I'm trying to write a hook for stat/lstat/fstat but I can't seem to get the original version from dlsym. I'm using the following code to obtain the original pointers.
orig_stat = dlsym(RTLD_NEXT, "stat");
orig_lstat = dlsym(RTLD_NEXT, "lstat");
orig_fstat = dlsym(RTLD_NEXT, "fstat");
However, all three variables are set to null and calling dlerror also returns null.
I'm creating the shared object with:
clang fakestat.c -shared -fPIC -ldl -o fakestat.so
and using my library by running a test program with LD_PRELOAD=fakestat.so ./test
The stat family functions are actually wrappers to internal functions in glibc. You can look at the output of objdump on your binary that calls any of the standard [lf]stat calls and you'll see the actual symbols in the binary for these functions. So you'll have to hook those functions. The following are the functions you want to hook/dlsym on:
__xstat & __xstat64 for stat.
__lxstat & __lxstat64 for lstat.
__fxstat & __fxstat64 for fstat.
The 64 suffixed functions are for LFS support. See the feature test macros.