XZ Utils Made Me Paranoid

This post describes the development of VerifyELF, a tool to detect in-memory function hooks and backdoored shared objects (motivated by the XZ Utils backdoor). The author outlines parsing ELF binaries, applying relocations, comparing on-disk sections with process memory (including GOT checks), demonstrates detection of an accept() backdoor, and discusses limitations (ptrace/root requirement, container/snap path issues, WTEXT false positives) and future defensive uses.