Linux libraries loaded by process

How to check what libraries are used by a program or process on Linux

Last updated on November 28, 2020 by Dan Nanni

You can use the following methods to identiy which shared librariies a given program executable (e.g., /path/to/program ) or a given running process (e.g., PID 1149 ) depends on.

Check Shared Library Dependencies of a Program Executable

To find out what libraries a particular executable depends on, you can use ldd command. This command invokes dynamic linker to find out library dependencies of an executable.

Note that it is not recommended to run ldd with any untrusted third-party executable because some versions of ldd may directly invoke the executable to identify its library dependencies, which can be security risk.

Instead, a safer way to show library dependencies of an unknown application binary is to use the following command.

Check Shared Library Dependencies of a Running Process

If you want to find out what shared libraries are loaded by a running process, you can use pldd command, which shows all shared objects loaded into a process at run-time.

Note that you need root privilege to run pldd command.

Alternatively, a command line utility called pmap , which reports memory map of a process, can also show shared library dependencies of a running process.

Support Xmodulo

This website is made possible by minimal ads and your gracious donation via PayPal (Credit Card) or Bitcoin ( 1M161JGAkz3oaHNvTiPFjNYkeABox8rb4g ).

Источник

How to find out the dynamic libraries executables loads when run?

I want to find out the list of dynamic libraries a binary loads when run (With their full paths). I am using CentOS 6.0. How to do this?

8 Answers 8

You can do this with ldd command:

readelf -d $executable | grep ‘NEEDED’

Can be used if you can’t run the executable, e.g. if it was cross compiled, or if you don’t trust it:

In the usual case, ldd invokes the standard dynamic linker (see ld.so(8)) with the LD_TRACE_LOADED_OBJECTS environment variable set to 1, which causes the linker to display the library dependencies. Be aware, however, that in some circumstances, some versions of ldd may attempt to obtain the dependency information by directly executing the program. Thus, you should never employ ldd on an untrusted executable, since this may result in the execution of arbitrary code.

Note that libraries can depend on other libraries, so now you need to find the dependencies.

A naive approach that often works is:

but the more precise method is to understand the ldd search path / cache. I think ldconfig is the way to go.

Choose one, and repeat:

/maps for running processes

Mentioned by Basile, this is useful to find all the libraries currently being used by running executables. E.g.:

shows all currently loaded dynamic dependencies of init (PID 1 ):

This method also shows libraries opened with dlopen , tested with this minimal setup hacked up with a sleep(1000) on Ubuntu 18.04.

Источник

How to check what shared libraries are loaded at run time for a given process?

Is there a way to check which libraries is a running process using?

To be more specific, if a program loads some shared libraries using dlopen, then readelf or ldd is not going to show it. Is it possible at all to get that information from a running process? If yes, how?

8 Answers 8

Other people are on the right track. Here are a couple ways.

Both of these assume that shared libraries have «.so» somewhere in their paths, but you can modify that. The first one gives fairly pretty output as just a list of libraries, one per line. The second one will keep on listing libraries as they are opened, so that’s nice.

And of course lsof .

May be lsof — the swiss army knife of linux will help?

edit: to run, lsof -p

, lists all sorts of useful information, for example, if the process is java, lists all the open jars — very cool.

Actually, you can do this in your code in the following way:

The link_map structure contains at least the base address and the absolute file name. It’s the structure that is actually returned by dlopen() with non-NULL first argument. For more details see here.

ltrace seems to be your friend.

From ltrace manual:

ltrace is a program that simply runs the specified command until it exits. It intercepts and records the dynamic library calls which are called by the executed process and the signals which are received by that process. It can also intercept and print the system calls exe‐ cuted by the program.

Источник

How to see the currently loaded shared objects in Linux?

I have two, related questions:

• How can I see if a shared library is currently loaded? (i.e. system-wide, process agnostic)
• How can I see all shared libraries loaded by a process?

4 Answers 4

You can do both with lsof . To see what processes have a library open or mapped do:

and to see what files (including shared libraries) a process has open and/or mapped, do:

Another way to see what’s loaded in a process is by looking at the /proc/PID/maps file. This shows everything mapped into your address space, including shared objects mapped in.

is a nice way to explore all /proc/PID/maps mentioned by Rich at once. Sample output:

Further awk and bash-fu can refine the output further.

This method also shows libraries opened with dlopen , tested with this minimal setup hacked up with a sleep(1000) on Ubuntu 18.04.

You can run the next command by root and see a full list,

This is for users who don’t have lsof.

Not the answer you’re looking for? Browse other questions tagged linux libraries or ask your own question.

Linked

Related

Hot Network Questions

Subscribe to RSS

To subscribe to this RSS feed, copy and paste this URL into your RSS reader.

site design / logo © 2021 Stack Exchange Inc; user contributions licensed under cc by-sa. rev 2021.10.8.40416

By clicking “Accept all cookies”, you agree Stack Exchange can store cookies on your device and disclose information in accordance with our Cookie Policy.

Источник

How to show all shared libraries used by executables in Linux?

I’d like to know which libraries are used by executables on my system. More specifically, I’d like to rank which libraries are used the most, along with the binaries that use them. How can I do this?

13 Answers 13

1. Use ldd to list shared libraries for each executable.
2. Cleanup the output
3. Sort, compute counts, sort by count

To find the answer for all executables in the «/bin» directory:

Change «/bin» above to «/» to search all directories.

Output (for just the /bin directory) will look something like this:

Edit — Removed «grep -P»

I didn’t have ldd on my ARM toolchain so I used objdump:

This works better than ldd when the executable uses a non default loader

to learn what libraries a binary uses, use ldd

You’d have to write a little shell script to get to your system-wide breakdown.

Check shared library dependencies of a program executable

To find out what libraries a particular executable depends on, you can use ldd command. This command invokes dynamic linker to find out library dependencies of an executable.

> $ ldd /path/to/program

Note that it is NOT recommended to run ldd with any untrusted third-party executable because some versions of ldd may directly invoke the executable to identify its library dependencies, which can be security risk.

Instead, a safer way to show library dependencies of an unknown application binary is to use the following command.

$ objdump -p /path/to/program | grep NEEDED

readelf -d recursion

redelf -d produces similar output to objdump -p which was mentioned at: https://stackoverflow.com/a/15520982/895245

But beware that dynamic libraries can depend on other dynamic libraries, to you have to recurse.

Choose one, and repeat:

/maps for running processes

This is useful to find all the libraries currently being used by running executables. E.g.:

shows all currently loaded dynamic dependencies of init (PID 1 ):

This method also shows libraries opened with dlopen , tested with this minimal setup hacked up with a sleep(1000) on Ubuntu 18.04.

On OS X by default there is no ldd , objdump or lsof . As an alternative, try otool -L :

In this example, using which openssl fills in the fully qualified path for the given executable and current user environment.

On UNIX system, suppose binary (executable) name is test. Then we use the following command to list the libraries used in the test is

With ldd you can get the libraries that tools use. To rank the usage of libraries for a set of tool you can use something like the following command.

(Here sed strips all lines that do not start with a tab and the filters out only the actual libraries. With sort | uniq -c you get each library with a count indicating the number of times it occurred.)

You might want to add sort -g at the end to get the libraries in order of usage.

Источник