Inject a thread with LD_PRELOAD and thread-safety

Question

I'm working on a project to inject a shared library in a program with LD_PRELOAD.

My injected library creates a new thread when it is injected into the program. All logic happens in this thread (like analyzing network traffic and so on).

First you need to know this about the program that is being preloaded. It is a client application that encrypts every packet, written to a static buffer, that it sends to the server. I found the function that encrypts and sends the packets in the client and I was able to detour it. So now I can just modify the static buffer and let the 'send' function encrypt the buffer and send the buffer to the server.

But now I have a problem: what if I change contents of the static buffer in my library's thread (so that I can send a fake packet) and at the same time the program's thread changes the static buffer too? That would cause a crash.

I need some kind of synchronization.

So I've been thinking of some solutions:

1. Find every function in the program that changes the buffer, detour them and add a mutex to that call or something like that. Would take like ages though...
2. Find a way to execute my piece of code, that changes the buffer, in one block. So my piece of code actually gets executed at once, without POSIX threads switching to other threads. Is this even possible?
3. Make my application synchronous and cry.

Can anyone come up with a better solution? Or do you know how to make solution 2 possible?

Thanks in advance, Gillis

Answer 1

If you detoured the 'send' function and you have the code of your 'detoured send' in your preloaded library it means that when the main thread calls 'send', your 'detoured send' code will be executed in the main thread's context, your thread is doing nothing at that moment. If you have more than one 'main thread' that could potentially call 'send', then you need synchronization in your 'detoured send'.

Alternatively, it you really want to process something in your new 'injected' thread you can: 1) in your 'detoured send' (invoked from main thread's context): pass the data to your thread and wait untill it finishes processing the data (notice: the main thread is waiting).