There are no reviews yet. Be the first to send feedback to the community and the maintainers!
Sherlocked v3. by [email protected] 2014 from Bitlackeys About: Sherlocked is a protector for scripts of any type. It uses a simple xor cipher with a provided key. Unless '-r' option is used, the key is stored (encrypted) within the binary and the binary will run without the user providing the key. Sherlocked takes your script, encrypts it, and stores it in an output ELF x86_64 executable file. The ELF executable at runtime will decrypt the script and temporarily write it to a random file in /tmp. It passes the script and cmdline args to the interpreter, and then deletes the script. NOTE: Protected files that are also locked with a password (e.g. -r) won't accept cmdline args. In other words you can't password protect your script and expect it to take cmdline args. This is a temporary restriction due to my lazy programming since there is no quick way to seperate the command line args from the password you would have to give on the command line. If you don't like this, then implement it yourself :) Compile: make Usage: ./sherlocked <infile> <outfile> <key> <interpreter> [-r] Options: <infile> <-> The script file <outfile> <-> The protected output file <key> <-> The key string used to encrypt the script [-r] <-> Require the user who runs the protected executable supplies the key for it to run I.E ./script.elf <key>
libelfmaster
Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering toolsftrace
POSIX Function tracingskeksi_virus
Devestating and awesome Linux X86_64 ELF Virusecfs
extended core file snapshot formatmaya
Highly advanced Linux anti-exploitation and anti-tamper binary protector for ELF.dsym_obfuscate
Obfuscates dynamic symbol tablesaruman
ELF anti-forensics exec, for injecting full dynamic executables into process image (With thread injection)kdress
Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcorebinflow
This is the new ftrace (https://github.com/elfmaster/ftrace) - Much faster, better resolution but not complete yet! :)dt_infect
ELF Shared library injector using DT_NEEDED precedence infection. Acts as a permanent LD_PRELOADlinker_preloading_virus
An example of hijacking the dynamic linker with a custom interpreter who loads and executes modular virusestaskverse
A tool like /bin/ps but uses /proc/kcore for walking the tasklist; this finds hidden processeslibelfmaster_examples
Simple ELF tools written to demonstrate libelfmaster capabilities.kprobe_rootkit
Linux kernel rootkit using kprobes (From http://phrack.org/issues/67/6.html)ecfs_exec
Be able to execute memory snapshots so they can start running where they left off.static_binary_mitigations
relros.c applies RELRO to static binaries, and static_to_dyn.c applies ASLR to static binaries.shiva
Shiva is a programmable dynamic linker for loading ELF microprogramsdavinci
Transforms any file into a protected ELF executablescop_virus_paper
ELF Virus infection techniques that work with SCOP (Secure code partitioned) executablesfork_trace
avu32
anti virus 32bit. my first attempt (in 2008) to write prototype for detecting/disinfecting unix ELF virusescanaryism
Canaryism will tell you which functions are protected with gcc stack canariespackt_book
interpx_documentation
shiva_blogposts
Multiple blogposts are maintained here.shiva_presentations
unix_virus_anniversary
veriexec.linux
Veriexec implementation for Linuxpoetry
Transcribing my poetry from 19yrs agoLove Open Source and this site? Check out how you can help us