Re: HELP: Error at exploit.so: undefined symbol: __guard

[Matthew Watchinski <mwatchinski () sourcefire com>]

Not sure if this will fix it, but it's something to try.

In the make file that builds exploit.so try adding -fno-stack-protector
to the CFLAGS line.

-matt

Rachmat Hidayat Al-Anshar wrote:
> Hi guys, there is something that I have to know about so_rules..
>
> # cd /usr/include/pcre
> # cp * /etc/snort/so_rules
> # cd /etc/snort/so_rules
> # make
> # cat *.rules > so.rules
> # cp so.rules /etc/snort/rules
> # cd /etc/snort/rules 
> # chmod 644 so.rules
>
> # mkdir -p /usr/local/lib/snort_dynamicrule
> # cp *.so /usr/local/lib/snort_dynamicrule
> # cd /usr/local/lib/snort_dynamicrule
> # chmod 755 *
>
> # vi /etc/snort/snort.conf
>     ..(appending these)...
>     dynamiclibrary directory /usr/local/lib/snort_dynamicrule
>     include $RULE_PATH/so.rules
>
> # snort -c /etc/snort/snort.conf
>
> This message suddenly occur:
> ...
> Loading dynamic detection library /usr/local/lib/snort_dynamicrule//exploit.so...
> ERROR: Failed to load /usr/local/lib/snort_dynamicrule//exploit.so: /usr/local/li
> b/snort_dynamicrule//exploit.so: undefined symbol: __guard
> Fatal Error, Quitting..
>
> There is someone could tell me what happen?
> How to solve this?
>
> Thanks in advance
> ~ Mat (^^) ~
>
>
>
>
>       ____________________________________________________________________________________
> Be a better pen pal. 
> Text or chat with friends inside Yahoo! Mail. See how.  http://overview.mail.yahoo.com/
>
>
> ------------------------------------------------------------------------
>
> -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
>
>
> ------------------------------------------------------------------------
>
> _______________________________________________
> Snort-users mailing list
> Snort-users () lists sourceforge net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
_______________________________________________
Snort-users mailing list
Snort-users () lists sourceforge net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users