Using LD_PRELOAD to cheat, inject features and investigate programs

1. frida

   1 16 18,086 9.4 Meson

   Clone this repo to build Frida

   

   A great framework for doing something along those lines is Frida (https://github.com/frida/frida). Works on a bunch of stuff, including Android and iOS. Some global-ish certificate pinning bypasses work through Frida, by patching http libraries to not raise exceptions, accept system certificates, etc and just quietly hum along instead. Certificate unpinning in turn enables network MITM with mitmproxy, which makes it a lot quicker and easier to inspect, block, or modify network traffic.

   Funnily enough, I've seen much stronger obfuscation from reverse engineering from my cheap Tuya IoT devices app than from my bank app.

2. Stream

   getstream.io featured

   Stream - Scalable APIs for Chat, Feeds, Moderation, & Video. Stream helps developers build engaging apps that scale to millions with performant and flexible Chat, Feeds, Moderation, and Video APIs and SDKs powered by a global edge network and enterprise-grade infrastructure.

   

3. proxychains

   2 19 7,231 6.2 C

   proxychains - a tool that forces any TCP connection made by any given application to follow through proxy like TOR or any other SOCKS4, SOCKS5 or HTTP(S) proxy. Supported auth-types: "user/pass" for SOCKS4/5, "basic" for HTTP.

   

   Fun fact: proxychains uses LD_PRELOAD [0] to hook the necessary syscalls [1] for setting up a "proxy environment" for the wrapped program, e.g. `connect`, `gethostbyname`, `gethostbyaddr`, etc. Note this also implies that it could be leaky in some cases when applied to a program that uses alternative syscalls to make an external connection.

   [0] https://github.com/haad/proxychains/blob/master/src/proxycha...

   [1] https://github.com/haad/proxychains/blob/master/src/libproxy...

4. tup

   3 28 1,221 6.9 C

   Tup is a file-based build system.

   

5. ClickHouse

   4 251 41,764 10.0 C++

   ClickHouse® is a real-time analytics database management system

   

6. QuAPI

   5 1 4 10.0 C++

   Library and tool to add assumption-support to generic SAT or QBF solver binaries using automated fork()ing and LD_PRELOAD (by maximaximal)

   

7. ld_preload-sounds

   6 1 192 10.0 C

   Generates raw WAV output by hooking malloc() and read().

   

   one of my favorite hacks, which started as a joke, is using LD PRELOAD to generate audio from memory allocation and read calls.

   https://github.com/gordol/ld_preload-sounds

   this started out as like 10-20 lines of terrible code originally, and a few people sent merge requests to improve it

Suggest a related project