0

An executable file, a.out, loads the shared libraries 1.so, 2.so and 3.so. There is a function func() implemented in each of the three libraries. When func() is invoked, I want to identify, which implementation of func() is executed.

I tried ltrace on the PID of the executable file. It only lists the func() call, but not the shared library.

Any suggestions?

DYZ
  • 55,249
  • 10
  • 64
  • 93
Guru24
  • 41
  • 3
  • Two similar questions (but not exact duplicates, IMHO): http://stackoverflow.com/questions/6538501/linking-two-shared-libraries-with-some-of-the-same-symbols http://stackoverflow.com/questions/29079742/same-symbols-in-different-libraries-and-linking-order – DYZ Jan 25 '17 at 07:23
  • 1
    If you know the address of the function, you can look it up in the process memory map (`/proc//maps`). – n. m. could be an AI Jan 25 '17 at 07:24
  • I agree "not duplicates", but if you know the order that the libraries were passed to the linker, the questions very strongly imply that it will be `func` from the first one. – Martin Bonner supports Monica Jan 25 '17 at 08:17

1 Answers1

0

Using systemtap:

probe process("/path/to/1.so").function("func")
{
  printf("%d: 1.so\n", pid());
}       

probe process("/path/to/2.so").function("func")
{
  printf("%d: 2.so\n", pid());
}       

probe process("/path/to/3.so").function("func")
{
  printf("%d: 3.so\n", pid());
}

Use it with:

sudo -E stap ./func.stap

With linux perf:

sudo perf probe -x /path/to/1.so func
sudo perf probe -x /path/to/2.so func
sudo perf probe -x /path/to/3.so func
sudo perf top -e probe_1:func,probe_2:func,probe3:func
ysdx
  • 8,889
  • 1
  • 38
  • 51