Nov 19, 2023 Tags: devblog, programming, rust, security
Yet another announcement-type post, this time for a small Rust library I hacked up while trying to deduplicate some boilerplate in another project: upgrayedd.
The rest of this post will be a brief introduction to (dynamic) function interposition and how it works, upgrayedd’s implementation details, and what it can (and can’t) be used for.
Function interposition is a basic program instrumentation technique: to measure, detect, or modify the use of a function in a program, we replace calls to that function with calls to a function that we (the instrumenter) control. The interposed (“wrapper”) function can then monitor (and rewrite) the program’s state, including:
There are many different ways to interpose on a program’s functions, but one of the simplest is the LD_PRELOAD trick:1 when set, the dynamic linker/loader will give precedence to the symbols defined in the specified shared object.