Originally posted by Weasel
View Post
Originally posted by Weasel
View Post
Originally posted by Weasel
View Post
Hooking need to be processed in a order. Even without LD_PRELOAD the libraries and applications files in ELF hook themselves in a predictable order.
Weasel the nightmare with AppInit_DLL is if you read careful the Appinit_DLL can only use kernel32.dll You don't have a global namespace. So now the dllmain has to go to sleep until more of the application loads. This creates a race condition.
Like it or not having a global symbol namespace to fill in with information from the start line has some serous advantages particularly if you have to hook stuff and not to race condition it.
Would I like to see the information in the global symbol namespace more used. Yes the ELF global symbol namespace records what file the symbol comes from. Would I like to see applications use versioned symbols more include filters. The more usage of filters would lead to having to add in extra information for exports. Like this export please pretend that it comes from x file for hooking. This would cure your problems. The global symbol namespace of elf is storing all the need information. The general elf import without versioned does not check what one it gets.
You really want you dll exported symbols to have all the information for hooking. So that only the dynamic loader has to perform hooking and you don't have hooking order cat fight.
ELF format has something right. Now I am not going say that lacking usage of versioned and complete implementation of versioned on ELF is right.
Windows style of hooking where it can race condition and end up applied in wrong order..... is absolutely dangerous. Yes hooking in the wrong order can happen by mistake under windows and randomally.
ELF symbol conflicts happen because you are mixing binaries with each other but when you have a error is absolutely reproducible nothing random about it. Usage of versioned with ELF would block a lot of these conflicts.
Comment