1. How a Dynamically Linked Program Starts

Every dynamically-linked ELF executable contains a special segment called PT_INTERP that names the dynamic linker to use. On x86-64 Linux this is /lib64/ld-linux-x86-64.so.2. The kernel reads this when loading the program and maps the dynamic linker into the process’s address space first.

2. Lazy Binding vs Eager Binding

Symbol resolution (filling GOT entries) can happen either eagerly (all at startup) or lazily (on first use). Linux uses lazy binding by default for performance — resolving 200 library functions at startup adds measurable delay, especially if most are never called.

Code Example 1 — Observing the Dynamic Linker at Work

/* prog.c — simple program using shared library */
#include <stdio.h>
#include <math.h>
#include "net_utils.h"

int main(void) {
    char buf[32];
    uint32_t ip = ip_to_int("192.168.1.100");
    int_to_ip(ip, buf, sizeof(buf));
    printf("IP roundtrip: %s\n", buf);
    printf("sqrt(2) = %.6f\n", sqrt(2.0));
    return 0;
}

# Compile the program
gcc -o prog prog.c -L. -lnetutils -lm

# Check what dynamic libraries it needs (DT_NEEDED entries)
readelf -d prog | grep NEEDED
#  (NEEDED)  Shared library: [libnetutils.so.1]
#  (NEEDED)  Shared library: [libm.so.6]
#  (NEEDED)  Shared library: [libc.so.6]

# Check the PT_INTERP (dynamic linker path)
readelf -l prog | grep interpreter
#       [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]

# Enable LAZY binding debug output (LD_DEBUG shows resolution)
LD_DEBUG=bindings LD_LIBRARY_PATH=. ./prog 2>&1 | head -30
#   binding file prog to libnetutils.so.1: normal symbol 'ip_to_int' [GLIBC_2.17]
#   binding file prog to libnetutils.so.1: normal symbol 'int_to_ip'
#   binding file prog to libm.so.6: normal symbol 'sqrt'
#   IP roundtrip: 192.168.1.100
#   sqrt(2) = 1.414214

# Enable EAGER binding — all symbols resolved before main()
LD_BIND_NOW=1 LD_LIBRARY_PATH=. ./prog

# If a library is missing, with eager binding you get an immediate error:
LD_BIND_NOW=1 ./prog_missing_lib
# /lib64/ld-linux-x86-64.so.2: error: symbol lookup error:
#   undefined symbol: ip_to_int

3. LD_PRELOAD — Symbol Interposition

LD_PRELOAD is an environment variable that tells the dynamic linker to load specified .so files before all others. Because the dynamic linker resolves symbols in order (RPATH, LD_PRELOAD, cache/system libraries), a symbol defined in an LD_PRELOAD library shadows (interposes) the same symbol from the standard library. This is powerful for debugging, testing, and patching.

Code Example 2 — LD_PRELOAD for Function Interposition

/* malloc_trace.c — intercept malloc to trace allocations */
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>   /* for RTLD_NEXT */

/* 
 * RTLD_NEXT: find the "next" definition of malloc in the 
 * dynamic linker search order (i.e., the real malloc in libc)
 */
static void *(*real_malloc)(size_t) = NULL;

/* Our replacement malloc — called instead of libc malloc */
void *malloc(size_t size) {
    if (!real_malloc) {
        real_malloc = dlsym(RTLD_NEXT, "malloc");
    }
    void *ptr = real_malloc(size);
    fprintf(stderr, "[TRACE] malloc(%zu) = %p\n", size, ptr);
    return ptr;
}

static void (*real_free)(void *) = NULL;

void free(void *ptr) {
    if (!real_free) {
        real_free = dlsym(RTLD_NEXT, "free");
    }
    fprintf(stderr, "[TRACE] free(%p)\n", ptr);
    real_free(ptr);
}

# Build the interposition library
gcc -g -shared -fPIC -o malloc_trace.so malloc_trace.c -ldl

# Run ANY program with malloc tracing (no recompile needed!)
LD_PRELOAD=./malloc_trace.so ls /tmp
# [TRACE] malloc(120) = 0x561f...
# [TRACE] malloc(8192) = 0x7f...
# [TRACE] free(0x561f...)
# ... (all malloc/free calls from 'ls' are traced)

# Trace your own program:
LD_PRELOAD=./malloc_trace.so ./prog
# [TRACE] malloc(32) = 0x...
# IP roundtrip: 192.168.1.100

Code Example 3 — Library Search Order and Debugging

# Full LD_DEBUG options for diagnosing dynamic linking issues
# LD_DEBUG=help shows all available categories

LD_DEBUG=libs LD_LIBRARY_PATH=. ./prog 2>&1 | head -20
#   find library=libnetutils.so.1 [0]; searching
#    search path=/lib/x86_64-linux-gnu/tls/x86_64:...  (LD_LIBRARY_PATH)
#    trying file=./libnetutils.so.1
#    found libnetutils.so.1 at ./libnetutils.so.1.0.0

# Show all library search steps
LD_DEBUG=libs,files ./prog 2>&1

# Check if a program would successfully link its libraries
# (faster and safer than running the program directly)
ldd ./prog
# linux-vdso.so.1 (0x...)
# libnetutils.so.1 => /usr/local/lib/libnetutils.so.1.0.0
# libm.so.6 => /lib/x86_64-linux-gnu/libm.so.6
# libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6

# Show "not found" when library is missing:
ldd ./prog_bad
# libmissing.so.1 => not found   ← clear error

# LD_DEBUG categories (partial list):
# libs       - library search and loading
# bindings   - symbol binding (lazy resolution)  
# symbols    - symbol table lookups
# reloc      - relocations applied
# files      - all file opens by dynamic linker
# all        - everything (very verbose)
# statistics - timing/count statistics

# Useful: see what version of a symbol is being resolved
LD_DEBUG=symbols,bindings ./prog 2>&1 | grep sqrt
#   symbol=sqrt;  lookup in file=prog [0]
#   symbol=sqrt;  lookup in file=libnetutils.so.1 [0]
#   symbol=sqrt;  lookup in file=libm.so.6 [0]
#   binding file prog [0] to libm.so.6 [0]: normal symbol 'sqrt'

4. Library Constructors and Destructors

Shared libraries can run code automatically when they are loaded or unloaded using GCC’s constructor/destructor attributes. The dynamic linker calls constructors before main() and destructors after main() returns (or on exit()).

/* libinit_demo.c — library with constructor and destructor */
#include <stdio.h>

/* Called automatically when library is loaded */
__attribute__((constructor))
static void library_init(void) {
    printf("[libinit_demo] Library loaded — running constructor\n");
    /* Good place for: initializing global state, opening files,
       starting background threads, etc. */
}

/* Called automatically when library is unloaded */
__attribute__((destructor))
static void library_fini(void) {
    printf("[libinit_demo] Library unloaded — running destructor\n");
    /* Good place for: cleanup, flushing buffers, joining threads */
}

void demo_function(void) {
    printf("[libinit_demo] demo_function() called\n");
}

# Build the library
gcc -g -shared -fPIC -Wl,-soname,libinit_demo.so.1 \
    -o libinit_demo.so.1.0.0 libinit_demo.c

# Run a program that uses it
cat > main_init.c << 'EOF'
#include <stdio.h>
extern void demo_function(void);
int main(void) {
    printf("[main] main() started\n");
    demo_function();
    printf("[main] main() finishing\n");
    return 0;
}
EOF

gcc -o main_init main_init.c -L. -linit_demo
LD_LIBRARY_PATH=. ./main_init

# Output:
# [libinit_demo] Library loaded — running constructor
# [main] main() started
# [libinit_demo] demo_function() called
# [main] main() finishing
# [libinit_demo] Library unloaded — running destructor

Interview Questions & Answers