If you get told that an intruder may have recompiled, say apache, to run a bunch of extra things, adn you want to check that, how far will ldd get you? You will be able to see if it uses any unusual libraries I expect.

However, if the the extra "things" just use libc well then, it's a very weak check, right? But what other tools are available to check in situations like that?

lsof -p pid could be a good check.
would show all modules being used as well as ports and all files being used by the given pid.

strace -p pid will trace the system calls of the pid.


and snoopy will also tell you everything the httpd executable might be up to

It needs to be installed and ld.preloaded before the application to be investigated is executed.


Like you indicated yourself: "it depends". BTW if the investigator runs code outside an isolated environment then also see some old thoughts about doing that in Compromising analysis tools.


In investigations expectations and assumptions are (or should be considered) pitfalls as they colour your view. First port of call however should be to log MAC data, hash the binary and compare it to a known good copy so you know it's tampered with. Do note that while examining a root-owned binary is nice it doesn't cover the more important act of somebody replacing root-owned binaries.


objdump, nm, readelf, The Examiner, fakebust, strings and whatnot.

Don't run ldd on any "dodgy executable" because many known exploits exist if you do this. Well, they're not really exploits, but code can be run.

I'd like to thank centosboy, unSpawn and H_TeXMeX_H
for the very helpful remarks.
I will read several times over.
Cheers!!!!!