Awesome ELF Resources

                       ┌───────────────────────┐                            
                       ▄▄▄▄▄ ▄▄▄▄▄ ▄▄▄▄▄       │                            
                       │ █   █ █ █ █   █       │                            
                       │ █   █ █ █ █▀▀▀▀       │                            
                       │ █   █   █ █     ▄     │                            
                       │                 ▄▄▄▄▄ │                            
                       │                 █   █ │                            
                       │                 █   █ │                            
                       │                 █▄▄▄█ │                            
                       │                 ▄   ▄ │                            
                       │                 █   █ │                            
                       │                 █   █ │                            
                       │                 █▄▄▄█ │                            
                       │                 ▄▄▄▄▄ │                            
                       │                   █   │                            
                       │                   █   │                            
                       └───────────────────█ ──┘ 

TMP.0UT stands on the shoulders of giants, and we lend a hand for the next generation of giants to stand on ours.

This repo contains an appendix of resources and links to our own work and the work of others.

If you see your work cited here and would like us to credit in a more specific way, please let us know!

A collection of awesome ELF resources

Your contributions are always welcome !

Awesome Repositories

ELF binary format

• Amos on ELF packers

  • Making your own executable packer - 18 part series

• Aprodu Andrei Ciprian and ELF linking process

  • Interactive Exploration of the Process of Linking Executables
  • ELF_Detective

• Brian Raiter's essays on tiny ELF (1999)

  • Guide about creating tiny ELF
  • Return 42 collection
  • Usefull tiny programs

• Bx and the ELF metadata

  • Returning from ELF to Libc by Bx
  • “Weird Machines” in ELF by Bx

• David Smith and Handmade ELFs

  • Handmade Linux x86 executables

• elfmaster and everything about ELF

  • ELF shared library injection forensics
  • Secure ELF parsing/loading library
  • ... and examples
  • Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcore
  • fork-trace
  • extended core file snapshot format and exec
  • Obfuscates dynamic symbol table
  • ftrace and new ftrace
  • hidden process /bin/ps
  • davinci
  • sherlocked
  • Modern Day ELF Runtime infection via GOT poisoning

• Ignacio Sanmillan / Paul Litvak and ELF 101

  • Executable and Linkable Format 101 - Part 1 Sections and Segments
  • Executable and Linkable Format 101 - Part 2: Symbols
  • Executable and Linkable Format 101 - Part 3: Relocations
  • Executable and Linkable Format 101 - Part 4: Dynamic Linking

• Ignat Korchagin and object files

  • How to execute an object file: Part 1
  • How to execute an object file: Part 2
  • How to execute an object file: Part 3

• Keith Makan ELF Format Series

  • Introduction to the ELF Format (Part I): The ELF Header
  • Introduction to the ELF Format (Part II): Understanding Program Headers
  • Introduction to the ELF Format (Part III): The Section Headers
  • Introduction to the ELF Format (Part IV): Exploring Section Types and Special Sections
  • Introduction to the ELF Format (Part V): Understanding C start up .init_array and .fini_array sections
  • Introduction to the ELF Format (Part VI): The Symbol Table and Relocations (1)
  • Introduction to the ELF Format (Part VI): The Symbol Table and Relocations (2)
  • Introduction to the ELF Format (Part VI): More Relocation tricks - r_addend execution (3)
  • Introduction to the ELF Format (Part VII): Dynamic Linking / Loading and the .dynamic section

• charngda ELF Format reference (mirror)

• Linux Foundation Referenced Specifications

• Manu Garg and ELF Auxiliary Vectors

  • About ELF Auxiliary Vectors

• MaskRay and ELF interposition

  • ELF interposition and -Bsymbolic

• netspooky and ELF Binary Mangling

  • ELF Binary Mangling Part 1: Concepts
  • Elf Binary Mangling Part 2: Golfin'
  • Elf Binary Mangling Part 3: Weaponization
  • Elf Binary Mangling Part 4: Limit Break

• Orlando Padilla and binary parsers

  • Analyzing Common Binary Parser Mistakes

• Patrick Horgan and main()

  • How the heck do we get to main()?

• Robin Hoksbergen and Manually Creating An ELF

  • Manually Creating An ELF Executable

• Samuel A. Falvo II and ELF

  • On ELF, Part 1
  • On ELF, Part 2

• richinseattle - Hooking the Linux ELF Loader

• Tools

  • BioDiff - hex diff viewer
  • clodl: self-contained dynamic libraries
  • d0zer - ELF infector written in Go
  • elfcat - ELF visualizer
  • Embuche - Anti reverse compiling tool
  • Hellf - ELF patching lib in Python
  • Hexyl - hexdumper with colors
  • lief
  • Macaw - binary analysis framework(ELF/DWARF/more)
  • PatchELF - a simple utility for modifying existing ELF executables and libraries
  • PLTHook - utility library to hook library function calls
  • StaticX
  • The Backdoor Factory
  • xELFViewer - ELF file viewer
  • pyelftools - Parsing ELF and DWARF in Python
  • GNU poke - an interactive, extensible editor for binary data
  • fq - jq for binary formats
  • ImHex - a hex editor for reverse engineers
  • Binsider
    • Binsider is a TUI tool written in Rust that can perform static and dynamic analysis, inspect strings, examine linked libraries, and perform hexdumps.

ELF VX technology

• TMZ

  • Linux.Midrashim: Assembly x64 ELF virus
  • Linux.Nasty: Assembly x64 ELF virus
  • Ezuri: Linux ELF Runtime Crypter
  • Running ELF executables from memory
  • Linux.Fe2O3: a Rust virus
  • Linux.Cephei: a Nim virus
  • Linux.Liora: a Go virus
  • Linux.Zariche: a Vala virus

• elfmaster and ELF vx

  • Devestating and awesome Linux X86_64 ELF Virus
  • ELF Shared library injector using DT_NEEDED precedence infection
  • ELF Virus infection techniques that work with SCOP
  • Saruman - ELF anti-forensics exec
  • AV prototype - 32bit
  • LK rootkit
  • Shiva micropatching system
    • About Shiva
    • Source
    • DEFCON 31 Talk
      • Video
      • Slides

• Peter Ferrie and Flibi

  • FLIBI: EVOLUTION
  • FLIBI: RELOADED

• Shane tully on ELF vx

  • Writing a Self-Mutating x86_64 C Program

• Shreyansh Singh and ELF-Miner

  • Paper: ELF-Miner: using structural knowledge and data mining methods to detect new (Linux) malicious executables
  • Code

• TheXcellerator and Linux Rootkits

  • Linux Rootkits Part 1: Introduction and Workflow
  • Linux Rootkits Part 2: Ftrace and Function Hooking
  • Linux Rootkits Part 3: A Backdoor to Root
  • Linux Rootkits Part 4: Backdooring PRNGs by Interfering with Char Devices
  • Linux Rootkits Part 5: Hiding Kernel Modules from Userspace
  • Linux Rootkits Part 6: Hiding Directories
  • Linux Rootkits Part 7: Hiding Processes
  • Linux Rootkits Part 8: Hiding Open Ports
  • Linux Rootkits Part 9: Hiding Logged In Users (Modifying File Contents Without Touching Disk)
  • Fancy Bear’s a Lumberjack and It’s Okay - A Dive into the Kernel Component of Drovorub
  • Linux Rootkits: New Methods for Kernel 5.7+

• Becoming a rat in your system

• Kernel mode hooking [EN]

• Last Digital Common Ancestor (LDCA)

• (nearly) Complete Linux Loadable Kernel Modules

• Reflections on Trusting Trust

• Static linked ELF infecting

• PoC executable packer that does not use any custom code to unpack binaries at execution time

  • Locreate: An Anagram for Relocate

• perljam.pl: A Perl x64 ELF virus by isra

  • Writeup
  • Source code

• stelf-loader: stealthy ELF loader - no files, no execve, no RWX

• DDexec: run binaries filelessly and stealthily on Linux by overwriting the shell's process with another

• Griffiths - Binary Protection Schemes

• KoviD kernel rootkit

• Offensive capabilities of eBPF and implementation of a rootkit

• debugoff - linux anti-debugging and anti-analysis rust library

• ELF Binaries: One Algorithm to Infect Them All (VXUG Black Mass Volume II)

• grugq & scut: Armouring the ELF: Binary encryption on the UNIX platform

• sblip & elfmaster: Secure Code Partitioning With ELF binaries, aka. SCOP (mirror)

ELF header hacks

Debugging Formats

• DWARF

  • dwarf-writer
  • gimli - a library for reading and writing the DWARF debugging format
  • The Almighty DWARF: A Trojan Horse for Program Analysis, Verification, and Recompilation

• Compact C Type Format

  • The Compact C Type Format in the GNU toolchain
  • The CTF File Format

• Oops Rewind Capability (ORC)

  • The ORCs are coming!
  • ORC unwinder

Programming

• The Art of Assembly Programming Language
• Bit twiddling hacks
• Intel® 64 and IA-32 Instruction Set Reference
• Process name stomping
• System call reference tables for x86, x64, arm and arm64
• API for system call references for x86, x64, arm and arm64
• Writing C software without the standard library [Linux Edition] - Franc[e]sco's Gopherspace

Reverse Engineering and Detection

• Intezer Labs and malware analysis
  • ELF Malware Analysis 101 Part 1: Linux Threats No Longer an Afterthought
  • ELF Malware Analysis 101 Part 2: Initial Analysis
  • ELF Malware Analysis 101 Part 3: Advanced Analysis
• Lucas Galante + Marcus Botacin and (malware/goodware) binary classification
  • Forseti
  • Machine Learning for Malware Detection
• Ghidra Patch Diffing
• fnprint - behavioral function fingerprinting for ELF: names functions in stripped binaries and patch-diffs vuln vs patched builds by microexecuting each function, not by bytes or CFG
• drgn - a powerful and flexible debugger
• Towards Optimal Use of Exception Handling Information for Function Detection
• Reverse Engineering Ebpfkit Rootkit With BlackBerry's Enhanced IDA Processor Tool
• UPX Recovery Tool
• Userland rootkits are lame
• OrBit: New Undetected Linux Threat Uses Unique Hijack of Execution Flow
• elfmaster: Arcana ElfScan
  • The philosophy of Elves in Linux threat detection
  • Source
• ESET: Ebury is alive but unseen
• SentinelOne: Leveraging LD_AUDIT to Beat the Traditional Linux Library Preloading Technique
• richinseattle: Automated Debugging and Process Analysis

ELF Challs and CTFs

• Crack The ELF! by s0lden

Misc

• vxer.io (vxheaven successor)
• ANSIWAVE BBS
• PageBuster
• vx-underground heaven
• WIZARD BIBLE (in Japanese)
• Second Part To Hell
• Lotus 1-2-3 for Linux
• The Decompilation wiki

Polyglots

• αcτµαlly pδrταblε εxεcµταblε
• Architecture Spanning Shellcode
• Doublethink – 8-Architecture Assembly Polyglot
• Polyglottar, an ISO+TAR+ELF polyglot
• tweetable-polyglot-png

Linker Script Tutorials

• Everything You Never Wanted To Know About Linker Script
• Linker Script Guide
• Most Commented Linker Script in the World

macOS - General

• Papers, Slides and Thesis Archive

macOS - Mach-O binary format

• Mach-O architecture
• Mach-O file builders
• Exploring the Mach-O (4 part series of blogposts)
• Understanding the Mach-O file format
• Mach-O file format reference

macOS - APFS

• APFS Reference
• APFS Structure
• APFS Forensics

macOS - Official Apple resources

• Apple's docs archive
• Apple Open Source
• XNU
• Distribution macOS

macOS - Mac-related blogs

• Patrick Wardle Objective-See Blog
• Pedro Vilaca Reverse Engineering
• Howard Oakley (@howardnoakley) - The Eclectic Light Company – Macs, paintings and more
• Jeff Johnson (@lapcatsoftware) - The Desolation of Blog
• Wojciech Reguła (@_r3ggi) Blog
• Scott Knight (@sdotknight) - Reverse engineering and debugging
• Zhi Zhou (@CodeColorist) Blog
• Kai Lu (@K3vinLuSec) - Fortinet’s macOS posts
• Jaron Bradley (@jbradley89) - The Mitten Mac – Mac Incident Response and Threat Hunting
• Cody Thomas (@itsa_feature) – Medium
• Adam Chester (@xpn) Blog
• Alex Plaskett (@alexjplaskett) - Blog
• George Johnson (@GeoSn0w) – Blog
• Harry Moulton (@h3adsh0tzz) - Blog
• Sarah Edwards (@iamevltwin) - Blog
• Saagar Jha - Blog
• LockBoxx (@1njection) - macOS Post Collection
• Brandon Azad (@_bazad) - Blog
• Google Project Zero Bug Tracker - Apple
• Cedric Owens (@cedowens) – Medium
• Christopher Ross (@xorrior) – Medium
• Richie Cyrus (@rrcyrus) – Medium
• Phil Stokes (@philofishal) - SentinelOne
• Jakob Rieck (0xdead10cc) - Blog
• Csaba Fitzl (@theevilbit) - Blog

Misc Apple-related resources

• Apple Knowledge repo
• AppleDB - list of software versions and released hardware
• iOS development wiki (also covers a lot on the *OS internals)
• macOS Security and Privilege Escalation from HackTricks