Re: [Snort-users] HELP: Error at exploit.so: undefined symbol: __guard

Hi Matt !!

It's working, I'm trying to..

1. modification the make file
# vi +14 /etc/snort/so_rules/Makefile
    add the "-fno-stack-protector" (to the CFLAGS argument)

2. re-make the so_rules, 
3. testing it

there is no error message occurred!!!
hope this can make it functionally working (^^!) ...

Thanks a million
Cheers 
~Mat(^^)~
    


----- Original Message ----
From: Matthew Watchinski <mwatchinski@sourcefire.com>
To: Rachmat Hidayat Al-Anshar <rachmat_hidayat_02@yahoo.com>
Cc: snort <Snort-users@lists.sourceforge.net>
Sent: Sunday, November 18, 2007 12:41:26 AM
Subject: Re: [Snort-users] HELP: Error at exploit.so: undefined symbol: __guard


Not sure if this will fix it, but it's something to try.

In the make file that builds exploit.so try adding -fno-stack-protector
to the CFLAGS line.

-matt

Rachmat Hidayat Al-Anshar wrote:
> Hi guys, there is something that I have to know about so_rules..
>
> # cd /usr/include/pcre
> # cp * /etc/snort/so_rules
> # cd /etc/snort/so_rules
> # make
> # cat *.rules > so.rules
> # cp so.rules /etc/snort/rules
> # cd /etc/snort/rules 
> # chmod 644 so.rules
>
> # mkdir -p /usr/local/lib/snort_dynamicrule
> # cp *.so /usr/local/lib/snort_dynamicrule
> # cd /usr/local/lib/snort_dynamicrule
> # chmod 755 *
>
> # vi /etc/snort/snort.conf
>     ..(appending these)...
>     dynamiclibrary directory /usr/local/lib/snort_dynamicrule
>     include $RULE_PATH/so.rules
>
> # snort -c /etc/snort/snort.conf
>
> This message suddenly occur:
> ...
> Loading dynamic detection library
 /usr/local/lib/snort_dynamicrule//exploit.so...
> ERROR: Failed to load /usr/local/lib/snort_dynamicrule//exploit.so:
 /usr/local/li
> b/snort_dynamicrule//exploit.so: undefined symbol: __guard
> Fatal Error, Quitting..
>
> There is someone could tell me what happen?
> How to solve this?
>
> Thanks in advance
> ~ Mat (^^) ~
>
>
>
>
>      
 
____________________________________________________________________________________
> Be a better pen pal. 
> Text or chat with friends inside Yahoo! Mail. See how.
  http://overview.mail.yahoo.com/
>
 ------------------------------------------------------------------------
>
 -------------------------------------------------------------------------
> This SF.net email is sponsored by: Microsoft
> Defy all challenges. Microsoft(R) Visual Studio 2005.
> http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
 ------------------------------------------------------------------------
> _______________________________________________
> Snort-users mailing list
> Snort-users@lists.sourceforge.net
> Go to this URL to change user options or unsubscribe:
> https://lists.sourceforge.net/lists/listinfo/snort-users
> Snort-users list archive:
> http://www.geocrawler.com/redir-sf.php3?list=snort-users







      
____________________________________________________________________________________
Be a better pen pal. 
Text or chat with friends inside Yahoo! Mail. See how.  
http://overview.mail.yahoo.com/

-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

_______________________________________________
Snort-users mailing list
Snort-users@lists.sourceforge.net
Go to this URL to change user options or unsubscribe:
https://lists.sourceforge.net/lists/listinfo/snort-users
Snort-users list archive:
http://www.geocrawler.com/redir-sf.php3?list=snort-users