使用 LD_PRELOAD 和线程安全注入线程
我正在开发一个项目，使用 LD_PRELOAD 在程序中注入共享库。
我的注入库在注入程序时会创建一个新线程。所有逻辑都发生在该线程中（例如分析网络流量等）。
首先您需要了解正在预加载的程序。它是一个客户端应用程序，对写入静态缓冲区并发送到服务器的每个数据包进行加密。我找到了客户端中加密和发送数据包的函数，并且能够绕过它。所以现在我可以修改静态缓冲区并让“发送”函数加密缓冲区并将缓冲区发送到服务器。
但现在我有一个问题：如果我更改库线程中静态缓冲区的内容会怎样（所以我可以发送一个假数据包），同时程序的线程也更改静态缓冲区？那会导致崩溃。
我需要某种同步。
所以我一直在考虑一些解决方案：
- 找到程序中更改缓冲区的每个函数，绕过它们并向该调用添加互斥体或类似的东西。不过，需要很长时间...
- 找到一种方法来执行我的代码，在一个块中更改缓冲区。所以我的代码实际上是立即执行的，没有 POSIX 线程切换到其他线程。这可能吗？
- 让我的应用程序同步并哭泣。
有人能想出更好的解决方案吗？或者你知道如何使解决方案2成为可能吗？
提前致谢， 吉利斯
I'm working on a project to inject a shared library in a program with LD_PRELOAD.
My injected library creates a new thread when it is injected into the program. All logic happens in this thread (like analyzing network traffic and so on).
First you need to know this about the program that is being preloaded. It is a client application that encrypts every packet, written to a static buffer, that it sends to the server. I found the function that encrypts and sends the packets in the client and I was able to detour it. So now I can just modify the static buffer and let the 'send' function encrypt the buffer and send the buffer to the server.
But now I have a problem: what if I change contents of the static buffer in my library's thread (so that I can send a fake packet) and at the same time the program's thread changes the static buffer too? That would cause a crash.
I need some kind of synchronization.
So I've been thinking of some solutions:
- Find every function in the program that changes the buffer, detour them and add a mutex to that call or something like that. Would take like ages though...
- Find a way to execute my piece of code, that changes the buffer, in one block. So my piece of code actually gets executed at once, without POSIX threads switching to other threads. Is this even possible?
- Make my application synchronous and cry.
Can anyone come up with a better solution? Or do you know how to make solution 2 possible?
Thanks in advance,
Gillis
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
如果您绕行了“发送”函数，并且预加载库中有“绕行发送”的代码，则意味着当主线程调用“发送”时，您的“绕行发送”代码将在主线程中执行线程的上下文，您的线程此时什么也不做。如果您有多个可能调用“发送”的“主线程”，那么您需要在“绕道发送”中进行同步。
或者，如果您确实想在新的“注入”线程中处理某些内容，您可以：
1）在“绕道发送”（从主线程上下文调用）中：将数据传递到您的线程
并等待它完成数据处理（注意：主线程正在等待）。
If you detoured the 'send' function and you have the code of your 'detoured send' in your preloaded library it means that when the main thread calls 'send', your 'detoured send' code will be executed in the main thread's context, your thread is doing nothing at that moment. If you have more than one 'main thread' that could potentially call 'send', then you need synchronization in your 'detoured send'.
Alternatively, it you really want to process something in your new 'injected' thread you can:
1) in your 'detoured send' (invoked from main thread's context): pass the data to your thread
and wait untill it finishes processing the data (notice: the main thread is waiting).