Hooking fopen on Linux about subhook HOT 2 CLOSED

I think it depends on where fopen points to at runtime, it could be a pointer to the imports table shared by the process and all libraries or it could point to some other place internal to the module. IIRC there are linker flags that change this behavior (like -fPIC, etc).

I don't remember using any special flags in crashdetect for this purpose, maybe cmake handles it by default.

from subhook.

Disabling PIC does not seem to make a difference, unfortunately. Crashdetect loads the pointer via mov eax, ds:(fopen_ptr - 44000h)[ebx], my plugin via mov [esp+1Ch+var_1C], offset fopen, but there's something strange; IDA doesn't show the contents of the import table for my plugin, while it does for crashdetect and the server binary.

Edit: -nodefaultlibs seems to have been the issue, to no surprise actually. Now it seems the correct function is found, since subhook_read_dst points to crashdetect.

Case closed, thanks!

from subhook.