Sign in Join

Live chat for Free Pascal, Lazarus, Delphi and every Pascal programmer.

Mailing lists / fpc-pascal / 2012-05

Linux elf with signed checksum

3 messages · 2 people ·

Reply by email Subscribe to this list Your subscription

Read-only archive. Use j and k to move between messages.

ik

Hello,

I see that most of the ELF on my system, contain a signature like so:

ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32,
BuildID[sha1]=0x39645af26ea483eaae81df45bf34701580506115, stripped

There are two very interesting signatures here that does not exists when creating an ELF with FPC:
1. GNU/Linux 2.6.32
2. BuildID[sha1]=0x39645af26ea483eaae81df45bf34701580506115

The second part is more interesting for this subject: It signs a checksum of the ELF file, so any change to it will break the checksum. It helps you to discover for example root-kits.

Is it a compiler based signature, or something from the build itself ? If it's from the compiler itself, what is the requirement to add such support for FPC ?

Thanks,
Ido

Jonas Maebe
to ik
ik wrote 5 lines
The second part is more interesting for this subject: It signs a checksum of the ELF file, so any change to it will break the checksum. It helps you to discover for example root-kits. Is it a compiler based signature, or something from the build itself ?

The first google hit I get for BuildID is this page: http://fedoraproject.org/wiki/Releases/FeatureBuildId

It explains everything, including the linker option to use (--build-id).

Jonas

ik
to Jonas Maebe
Jonas Maebe wrote 14 lines
On 28 May 2012, at 14:09, ik wrote: > The second part is more interesting for this subject: It signs a checksum > of the ELF file, so any change to it will break the checksum. > It helps you to discover for example root-kits. > > Is it a compiler based signature, or something from the build itself ? The first google hit I get for BuildID is this page: http://fedoraproject.org/wiki/Releases/FeatureBuildId It explains everything, including the linker option to use (--build-id).

Thank you

Show quoted text 6 lines
Jonas_______________________________________________ fpc-pascal maillist - http://lists.freepascal.org/mailman/listinfo/fpc-pascal