Dynamic library loading
During static analysis, we can immediately see imported functions that are available for the program's use. It is possible to only see two API functions in the import table, but have the program use dozens of APIs. In Windows, these two API functions are LoadLibrary and GetProcAddress, while in Linux, these are dlopen and dlsym.
LoadLibrary only requires the name of the library where the desired API function name is located. GetProcAddress is then responsible for retrieving the address of the API function from the library with that API name. With the library loaded, a program can call the API function using the API's address.
The following code snippet demonstrates how dynamic library loading is done. The code eventually ...
Become an O’Reilly member and get unlimited access to this title plus top books and audiobooks from O’Reilly and nearly 200 top publishers, thousands of courses curated by job role, 150+ live events each month,
and much more.
Read now
Unlock full access