Jan Engelhardt wrote:
>>>Well you could patch the affected plugin's .dynstr table so that it should at
>>>best try to call a function that has not yet been defined somewhere else (like
>>>open); IOW, you change the .dynstr entry from 'open' to say 'my_open', and
>>>regularly include libmy.so through e.g. LD_PRELOAD.
>>>
>>>Of course the MD5 won't match afterwards, but I think the plugin should execute
>>>as usual afterwards, since .dynstr is something no app should rely on.
>>
>>Is this likely to work with an app like Skype that takes extensive steps
>>to thwart reverse engineers?
> 
> 
> We do not reverse engineer the .text section, but change the .dynstr 
> section that is specific to the ELF format. I doubt any app out there md5s 
> itself.

There is at least one. True that it doesn't do sound (it's an antivirus
scanner for mailservers :)) but regardless, it checksums the whole
thing.

// Stefan