[Gammaray-interest] Impact of "-Bsymbolic" linker flag (summary)

[Kevin Funk]

On Saturday 14 January 2012, 16:21, Volker Krause wrote:
> Thanks, very interesting indeed.
> 
> While we are at it, someone mentioned you found a way to check whether the
> qt_* hooks are affected by -Bsymbolic-functions or not. Could you maybe add
> that to the wiki or post it here? Ideally we can implement it in the preload
> injector self-test then.
> 
> regards,
> Volker
> 
> On Saturday 14 January 2012 13:17:03 Kevin Funk wrote:
> (snip)

Well, this is quite easy,

Suppose you want to check if QtCore is built with -Bsymbolic, then run:
$ objdump -d /usr/lib/libQtCore.so | grep qt_startup_hook at plt

I get the following output (currently using OpenSuse 12.1):
00049444 <qt_startup_hook at plt>:
  164f32:       e8 0d 45 ee ff          call   49444 <qt_startup_hook at plt>

This means, QtCore was built *without* -Bsymbolic. If you don't get any 
output, then qt_startup_hook cannot be overwritten by LD_PRELOAD.

So, in other words, if the qt_startup_hook symbol has an entry in the .PLT 
section, then a call to qt_startup_hook() from within QtCore itself will first 
go through the GOT (that's the desired behavior to make the LD_PRELOAD hack 
work).

It should be possible to get the .PLT information from a dlopen'ed library, 
which could be used in a runtime test. See [1]

I'll add that to the wiki when I find time.

Greets

[1] http://www.kernel.org/doc/man-pages/online/pages/man5/elf.5.html

-- 
Kevin Funk | kevin.funk at kdab.com | Software Engineer
KDAB (Deutschland) GmbH&Co KG, a KDAB Group company
Tel. Germany +49-30-521325470, Sweden (HQ) +46-563-540090
KDAB - Qt Experts - Platform-independent software solutions