2

Is it possible to conditionally replace a function at runtime in C (in particular, a function in a dynamically loaded library)?

I know that you can use LD_PRELOAD or just make a function of the same name, such as:

// Silly example intercepting exit
typedef void (*exit_func)(int code);

void exit(int code)
{
    exit_func orig_exit = (exit_func)dlsym(RTLD_NEXT, "exit");

    NSLog(@"EXIT CALLED WITH CODE %d!!!!", code);

    orig_exit(code);
}

However, is it possible to CONDITIONALLY replace a function, at runtime, after the program has loaded and is running?

if(some_condition)
{
    swap_impementations(exit, my_exit);
}

Edit: This is somewhat similar to Is it possible to swap C functions? but specifically, I am trying to intercept a call to a function from a different library that was loaded by the operating system.

What this means is that, for example, were I to intercept the exit() function from stdlib, ANY call to exit() from ANYWHERE would call my implementation instead of the original, much like my example above, except controllable at runtime.

There have been suggestions of hooking the call by overwriting the original with a jump instruction, but I was hoping for something that doesn't require stomping on executable memory, like perhaps there was something I could call in the dynamic linker to "re-link" the function after the program starts and point it somewhere else?

5
  • Maybe I'm missing something: Why can't you just use a function pointer?
    – Ezra
    May 21, 2013 at 3:04
  • 1
    I'm not sure why a function pointer wouldn't work for you, but alternatively you could hook the function. the most basic way being simply writing a jump or call instruction over the start of the function.
    – AusCBloke
    May 21, 2013 at 3:12
  • I want to replace the implementation of a function contained in a dynamic library loaded by the OS, such that anything calling that function calls my implementation instead. If you wanted to intercept the exit() function, for example, function pointers wouldn't do it.
    – Karl
    May 21, 2013 at 3:31
  • Yeah then you're probably wanting to hook the function. For example Microsoft has their Detours library for creating trampolines and hooking Win32 functions.
    – AusCBloke
    May 21, 2013 at 4:11
  • possible duplicate of Is it possible to swap C functions? May 21, 2013 at 11:22

2 Answers 2

0

Use function pointer for this purpose.

0

Others are correct when they say you can use a function pointer for this. The question is reasonable in that it's not as simple as "just use a function pointer".

To replace the definition of a dynamically loaded function and still use the same function symbol (glossing over details of the dynamic loading):

  1. Define a stub for the function you want to replace (to ensure it's always defined)
  2. Define a type matching the signature
  3. Create a pointer to the stub using the type
  4. Use a macro to replace all calls to the function_to_replace by the stub pointer
#include <stdio.h>

/* conditionally load this function using something like dlopen and dlsym */
void
function_to_replace (char * message)
{
  printf ("%s\n", message);
}

/* 1. Define a stub for the library function */
void stub_for_function_to_replace(char * message)
{
  printf ("the function was replaced!\n");
}

/* 2. Define a new type for the function pointer using the type*/
typedef void function_to_replace_t(char *);

/* 3. Create a function pointer to the stub */
function_to_replace_t * function_to_replace_ = stub_for_function_to_replace;

/* 4. Replace all instances of the original function call with the function pointer */
#define function_to_replace function_to_replace_

int
main (void)
{
  char * message = "hello, world!";

  function_to_replace(message);

  return (0);
}

The downside to this approach is that you can only do the replacement once and that the replacement happens before run-time. That is, you can't define a main like in the next example (which swaps out the function during run-time). AFAICT, you can't dynamically change a function's definition and preserve the function name symbol during run-time.

If you don't care about using the same symbol the library uses for its function, then the following works.

#include <stdio.h>

void
library_function (char *message)
{
  printf ("Library function: %s\n", message);
}

void
replacement_function (char *message)
{
  printf ("Replacement function: %s\n", message);
}

typedef void library_function_t (char *);

library_function_t *my_function = replacement_function;

int
main (void)
{
  char *message = "Hello, world!";
  int *choice;
  *choice = 0;

  while (3 != *choice)
    {
      printf ("\n=== MENU ===\n");
      printf ("1. Library\n");
      printf ("2. Replaced\n");
      printf ("3. Exit program\n\n");

      printf ("Select function definition to use: ");
      scanf ("%d", choice);

      if (1 == *choice)
        {
          my_function = library_function;
          my_function (message);
        }
      else if (2 == *choice)
        {
          my_function = replacement_function;
          my_function (message);
        }
      else if (3 == *choice)
        {
          break;
        }
    }

  return (0);
}

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.