. Android hook -- LD_PRELOAD

The secrets of Smart terminal security on the mobile Internet mentioned a method of android hook. You can set the LD_PRELOAD environment variable to change the function execution process to achieve the purpose of hook. Sample Code in the book and Chen Hao's blog: Ghost. Sample Code 1. The following is a program used to determine the user password. The standard c function strcmproot @ bt is used :~ /Programe # cat verify. c # include <stdio. h> int main (int argc, char ** argv) {char passwd [] = "password"; if (argc <2) {printf ("usage: % s <password> \ n ", argv [0]); return;} if (! Strcmp (passwd, argv [1]) {printf ("Correct! \ N "); return;} printf (" Invalid! \ N ");} test program result root @ bt :~ /Programe #./verify daniInvalid! Root @ bt :~ /Programe #./verify passwordCorrect! 2. The following programs reload the strcmp function and always return 0, that is, the two strings are considered to be equal root @ bt :~ /Programe # cat hack. c # include <stdio. h> # include <string. h> int strcmp (const char * s1, const char * s2) {printf ("hack invoked. s1 = <% s> s2 = <% s> \ n ", s1, s2); return 0;} compile to so, and then set the LD_PRELOAD environment variable, observe the running result root @ bt :~ /Programe # gcc-shared-o hack. so hack. c root @ bt :~ /Programe # export LD_PRELOAD = "./hack. so" root @ bt :~ /Programe #./verify danihack invoked. s1 = <password> s2 = <dani> Correct! From the running result, the program preferentially calls hack. so's strcmp, it seems that the principle of using this method to hook is to set the LD_PRELOAD environment variable. Before the main program calls other dynamic link libraries, it will give priority to calling the self-compiled dynamic link library, overwrite the normal function library for the purpose.