Analyze Dynamic Dispatch with dlopen and dlsym

Topic Overview

Dynamic Dispatch with dlopen and dlsym

Linux supports loading shared libraries at runtime through dlopen, dlsym, and dlclose. Legitimate software uses these for plugin architectures; malware abuses them to hide API imports from static analysis.

API Usage

Open a library and resolve symbols:

cCopy
Loading…

RTLD_LAZY resolves symbols on first call; RTLD_NOW resolves everything immediately. If the symbol does not exist, dlsym returns NULL.

Plugin architectures load .so files, resolve entry points via dlsym, and call init/process/cleanup functions through function pointers.

For This Exercise

You will document how dlopen and dlsym enable runtime library loading. Malware uses this to hide imports from objdump -T and to load encrypted payloads only at runtime, which is why dynamic analysis with ltrace is necessary.

Detecting Runtime Loading

Static analysis of the import table misses dlsym-resolved functions. Use ltrace to see library calls at runtime, or set GDB breakpoints on dlopen and dlsym to capture which libraries and symbols the program loads. Malware packs its payload as an encrypted blob, decrypts it to disk or memory, then loads it with dlopen to evade static scanners that only examine the on-disk image.

Write a C program that emulates the address arithmetic dlsym performs: the resolved address of a symbol is the library's load base plus the symbol's table offset.

Input:

• Line 1: the load base in hex (no 0x prefix, e.g. "7f3a20000000") and an integer T
• Next T lines: one symbol per line: a name (single token) and its offset in hex, separated by whitespace
• Then an integer Q
• Next Q lines: one query name per line

For each query, print exactly one line: <name> -> 0x<hex address> when the name is in the symbol table <name> -> NULL (symbol not found) otherwise, like dlsym returning NULL

Addresses are lowercase hex, no leading zeros beyond the value itself.

Success Criteria:

• Code compiles with gcc -Wall -Wextra
• Address arithmetic and not-found handling match real dlsym semantics