• 
• [index]
• [about me]
• [debian]
• [software]
• [security]
• [studies]
• [contact]

What is libstrstd.so?

A few years ago I found on my system a mysterious file called /usr/lib/libstrstd.so.104.

I say "mysterious" because its name suggests it is a shared library called "strstd" whose ABI version is 104, however in fact it is not a library. Moreover I was not able to find any evidence of such library anywhere on the Internet. The only mentions of such file are from people who, like me, wondered what this file is — see below.

So far I have not figured out where it came from, so if you have any information about it, please contact me.

Here is what I managed to find out so far:

• on my system the file was created on 2005-09-28 21:47:40 +0100. Unfortunately I do not remember what I was doing at that moment.
• the file was in a directory to which only root can write (/usr/lib), which suggests it was created by an installer or another program running as root
• despite the name, it is not a shared library — the file is too small and does not contain a valid ELF header
• when ldconfig(8) encounters this file, it generates an error message:

  ldconfig: /usr/lib/libstrstd.so.104 is not an ELF file - it has the wrong magic bytes at the start.

• on my system the file has 362 bytes, MD5 sum of 515f3ea9d4d66c4738844a1bba76c779 and the following contents:

  00000000  00 bc 61 79 eb 0b 93 43  f7 d4 1a cb 2d c8 60 93  |..ay...C....-.`.|
  00000010  17 39 51 e9 74 9c 5c b0  53 12 a3 7f 65 e9 f9 d9  |.9Q.t.\.S...e...|
  00000020  f2 da 62 ed b8 6c 72 60  67 82 36 58 ca 69 26 00  |..b..lr`g.6X.i&.|
  00000030  00 01 06 9e 7d 8f 2b c9  b2 15 64 12 50 c4 ae 36  |....}.+...d.P..6|
  00000040  fc f2 f2 fa 8b 31 41 fd  f2 aa c9 a6 6d 31 80 49  |.....1A.....m1.I|
  00000050  e8 56 99 fa 8e f0 2f 6e  d3 08 fd e8 e7 54 c6 64  |.V..../n.....T.d|
  00000060  90 a2 5a fb a4 9a 6b ea  1f e4 7f a1 95 db a6 f8  |..Z...k.........|
  00000070  ae 6c f7 6c fe f2 97 ed  b0 d0 ac cf de 38 a8 e4  |.l.l.........8..|
  00000080  54 57 32 61 e0 da 43 01  12 7c 3e 48 90 f6 24 bd  |TW2a..C..|>H..$.|
  00000090  31 85 11 27 94 57 d3 b9  67 6e 3d bb f0 ad 03 77  |1..'.W..gn=....w|
  000000a0  11 9f 6b a8 a0 83 2f cc  8b 75 8e 76 11 fe cc 2f  |..k.../..u.v.../|
  000000b0  aa 2d 01 44 3a df e7 69  78 1e 5a 51 69 13 fa ff  |.-.D:..ix.ZQi...|
  000000c0  94 4b 2b 3b fc b3 33 7c  ea e0 27 0d a0 94 eb 2f  |.K+;..3|..'..../|
  000000d0  99 f3 34 43 d3 7f f9 e1  45 e1 0d 9a ab 08 a2 9e  |..4C....E.......|
  000000e0  2f 6f 04 60 3d 9b ed 1c  b6 6c 00 a6 19 0a 4e d9  |/o.`=....l....N.|
  000000f0  41 a9 0e a4 b3 8e 38 ed  99 93 5a b2 ad db 5f 0d  |A.....8...Z..._.|
  00000100  35 69 e6 90 63 cb 28 fd  1a 86 6b 38 2c 32 23 39  |5i..c.(...k8,2#9|
  00000110  2a ba 55 a8 21 bb 7a a6  1e 97 6a b4 76 47 6d 72  |*.U.!.z...j.vGmr|
  00000120  81 02 10 d8 9f 5b fd f3  63 09 ee 67 db 8a b0 c4  |.....[..c..g....|
  00000130  9f 8f ef 1d dc d8 08 ac  e5 0a 1f 58 a7 82 2a 99  |...........X..*.|
  00000140  f0 99 99 68 da da 9f 7d  83 82 a7 2a fe b2 15 3a  |...h...}...*...:|
  00000150  2e 05 90 ec 93 7a 6b 62  e2 93 fc a4 ef 9d 12 46  |.....zkb.......F|
  00000160  e2 60 68 08 2d 12 4d 26  91 fd                    |.`h.-.M&..|
  0000016a
  

• a similar file found on the internet has the same size, an MD5 sum of c8894877884451714b1270b22d590b91 and the following, different contents, although it starts with similar values:

  00000000  00 bc 61 7d 07 6c 36 2f  e9 5c 22 66 56 28 cc c8  |..a}.l6/.\"fV(..|
  00000010  d6 ed 17 ea 09 cf 4b c3  a3 ec 8d 27 f7 14 10 4c  |......K....'...L|
  00000020  b0 31 1b 6a 08 34 9b 05  a1 25 76 96 f2 31 c7 74  |.1.j.4...%v..1.t|
  00000030  60 97 e3 00 00 00 f7 07  18 c8 2f 42 cc 27 a2 10  |`........./B.'..|
  00000040  38 7e 64 0d 50 86 bf 79  26 8c cb d7 be 6b 43 34  |8~d.P..y&....kC4|
  00000050  e7 b4 69 2a be fb cf 89  42 a8 93 e3 bb 16 19 9b  |..i*....B.......|
  00000060  9b 42 04 18 80 1d 50 2f  dc 34 de 08 2a 6f 87 ef  |.B....P/.4..*o..|
  00000070  2e 2d 85 28 a5 52 d8 98  23 ac 42 40 50 d2 5a 18  |.-.(.R..#.B@P.Z.|
  00000080  30 fe 90 1c 7c 07 8f f0  b7 97 56 26 e2 3c 8c 26  |0...|.....V&.<.&|
  00000090  ea e1 f2 32 46 7a 9a d6  4b 71 fb 29 db 48 6d 53  |...2Fz..Kq.).HmS|
  000000a0  9f 32 d4 be 2c 1f 96 98  86 69 17 5e 90 b4 35 61  |.2..,....i.^..5a|
  000000b0  15 f4 ca 49 73 cf 65 0a  2a 39 d9 23 01 c7 f9 0c  |...Is.e.*9.#....|
  000000c0  53 03 56 cd ed 37 b0 93  77 60 05 52 71 25 b2 59  |S.V..7..w`.Rq%.Y|
  000000d0  ab fe 85 eb b2 3a ed 6b  d1 78 cd dc 37 ee 72 f5  |.....:.k.x..7.r.|
  000000e0  fa 29 fe 1c 10 38 8c 64  a0 7c 98 26 d6 2c 79 8d  |.)...8.d.|.&.,y.|
  000000f0  2e d3 68 eb bf 72 81 80  77 29 2d 07 4b fb 92 a0  |..h..r..w)-.K...|
  00000100  08 fb 2e a7 59 03 c9 e1  77 e0 1d 9a a6 e4 d7 e2  |....Y...w.......|
  00000110  22 46 fb bd 08 0f 61 eb  f5 a8 67 09 dc 5c ec 06  |"F....a...g..\..|
  00000120  33 7a 8c 59 80 35 24 70  5a 39 2c b4 da 61 64 49  |3z.Y.5$pZ9,..adI|
  00000130  92 0b dc 2b 30 6a 08 30  4b 2a 89 4d dd 99 86 47  |...+0j.0K*.M...G|
  00000140  f8 7e e1 fa b3 ac d5 fc  09 b8 0c 4b 00 83 f2 ec  |.~.........K....|
  00000150  89 a3 83 53 8c 54 ab 98  19 b6 6a 47 16 88 c1 e0  |...S.T....jG....|
  00000160  15 e9 d4 c4 12 e4 e1 a2  27 99                    |........'.|
  0000016a
  

• the file is not recognized by the file(1) utility
• the file is not recognized as a malware by ClamAV 0.94.dfsg.2-1ubuntu0.3~hardy4 with database version 9434

I have found the following mentions of similar files on the Internet:

Last modification of this page: 2009-06-06 17:14:22 UTC