How does ltrace
work?
How does it find out which library functions a program calls?
Is there any common code path that all calls to library functions go through? Maybe ltrace
sets breakpoints in this common code path?
How does ltrace
work?
How does it find out which library functions a program calls?
Is there any common code path that all calls to library functions go through? Maybe ltrace
sets breakpoints in this common code path?
Copyright © 2021 Jogjafile Inc.
Dynamic executables have a symbol table used by the linker when resolving references that need to be connected to library functions. (You can see this yourself by running
objdump -T /path/to/binary
).This symbol table is accessible by other tools -- such as
ltrace
-- as well, so it's trivial to determine which functions need to be hooked and walk that list individually.See a talk on ltrace internals presented at the Ottowa Linux Symposium, which provides a detailed, function-by-function breakdown; to follow along the source, see the official repository, or a third-party github mirror.
Some newer releases (more recent than that talk) also hook the
dlopen()
call, to be able to trace invocation of dynamically loaded libraries as well. The mechanism there should be rather obvious on a moment's thought -- if one can replacedlopen()
with a shim (whendlopen()
itself is dynamically linked as above), one can then set a breakpoint on any function pointer it returns.