dlsym() is the core lookup function of the dlopen API. Once you have a library handle from dlopen(), you call dlsym() to resolve a named symbol — whether a variable or a function — to its in-process virtual address.

The handle is either:

• A library handle returned by dlopen(), or
• One of the special pseudohandles: RTLD_DEFAULT or RTLD_NEXT (see Section 3).

The symbol argument is the C name of the symbol (e.g., “malloc”, “my_func”, “global_counter”).

A tricky corner case: dlsym() returns NULL both when a symbol is not found and when a symbol’s actual value is NULL (e.g., a global pointer variable initialised to NULL).

The correct pattern is to clear any prior error first, call dlsym(), then inspect dlerror():

void *sym;
const char *err;

dlerror();                          /* 1. Clear any previous error */
sym = dlsym(handle, "my_symbol");
err = dlerror();                    /* 2. Check for error AFTER the call */
if (err != NULL) {
    fprintf(stderr, "dlsym error: %s\n", err);
    exit(EXIT_FAILURE);
}

/* sym == NULL now means the symbol's value genuinely IS NULL */
if (sym == NULL)
    printf("Symbol value is NULL\n");

When the symbol names a global variable in the shared library, cast the void * return to the correct pointer type, then dereference:

#include <dlfcn.h>
#include <stdio.h>

/* --- In the shared library (libdemo.so) --- */
// int myvar = 42;

/* --- In the calling program --- */
int *ip;

dlerror();
ip = (int *) dlsym(handle, "myvar");
if (dlerror() == NULL && ip != NULL)
    printf("myvar = %d\n", *ip);      /* prints: myvar = 42 */

This is the most nuanced part of dlsym() usage. The C99 standard forbids direct conversion between void * (a data pointer) and a function pointer. Attempting the intuitive assignment:

int (*funcp)(int);

/* ❌ WRONG — C99 forbids direct void* → function-pointer conversion */
funcp = dlsym(handle, "my_function");

produces a compiler warning (“assignment from incompatible pointer type”). Similarly, the apparently equivalent:

/* ❌ Also WRONG — gcc -pedantic warns: */
/* "ANSI C forbids use of cast expressions as lvalues" */
(void *) funcp = dlsym(handle, "my_function");

The correct, portable workaround — sanctioned by SUSv3 TC1 — is:

int (*funcp)(int);   /* function pointer: takes int, returns int */

/* ✅ CORRECT — cast address of funcp to void**, then assign */
*(void **) (&funcp) = dlsym(handle, "my_function");

After obtaining the function pointer, invoke it with standard C function-pointer syntax:

int result;

/* Invoke the dynamically loaded function */
result = (*funcp)(42);

/* Most compilers also accept: */
result = funcp(42);

Instead of a real library handle from dlopen(), dlsym() accepts two special pseudohandle constants. These extend the symbol search scope beyond a single library.

#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>

int main(void)
{
    void *sym;

    /* Search everywhere in the process for "printf" */
    dlerror();
    sym = dlsym(RTLD_DEFAULT, "printf");
    if (dlerror() == NULL && sym != NULL)
        printf("Found printf at: %p\n", sym);

    return 0;
}

Compile and run:

$ gcc -o rtld_default rtld_default.c -ldl
$ ./rtld_default
Found printf at: 0x7f8a3c2b1234

The classic use of RTLD_NEXT is to wrap a standard library function. Your wrapper has the same name; it does its extra work, then calls the real implementation via RTLD_NEXT.

#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdlib.h>
#include <stdio.h>

/* Custom malloc: log every allocation, then call the real malloc */
void *malloc(size_t size)
{
    static void *(*real_malloc)(size_t) = NULL;

    if (real_malloc == NULL) {
        /* One-time initialisation: find the real malloc */
        dlerror();
        *(void **) (&real_malloc) = dlsym(RTLD_NEXT, "malloc");
        if (dlerror() != NULL) {
            fprintf(stderr, "Cannot locate real malloc!\n");
            return NULL;
        }
    }

    fprintf(stderr, "[TRACE] malloc(%zu)\n", size);
    return real_malloc(size);   /* delegate to real implementation */
}

/* Build as a preload library */
$ gcc -shared -fPIC -o libmymalloc.so mymalloc.c -ldl

/* Preload it so every malloc goes through our wrapper */
$ LD_PRELOAD=./libmymalloc.so ls /tmp
[TRACE] malloc(552)
[TRACE] malloc(120)
...

Listing 42-1 from TLPI demonstrates a minimal but complete use of the dlopen API. The program accepts a shared library path and a function name on the command line, dynamically loads the library, resolves the function, calls it, then unloads the library cleanly.

/* shlibs/dynload.c */
#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>
#include <string.h>

int main(int argc, char *argv[])
{
    void        *libHandle;       /* Handle for the shared library     */
    void        (*funcp)(void);   /* Pointer: function taking no args  */
    const char  *err;

    if (argc != 3 || strcmp(argv[1], "--help") == 0) {
        fprintf(stderr, "Usage: %s lib-path func-name\n", argv[0]);
        exit(EXIT_FAILURE);
    }

    /* ── Step 1: Load the shared library ── */
    libHandle = dlopen(argv[1], RTLD_LAZY);
    if (libHandle == NULL) {
        fprintf(stderr, "dlopen: %s\n", dlerror());
        exit(EXIT_FAILURE);
    }

    /* ── Step 2: Look up the named symbol ── */
    dlerror();                                    /* clear prior errors */
    *(void **) (&funcp) = dlsym(libHandle, argv[2]);
    err = dlerror();
    if (err != NULL) {
        fprintf(stderr, "dlsym: %s\n", err);
        exit(EXIT_FAILURE);
    }

    /* ── Step 3: Call or report ── */
    if (funcp == NULL)
        printf("%s is NULL\n", argv[2]);
    else
        (*funcp)();                               /* call the function  */

    /* ── Step 4: Unload ── */
    dlclose(libHandle);
    exit(EXIT_SUCCESS);
}

Build and run:

$ gcc -o dynload dynload.c -ldl

/* Using a relative library path (slash present → relative pathname) */
$ ./dynload ./libdemo.so.1 x1
Called mod1-x1

/* Using LD_LIBRARY_PATH to set search path, library name only */
$ LD_LIBRARY_PATH=. ./dynload libdemo.so.1 x2
Called mod1-x2

dlclose() decrements an internal reference counter maintained by the dynamic linker for the library identified by handle. The library is only actually unmapped from memory when:

• Its reference count drops to zero, and
• No other currently loaded library depends on it (dependency-tree check, applied recursively).

#include <dlfcn.h>
#include <stdio.h>
#include <stdlib.h>

int main(void)
{
    void *h1 = dlopen("./libfoo.so", RTLD_LAZY);  /* refcount = 1 */
    void *h2 = dlopen("./libfoo.so", RTLD_LAZY);  /* refcount = 2 */

    /* h1 and h2 are the same handle value (same library) */

    dlclose(h1);   /* refcount = 1 — library still loaded */
    dlclose(h2);   /* refcount = 0 — library now unmapped  */

    return 0;
}

dladdr() is the reverse lookup function: given a virtual address (typically one obtained from dlsym() or a function pointer), it returns metadata about the symbol and the shared library that contains it.

The caller provides a Dl_info structure (allocated on the stack or heap); dladdr() fills it in:

If addr points to the exact start of a symbol, dli_saddr == addr. If addr points inside a function body (e.g., a return address from a stack frame), dli_sname gives the enclosing function’s name and dli_saddr its start — useful for stack-trace generation.

#define _GNU_SOURCE
#include <dlfcn.h>
#include <stdio.h>
#include <math.h>

int main(void)
{
    Dl_info info;
    void (*fp)(void);

    /* Look up sin() from the math library */
    dlerror();
    *(void **) (&fp) = dlsym(RTLD_DEFAULT, "sin");
    if (dlerror() != NULL) {
        fprintf(stderr, "sin not found\n");
        return 1;
    }

    /* Reverse-lookup: which library and symbol does this address belong to? */
    if (dladdr(fp, &info)) {
        printf("Library  : %s\n", info.dli_fname);
        printf("Load base: %p\n", info.dli_fbase);
        printf("Symbol   : %s\n", info.dli_sname);
        printf("Sym addr : %p\n", info.dli_saddr);
    } else {
        printf("Address not found in any shared library\n");
    }

    return 0;
}

$ gcc -o dladdr_demo dladdr_demo.c -ldl -lm
$ ./dladdr_demo
Library  : /lib/x86_64-linux-gnu/libm.so.6
Load base: 0x7f3a1c000000
Symbol   : sin
Sym addr : 0x7f3a1c045600