1

This is in continuance to my previous question.

hash of libgmp.so changes automatically

I have developed a library and linked it to my process. It is required that my library should have same hash (from installation time), every time I link it with my process. My process always checks library's hash before doing anything else. My process is a daemon process and it gets started and stopped with script in initrd. I am always killing my process through "kill -9 myproc" command which send SIGKILL to process and forcefully terminates the process.

but it happens that sometimes my shared library file's hash gets changed when I stop and restart my process. It happens at random times and recently it is happening more frequently, due which my process does not start because of hash comparison condition that I coded in it.

I have taken dumps of both shared libraries i.e. right after installation and the changed version. I have used "objdump -d libmy.so" to take dumps. Here is a 'diff' screen shot of both dumps (yellow is original file and red is changed version):

enter image description here

I dont know much about elf file contents but it looks like that original file only had offsets and changed file has full address of instructions and functions. As a result, changed version of library is 2kb bigger than that of original.

Why is this happening? Does it has anything to do with SIGKILL signal which forces process to shutdown? If not, what can be the reason?

Any help would be appreciated.

Community
  • 1
  • 1
awatan
  • 1,182
  • 15
  • 33

1 Answers1

3

Why is this happening?

Most likely because you are on a RedHat, Fedora or CentOS system, and prelink is enabled (by default it prelinks all shared libraries on the system to a new random address every two weeks). When you stop/restart your daemon, it gets a new version of the library IF prelink ran since last time you started your daemon.

See these instructions on how to disable prelink.

Alternatively, modify your checksumming process to only pay attention to interesting sections, such as .text, .data, and .rodata, and ignore the rest.

Employed Russian
  • 199,314
  • 34
  • 295
  • 362