// For RTLD_NEXT #define _GNU_SOURCE #include #include #include #include static FILE *(*real_fopen)(const char *, const char *) = NULL; #define SEARCH_TOKEN_SIZE 6 char mySearchToken[SEARCH_TOKEN_SIZE] = "That's"; void *searchData(char *data, int len, void *start, void *end) { void *i; for(i = start; i < end; i += 1) { if (memcmp(i, data, len) == 0 && i != (void *)data) { return i; } } return NULL; } FILE * fopen ( const char * filename, const char * mode ) { printf("HUEBR, GIBE DATA PLOS, OR I REPORT U HUEHUE\n"); printf("MI NO LIK U FIL, MI UPEN HUE.TXT\n"); return real_fopen("hue.txt", "w"); } void __attribute__((constructor)) initialize(void) { real_fopen = dlsym(RTLD_NEXT, "fopen"); if (real_fopen == NULL) { printf("What? We couldn't find our fopen!!!!\n"); exit(255); // This will crash the program since it isn't expecting to exit in the constructor } void *addr = searchData(mySearchToken, SEARCH_TOKEN_SIZE, (void *)0x4006e0, (void*)0x400791 ); // Thats for 64 bit. printf("Token Addr: %p\n", addr); }