[Snort-users] HELP: Error at exploit.so: undefined symbol: __guard

Rachmat Hidayat Al-Anshar rachmat_hidayat_02 at ...131...
Sat Nov 17 13:34:36 EST 2007


Hi Matthew, 
Thanks for ur responses.
I'll try it.

Any other response will be greatful appreciated.



Cheers 

~Mat(^^)~



----- Original Message ----
From: Matthew Watchinski <mwatchinski at ...1935...>
To: Rachmat Hidayat Al-Anshar <rachmat_hidayat_02 at ...131...>
Cc: snort <Snort-users at lists.sourceforge.net>
Sent: Sunday, November 18, 2007 12:41:26 AM
Subject: Re: [Snort-users] HELP: Error at exploit.so: undefined symbol: __guard


Not sure if this will fix it, but it's something to try.

In the make file that builds exploit.so try adding -fno-stack-protector
to the CFLAGS line.

-matt

Rachmat Hidayat Al-Anshar wrote:
> Hi guys, there is something that I have to know about so_rules..
> 
> # cd /usr/include/pcre
> # cp * /etc/snort/so_rules
> # cd /etc/snort/so_rules
> # make
> # cat *.rules > so.rules
> # cp so.rules /etc/snort/rules
> # cd /etc/snort/rules 
> # chmod 644 so.rules
> 
> # mkdir -p /usr/local/lib/snort_dynamicrule
> # cp *.so /usr/local/lib/snort_dynamicrule
> # cd /usr/local/lib/snort_dynamicrule
> # chmod 755 *
> 
> # vi /etc/snort/snort.conf
>     ..(appending these)...
>     dynamiclibrary directory /usr/local/lib/snort_dynamicrule
>     include $RULE_PATH/so.rules
> 
> # snort -c /etc/snort/snort.conf
> 
> This message suddenly occur:
> ...
> Loading dynamic detection library
 /usr/local/lib/snort_dynamicrule//exploit.so...
> ERROR: Failed to load /usr/local/lib/snort_dynamicrule//exploit.so:
 /usr/local/li
> b/snort_dynamicrule//exploit.so: undefined symbol: __guard
> Fatal Error, Quitting..
> 
> There is someone could tell me what happen?
> How to solve this?
> 
> Thanks in advance
> ~ Mat (^^) ~
> 
> 
> 
> 
>      
 ____________________________________________________________________________________
> Be a better pen pal. 
> Text or chat with friends inside Yahoo! Mail. See how.
  http://overview.mail.yahoo.com/
> 
> 
>
 ------------------------------------------------------------------------
> 
>
 -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
> 
> 
>
 ------------------------------------------------------------------------
> 
> _______________________________________________
> Snort-users mailing list
> Snort-users at lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users







      ____________________________________________________________________________________
Never miss a thing.  Make Yahoo your home page. 
http://www.yahoo.com/r/hs
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.snort.org/pipermail/snort-users/attachments/20071117/189a0780/attachment.html>


More information about the Snort-users mailing list