How does xz's backdoor rewrite the entry of RSA_public_decrypt@....plt ?

I read some articles about the attack.

[https://openwall.com/lists/oss-security/2024/03/29/4](https://openwall.com/lists/oss-security/2024/03/29/4)

[https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27](https://gist.github.com/thesamesam/223949d5a074ebc3dce9ee78baad9e27)

The first article refers to hack glibc IFUNC resolver and hooks to the dynamic linker (ld-linux.so?).

As a result, importantly, calls to RSA\_public\_decrypt redirects to malicious code.

But I dont understand how attackers register hooks into the dynamic linker. I heard that the malicious function analyzes the symbol table.

Someone can explain it?

article articles attack attackers backdoor code cybersecurity dynamic entry glibc hack linux malicious redirects register resolver result rsa understand