What is library interpositioning and when can it occur?

A technique that intercepts or wraps calls to a function without changing its source — possible at compile-time, link-time, or load/run-time (LD_PRELOAD).

Library interpositioning lets you replace or wrap any function call without modifying source code or binaries.

Three stages where it can occur:

Load-time is most powerful:

• No recompilation needed
• Works on any binary
• Can intercept libc functions (malloc, free, open, etc.)

Example use cases:

• Security: Sandbox untrusted code by intercepting syscalls
• Debugging: Log all malloc/free calls to detect memory leaks
• Profiling: Count function calls, measure execution time
• Encryption: Transparently encrypt network traffic

Go deeper:

• Rafał Cieślak — Dynamic linker tricks: using LD_PRELOAD to cheat, inject and investigate — hands-on load-time interpositioning, from rand() to open().
• Dynamic linker — runtime hooks (Wikipedia) — where LD_PRELOAD sits in the linker's search order.