elfmaster/packt_book

Stars
6
Rank 2,539,965 (Top 51 %)
Language
C
Created over 8 years ago
Updated over 8 years ago

elfmaster/packt_book

elfmaster

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

libelfmaster

Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools

ftrace

POSIX Function tracing

skeksi_virus

Devestating and awesome Linux X86_64 ELF Virus

ecfs

extended core file snapshot format

maya

Highly advanced Linux anti-exploitation and anti-tamper binary protector for ELF.

dsym_obfuscate

Obfuscates dynamic symbol table

saruman

ELF anti-forensics exec, for injecting full dynamic executables into process image (With thread injection)

kdress

Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcore

binflow

This is the new ftrace (https://github.com/elfmaster/ftrace) - Much faster, better resolution but not complete yet! :)

dt_infect

ELF Shared library injector using DT_NEEDED precedence infection. Acts as a permanent LD_PRELOAD

sherlocked

Universal script packer-- transforms any type of script into a protected ELF executable, encrypted with anti-debugging.

linker_preloading_virus

An example of hijacking the dynamic linker with a custom interpreter who loads and executes modular viruses

taskverse

A tool like /bin/ps but uses /proc/kcore for walking the tasklist; this finds hidden processes

libelfmaster_examples

Simple ELF tools written to demonstrate libelfmaster capabilities.

kprobe_rootkit

Linux kernel rootkit using kprobes (From http://phrack.org/issues/67/6.html)

ecfs_exec

Be able to execute memory snapshots so they can start running where they left off.

static_binary_mitigations

relros.c applies RELRO to static binaries, and static_to_dyn.c applies ASLR to static binaries.

shiva

Shiva is a programmable dynamic linker for loading ELF microprograms

davinci

Transforms any file into a protected ELF executable

scop_virus_paper

ELF Virus infection techniques that work with SCOP (Secure code partitioned) executables

fork_trace

avu32

anti virus 32bit. my first attempt (in 2008) to write prototype for detecting/disinfecting unix ELF viruses

canaryism

Canaryism will tell you which functions are protected with gcc stack canaries

interpx_documentation

shiva_blogposts

Multiple blogposts are maintained here.

shiva_presentations

unix_virus_anniversary

veriexec.linux

Veriexec implementation for Linux

poetry

Transcribing my poetry from 19yrs ago