/* DLL Injection (Library Switcharoo) The act of replacing a library by another to modify the behaviour of a program. While this could easily be used to troll somebody or do other malicious intent, it is also a very useful tool for testing or debugging. Example: Let's say you have a game program that deals you cards and for some reason, the program fails when you are dealt the joker card. Using DLL injection, you could trick the program to make it always deal joker cards so then you could investigate the bug further.(that is if your program wasnt statically compiled and depends on shared librar(y)/(ies)) LD_PRELOAD Linux's linker, ld, will retrieve symbols from a shared library at execution time and link 'em with the program. The LD_PRELOAD environment variable is used to specify which library the executed program(s) should be linking to first. All function contained within will override any others with same names. If LD_PRELOAD is exported, all running programs will be linked to what this environment variable says. If you have a doubt you are using the wrong library, just check the value of LD_PRELOAD, in case a little troll switched your libraries. */ #include #include using namespace std; const string source{ R"( #include #include using namespace std; int main(){ srand(time(0)); int lucky = rand(); cout << "Your lucky number is " << lucky << endl; } )" }; const string my_rand{ R"( #include int rand(){ puts("\nHACKED"); puts("\nNever gonna give you up\n" "Never gonna let you down\n" "Never gonna run around and desert you\n" "Never gonna make you cry\n" "Never gonna say goodbye\n" "Never gonna tell a lie and hurt you\n"); return 42; // the dice are fixed } )" }; int main() { // write source code ofstream cpp{"hello.cpp"}; cpp << source; cpp.close(); // compile to executable a.out system("g++ hello.cpp"); // run / execute a.out system("./a.out"); // write my rand file ofstream cmyrand{"my_rand.c"}; cmyrand << my_rand; cmyrand.close(); // compile my rand lib system("gcc -shared -fPIC -o my_rand.so my_rand.c"); // dll injection happens here system("export LD_PRELOAD=$PWD/my_rand.so && ./a.out"); return 0; }

DLL injection - LD_PRELOAD