I'm cross-comparing a few approaches to testing for binaries that import a symbol and I noticed a YARA rule not finding one in
sudo that nm + grep could find.
I looked at it in
xxd to figure out why, but couldn't find a match. This explains why the YARA rule misses, but leaves me with a new question: how are tools like nm or objdump discovering the symbol?
I checked other the other GLIBC symbols that nm reports to see how common this is, and found 5 symbols that didn't match in the output of xxd:
execve exit getpgrp sleep textdomain. (I haven't yet manually verified whether any of the others only fail to match because they're split over a line break, but for this search I did run xxd at a width of 256 cols to minimize the likelihood).
I'm running something like:
nm --undefined $(type -p sudo) xxd -c 40 $(type -p sudo)
Since this outputs a few thousand lines and there may be platform differences in the binary/commands, I went ahead made a GH repo for reference.