关于LD_PRELOAD对抗总结

#prog.c
#include <stdio.h>

int main(void) {
    printf("Calling the fopen() function...\n");
    FILE *fd = fopen("test.txt","r");
    if (!fd) {
        printf("fopen() returned NULL\n");
        return 1;
    }
    printf("fopen() succeeded\n");
    return 0;
}

#include <stdio.h>

FILE *fopen(const char *path, const char *mode) {
    printf("Always failing fopen\n");
    return NULL;
}

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/stat.h>

int main()
{
    if(getenv("LD_PRELOAD"))
        printf("LD_PRELOAD detected through getenv()\n");
    else
        printf("Environment is clean\n");
    if(open("/etc/ld.so.preload", O_RDONLY) > 0)
        printf("/etc/ld.so.preload detected through open()\n");
    else
        printf("/etc/ld.so.preload is not present\n");
}

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <limits.h>
#include <errno.h>
#include <sys/stat.h>
#include <fcntl.h>

// We will store the real function pointer in here
int (*o_open)(const char*, int oflag) = NULL;
char* (*o_getenv)(const char *) = NULL;

char* getenv(const char *name)
{
    if(!o_getenv)
        // Find the real function pointer
        o_getenv = dlsym(RTLD_NEXT, "getenv");
    if(strcmp(name, "LD_PRELOAD") == 0)
        // This environment variable does not exist, I swear
        return NULL;
    // Everything is ok, call the real getenv
    return o_getenv(name);
}

int open(const char *path, int oflag, ...)
{
    char real_path[PATH_MAX];
    if(!o_open)
        // Find the real function pointer
        o_open = dlsym(RTLD_NEXT, "open");
    // Resolve symbolic links and dot notation fu
    realpath(path, real_path);
    if(strcmp(real_path, "/etc/ld.so.preload") == 0)
    {
        // This file does not exist, I swear.
        errno = ENOENT;
        return -1;
    }
    // Everything is ok, call the real open
    return o_open(path, oflag);
}

// Still many other functions to hook, like fopen, open64, stat, readdir, 
// rename, unlink, etc.

#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <sys/stat.h>

#define BUFFER_SIZE 256

// Avoid to use libc strstr
// Return a pointer after the first location of sub in str
char* afterSubstr(char *str, const char *sub)
{
    int i, found;
    char *ptr;
    found = 0;
    for(ptr = str; *ptr != '\0'; ptr++)
    {
        found = 1;
        for(i = 0; found == 1 && sub[i] != '\0'; i++)
            if(sub[i] != ptr[i])
                found = 0;
        if(found == 1)
            break;
    }
    if(found == 0)
        return NULL;
    return ptr + i;
}

// Try to match the following regexp: libname-[0-9]+\.[0-9]+\.so$
// Not using any libc function makes that code awful, I know
int isLib(char *str, const char *lib)
{
    int i, found;
    static const char *end = ".so\n";
    char *ptr;
    // Trying to find lib in str
    ptr = afterSubstr(str, lib);
    if(ptr == NULL)
        return 0;
    // Should be followed by a '-'
    if(*ptr != '-')
        return 0;
    // Checking the first [0-9]+\.
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0 || *ptr != '.')
        return 0;
    // Checking the second [0-9]+
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0)
        return 0;
    // Checking if it ends with ".so\n"
    for(i = 0; end[i] != '\0'; i++)
        if(end[i] != ptr[i])
            return 0;
    return 1;
}

int main()
{
    FILE *memory_map;
    char buffer[BUFFER_SIZE];
    int after_libc = 0;
    memory_map = fopen("/proc/self/maps", "r");
    if(memory_map == NULL)
    {
        printf("/proc/self/maps is unaccessible, probably a LD_PRELOAD attempt\n");
        return 1;
    }
    // Read the memory map line by line
    // Try to look for a library loaded in between the libc and ld
    while(fgets(buffer, BUFFER_SIZE, memory_map) != NULL)
    {
        // Look for a libc entry
        if(isLib(buffer, "libc"))
            after_libc = 1;
        else if(after_libc)
        {
            // Look for a ld entry
            if(isLib(buffer, "ld"))
            {
                // If we got this far then everythin is fine
                printf("Memory maps are clean\n");
                break;
            }
            // If it's not an anonymous memory map
            else if(afterSubstr(buffer, "00000000 00:00 0") == NULL)
            {
                // Something has been preloaded by ld.so
                printf("LD_PRELOAD detected through memory maps\n");
                break;
            }
        }
    }
}

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <dlfcn.h>
#include <limits.h>
#include <errno.h>

FILE* (*o_fopen)(const char*, const char*) = NULL;
char *soname = "fakememory_preload.so";

void fakeMaps(char *original_path, char *fake_path, char *pattern)
{
    FILE *original, *fake;
    char buffer[PATH_MAX];
    original = o_fopen(original_path, "r");
    fake = o_fopen(fake_path, "w");
    // Copy original in fake but discard the lines containing pattern
    while(fgets(buffer, PATH_MAX, original))
        if(strstr(buffer, pattern) == NULL)
            fputs(buffer, fake);
    fclose(fake);
    fclose(original);
}

FILE* fopen(const char *path, const char *mode)
{
    char real_path[PATH_MAX], maps_path[PATH_MAX];
    pid_t pid = getpid();
    if(!o_fopen)
        // Find the real function pointer
        o_fopen = dlsym(RTLD_NEXT, "fopen");
    // Resolve symbolic links and dot notation fu
    realpath(path, real_path);
    snprintf(maps_path, PATH_MAX, "/proc/%d/maps", pid);
    if(strcmp(real_path, maps_path) == 0)
    {
        snprintf(maps_path, PATH_MAX, "/tmp/%d.fakemaps", pid);
        // Create a file in tmp containing our fake map
        fakeMaps(real_path, maps_path, soname);
        return o_fopen(maps_path, mode);
    }
    // Everything is ok, call the real open
    return o_fopen(path, mode);
}

 
#include <stdio.h>
#include <sys/stat.h>
#include <fcntl.h>

#define BUFFER_SIZE 256

int syscall_open(char *path, long oflag)
{
    int fd = -1;
    #ifdef __i386__
    __asm__ (
             "mov $5, %%eax;" // Open syscall number
             "mov %1, %%ebx;" // Address of our string
             "mov %2, %%ecx;" // Open mode
             "mov $0, %%edx;" // No create mode
             "int $0x80;"     // Straight to ring0
             "mov %%eax, %0;" // Returned file descriptor
             :"=r" (fd)
             :"m" (path), "m" (oflag)
             :"eax", "ebx", "ecx", "edx"
             );
    #elif __amd64__
    __asm__ (
             "mov $2, %%rax;" // Open syscall number
             "mov %1, %%rdi;" // Address of our string
             "mov %2, %%rsi;" // Open mode
             "mov $0, %%rdx;" // No create mode
             "syscall;"       // Straight to ring0
             "mov %%eax, %0;" // Returned file descriptor
             :"=r" (fd)
             :"m" (path), "m" (oflag)
             :"rax", "rdi", "rsi", "rdx"
             );
    #endif
    return fd;
 }

size_t syscall_gets(char *buffer, size_t buffer_size, int fd)
{
    size_t i;
    for(i = 0; i < buffer_size-1; i++)
    {
        size_t nbytes;
        #ifdef __i386__
        __asm__ (
                 "mov $3, %%eax;" // Read syscall number
                 "mov %1, %%ebx;" // File descriptor
                 "mov %2, %%ecx;" // Address of our buffer
                 "mov $1, %%edx;" // Read 1 byte
                 "int $0x80;"     // Straight to ring0
                 "mov %%eax, %0;" // Returned read byte number 
                 :"=r" (nbytes)
                 :"m" (fd), "r" (&(buffer[i]))
                 :"eax", "ebx", "ecx", "edx"
                 );
        #elif __amd64__
        __asm__ (
                 "mov $0, %%rax;" // Read syscall number
                 "mov %1, %%rdi;" // File descriptor
                 "mov %2, %%rsi;" // Address of our buffer
                 "mov $1, %%rdx;" // Read 1 byte
                 "syscall;"       // Straight to ring0
                 "mov %%rax, %0;" // Returned read byte number
                 :"=r" (nbytes)
                 :"m" (fd), "r" (&(buffer[i]))
                 :"rax", "rdi", "rsi", "rdx"
                 );
        #endif
        if(nbytes != 1)
            break;
        if(buffer[i] == '\n')
        {
            i++;
            break;
        }
    }
    buffer[i] = '\0';
    return i;
}

// Avoid to use libc strstr
char* afterSubstr(char *str, const char *sub)
{
    int i, found;
    char *ptr;
    found = 0;
    for(ptr = str; *ptr != '\0'; ptr++)
    {
        found = 1;
        for(i = 0; found == 1 && sub[i] != '\0'; i++)
            if(sub[i] != ptr[i])
                found = 0;
        if(found == 1)
            break;
    }
    if(found == 0)
        return NULL;
    return ptr + i;
}

// Try to match the following regexp: libname-[0-9]+\.[0-9]+\.so$
// Not using any libc function makes that code awful, I know
int isLib(char *str, const char *lib)
{
    int i, found;
    static const char *end = ".so\n";
    char *ptr;
    // Trying to find lib in str
    ptr = afterSubstr(str, lib);
    if(ptr == NULL)
        return 0;
    // Should be followed by a '-'
    if(*ptr != '-')
        return 0;
    // Checking the first [0-9]+\.
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0 || *ptr != '.')
        return 0;
    // Checking the second [0-9]+
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0)
        return 0;
    // Checking if it ends with ".so\n"
    for(i = 0; end[i] != '\0'; i++)
        if(end[i] != ptr[i])
            return 0;
    return 1;
}

int main()
{
    int memory_map;
    char buffer[BUFFER_SIZE];
    int after_libc = 0;

    // If the file was succesfully opened
    if(syscall_open("/etc/ld.so.preload", O_RDONLY) > 0)
        printf("/etc/ld.so.preload detected through open syscall\n");
    else
        printf("/etc/ld.so.preload is not present\n");
    // Open the memory map through a syscall this time
    memory_map = syscall_open("/proc/self/maps", O_RDONLY);
    if(memory_map == -1)
    {
        printf("/proc/self/maps is unaccessible, probably a LD_PRELOAD attempt\n");
        return 1;
    }
    // Read the memory map line by line
    // Try to look for a library loaded in between the libc and ld
    while(syscall_gets(buffer, BUFFER_SIZE, memory_map) != 0)
    {
        // Look for a libc entry
        if(isLib(buffer, "libc"))
            after_libc = 1;
        else if(after_libc)
        {
            // Look for a ld entry
            if(isLib(buffer, "ld"))
            {
                // If we got this far then everythin is fine
                printf("Memory maps are clean\n");
                break;
            }
            // If it's not an anonymous memory map
            else if(afterSubstr(buffer, "00000000 00:00 0") == NULL)
            {
                // Something has been preloaded by ld.so
                printf("LD_PRELOAD detected through memory maps\n");
                break;
            }
        }
    }
}

#include <stdio.h>
#include <stdlib.h>
#include <fcntl.h>
#include <sys/stat.h>

int main()
{
    if(getenv("LD_PRELOAD"))
        printf("LD_PRELOAD detected through getenv()\n");
    else
        printf("Environment is clean\n");
    if(open("/etc/ld.so.preload", O_RDONLY) > 0)
        printf("/etc/ld.so.preload detected through open()\n");
    else
        printf("/etc/ld.so.preload is not present\n");
}

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>
#include <limits.h>
#include <errno.h>
#include <sys/stat.h>
#include <fcntl.h>

// We will store the real function pointer in here
int (*o_open)(const char*, int oflag) = NULL;
char* (*o_getenv)(const char *) = NULL;

char* getenv(const char *name)
{
    if(!o_getenv)
        // Find the real function pointer
        o_getenv = dlsym(RTLD_NEXT, "getenv");
    if(strcmp(name, "LD_PRELOAD") == 0)
        // This environment variable does not exist, I swear
        return NULL;
    // Everything is ok, call the real getenv
    return o_getenv(name);
}

int open(const char *path, int oflag, ...)
{
    char real_path[PATH_MAX];
    if(!o_open)
        // Find the real function pointer
        o_open = dlsym(RTLD_NEXT, "open");
    // Resolve symbolic links and dot notation fu
    realpath(path, real_path);
    if(strcmp(real_path, "/etc/ld.so.preload") == 0)
    {
        // This file does not exist, I swear.
        errno = ENOENT;
        return -1;
    }
    // Everything is ok, call the real open
    return o_open(path, oflag);
}

// Still many other functions to hook, like fopen, open64, stat, readdir, 
// rename, unlink, etc.

#include <stdio.h>

// This will resolve at linking time
extern char **environ;

int main()
{
    long i, j;
    char env[] = "LD_PRELOAD";
    // Go through all environment strings, the end of the array 
    // is marked by a null pointer.
    for(i = 0; environ[i]; i++)
    {
        // Check is the string begins by LD_PRELOAD
        // I said NO CALL not even to strstr
        for(j = 0; env[j] != '\0' && environ[i][j] != '\0'; j++)
            if(env[j] != environ[i][j])
                break;
        // If the complete chain was found
        if(env[j] == '\0')
        {
            printf("LD_PRELOAD detected through environ\n");
            return;
        }
    }
    printf("Environment is clean\n");
}

#define _GNU_SOURCE
#include <unistd.h>
#include <dlfcn.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

extern char **environ;

int (*o_execve)(const char *path, char *const argv[], char *const envp[]) = NULL;

char *sopath;

// Called as soon as the library is loaded, the program has not executed any 
// instructions yet.
void init()
{
    int i, j;
    static const char *ldpreload = "LD_PRELOAD";
    // First save the value of LD_PRELOAD
    int len = strlen(getenv(ldpreload));
    sopath = (char*) malloc(len+1);
    strcpy(sopath, getenv(ldpreload));
    // unsetenv() has a weird behavior, this is a custom implementation
    // Look for LD_PRELOAD variable
    for(i = 0; environ[i]; i++)
    {
        int found = 1;
        for(j = 0; ldpreload[j] != '\0' && environ[i][j] != '\0'; j++)
            if(ldpreload[j] != environ[i][j])
            {
                found = 0;
                break;
            }
        if(found)
        {
            // Set to zero the variable
            for(j = 0; environ[i][j] != '\0'; j++)
                environ[i][j] = '\0';
            break;
            // Free that memory
            free((void*)environ[i]);
        }
    }
    // Remove the string pointer from environ
    for(j = i; environ[j]; j++)
        environ[j] = environ[j+1];
}


int execve(const char *path, char *const argv[], char *const envp[])
{
    int i, j, ldi = -1, r;
    char** new_env;
    if(!o_execve)
        o_execve = dlsym(RTLD_NEXT,"execve");
    // Look if the provided environment already contains LD_PRELOAD
    for(i = 0; envp[i]; i++)
    {
        if(strstr(envp[i], "LD_PRELOAD"))
            ldi = i;
    }
    // If it doesn't, add it at the end
    if(ldi == -1)
    {
        ldi = i;
        i++;
    }
    // Create a new environment
    new_env = (char**) malloc((i+1)*sizeof(char*));
    // Copy the old environment in the new one, except for LD_PRELOAD
    for(j = 0; j < i; j++)
    {
        // Overwrite or create the LD_PRELOAD variable
        if(j == ldi)
        {
            new_env[j] = (char*) malloc(256);
            strcpy(new_env[j], "LD_PRELOAD=");
            strcat(new_env[j], sopath);
        }
        else
            new_env[j] = (char*) envp[j];
    }
    // That string array is NULL terminated
    new_env[i] = NULL;
    r = o_execve(path, argv, new_env);
    free(new_env[ldi]);
    free(new_env);
    return r;
}
// You also have to patch all the other variants of exec

#include <stdlib.h>
#include <stdio.h>
#include <fcntl.h>
#include <sys/stat.h>

#define BUFFER_SIZE 256

// Avoid to use libc strstr
// Return a pointer after the first location of sub in str
char* afterSubstr(char *str, const char *sub)
{
    int i, found;
    char *ptr;
    found = 0;
    for(ptr = str; *ptr != '\0'; ptr++)
    {
        found = 1;
        for(i = 0; found == 1 && sub[i] != '\0'; i++)
            if(sub[i] != ptr[i])
                found = 0;
        if(found == 1)
            break;
    }
    if(found == 0)
        return NULL;
    return ptr + i;
}

// Try to match the following regexp: libname-[0-9]+\.[0-9]+\.so$
// Not using any libc function makes that code awful, I know
int isLib(char *str, const char *lib)
{
    int i, found;
    static const char *end = ".so\n";
    char *ptr;
    // Trying to find lib in str
    ptr = afterSubstr(str, lib);
    if(ptr == NULL)
        return 0;
    // Should be followed by a '-'
    if(*ptr != '-')
        return 0;
    // Checking the first [0-9]+\.
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0 || *ptr != '.')
        return 0;
    // Checking the second [0-9]+
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0)
        return 0;
    // Checking if it ends with ".so\n"
    for(i = 0; end[i] != '\0'; i++)
        if(end[i] != ptr[i])
            return 0;
    return 1;
}

int main()
{
    FILE *memory_map;
    char buffer[BUFFER_SIZE];
    int after_libc = 0;
    memory_map = fopen("/proc/self/maps", "r");
    if(memory_map == NULL)
    {
        printf("/proc/self/maps is unaccessible, probably a LD_PRELOAD attempt\n");
        return 1;
    }
    // Read the memory map line by line
    // Try to look for a library loaded in between the libc and ld
    while(fgets(buffer, BUFFER_SIZE, memory_map) != NULL)
    {
        // Look for a libc entry
        if(isLib(buffer, "libc"))
            after_libc = 1;
        else if(after_libc)
        {
            // Look for a ld entry
            if(isLib(buffer, "ld"))
            {
                // If we got this far then everythin is fine
                printf("Memory maps are clean\n");
                break;
            }
            // If it's not an anonymous memory map
            else if(afterSubstr(buffer, "00000000 00:00 0") == NULL)
            {
                // Something has been preloaded by ld.so
                printf("LD_PRELOAD detected through memory maps\n");
                break;
            }
        }
    }
}

#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <unistd.h>
#include <dlfcn.h>
#include <limits.h>
#include <errno.h>

FILE* (*o_fopen)(const char*, const char*) = NULL;
char *soname = "fakememory_preload.so";

void fakeMaps(char *original_path, char *fake_path, char *pattern)
{
    FILE *original, *fake;
    char buffer[PATH_MAX];
    original = o_fopen(original_path, "r");
    fake = o_fopen(fake_path, "w");
    // Copy original in fake but discard the lines containing pattern
    while(fgets(buffer, PATH_MAX, original))
        if(strstr(buffer, pattern) == NULL)
            fputs(buffer, fake);
    fclose(fake);
    fclose(original);
}

FILE* fopen(const char *path, const char *mode)
{
    char real_path[PATH_MAX], maps_path[PATH_MAX];
    pid_t pid = getpid();
    if(!o_fopen)
        // Find the real function pointer
        o_fopen = dlsym(RTLD_NEXT, "fopen");
    // Resolve symbolic links and dot notation fu
    realpath(path, real_path);
    snprintf(maps_path, PATH_MAX, "/proc/%d/maps", pid);
    if(strcmp(real_path, maps_path) == 0)
    {
        snprintf(maps_path, PATH_MAX, "/tmp/%d.fakemaps", pid);
        // Create a file in tmp containing our fake map
        fakeMaps(real_path, maps_path, soname);
        return o_fopen(maps_path, mode);
    }
    // Everything is ok, call the real open
    return o_fopen(path, mode);
}

 
#include <stdio.h>
#include <sys/stat.h>
#include <fcntl.h>

#define BUFFER_SIZE 256

int syscall_open(char *path, long oflag)
{
    int fd = -1;
    #ifdef __i386__
    __asm__ (
             "mov $5, %%eax;" // Open syscall number
             "mov %1, %%ebx;" // Address of our string
             "mov %2, %%ecx;" // Open mode
             "mov $0, %%edx;" // No create mode
             "int $0x80;"     // Straight to ring0
             "mov %%eax, %0;" // Returned file descriptor
             :"=r" (fd)
             :"m" (path), "m" (oflag)
             :"eax", "ebx", "ecx", "edx"
             );
    #elif __amd64__
    __asm__ (
             "mov $2, %%rax;" // Open syscall number
             "mov %1, %%rdi;" // Address of our string
             "mov %2, %%rsi;" // Open mode
             "mov $0, %%rdx;" // No create mode
             "syscall;"       // Straight to ring0
             "mov %%eax, %0;" // Returned file descriptor
             :"=r" (fd)
             :"m" (path), "m" (oflag)
             :"rax", "rdi", "rsi", "rdx"
             );
    #endif
    return fd;
 }

size_t syscall_gets(char *buffer, size_t buffer_size, int fd)
{
    size_t i;
    for(i = 0; i < buffer_size-1; i++)
    {
        size_t nbytes;
        #ifdef __i386__
        __asm__ (
                 "mov $3, %%eax;" // Read syscall number
                 "mov %1, %%ebx;" // File descriptor
                 "mov %2, %%ecx;" // Address of our buffer
                 "mov $1, %%edx;" // Read 1 byte
                 "int $0x80;"     // Straight to ring0
                 "mov %%eax, %0;" // Returned read byte number 
                 :"=r" (nbytes)
                 :"m" (fd), "r" (&(buffer[i]))
                 :"eax", "ebx", "ecx", "edx"
                 );
        #elif __amd64__
        __asm__ (
                 "mov $0, %%rax;" // Read syscall number
                 "mov %1, %%rdi;" // File descriptor
                 "mov %2, %%rsi;" // Address of our buffer
                 "mov $1, %%rdx;" // Read 1 byte
                 "syscall;"       // Straight to ring0
                 "mov %%rax, %0;" // Returned read byte number
                 :"=r" (nbytes)
                 :"m" (fd), "r" (&(buffer[i]))
                 :"rax", "rdi", "rsi", "rdx"
                 );
        #endif
        if(nbytes != 1)
            break;
        if(buffer[i] == '\n')
        {
            i++;
            break;
        }
    }
    buffer[i] = '\0';
    return i;
}

// Avoid to use libc strstr
char* afterSubstr(char *str, const char *sub)
{
    int i, found;
    char *ptr;
    found = 0;
    for(ptr = str; *ptr != '\0'; ptr++)
    {
        found = 1;
        for(i = 0; found == 1 && sub[i] != '\0'; i++)
            if(sub[i] != ptr[i])
                found = 0;
        if(found == 1)
            break;
    }
    if(found == 0)
        return NULL;
    return ptr + i;
}

// Try to match the following regexp: libname-[0-9]+\.[0-9]+\.so$
// Not using any libc function makes that code awful, I know
int isLib(char *str, const char *lib)
{
    int i, found;
    static const char *end = ".so\n";
    char *ptr;
    // Trying to find lib in str
    ptr = afterSubstr(str, lib);
    if(ptr == NULL)
        return 0;
    // Should be followed by a '-'
    if(*ptr != '-')
        return 0;
    // Checking the first [0-9]+\.
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0 || *ptr != '.')
        return 0;
    // Checking the second [0-9]+
    found = 0;
    for(ptr += 1; *ptr >= '0' && *ptr <= '9'; ptr++)
        found = 1;
    if(found == 0)
        return 0;
    // Checking if it ends with ".so\n"
    for(i = 0; end[i] != '\0'; i++)
        if(end[i] != ptr[i])
            return 0;
    return 1;
}

int main()
{
    int memory_map;
    char buffer[BUFFER_SIZE];
    int after_libc = 0;

    // If the file was succesfully opened
    if(syscall_open("/etc/ld.so.preload", O_RDONLY) > 0)
        printf("/etc/ld.so.preload detected through open syscall\n");
    else
        printf("/etc/ld.so.preload is not present\n");
    // Open the memory map through a syscall this time
    memory_map = syscall_open("/proc/self/maps", O_RDONLY);
    if(memory_map == -1)
    {
        printf("/proc/self/maps is unaccessible, probably a LD_PRELOAD attempt\n");
        return 1;
    }
    // Read the memory map line by line
    // Try to look for a library loaded in between the libc and ld
    while(syscall_gets(buffer, BUFFER_SIZE, memory_map) != 0)
    {
        // Look for a libc entry
        if(isLib(buffer, "libc"))
            after_libc = 1;
        else if(after_libc)
        {
            // Look for a ld entry
            if(isLib(buffer, "ld"))
            {
                // If we got this far then everythin is fine
                printf("Memory maps are clean\n");
                break;
            }
            // If it's not an anonymous memory map
            else if(afterSubstr(buffer, "00000000 00:00 0") == NULL)
            {
                // Something has been preloaded by ld.so
                printf("LD_PRELOAD detected through memory maps\n");
                break;
            }
        }
    }
}

#define _GNU_SOURCE
#include <stdlib.h>
#include <stdio.h>
#include <string.h>
#include <unistd.h>
#include <time.h>
#include <errno.h>
#include <limits.h>
#include <sys/prctl.h>
#include <sys/ptrace.h>
#include <sys/wait.h>
#include <sys/reg.h>
#include <sys/user.h>
#include <asm/unistd.h>


// Some useful defines to make the code architecture independent
#if defined(__i386__)
#define REG_SYSCALL ORIG_EAX
#define REG_SP esp
#define REG_IP eip 
#elif defined(__x86_64__)
#define REG_SYSCALL ORIG_RAX
#define REG_SP rsp
#define REG_IP rip 
#endif

long NOHOOK = 0;
char *soname = "nosyscall_preload.so";

void fakeMaps(char *original_path, char *fake_path, char *pattern)
{
    FILE *original, *fake;
    char buffer[PATH_MAX];
    original = fopen(original_path, "r");
    fake = fopen(fake_path, "w");
    // Copy original in fake but discard the lines containing pattern
    while(fgets(buffer, PATH_MAX, original))
        if(strstr(buffer, pattern) == NULL)
            fputs(buffer, fake);
    fclose(fake);
    fclose(original);
}

long open_gate(const char *path, long oflag, long cflag) 
{
    char real_path[PATH_MAX], maps_path[PATH_MAX];
    long ret;
    pid_t pid;
    pid = getpid();
    // Resolve symbolic links and dot notation fu
    realpath(path, real_path);
    snprintf(maps_path, PATH_MAX, "/proc/%d/maps", pid);
    if(strcmp(real_path, "/etc/ld.so.preload") == 0)
    {
        // This file does not exist, I swear.
        errno = ENOENT;
        ret = -1;
    }
    else if(strcmp(real_path, maps_path) == 0)
    {
        snprintf(maps_path, PATH_MAX, "/tmp/%d.fakemaps", pid);
        // Create a file in tmp containing our fake map
        NOHOOK = 1; // Entering NOHOOK section
        fakeMaps(real_path, maps_path, soname);
        ret = open(maps_path, oflag);
    }
    else
    {
        // Everything is ok, call the real open
        NOHOOK = 1; // Entering NOHOOK section
        ret = open(path, oflag, cflag);
    }
    // Exiting NOHOOK section
    NOHOOK = 0;
    #ifdef __i386__
    // Tricky stack cleaning and return in the x86 case
    // We need to clean the 3 arguments (12 bytes) that were pushed on the stack
    __asm__ __volatile__ ("mov %0, %%eax;" // set the return value
                          "mov (%%ebp), %%ecx;" // move saved ebp 12 bytes up
                          "mov %%ecx, 0xc(%%ebp);"
                          "mov 0x4(%%ebp), %%ecx;" // move saved eip 12 bytes up
                          "mov %%ecx, 0x10(%%ebp);"
                          "add $0xc, %%ebp;" //move stack base 12 bytes up
                          "leave;" // normal leave and return
                          "ret;"
                          :
                          :"m" (ret)
                          :
                          );
    #endif
    return ret;
}

void init()
{
    pid_t program;
    // Forking a child process
    program = fork();
    if(program != 0)
    {
        // Parent process which will debug the program in the child process
        int status;
        long syscall_nr;
        struct user_regs_struct regs;
        // We attach to the child
        if(ptrace(PTRACE_ATTACH, program) != 0)
        {
            printf("Failed to attach to the program.\n");
            exit(1);
        }
        waitpid(program, &status, 0);
        // We are only interested in tracing SYSCALLs
        ptrace(PTRACE_SETOPTIONS, program, 0, PTRACE_O_TRACESYSGOOD);
        while(1)
        {
            ptrace(PTRACE_SYSCALL, program, 0, 0);
            waitpid(program, &status, 0);
            if(WIFEXITED(status) || WIFSIGNALED(status))
                break; // Stop tracing if the parent process terminates
            else if(WIFSTOPPED(status) && WSTOPSIG(status) == SIGTRAP|0x80)
            {
                // Getting the syscall number
                syscall_nr = ptrace(PTRACE_PEEKUSER, program, sizeof(long)*REG_SYSCALL);
                // Is it an open syscall ?
                if(syscall_nr == __NR_open)
                {
                    // Getting the value of NOHOOK in the child process
                    NOHOOK = ptrace(PTRACE_PEEKDATA, program, (void*)&NOHOOK);
                    // Only hook the syscall if it's not in a NOHOOK section
                    if(!NOHOOK)
                    {
                        // Now we are going to simulate a call
                        // First get the register state
                        ptrace(PTRACE_GETREGS, program, 0, &regs);
                        // Under x86 we need to push the arguments on the stack
                        #ifdef __i386__
                        regs.REG_SP -= sizeof(long);
                        ptrace(PTRACE_POKEDATA, program, (void*)regs.REG_SP, regs.edx);
                        regs.REG_SP -= sizeof(long);
                        ptrace(PTRACE_POKEDATA, program, (void*)regs.REG_SP, regs.ecx);
                        regs.REG_SP -= sizeof(long);
                        ptrace(PTRACE_POKEDATA, program, (void*)regs.REG_SP, regs.ebx);
                        #endif
                        // Push return address on the stack
                        regs.REG_SP -= sizeof(long);
                        ptrace(PTRACE_POKEDATA, program, (void*)regs.REG_SP, regs.REG_IP);
                        // Set RIP to open_gate address
                        regs.REG_IP = (unsigned long) open_gate;
                        // Finnally set the register
                        ptrace(PTRACE_SETREGS, program, 0, &regs);
                    }
                }
                //We always get a second signal after the syscall
                ptrace(PTRACE_SYSCALL, program, 0, 0);
                waitpid(program, &status, 0);
            }
        }
        exit(0);
    }
    else
    {
        // Child process
        // Sleep a bit to give the parent process enough time to attach
        sleep(0);
    }
}