将Mac二进制文件加载为动态库 [英] Load a Mac binary as a dynamic library
问题描述
我正在使用没有源代码的二进制可执行文件进行一些反向工程.在Windows上,我可以执行的操作是使用LoadLibrary加载可执行文件(EXE),就像它是DLL文件一样.如果加载的文件不可重定位,则可以简单地将加载器代码重新定位为腾出空间"用于其他模块.加载二进制文件后,可以调用它的函数(当然,假设我在哪里),并执行其他操作.
I am doing some reverse engineering with a binary executable without sources. On Windows what I can do is load an executable file (EXE) with LoadLibrary, just as it was a DLL file. If the loaded file is not relocatable I can simply relocate my loader code to "make space" for the other module. When I have the binary loaded, I can call it's functions (assuming I where where they are, of course), and do other stuff.
在Mac上是否可以做一些相同或相似的事情?我有一个mach-o可执行文件,我想加载它,因为它是一个动态库(DYLIB).还是有某种方法可以将可执行文件转换为DYLIB?可执行文件和DYLIB之间的 real 有什么区别?
Is there some way to do the same or similar on Mac? I have a mach-o executable, and I'd like to load it as it was a dynamic library (DYLIB). Or is there some way to convert an executable into a DYLIB? What are the real differences between an executable and a DYLIB?
推荐答案
好的,所以我做了一些实验,然后看了一下.文件"bin1.c"包含:
OK, so I did some experiments, and see this. File "bin1.c" contains:
#include <stdio.h>
int main() {
printf("I am bin1.\n");
return 0;
}
"bin2.c"是:
#include <stdio.h>
#include <dlfcn.h>
int main() {
printf("I am bin2.\n");
void *l = dlopen("bin1", RTLD_NOW);
if (l == NULL) {
printf("dlopen failed: %s\n", dlerror());
return -1;
}
void *f = dlsym(l, "main");
if (f == NULL) {
printf("dlsym failed: %s\n", dlerror());
return -1;
}
int (*main)() = f;
main();
return 0;
}
在Mac上,所有程序都可以正常编译,并且确实可以加载另一个可执行文件,因为它是一个可加载的库,并且我可以在另一个二进制文件中调用main函数:
On my Mac, all compiles fine and indeed loads the other executable as it was a loadable library, and I can call the main function in the other binary:
Johanka:Desktop newacc$ uname -a
Darwin Johanka.local 11.3.0 Darwin Kernel Version 11.3.0: Thu Jan 12 18:47:41 PST 2012; root:xnu-1699.24.23~1/RELEASE_X86_64 x86_64
Johanka:Desktop newacc$ gcc bin1.c -o bin1 && ./bin1
I am bin1.
Johanka:Desktop newacc$ gcc bin2.c -o bin2 && ./bin2
I am bin2.
I am bin1.
不过,不确定是否对此有限制,以及是否可以使用不可重定位的二进制文件完成此操作.但是此示例表明,至少在某些情况下,这是可能的.
Not sure though, whether there are limitations on this and if this can be done with non-relocatable binaries. But this example show that at least in some cases, it's possible.
这篇关于将Mac二进制文件加载为动态库的文章就介绍到这了,希望我们推荐的答案对大家有所帮助,也希望大家多多支持IT屋!