![]() | |||||||||||||
Messages in this thread |
Jan Engelhardt wrote: >>>Well you could patch the affected plugin's .dynstr table so that it should at >>>best try to call a function that has not yet been defined somewhere else (like >>>open); IOW, you change the .dynstr entry from 'open' to say 'my_open', and >>>regularly include libmy.so through e.g. LD_PRELOAD. >>>>>>Of course the MD5 won't match afterwards, but I think the plugin should execute >>>as usual afterwards, since .dynstr is something no app should rely on.>>>>Is this likely to work with an app like Skype that takes extensive steps >>to thwart reverse engineers?> > > We do not reverse engineer the .text section, but change the .dynstr > section that is specific to the ELF format. I doubt any app out there md5s > itself. There is at least one. True that it doesn't do sound (it's an antivirus scanner for mailservers :)) but regardless, it checksums the whole thing. // Stefan [unhandled content-type:application/pgp-signature] | ||||||||||||
| Last update: 2006-07-05 07:31 [W:1.443 / U:0.160 seconds] ©2003-2008 Jasper Spaans | |||||||||||||