XALT: Lessons from attaching to almost every program in Linux
summary
XALT is an LGPL open-source tool that uses LD_PRELOAD to attach a shared library into virtually every Linux program on a cluster, allowing code to run before and after main() to record what programs and libraries are executed. The talk covers practical lessons learned about symbol/routine name handling, memory usage implications of injecting the library, and additional challenges when using XALT inside containers due to differing available shared libraries.
AI-written summary · about
related talks
50mShared Libraries in Windows and Linux
01h 04mThe Bits Between the Bits: How We Get to main()
47mZombie Ant Farming: Practical Tips for Playing Hide and Seek with Linux EDRs
01h 02mSandboxing a Linux Application
27mThe Art and Craft of No-touch Instrumentation
31mAmong ELFs and DWARFs
18mLITESHIELD: Secure Containers via Lightweight, Composable Userspace μKernel...
58mExploiting Linux and Pax ASLR's Weaknesses on 32-Bit and 64-Bit Systems