• Stars
    star
    102
  • Rank 335,584 (Top 7 %)
  • Language
    Objective-C
  • Created about 10 years ago
  • Updated about 10 years ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

Universal script packer-- transforms any type of script into a protected ELF executable, encrypted with anti-debugging.
Sherlocked v3. by [email protected] 2014 from Bitlackeys

About:
Sherlocked is a protector for scripts of any type. It uses a simple xor cipher
with a provided key. Unless '-r' option is used, the key is stored (encrypted)
within the binary and the binary will run without the user providing the key.
Sherlocked takes your script, encrypts it, and stores it in an output ELF x86_64
executable file. The ELF executable at runtime will decrypt the script and
temporarily write it to a random file in /tmp. It passes the script and cmdline
args to the interpreter, and then deletes the script. 

NOTE: Protected files that are also locked with a password (e.g. -r) won't accept
cmdline args. In other words you can't password protect your script and expect it
to take cmdline args. This is a temporary restriction due to my lazy programming
since there is no quick way to seperate the command line args from the password
you would have to give on the command line. If you don't like this, then implement
it yourself :)

Compile:
make

Usage:
./sherlocked <infile> <outfile> <key> <interpreter> [-r]

Options:
<infile> 	<-> The script file
<outfile> 	<-> The protected output file
<key>		<-> The key string used to encrypt the script
[-r] 		<-> Require the user who runs the protected executable supplies the key for it to run I.E ./script.elf <key>


More Repositories

1

libelfmaster

Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools
C
403
star
2

ftrace

POSIX Function tracing
C
323
star
3

skeksi_virus

Devestating and awesome Linux X86_64 ELF Virus
C
221
star
4

ecfs

extended core file snapshot format
C
219
star
5

maya

Highly advanced Linux anti-exploitation and anti-tamper binary protector for ELF.
C
151
star
6

dsym_obfuscate

Obfuscates dynamic symbol table
C
134
star
7

saruman

ELF anti-forensics exec, for injecting full dynamic executables into process image (With thread injection)
C
126
star
8

kdress

Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcore
C
121
star
9

binflow

This is the new ftrace (https://github.com/elfmaster/ftrace) - Much faster, better resolution but not complete yet! :)
C++
107
star
10

dt_infect

ELF Shared library injector using DT_NEEDED precedence infection. Acts as a permanent LD_PRELOAD
C
106
star
11

linker_preloading_virus

An example of hijacking the dynamic linker with a custom interpreter who loads and executes modular viruses
C
58
star
12

taskverse

A tool like /bin/ps but uses /proc/kcore for walking the tasklist; this finds hidden processes
C
56
star
13

libelfmaster_examples

Simple ELF tools written to demonstrate libelfmaster capabilities.
C
37
star
14

kprobe_rootkit

Linux kernel rootkit using kprobes (From http://phrack.org/issues/67/6.html)
C
35
star
15

ecfs_exec

Be able to execute memory snapshots so they can start running where they left off.
C
34
star
16

static_binary_mitigations

relros.c applies RELRO to static binaries, and static_to_dyn.c applies ASLR to static binaries.
C
32
star
17

shiva

Shiva is a programmable dynamic linker for loading ELF microprograms
Roff
29
star
18

davinci

Transforms any file into a protected ELF executable
C
26
star
19

scop_virus_paper

ELF Virus infection techniques that work with SCOP (Secure code partitioned) executables
C
14
star
20

fork_trace

C++
10
star
21

avu32

anti virus 32bit. my first attempt (in 2008) to write prototype for detecting/disinfecting unix ELF viruses
C
8
star
22

canaryism

Canaryism will tell you which functions are protected with gcc stack canaries
C
6
star
23

packt_book

C
6
star
24

interpx_documentation

4
star
25

shiva_blogposts

Multiple blogposts are maintained here.
3
star
26

shiva_presentations

2
star
27

unix_virus_anniversary

2
star
28

veriexec.linux

Veriexec implementation for Linux
C
2
star
29

poetry

Transcribing my poetry from 19yrs ago
1
star