kubo/plthook

plthook_elf.c: plthook_open() fails on executables with local hint symbols (__INIT_ARRAY, _end)

smichaku opened this issue · 1 comments

We came across an executable in which the plthook_open_by_handle() fails as
dlsym() can't find the __INIT_ARRAY__ and _end symbols. The _end symbol
seems to be local in the file:

micha ~/temp/plthook $ nm -CD example | egrep -w "__INIT_ARRAY__|_end"
0111ab6c b _end

It might be because this is executable was extracted from a UPX packed
executable. Unlike _end the _start symbol is exported:

001b3d48 T _start

We currently added a call to dlsym(hndl, "_start") in order to make it
work.

kubo commented

Thanks. _start is also checked in plthook_open_by_handle() now.