from what i gather they pass the pipename into smb_probe_module which ends up calling dlopen status = smb_probe_module("rpc", pipename); my guess is you c

from what i gather they pass the pipename into smb_probe_module which ends up calling dlopen status = smb_probe_module("rpc", pipename); my guess is you can either pass in a pipename starting with / which will cause it to be treated absolutely or ../../ which will cause dlopen to do a relative lookup