Having fun with the dynamic linker

• The ld.so dynamic linker will first load any library named in the LD_PRELOAD environment variable.

• Remember what I said before about the results of symbol lookups for the same symbol can vary for each of the objects because of lookup scope?

• Well, together these two facts can be use to hijack symbols.