&gt; We cannot rule out possible infection methods, but it is highly unlikely that attackers will reliably insert a phony DT_NEEDED entry that is contiguous with the ones generated by the linker.<p>It seems pretty trivial to delete the DT_DEBUG entry, shift the entries in front of it forward by one, and then add a (now contiguous) DT_NEEDED entry.  That shouldn&#x27;t affect the offset of the GOT&#x2F;PLT segment.<p>Edit:  The Saruman backdoor injection detection at the end seems pretty simplistic too.  E.g. on FreeBSD you could arrive at the same data with just `procstat -kk pid_of_host`.