlen)&#59;
obj_rela_text =
(Elf32_Rela *)(objdata + objsh[obj_rela_text_ndx].sh_offset)&#59;
nobj_rela_text =
objsh[obj_rela_text_ndx].sh_size / objsh[obj_rela_text_ndx].sh_entsize&#59;
printf(&quot;obj: .rela.text index is : %d,number=%d\n&quot;,
obj_rela_text_ndx,nobj_rela_text)&#59;
printf(&quot;obj: .symtab index is : %d\n&quot;,obj_symtab_ndx)&#59;
objsym = (Elf32_Sym *)(objdata + objsh[obj_symtab_ndx].sh_offset)&#59;
printf(&quot;obj: .strtab index is : %d\n&quot;,obj_strtab_ndx)&#59;
objstr = (char*)(objdata + objsh[obj_strtab_ndx].sh_offset)&#59;

/* Open &amp; mmap tmp file */
if ((fd=open(tmpfile,O_RDWR|O_CREAT|O_TRUNC,S_IRWXU)) < 0) {
perror(&quot;open tmpfile&quot;)&#59;
return -1&#59;
}
lseek(fd,libst.st_size + objlen -1,SEEK_SET)&#59;
write(fd,(unsigned char*)&amp;i,1)&#59;
if ((tmpdata=mmap(NULL,libst.st_size + objlen,
PROT_READ|PROT_WRITE,MAP_SHARED,fd,0)) == NULL) {
perror(&quot;mmap tmpfile&quot;)&#59;
return -1&#59;
}
close(fd)&#59;
bzero(tmpdata,libst.st_size + objlen)&#59;


fprintf(stderr,&quot;Now collecting lib file infomation .....\n&quot;)&#59;
libeh = (Elf32_Ehdr*)libdata&#59;
#ifdef DEBUG
printf(&quot;lib: e_shoff:%#x,e_shnum:%d,e_shentsize:%d\n&quot;,
libeh->;e_shoff,libeh->;e_shnum,libeh->;e_shentsize)&#59;
printf(&quot;lib: e_shstrndx:%d,e_phoff:%#x\n&quot;,
libeh->;e_shstrndx,libeh->;e_phoff)&#59;
#endif
/* Find .got section index,will insert code there */
libsh = (Elf32_Shdr*)(libdata + libeh->;e_shoff)&#59;
libsn = (char*)(libdata + libsh[libeh->;e_shstrndx].sh_offset)&#59;
{
Elf32_Shdr *tmp = libsh&#59;
for (lib_got_ndx=-1,i=0&#59; i<libeh->;e_shnum&#59; i++,tmp++) {
#ifdef DEBUG
printf(&quot;lib: %d %#x %#x %s\n&quot;,
i,tmp->;sh_offset,tmp->;sh_size,libsn + tmp->;sh_name)&#59;
#endif
if (!strncmp(libsn + tmp->;sh_name,&quot;.got&quot;,4)) {
lib_got_ndx = i&#59;
}
else if (!strncmp(libsn + tmp->;sh_name,&quot;.dynsym&quot;,7)) {
lib_dynsym_ndx = i&#59;
}
else if (!strncmp(libsn + tmp->;sh_name,&quot;.dynstr&quot;,7)) {
lib_dynstr_ndx = i&#59;
}
else if (!strncmp(libsn + tmp->;sh_name,&quot;.plt&quot;,4)) {
lib_plt_ndx = i&#59;
}
else if (!strncmp(libsn + tmp->;sh_name,&quot;.hash&quot;,4)) {
lib_hash_ndx = i&#59;
}
}
}
if (!lib_got_ndx || !lib_plt_ndx || !lib_dynsym_ndx ||
!lib_dynstr_ndx || !lib_hash_ndx) {
fprintf(stderr,
&quot;Lib: one of .got,.plt,.dynsym,.dynstr,.hash not found.\n&quot;)&#59;
return -1&#59;
}
fprintf(stderr,&quot;Lib: got:%d,plt:%d,dynsym:%d,dynstr:%d,hash:%d\n&quot;,
lib_got_ndx,lib_plt_ndx,lib_dynsym_ndx,lib_dynstr_ndx,lib_hash_ndx
)&#59;
{
unsigned long *l =
(unsigned long*)(libdata + libsh[lib_hash_ndx].sh_offset)&#59;
nbucket = *l++&#59;
nchain = *l++&#59;
fprintf(stderr,&quot;Lib: nbucket=%d,nchain=%d\n&quot;,nbucket,nchain)&#59;
buckets = l&#59;
chains = l + nbucket&#59;
}
libsym = (Elf32_Sym*)(libdata + libsh[lib_dynsym_ndx].sh_offset)&#59;
libstr = (char *)(libdata + libsh[lib_dynstr_ndx].sh_offset)&#59;

/* Now create output library,copy origin library data */
memcpy(tmpdata,libdata,libsh[lib_got_ndx+1].sh_offset)&#59;
memcpy(tmpdata + libsh[lib_got_ndx+1].sh_offset,
objdata + objoff,
objlen
)&#59;
memcpy(tmpdata + libsh[lib_got_ndx+1].sh_offset + objlen,
libdata + libsh[lib_got_ndx+1].sh_offset,
libst.st_size - libsh[lib_got_ndx+1].sh_offset
)&#59;

tmpeh = (Elf32_Ehdr*)tmpdata&#59;
/* Because e_shoff >; got_off, so we must adjust it */
tmpeh->;e_shoff = libeh->;e_shoff + objlen&#59;
/* Adjust .got size and adjust offset of sections beyond .got */
tmpsh = (Elf32_Shdr*)(tmpdata + tmpeh->;e_shoff)&#59;
tmpsym = (Elf32_Sym*)(tmpdata + tmpsh[lib_dynsym_ndx].sh_offset)&#59;
#ifdef DEBUG
printf(&quot;tmpgot off: %#x,size: %#x\n&quot;,
tmpsh[lib_got_ndx].sh_offset,libsh[lib_got_ndx].sh_size)&#59;
#endif
tmpsh[lib_got_ndx].sh_size += objlen&#59;

for (i = lib_got_ndx + 1&#59; i<tmpeh->;e_shnum&#59; i++) {
tmpsh.sh_offset += objlen&#59;
if (tmpsh.sh_addr)
tmpsh.sh_addr += objlen&#59;
}

for (i=0&#59; spsym&#59; i++) {
if ((idx = lookup_sym(libsym,libstr,spsym)) != STN_UNDEF) {
Elf32_Sym *sym = &amp;libsym[idx]&#59;
printf(&quot;value: %#x,size: %#x,bind:%d,type:%d,shndx: %d\n&quot;,
sym->;st_value,sym->;st_size,
ELF32_ST_BIND(sym->;st_info),
ELF32_ST_TYPE(sym->;st_info),
sym->;st_shndx
)&#59;
sym = &amp;tmpsym[idx]&#59;
sym->;st_value += objlen&#59;
}
else
fprintf(stderr,&quot;Relocate: symbox %s not found\n&quot;,spsym)&#59;
}

/* Adjust Program header table */
#ifdef DEBUG
printf(&quot;e_phoff:%#x, e_phnum:%d, e_phentsize:%d\n&quot;,
tmpeh->;e_phoff,tmpeh->;e_phnum,tmpeh->;e_phentsize)&#59;
#endif
tmpph = (Elf32_Phdr*)(tmpdata + tmpeh->;e_phoff)&#59;
for (i=0&#59; i<tmpeh->;e_phnum&#59; i++,tmpph++) {
#ifdef DEBUG
printf(&quot;p offset: %#x,vaddr: %#x,paddr: %#x,filesz: %#x,memsz: %#x\n&quot;,
tmpph->;p_offset,tmpph->;p_vaddr,tmpph->;p_paddr,
tmpph->;p_filesz,tmpph->;p_memsz)&#59;
#endif
if (tmpph->;p_offset >; tmpsh[lib_got_ndx].sh_offset) {
tmpph->;p_offset += objlen&#59;
tmpph->;p_vaddr += objlen&#59;
tmpph->;p_paddr = tmpph->;p_vaddr&#59;
}
else if (tmpph->;p_offset + tmpph->;p_filesz >;
tmpsh[lib_got_ndx].sh_offset) {
tmpph->;p_filesz += objlen&#59;
tmpph->;p_memsz += objlen&#59;
tmpph->;p_flags = (PF_R | PF_W | PF_X)&#59;
}
}

/* Now relocate function references */
for (i=0&#59; i<nobj_rela_text&#59; i++) {
Elf32_Sym *sym = &amp;objsym[ELF32_R_SYM(obj_rela_text.r_info)]&#59;
char *symname = sym->;st_name + objstr&#59;
unsigned long *reloff = NULL&#59;
fprintf(stderr,&quot;Relocate symbol: %s,offset:%#x,info:%#x,addend:%#x\n&quot;,
symname,obj_rela_text.r_offset,
obj_rela_text.r_info,obj_rela_text.r_addend
)&#59;
if ((idx = lookup_sym(libsym,libstr,symname)) != STN_UNDEF) {
sym = &amp;libsym[idx]&#59;
printf(&quot;value: %#x,size: %#x,bind:%d,type:%d,shndx: %d\n&quot;,
sym->;st_value,sym->;st_size,
ELF32_ST_BIND(sym->;st_info),
ELF32_ST_TYPE(sym->;st_info),
sym->;st_shndx
)&#59;
}
else {
fprintf(stderr,&quot;Symbol %s not found in lib,continue anyway.\n&quot;,
symname)&#59;
continue&#59;
}
if (ELF32_ST_TYPE(libsym[idx].st_info) == STT_FUNC) {
reloff = (unsigned long*)(tmpdata +
libsh[lib_got_ndx+1].sh_offset + obj_rela_text.r_offset)&#59;
if (ELF32_R_TYPE(obj_rela_text.r_info) == R_SPARC_WPLT30){
unsigned long disp30 = 0&#59;
printf(&quot;*reloff:%#x\n&quot;,*reloff)&#59;
disp30 = libsh[lib_got_ndx+1].sh_addr +
obj_rela_text.r_offset - sym->;st_value&#59;
printf(&quot;base=%#x,disp30=%#x,disp30=%#x\n&quot;,
libsh[lib_got_ndx+1].sh_addr,disp30,disp30 >;>; 2)&#59;
disp30 = ~(disp30 >;>; 2)&#59;
disp30 &amp;= 0x3fffffff&#59;
disp30 |= 0x40000000&#59;
printf(&quot;final *reloff: %#x\n&quot;,disp30)&#59;
*reloff = disp30&#59;
}
else if (ELF32_R_TYPE(obj_rela_text.r_info) == R_386_PC32) {
unsigned long dest = sym->;st_value - 4 -
(libsh[lib_got_ndx+1].sh_addr + obj_rela_text.r_offset)&#59;
printf(&quot;dest: %x\n&quot;,dest)&#59;
*reloff = dest&#59;
}
}
}

/* Hook function */
if ((idx = lookup_sym(libsym,libstr,&quot;huhu&quot;)) != STN_UNDEF) {
Elf32_Sym *sym = &amp;libsym[idx]&#59;
printf(&quot;value: %#x,size: %#x,bind:%d,type:%d,shndx: %d\n&quot;,
sym->;st_value,sym->;st_size,
ELF32_ST_BIND(sym->;st_info),
ELF32_ST_TYPE(sym->;st_info),
sym->;st_shndx
)&#59;
sym = &amp;tmpsym[idx]&#59;
printf(&quot;value: %#x,size: %#x,bind:%d,type:%d,shndx: %d\n&quot;,
sym->;st_value,sym->;st_size,
ELF32_ST_BIND(sym->;st_info),
ELF32_ST_TYPE(sym->;st_info),
sym->;st_shndx
)&#59;
sym->;st_value = libsh[lib_got_ndx+1].sh_addr&#59;
sym->;st_size = objlen&#59;
sym->;st_shndx = lib_got_ndx&#59;
}

munmap(libdata,libst.st_size)&#59;
munmap(tmpdata,libst.st_size + objlen)&#59;
munmap(objdata,objst.st_size)&#59;
return 0&#59;
}