News for hackers. Stuff that matters.
Re:Ldd(1) and Untrusted Binaries (2023) by sim7c00 on Tuesday October 01, 2024 @09:55AM (#41708474)
I think in this case, you might be able to resolve the ones in DT_NEEDED on the disk, and parse those elf headers, and do that until they don't have any DT_NEEDED in there anymore which you didn't touch.

The reason it doesn't find all with a simple elf-parse is that included libs might depend on other libs. I'd say if your linker can figure out before executing anything after the entry-point what to resolve, it has read it from ELF files it has seen by parsing the initial executable.

I was really surprised honestly to see LDD executes stuff, but I suppose it's a very old thing, from before 'untrusted' executables were really a (big) thing.

There are no comments on this comment yet.