Import classes from shared object into a specific namespace - c++

Question

I have a compiled ELF file, libfoo.so, that exports some class methods, like:
struct Bar {
void f();
void g();
};
I know the exact declaration of these classes, but the definition is compiled into the .so. I'm using the same compiler (gcc >= 7) as the .so, so the name mangling and ABI match. This means that if I add the above declaration to my code, I'll be able to call the methods implemented in libfoo.so directly.
However, I don't want to pollute my namespace with toplevel libfoo stuff (and I don't control libfoo source). So I'd like to declare struct Bar inside namespace foo {}. Now, once I do that, the name mangling no longer matches and the loader will not be able to find the functions in question.
I do not want to write thunks for all of them as a) there's thousands and b) it causes issues with virtual functions and destructors.
I'm thinking of using objcopy and renaming all exported symbols in libfoo.so, but hoping there's a better solution here.
Both libfoo and my code are using C++14 (can be moved to C++17) and gcc 7 (can be moved to later). Compiled for 64bit ELF on Linux.

Answer 1

It ended up being a lot more complex than expected, but I did manage. If libfoo.so has the function Bar::f() (mangled as _ZN3Bar1fEv), and I want to define foo::Bar::f() (_ZN3foo3Bar1fEv), I first need to find the relative offset of the function in libfoo.so. With nm you get something like:
0000000000abcd00 T _ZN3Bar1fEv
I have a script that parses this output, and generates assembly code like this:
; Export start of the translation space
.global START
START:
nop
.global _ZN3foo3Bar1fEv ; Desired target name
_ZN3foo3Bar1fEv:
movq $0x0000abcd12345678, %rax ; arbitrary constant
addq $0xabcd00, %rax ; offset from libfoo
pushq %rax
ret
; same for every other needed symbol
; Export end of the translation space
.global END
END:
nop
This defines a "naked" function with the desired name, which adds an arbitrary constant to the offset and jumps to it. The extra jump is a perf hit I can live with.
The arbitrary constant is needed to deal with ASLR - the 0xabcd00 is the base offset, but when libfoo.so is loaded to some base address (e.g. 0x04000000) the actual address of the function (i.e. if you wanted a function pointer) is 0x04abde00. When generating the asm code, I used a temporary constant that I'll fix up after loading:
const uintptr_t offset = 0xabcd00; // Expected offset in libfoo.so
uintptr_t real = (uintptr_t) dlsym(RTLD_DEFAULT, "_ZN3Bar1fEv"); // real address with ASLR
uintptr_t aslr_base = real - offset; // This is the actual base to be applied.
// Search everything between START and END and update the arbitrary constant
extern "C" void START(); extern "C" void END();
uint8_t *p = (uint8_t*)&START;
uint8_t *end = (uint8_t*)&END;
mprotect(ALIGN_TO_PAGE(p), end-p+PAGE_SIZE, PROT_READ | PROT_WRITE | PROT_EXEC); // mark the memory as writable
// update all instances of the arbitrary constant
while (p != end)
{
if (*(uintptr_t*)p == 0x0000abcd12345678)
*(uintptr_t*)p = aslr_base;
p++;
}
You can then restore the memory protections. The asm can be optimized to not use rax by doing calculations using just push and mov with indirect addressing using rsp, but this works for my case.
What doesn't work
objcopy allows redefining or injecting static symbols, but has no support for editing dynamic symbol table. None of the tools I found do either.
Linker scripts allow defining aliases (PROVIDE(alias = real)), but only if the target is defined at the time of linking; you cannot create an alias to a dynamic symbol.
Sourcing the ASLR offset from a global variable does not work - The linker kept asking that all code be compiled with -fPIC, which it was. This would have removed the need to modify the code.