# 0x02 LD_AUDIT

A list of additional, user-specified, ELF shared objects to be loaded before all others. This feature can be used to selectively override functions in other shared objects.

LD_AUDIT这个变量，如果这个环境变量存在，链接器将会从指定路径加载共享库，然后从中调用特定的函数。

la_objsearch()

The dynamic linker invokes this function to inform the auditinglibrary that it is about to search for a shared object. The name argument is the filename or pathname that is to be searched for.

As its function result, la_objsearch() returns the pathname that the dynamic linker should use for further processing. If NULL is returned, then this pathname is ignored for further processing. If this audit library simply intends to monitor search paths, then name should be returned.

la_objsearch函数，每当有一个共享库要被加载时都会调用这个函数，函数应当返回调用的文件路径，如果返回NULL的话，将不会加载。

LD_PRELOAD继续使用上一个案例的Demo代码进行测试：