Comments (4)
Finally fixed the problem using the $LIB
environment variable which expands to lib32
directory for 32-bit programs and lib/x86_64-linux-gnu
for 64-bit programs (as /usr/$LIB/libprocesshider.so
in /etc/ld.so.preload
) - as shown in strace
. This is for Debian based systems, as for other systems it will expand to lib64
and lib
(could always confirm with strace
, more specifically the openat()
system call).
So the solution would be to compile libprocesshider.c
with both -m32
and -m64
and put the relevant architecture files to their respective referenced folders from $LIB
.
In summary:
$ mkdir {32,64}
$ gcc -Wall -m32 -fPIC -shared -o 32/libprocesshider.so processhider.c -ldl
$ gcc -Wall -fPIC -shared -o 64/libprocesshider.so processhider.c -ldl
$ sudo mv 32/libprocesshider.so /usr/lib32/libprocesshider.so
$ sudo mv 64/libprocesshider.so /usr/lib/x86_64-linux-gnu/libprocesshider.so
$ sudo echo '/usr/$LIB/libprocesshider.so' > /etc/ld.so.preload
from libprocesshider.
Admittedly I never tried using a 32 bit binary, this project was more of a proof of concept I needed to publish a blog post a long time ago. I suppose in your case the 32 bit binary is using the 32 bit libc version, and the preload doesn't work.
Have you tried compiling the library itself (libprocesshider
) with -m32
? If it works, then you're lucky, otherwise you need that (-m32
) AND patching the library to intercept the right symbol. ltrace
/gdb
should show you what gets called, and it should be fairly easy to fix.
After you make it work, you need to install both versions of the library (32 bit and 64 bit) in your system, so that the dynamic loader can find and load the proper one at runtime (see https://stackoverflow.com/questions/36849507/using-ld-preload-mixed-64bit-32bit-environment-in-linux).
from libprocesshider.
Hi
Are you still having issues? If yes, and you post the exact steps for me to reproduce (with a Docker container ideally) I might be able to take a look.
And sorry for the delay.
from libprocesshider.
Perhaps I could add more information related to this issue. I am using libprocesshider
in a 64-bit system, and after following the tutorial, everything works as expected. However, there seems to be an issue when executing 32-bit ELF binaries after loading libprocesshider.so
with the global dynamic linker.
For example, I have the following binary:
ELF 32-bit LSB shared object, Intel 80386, version 1 (SYSV), dynamically linked, interpreter /lib/ld-linux.so.2, for GNU/Linux 3.2.0, BuildID[sha1]=0c1a9279b30f8009b89849b540c223f2959789cc, with debug_info, not stripped
When I execute it, the binary works as intended but it also gives this 'warning' at the beginning:
ERROR: ld.so: object '/usr/local/lib/libprocesshider.so' from /etc/ld.so.preload cannot be preloaded (wrong ELF class: ELFCLASS64): ignored.
By the way, this is not binary specific but it is true for all 32-bit programs. You can reproduce this by creating a simple C program which you can compile using gcc
's -m32
flag.
While this is not a critical issue as everything still works as expected, I would like to know if there is a workaround for this issue.
from libprocesshider.
Related Issues (13)
- Works not on Opensuse HOT 8
- Ubuntu 18,04 x64 dont work HOT 1
- evil_script.py is not Python3 compatible
- Raspberry Pi 4 (Buster) 32bit from /etc/ld.so.preload cannot be preloaded (cannot open shared object file): ignored. HOT 1
- 修改cpu使用率
- How to un-hide? HOT 1
- Add License?
- Ubuntu process keep being visible HOT 2
- Add multiple processes HOT 3
- Hiding from netstat HOT 1
- bug: readdir instead of readdir64 HOT 2
- kali linux don't work... HOT 1
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from libprocesshider.