自己解决

nm -D libx1.so
0000000000000b86 T _ZN10CxxReader25open2EPKc
0000000000000bfc T _ZN10CxxReader25read2EiPvi
0000000000000bb2 T _ZN10CxxReader26close2Ei

handle = dlopen("libx1.so")
sym_addr_ZN10CxxReader25open2EPKc = dlsym(handle, "_ZN10CxxReader25open2EPKc");
sym_addr_ZN10CxxReader25read2EiPvi = dlsym(handle, "_ZN10CxxReader25read2EiPvi")
sym_addr_ZN10CxxReader26close2Ei = dlsym(handle, "_ZN10CxxReader26close2Ei")

a.S
_ZN10CxxReader25open2EPKc:
    jmp dword ptr [sym_addr_ZN10CxxReader25open2EPKc]
_ZN10CxxReader25read2EiPvi:
    jmp dword ptr [sym_addr_ZN10CxxReader25read2EiPvi]
_ZN10CxxReader26close2Ei:
    jmp dword ptr [sym_addr_ZN10CxxReader26close2Ei]

【 在 prc79 的大作中提到: 】
: MyClass {
: int open();
: int read();
: ...................
--
FROM 117.136.0.*