Last active
April 28, 2025 20:34
-
-
Save supechicken/54839c560fac14e22e1dfaca9c6f4586 to your computer and use it in GitHub Desktop.
Simple audit library for intercepting/modifying library requests in glibc
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
#define _GNU_SOURCE | |
#include <stdio.h> | |
#include <stdlib.h> | |
#include <string.h> | |
#include <unistd.h> | |
#include <link.h> | |
#include <linux/limits.h> | |
#include <gnu/libc-version.h> | |
char *crew_prefix, crew_glibc_prefix[PATH_MAX], crew_libc_so_path[PATH_MAX]; | |
unsigned int la_version(unsigned int interface_ver) { | |
crew_prefix = getenv("CREW_PREFIX") ?: "/usr/local"; | |
snprintf(crew_glibc_prefix, PATH_MAX, "%s/opt/glibc-libs", crew_prefix); | |
snprintf(crew_libc_so_path, PATH_MAX, "%s/libc.so.6", crew_glibc_prefix); | |
fprintf(stderr, "crew-audit: Initialized on glibc %s with interface version %i\n", gnu_get_libc_version(), interface_ver); | |
fprintf(stderr, "crew-audit: Chromebrew prefix: %s\n", crew_prefix); | |
return LAV_CURRENT; | |
} | |
char *la_objsearch(const char *soname, uintptr_t *cookie, unsigned int flag) { | |
char *new_path = malloc(PATH_MAX); | |
// do not modify requests with absolute path | |
if (soname[0] == '/') return soname; | |
//printf("crew-audit: Library %s is being requested...\n", soname); | |
if (strncmp(soname, "libC.so.6", strlen(soname)) == 0) { | |
fprintf(stderr, "crew-audit: libC.so.6 being requested, replacing it with %s...\n", crew_libc_so_path); | |
return crew_libc_so_path; | |
} | |
snprintf(new_path, PATH_MAX, "%s/opt/glibc-libs/%s", crew_prefix, soname); | |
if (access(new_path, F_OK) == 0) { | |
fprintf(stderr, "crew-audit: Library found in %s, using it instead...\n", new_path); | |
return new_path; | |
} | |
return soname; | |
} |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment