Dear All,
We have observed the exe file size getting changed during run time of the system in CentOS.
We are using CentOS 4.4 release.
We have taken "strings" of the original "exe" and changed "exe". Then we compared the strings output of the two. The difference is given below.
We are not sure why this is happening. Can some one throw light on this.
diff oldExeStrings newExeStrings 1a2,8
MzFX# PzFr MzF` MzFm MzF% MzFXi MzF
163a171,182
libssl.so.4 libcrypto.so.4 libkrb5.so.3 libcom_err.so.2 libcrypt.so.1 libresolv.so.2 libnsl.so.1 libpthread.so.0 /lib/ld-linux.so.2 libgssapi_krb5.so.2 libk5crypto.so.3 libz.so.1
--Regards S.Balaji
On 6/21/07, balajisundar@midascomm.com balajisundar@midascomm.com wrote:
We have observed the exe file size getting changed during run timeof the system in CentOS.
Yep. that's normal.
We are not sure why this is happening. Can some one throw light on this.
Prelink. Basically there's a cron job that runs weekly, which optimizes binaries to load faster. It will change md5sums on the binaries it modifies. You can alter this behavior if you wish by setting parameters in /etc/sysconfig/prelink.
On Thursday 21 June 2007, Jim Perrin wrote:
On 6/21/07, balajisundar@midascomm.com balajisundar@midascomm.com wrote:
We have observed the exe file size getting changed during run timeof the system in CentOS.
Yep. that's normal.
We are not sure why this is happening. Can some one throw light on this.
Prelink. Basically there's a cron job that runs weekly, which optimizes binaries to load faster. It will change md5sums on the binaries it modifies. You can alter this behavior if you wish by setting parameters in /etc/sysconfig/prelink.
Also related, rpm -V "sees past" prelink stuff and is able to verify files even with prelink enabled. (if I remember correctly...)
/Peter
On 6/21/07, Peter Kjellstrom cap@nsc.liu.se wrote:
Also related, rpm -V "sees past" prelink stuff and is able to verify files even with prelink enabled. (if I remember correctly...)
Yep, that's correct. chkrootkit has issues doing this, but there's a patch which can be applied to make it smarter.
Dear All,
I have tested the prelink with yes and no option and verified the exe Size changes and revert it backup to default size
Thank you all
--Regards S.Balaji
On 6/21/07, Peter Kjellstrom cap@nsc.liu.se wrote:
Also related, rpm -V "sees past" prelink stuff and is able to verify files even with prelink enabled. (if I remember correctly...)
Yep, that's correct. chkrootkit has issues doing this, but there's a patch which can be applied to make it smarter.
-- During times of universal deceit, telling the truth becomes a revolutionary act. George Orwell _______________________________________________ CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos
-
balajisundar＠midascomm.com -
Jim Perrin -
Peter Kjellstrom