Suppose we have a library libdemo.so with functions x1() and x2(), and a program that calls both. We want to replace x1() with our own version without touching the program or libdemo.so.

/* mod1.c — part of libdemo.so */
#include <stdio.h>
void x1(void) { printf("Called mod1-x1 DEMO\n"); }

/* mod2.c — part of libdemo.so */
#include <stdio.h>
void x2(void) { printf("Called mod2-x2 DEMO\n"); }

# Build libdemo.so
gcc -g -c -fPIC -Wall mod1.c mod2.c
gcc -g -shared -o libdemo.so mod1.o mod2.o

/* prog.c — program using libdemo */
#include <stdio.h>
void x1(void);
void x2(void);

int main(void) {
    x1();
    x2();
    return 0;
}

# Build prog against libdemo
gcc -g -o prog prog.c -L. -ldemo
LD_LIBRARY_PATH=. ./prog

# Output (without preload):
# Called mod1-x1 DEMO
# Called mod2-x2 DEMO

/* libalt.c — our override library that replaces x1() only */
#include <stdio.h>
void x1(void) { printf("Called mod1-x1 ALT\n"); }
/* Note: x2() is NOT defined here — linker will fall through to libdemo.so */

# Build the override library
gcc -g -c -fPIC -Wall libalt.c
gcc -g -shared -o libalt.so libalt.o

# Preload libalt.so — its x1() overrides libdemo's x1()
LD_PRELOAD=libalt.so LD_LIBRARY_PATH=. ./prog

# Output (with preload):
# Called mod1-x1 ALT     ← from libalt.so
# Called mod2-x2 DEMO    ← still from libdemo.so (x2 not in libalt)

A classic use of LD_PRELOAD is wrapping standard library functions like malloc() to add logging or debugging. We use dlsym(RTLD_NEXT, ...) to get a pointer to the original function, then call it from our wrapper.

/* malloc_trace.c — wraps malloc() to log every allocation */
#define _GNU_SOURCE
#include <stdio.h>
#include <stdlib.h>
#include <dlfcn.h>

/* Function pointer to hold the real malloc */
static void *(*real_malloc)(size_t size) = NULL;

/* Our constructor runs first — grab the real malloc before anything */
void __attribute__((constructor)) init_tracer(void)
{
    real_malloc = dlsym(RTLD_NEXT, "malloc");
    if (!real_malloc) {
        fprintf(stderr, "Cannot find real malloc: %s\n", dlerror());
        exit(1);
    }
    fprintf(stderr, "[tracer] malloc wrapper installed\n");
}

/* Our malloc — logs the call then delegates to the real malloc */
void *malloc(size_t size)
{
    void *ptr = real_malloc(size);
    fprintf(stderr, "[malloc] size=%zu  ptr=%p\n", size, ptr);
    return ptr;
}

# Build the tracing library
gcc -g -c -fPIC -Wall malloc_trace.c
gcc -g -shared -o libmtrace.so malloc_trace.o -ldl

# Run ANY program with malloc tracing (no source changes needed!)
LD_PRELOAD=./libmtrace.so ls /tmp

# Example output:
# [tracer] malloc wrapper installed
# [malloc] size=1024  ptr=0x55a3f2b01260
# [malloc] size=64    ptr=0x55a3f2b012a0
# ... (followed by normal ls output)

The LD_PRELOAD environment variable works per-process: only the process where you set it gets the preloaded library. For system-wide preloading (affecting all processes), use the file /etc/ld.so.preload.

# /etc/ld.so.preload
# List library paths separated by whitespace (one per line or space-separated)
# These are loaded for EVERY process on the system

/usr/lib/libsystem_audit.so
/usr/local/lib/libsecure_malloc.so

You can preload multiple libraries at once. Separate them with spaces or colons:

# Space-separated
LD_PRELOAD="libfoo.so libbar.so" ./prog

# Colon-separated
LD_PRELOAD=libfoo.so:libbar.so ./prog

# Multiple with full paths
LD_PRELOAD=/usr/local/lib/libfoo.so:/home/ravi/libbar.so ./prog

Libraries listed earlier in LD_PRELOAD are searched first. If both libfoo.so and libbar.so define x1(), the version from libfoo.so wins.