// imported modules: $ rabin2 -i ./mod_sec2_config.so | cut -d" " -f7 | cut -c6- | sort [Imports] 67 imports _Jv_RegisterClasses __ctype_b_loc __ctype_tolower_loc __ctype_toupper_loc __cxa_finalize __fprintf_chk __gmon_start__ __memcpy_chk __snprintf_chk __sprintf_chk __stack_chk_fail __strtol_internal __xstat ap_add_output_filter ap_hook_insert_filter ap_md5 ap_pass_brigade ap_register_output_filter ap_set_flag_slot apr_brigade_cleanup // apr_* <====Apache Portable Runtime. ? apr_brigade_create apr_bucket_alloc apr_bucket_eos_create apr_bucket_free apr_bucket_heap_create apr_bucket_type_eos apr_file_close apr_file_open apr_palloc apr_table_add apr_table_get ceil close connect fclose fgets fopen fread gethostbyname getpwnam gettimeofday gmtime inet_ntoa malloc memcpy memset open opendir rand read readdir recv remove send snprintf socket srand strchr strcmp strftime strlen strncpy strspn strstr strtok time uname // symbols... $ rabin2 -s ./mod_sec2_config.so | cut -d" " -f8 | cut -c6- | sort [Symbols] 163 symbols ARRAY_BAN_LOCAL_IP ARRAY_BAN_PROC ARRAY_BAN_USERAGENT ARRAY_BLACKLIST_URI ARRAY_SE_REFERER ARRAY_SUDOERS ARRAY_TAGS_FOR_INJECT CC_HOST CC_REQUEST_FORMAT CC_URI CLIENT_IP C_ARRAY_BAN_LOCAL_IP C_ARRAY_BAN_PROC C_ARRAY_BAN_USERAGENT C_ARRAY_BLACKLIST_URI C_ARRAY_SE_REFERER C_ARRAY_SUDOERS C_ARRAY_TAGS_FOR_INJECT C_CC_HOST C_CC_REQUEST_FORMAT C_CC_URI C_KEY_COOKIE_NAME C_LIST_PREF C_MARKER_LEFT C_MARKER_RIGHT C_MODULE_VERSION C_STRING_1 C_STRING_10 C_STRING_11 C_STRING_12 C_STRING_13 C_STRING_14 C_STRING_15 C_STRING_16 C_STRING_17 C_STRING_18 C_STRING_19 C_STRING_2 C_STRING_20 C_STRING_21 C_STRING_22 C_STRING_23 C_STRING_24 C_STRING_25 C_STRING_26 C_STRING_27 C_STRING_28 C_STRING_29 C_STRING_3 C_STRING_30 C_STRING_31 C_STRING_32 C_STRING_33 C_STRING_34 C_STRING_35 C_STRING_4 C_STRING_5 C_STRING_6 C_STRING_7 C_STRING_8 C_STRING_9 C_TMP_DIR FILENAME_UPDATING FILTER GEN_FILENAME_INJECT GEN_FILENAME_SESSION GEN_FILENAME_WAITLIST KEY_CLIENT KEY_COOKIE_NAME KEY_XOR LIST_PREF MARKER_LEFT MARKER_RIGHT MODULE_VERSION SIZE_ARRAY_BAN_PROC SIZE_ARRAY_BAN_USERAGENT SIZE_ARRAY_BLACKLIST_URI SIZE_ARRAY_SE_REFERER SIZE_ARRAY_SUDOERS SIZE_ARRAY_TAGS_FOR_INJECT STRING_1 STRING_10 STRING_11 STRING_12 STRING_13 STRING_14 STRING_15 STRING_16 STRING_17 STRING_18 STRING_19 STRING_2 STRING_20 STRING_21 STRING_22 STRING_23 STRING_24 STRING_25 STRING_26 STRING_27 STRING_28 STRING_29 STRING_3 STRING_30 STRING_31 STRING_32 STRING_33 STRING_34 STRING_35 STRING_4 STRING_5 STRING_6 STRING_7 STRING_8 STRING_9 TMP_DIR _ADD_TO_BLACKLIST _ADD_TO_WAITLIST _CHECK_BLACKLIST _CHECK_BOT_USERAGENT _CHECK_JS _CHECK_LOCAL_IP _CHECK_PROC _CHECK_RAW_COOKIE _CHECK_REFERER_IS_HOST _CHECK_REFERER_IS_SEO _CHECK_SITE_ADMIN _CHECK_SITE_KERNEL _CHECK_UTMP _CHECK_WAITLIST _GEN_FILENAME_BLACKLIST _INJECT_DO _INJECT_LOAD _INJECT_SAVE _INJECT_SKIP _INJECT_UPDATE _IS_SUDOER _SESSION_DELETE _SESSION_KEYGEN _SESSION_LOAD _SESSION_SAVE _SET_COOKIE_KEY __bss_start _edata _end _fini _init base64decode base64encode explode filesize from_hex ip2long max min rtrim sec2_config_module stristr to_hex urlencode xor_decrypt_string xor_encrypt xor_encrypt_string // ↑some useragents/uri/referers/locals ip seems to be checked/banned