-
-
Notifications
You must be signed in to change notification settings - Fork 13
Description
Recently I was stumped trying to call strcpy() from an interposed function. It was taking in my rdi and rsi args but the result was not what i was expecting, because strcpy was never actually being called. The IFUNC stub was, which is supposed to then update the PLT/GOT.
Well the PLT/GOT in the target binary has already been fixed up by now with the correct strcpy address, but the GOT within the patch module needs to be resolved too (with the address picked by the IFUNC resolver).
Research ways to do this.
My thoughts on how to implement after some contemplating:
Currently our patch PLT entries only do an indirect jmp. It hasn't been necessary to add in the push afterwards since
we haven't been doing any type of lazy linking.
Method 1. New PLT stub to support ifunc. Only PLT stubs that that require IFUNC should use this code-format. The rest can stay a single jmp instruction (Possibly with nops afterward for aligning the PLT entries)
Method 2. Re-route libc.so IFUNC symbols to the musl-libc equivalent already baked into Shiva. This will not handle IFUNC in libraries other than libc though.