dlsym hook function crash

shihyu

1. #include <stdio.h>
   
2. #include <string.h>
   
3. #include <stddef.h>
   
4. #include <unistd.h>
   
5. #include <dlfcn.h>
   
6. 
   
7. void* malloc(size_t size)
   
8. {
   
9.     char buf[32];
   
10.     static void* (*real_malloc)(size_t) = NULL;
    
11. printf("ggggggggggg");
    
12. 
    
13.     if (real_malloc == NULL) {
    
14.         *(void**)(&real_malloc) = dlsym(RTLD_NEXT, "malloc");
    
15.     }
    
16. 
    
17.     sprintf(buf, "malloc called, size = %zu\n", size);
    
18.     write(2, buf, strlen(buf));
    
19.     return real_malloc(size);
    
20. }
    
21. 
    
22. void free(void* ptr)
    
23. {
    
24.     char buf[32];
    
25.     static void* (*real_free)(void* ptr) = NULL;
    
26. 
    
27.     if (real_free == NULL) {
    
28.         *(void**)(&real_free) = dlsym(RTLD_NEXT, "free");
    
29.     }
    
30. 
    
31.     sprintf(buf, "free called, ptr address = %p\n", ptr);
    
32.     write(2, buf, strlen(buf));
    
33.     real_free(ptr);
    
34. }
    

复制代码

gcc -D_GNU_SOURCE -shared -fPIC -o libmcount.so malloc_count.c -ldl
LD_PRELOAD=./libmcount.so ls

不明白在malloc函数里面 printf 函数会造成 crash ? 看網上dlsym hook一些例子只用 write or fprintf 而不用 printf

shihyu

1. #define _GNU_SOURCE
   
2. #include <stdio.h>
   
3. #include <string.h>
   
4. #include <dlfcn.h>
   
5. 
   
6. typedef size_t (*strlen_t)(const char *str);
   
7. size_t strlen(const char *str) {
   
8.     strlen_t real_strlen = (strlen_t) dlsym(RTLD_NEXT, "strlen");
   
9.     printf("calling strlen.\n");
   
10.     return real_strlen(str);
    
11. }

复制代码

1. #include <stdio.h>
   
2. #include <string.h>
   
3. int main(int argc, char* argv[])
   
4. {
   
5.     char s[] = "hello, world!";
   
6.     printf("length is %d\n", strlen(s));
   
7.     return 0;
   
8. }

复制代码

我又测试一版本是 hook strlen 在里面用 printf 没问题
编译指令:
gcc -shared -fPIC hook.c -o hook.so -ldl
LD_PRELOAD=$PWD/hook.so ./test

这样是 printf 跟 malloc 之间有什么关系嘛？
printf 底层是会call到 malloc 所以造成 crash?

lxyscls

贴栈信息看下

LD_PRELOAD=./libmcount.so ls
1.cap      build        hello world   malloc_count.c          node_modules  pmfm          swagger     t.c    v2
aaaa.pcap  code         l             n2n_v2_fork-master      pip-9.0.1     RESTServer    swagger.sh  t.cpp  whl
api        crossdomain  libmcount.so  n2n_v2_fork-master.zip  pktgen        RESTServerV2  t           t.o    xxxlll

cat /etc/centos-release
CentOS Linux release 7.0.1406 (Core)

shihyu

gdb ls core

1. #28848 0x00007fd3c8b45899 in printf () from /lib/x86_64-linux-gnu/libc.so.6
   
2. #28849 0x00007fd3c90dc89d in malloc () from ./libmcount.so
   
3. #28850 0x00007fd3c8b5d1d5 in _IO_file_doallocate () from /lib/x86_64-linux-gnu/libc.so.6
   
4. #28851 0x00007fd3c8b6b594 in _IO_doallocbuf () from /lib/x86_64-linux-gnu/libc.so.6
   
5. #28852 0x00007fd3c8b6a8f8 in _IO_file_overflow () from /lib/x86_64-linux-gnu/libc.so.6
   
6. #28853 0x00007fd3c8b6928d in _IO_file_xsputn () from /lib/x86_64-linux-gnu/libc.so.6
   
7. #28854 0x00007fd3c8b3d241 in vfprintf () from /lib/x86_64-linux-gnu/libc.so.6
   
8. #28855 0x00007fd3c8b45899 in printf () from /lib/x86_64-linux-gnu/libc.so.6
   
9. #28856 0x00007fd3c90dc89d in malloc () from ./libmcount.so
   
10. #28857 0x00007fd3c8b5d1d5 in _IO_file_doallocate () from /lib/x86_64-linux-gnu/libc.so.6
    
11. #28858 0x00007fd3c8b6b594 in _IO_doallocbuf () from /lib/x86_64-linux-gnu/libc.so.6
    
12. #28859 0x00007fd3c8b6a8f8 in _IO_file_overflow () from /lib/x86_64-linux-gnu/libc.so.6
    
13. #28860 0x00007fd3c8b6928d in _IO_file_xsputn () from /lib/x86_64-linux-gnu/libc.so.6
    
14. #28861 0x00007fd3c8b3d241 in vfprintf () from /lib/x86_64-linux-gnu/libc.so.6
    
15. #28862 0x00007fd3c8b45899 in printf () from /lib/x86_64-linux-gnu/libc.so.6
    
16. #28863 0x00007fd3c90dc89d in malloc () from ./libmcount.so
    
17. #28864 0x00007fd3c8b5d1d5 in _IO_file_doallocate () from /lib/x86_64-linux-gnu/libc.so.6
    
18. #28865 0x00007fd3c8b6b594 in _IO_doallocbuf () from /lib/x86_64-linux-gnu/libc.so.6
    
19. #28866 0x00007fd3c8b6a8f8 in _IO_file_overflow () from /lib/x86_64-linux-gnu/libc.so.6
    
20. #28867 0x00007fd3c8b6928d in _IO_file_xsputn () from /lib/x86_64-linux-gnu/libc.so.6
    
21. #28868 0x00007fd3c8b3d241 in vfprintf () from /lib/x86_64-linux-gnu/libc.so.6
    
22. #28869 0x00007fd3c8b45899 in printf () from /lib/x86_64-linux-gnu/libc.so.6
    
23. #28870 0x00007fd3c90dc89d in malloc () from ./libmcount.so
    
24. #28871 0x00007fd3c8b5d1d5 in _IO_file_doallocate () from /lib/x86_64-linux-gnu/libc.so.6
    
25. #28872 0x00007fd3c8b6b594 in _IO_doallocbuf () from /lib/x86_64-linux-gnu/libc.so.6
    
26. #28873 0x00007fd3c8b6a8f8 in _IO_file_overflow () from /lib/x86_64-linux-gnu/libc.so.6
    
27. #28874 0x00007fd3c8b6928d in _IO_file_xsputn () from /lib/x86_64-linux-gnu/libc.so.6
    
28. #28875 0x00007fd3c8b3d241 in vfprintf () from /lib/x86_64-linux-gnu/libc.so.6
    
29. <font color="#ff0000">#28876 0x00007fd3c8b45899 in printf () from /lib/x86_64-linux-gnu/libc.so.6
    
30. #28877 0x00007fd3c90dc89d in malloc () from ./libmcount.so</font>
    
31. #28878 0x00007fd3c8b5dcdd in ?? () from /lib/x86_64-linux-gnu/libc.so.6
    
32. #28879 0x00007fd3c8ec49b6 in selinuxfs_exists () from /lib/x86_64-linux-gnu/libselinux.so.1
    
33. #28880 0x00007fd3c8ebfcdc in ?? () from /lib/x86_64-linux-gnu/libselinux.so.1
    
34. #28881 0x00007fd3c92ee6ba in ?? () from /lib64/ld-linux-x86-64.so.2
    
35. #28882 0x00007fd3c92ee7cb in ?? () from /lib64/ld-linux-x86-64.so.2
    
36. #28883 0x00007fd3c92dec6a in ?? () from /lib64/ld-linux-x86-64.so.2
    
37. #28884 0x0000000000000002 in ?? ()
    
38. #28885 0x00007ffc1b6f537a in ?? ()
    
39. #28886 0x00007ffc1b6f537d in ?? ()
    
40. #28887 0x0000000000000000 in ?? ()
    

复制代码

bruceteen

死递归了吗？
malloc 调用 printf，printf内部又要调用malloc，……

shihyu

core dump 看起来像是 printf 递归 call malloc , 可是　printf 为什么需要递归 call malloc　？　 glibc printf 代码里面可以看出来有　递归 call malloc?

bruceteen

可是　printf 为什么需要递归 call malloc　？　
------ printf没有递归 call malloc，printf就是调用了malloc一下。谁知你的malloc又调用printf，这才导致死递归。

irp

递归调用malloc,栈溢出了。printf 里面肯定直接或者间接call malloc的, 在你自己的malloc实现里面先调用 real_malloc()再调用其它函数.