Hi @darad
Not sure why Mirai only implements strings
, haven’t really go into all the code in detail.
I believe whenever you do the dlopen
the whole library is loaded in memory. So, even if you do not map all the symbols, the code of all of them will be in memory, even when you just resolve a few symbols… Just try with a small library and check /proc/PID/maps
to see the memory assigned after and before loading the library. The main advantage of using dlsym
is to hide to the analyst the functions you use from a library, or to swap them dynamically… may be other use cases for those but I cannot thing about any right now (it is common on Windows tho).
Furthermore, getting your program to run without libc
is tricky because libc
does not just provides the regular functions you use in your programs, it also contains all the initialisation code that is needed in order to run main
… that is the infamous crt0.o
, crtS.o
, et al … This code sets up the stack, runs constructors and makes sure destructors will be executed before terminating the program (well not all crt
files implements the constructor/destructor thingy). BTW, crt
stands for C Run-Time.
This post may give you a bit of insights on what this involves (however it doesn’t dive on crt
implementation, but there are very good tutorials out there if you are interested):