Skip to main content

02. LD_PRELOAD Runtime Hooking at a Glance

When patching a binary is difficult in the early stages of reverse engineering, LD_PRELOAD is often the fastest bypass. It overrides functions with a preloaded shared library when the dynamic linker resolves symbols.

Core Idea​

  • Redefine a libc function called by the target, such as open or strcmp, with the same signature
  • Call the original function with dlsym(RTLD_NEXT, "open")
  • Inject it through an environment variable: LD_PRELOAD=./hook.so ./target

CTF and Vulnerability Analysis Points​

  • Conditionally disable license checks and anti-debugging routines
  • Intercept file and network I/O to trace the flow of input values
  • LD_PRELOAD is blocked for SUID binaries, so check noexec settings and permissions

Its advantage is that it provides both behavior observation and logic bypassing without patching. It is especially useful when you need to start designing a payload quickly.