Return to Question

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.

I looked at it in xxd to figure out why, but couldn't find a match. This explains why the YARA rule misses, but leaves me with a new question: how are tools like nm or objdump discovering the symbol?

I checked other the other GLIBC symbols that nm reports to see how common this is, and found 5 symbols that didn't match in the output of xxd: execve, exit, getpgrp, sleep, and textdomain. (I haven't yet manually verified whether any of the others only fail to match because they're split over a line break, but for this search I did run xxd at a width of 256 cols to minimize the likelihood).

I'm running something like:

nm --undefined $(type -p sudo)
xxd -c 40 $(type -p sudo)

Since this outputs a few thousand lines and there may be platform differences in the binary/commands, I went ahead made a GH repo for reference.

• CI run itself
• relevant section from a committed copy of the CI output for posterity
• actual invocation producing the CI output
• copy of the sudo binary itself

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.

I looked at it in xxd to figure out why, but couldn't find a match. This explains why the YARA rule misses, but leaves me with a new question: how are tools like nm or objdump discovering the symbol?

I checked other the other GLIBC symbols that nm reports to see how common this is, and found 5 symbols that didn't match in the output of xxd: execve exit getpgrp sleep textdomain. (I haven't yet manually verified whether any of the others only fail to match because they're split over a line break, but for this search I did run xxd at a width of 256 cols to minimize the likelihood).

I'm running something like:

nm --undefined $(type -p sudo)
xxd -c 40 $(type -p sudo)

Since this outputs a few thousand lines and there may be platform differences in the binary/commands, I went ahead made a GH repo for reference.

• CI run itself
• relevant section from a committed copy of the CI output for posterity
• actual invocation producing the CI output
• copy of the sudo binary itself

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.

I looked at it in xxd to figure out why, but couldn't find a match. This explains why the YARA rule misses, but leaves me with a new question: how are tools like nm or objdump discovering the symbol?

I checked other the other GLIBC symbols that nm reports to see how common this is, and found 5 symbols that didn't match in the output of xxd: execve, exit, getpgrp, sleep, and textdomain. (I haven't yet manually verified whether any of the others only fail to match because they're split over a line break, but for this search I did run xxd at a width of 256 cols to minimize the likelihood).

I'm running something like:

nm --undefined $(type -p sudo)
xxd -c 40 $(type -p sudo)

Since this outputs a few thousand lines and there may be platform differences in the binary/commands, I went ahead made a GH repo for reference.

• CI run itself
• relevant section from a committed copy of the CI output for posterity
• actual invocation producing the CI output

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.

I looked at it in xxd to figure out why, but couldn't find a match. This explains why the YARA rule misses, but leaves me with a new question: how are tools like nm or objdump discovering the symbol?

I checked other the other GLIBC symbols that nm reports to see how common this is, and found 5 symbols that didn't match in the output of xxd: execve, exit, getpgrp, sleep, and textdomain. (I haven't yet manually verified whether any of the others only fail to match because they're split over a line break, but for this search I did run xxd at a width of 256 cols to minimize the likelihood).

I'm running something like:

nm --undefined $(type -p sudo)
xxd -c 40 $(type -p sudo)

Since this outputs a few thousand lines and there may be platform differences in the binary/commands, I went ahead made a GH repo for reference.

• CI run itself
• relevant section from a committed copy of the CI output for posterity
• actual invocation producing the CI output
• copy of the sudo binary itself

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.

I looked at it in xxd to figure out why, but couldn't find a match. This explains why the YARA rule misses, but leaves me with a new question: how are tools like nm or objdump discovering the symbol?

I checked other the other GLIBC symbols that nm reports to see how common this is, and found 5 symbols that didn't match in the output of xxd: execve, exit, getpgrp, sleep, and textdomain. (I haven't yet manually verified whether any of the others only fail to match because they're split over a line break, but for this search I did run xxd at a width of 256 cols to minimize the likelihood).

I'm running something like:

nm --undefined $(type -p sudo)
xxd -c 40 $(type -p sudo)

Since this outputs a few thousand lines and there may be platform differences in the binary/commands, I went ahead made a GH repo for reference.

• CI run itself
• relevant section from a committed copy of the CI output for posterity
• actual invocation producing the CI output

I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in sudo that nm + grep could find.

I looked at it in xxd to figure out why, but couldn't find a match. This explains why the YARA rule misses, but leaves me with a new question: how are tools like nm or objdump discovering the symbol?

I checked other the other GLIBC symbols that nm reports to see how common this is, and found 5 symbols that didn't match in the output of xxd: execve, exit, getpgrp, sleep, and textdomain. (I haven't yet manually verified whether any of the others only fail to match because they're split over a line break, but for this search I did run xxd at a width of 256 cols to minimize the likelihood).

I'm running something like:

nm --undefined $(type -p sudo)
xxd -c 40 $(type -p sudo)

Since this outputs a few thousand lines and there may be platform differences in the binary/commands, I went ahead made a GH repo for reference.

• CI run itself
• relevant section from a committed copy of the CI output for posterity
• actual invocation producing the CI output