tracee icon indicating copy to clipboard operation
tracee copied to clipboard

[FEAT] Create event for collision of SO symbols

Open AlonZivony opened this issue 2 years ago • 0 comments

Prerequisites

  • [ ] This issue is an EPIC issue (add label: EPIC).
  • [ ] This issue is an EPIC TASK (add issue to EPIC description).

Select one OR another:

  • [x] I'll create a PR to implement this feature (assign to yourself).
  • [ ] Someone else should implement this (describe it well).

Feature description

One known way to create hook and running malicious code is using the LD_PRELOAD method. In this way, an attacker can export the same function as libc or other used shared library, and by loading the malicious shared object before the known one the loader will resolve the imported symbol to be of the malicious shared object instead of the normal one. To locate this issue, we need event that can check if a shared object loaded to a process has the same symbols as another one.

AlonZivony avatar May 12 '22 17:05 AlonZivony