安卓动态库加载

/system/bin/ldd 是一个脚本：

#!/system/bin/sh

# Rather than have ldd and ldd64, this script does the right thing depending
# on the argument.

function error() {
  echo "$1"
  exit 1
}

[ $# -eq 1 ] || error "usage: ldd FILE"

what=$(file -L "$1")
case "$what" in
  *32-bit*)
    linker --list "$1"
    ;;
  *64-bit*)
    linker64 --list "$1"
    ;;
  *)
    error "$what"
    ;;
esac

使用linker二进制：

130|console:/system/bin # readelf -d linker

Dynamic section at offset 0xa256c contains 18 entries:
  Tag        Type                 Name/Value
 0x0000000e (SONAME)             Library soname: [ld-android.so]
 0x0000001e (FLAGS)              SYMBOLIC BIND_NOW
 0x6ffffffb (FLAGS_1)            Flags: NOW
 0x6fffe000 (ANDROID_RELR)       0x6dc
 0x6fffe001 (ANDROID_RELRSZ)     468 (bytes)
 0x6fffe003 (ANDROID_RELRENT)    0x4
 0x00000017 (JMPREL)             0x4888
 0x00000002 (PLTRELSZ)           88 (bytes)
 0x00000003 (PLTGOT)             0x0
 0x00000014 (PLTREL)             REL
 0x00000006 (SYMTAB)             0x1b4
 0x0000000b (SYMENT)             16 (bytes)
 0x00000005 (STRTAB)             0x40c
 0x0000000a (STRSZ)              720 (bytes)
 0x6ffffef5 (GNU_HASH)           0x344
 0x00000019 (INIT_ARRAY)         0xa4538
 0x0000001b (INIT_ARRAYSZ)       52 (bytes)
 0x00000000 (NULL)               0x0

查找which的依赖库

console:/system/bin # linker --list /system/bin/which
        linux-vdso.so.1 => [vdso] (0xf7e58000)
        libcrypto.so => /system/lib/libcrypto.so (0xf77b8000)
        libz.so => /system/lib/libz.so (0xf7a12000)
        liblog.so => /system/lib/liblog.so (0xf79ad000)
        libprocessgroup.so => /system/lib/libprocessgroup.so (0xf790e000)
        libselinux.so => /system/lib/libselinux.so (0xf759c000)
        libc.so => /apex/com.android.runtime/lib/bionic/libc.so (0xf7686000)
        libm.so => /apex/com.android.runtime/lib/bionic/libm.so (0xf7a5c000)
        libdl.so => /apex/com.android.runtime/lib/bionic/libdl.so (0xf79dd000)
        libc++.so => /system/lib/libc++.so (0xf7881000)
        libbase.so => /system/lib/libbase.so (0xf7648000)
        libcgrouprc.so => /system/lib/libcgrouprc.so (0xf796a000)
        libpcre2.so => /system/lib/libpcre2.so (0xf75ed000)
        libpackagelistparser.so => /system/lib/libpackagelistparser.so (0xf7a91000)
 

Linkerconfig是一个用于配置链接器（linker）行为的工具

130|console:/system/bin # linkerconfig
dir.system = /system/bin/
dir.system = /system/xbin/
dir.system = /system_ext/bin/
dir.product = /product/bin/
dir.vendor = /odm/bin/
dir.vendor = /vendor/bin/
dir.vendor = /data/nativetest/odm
dir.vendor = /data/nativetest64/odm
dir.vendor = /data/benchmarktest/odm
dir.vendor = /data/benchmarktest64/odm
dir.vendor = /data/nativetest/vendor
dir.vendor = /data/nativetest64/vendor
dir.vendor = /data/benchmarktest/vendor
dir.vendor = /data/benchmarktest64/vendor
dir.unrestricted = /data/nativetest/unrestricted
dir.unrestricted = /data/nativetest64/unrestricted
dir.unrestricted = /data/local/tmp
dir.postinstall = /postinstall
dir.system = /data
[system]
additional.namespaces = com_android_adbd,com_android_art,com_android_conscrypt,com_android_media,com_android_neuralnetworks,com_android_os_statsd,com_android_resolv,com_android_runtime,rs,sphal,vndk,vndk_product
namespace.default.isolated = true
namespace.default.visible = true
namespace.default.search.paths = /system/${LIB}
namespace.default.search.paths += /system_ext/${LIB}
namespace.default.search.paths += /apex/com.android.media/lib
namespace.default.search.paths += /apex/com.android.media/lib/extractors
namespace.default.permitted.paths = /system/${LIB}/drm
namespace.default.permitted.paths += /system/${LIB}/extractors
namespace.default.permitted.paths += /system/${LIB}/hw
namespace.default.permitted.paths += /system_ext/${LIB}
namespace.default.permitted.paths += /system/framework
namespace.default.permitted.paths += /system/app
namespace.default.permitted.paths += /system/priv-app
namespace.default.permitted.paths += /system_ext/framework
namespace.default.permitted.paths += /system_ext/app
namespace.default.permitted.paths += /system_ext/priv-app
namespace.default.permitted.paths += /vendor/framework
namespace.default.permitted.paths += /vendor/app
namespace.default.permitted.paths += /vendor/priv-app
namespace.default.permitted.paths += /system/vendor/framework
namespace.default.permitted.paths += /system/vendor/app
namespace.default.permitted.paths += /system/vendor/priv-app
namespace.default.permitted.paths += /odm/framework
namespace.default.permitted.paths += /odm/app
namespace.default.permitted.paths += /odm/priv-app
namespace.default.permitted.paths += /oem/app
namespace.default.permitted.paths += /product/framework
namespace.default.permitted.paths += /product/app
namespace.default.permitted.paths += /product/priv-app
namespace.default.permitted.paths += /data
namespace.default.permitted.paths += /mnt/expand
namespace.default.permitted.paths += /apex/com.android.runtime/${LIB}/bionic
namespace.default.permitted.paths += /system/${LIB}/bootstrap
namespace.default.asan.search.paths = /data/asan/system/${LIB}
namespace.default.asan.search.paths += /system/${LIB}
namespace.default.asan.search.paths += /data/asan/system_ext/${LIB}
namespace.default.asan.search.paths += /system_ext/${LIB}
namespace.default.asan.search.paths += /data/asan/apex/com.android.media/lib
namespace.default.asan.search.paths += /apex/com.android.media/lib
namespace.default.asan.search.paths += /data/asan/apex/com.android.media/lib/extractors
namespace.default.asan.search.paths += /apex/com.android.media/lib/extractors
namespace.default.asan.permitted.paths = /system/${LIB}/drm
namespace.default.asan.permitted.paths += /system/${LIB}/extractors
namespace.default.asan.permitted.paths += /system/${LIB}/hw
namespace.default.asan.permitted.paths += /system_ext/${LIB}
namespace.default.asan.permitted.paths += /system/framework
namespace.default.asan.permitted.paths += /system/app
namespace.default.asan.permitted.paths += /system/priv-app
namespace.default.asan.permitted.paths += /system_ext/framework
namespace.default.asan.permitted.paths += /system_ext/app
namespace.default.asan.permitted.paths += /system_ext/priv-app
namespace.default.asan.permitted.paths += /vendor/framework
namespace.default.asan.permitted.paths += /vendor/app
namespace.default.asan.permitted.paths += /vendor/priv-app
namespace.default.asan.permitted.paths += /system/vendor/framework
namespace.default.asan.permitted.paths += /system/vendor/app
namespace.default.asan.permitted.paths += /system/vendor/priv-app
namespace.default.asan.permitted.paths += /odm/framework