{"id":13539957,"url":"https://github.com/elfmaster/libelfmaster","last_synced_at":"2025-04-02T06:31:57.763Z","repository":{"id":43393586,"uuid":"71839044","full_name":"elfmaster/libelfmaster","owner":"elfmaster","description":"Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools","archived":false,"fork":false,"pushed_at":"2025-02-21T21:07:12.000Z","size":1888,"stargazers_count":430,"open_issues_count":16,"forks_count":65,"subscribers_count":35,"default_branch":"master","last_synced_at":"2025-02-21T21:47:28.921Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"http://www.bitlackeys.org","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/elfmaster.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2016-10-24T22:59:12.000Z","updated_at":"2025-02-21T21:07:17.000Z","dependencies_parsed_at":"2024-10-20T02:55:47.160Z","dependency_job_id":null,"html_url":"https://github.com/elfmaster/libelfmaster","commit_stats":null,"previous_names":[],"tags_count":4,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elfmaster%2Flibelfmaster","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elfmaster%2Flibelfmaster/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elfmaster%2Flibelfmaster/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/elfmaster%2Flibelfmaster/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/elfmaster","download_url":"https://codeload.github.com/elfmaster/libelfmaster/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":246768313,"owners_count":20830647,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-01T09:01:35.359Z","updated_at":"2025-04-02T06:31:56.234Z","avatar_url":"https://github.com/elfmaster.png","language":"C","readme":"# libelfmaster\n## Update as of 11/17/18 -- I have a local branch with many new fixes that will be finished and committed by the end of December, been very busy.\n\n## Secure ELF parsing library\n\nlibelfmaster is a C library for loading and parsing ELF objects\nof any type. The goal of this project was to create an API that\nis innovative in its ability to be user-friendly, secure, and\nprovide a variety of creative and useful ways to access an ELF\nobject. Not only that, but this library was largley created for\ndesigning reverse engineering applications. This library is capable\nof loading binaries with corrupted section headers and it will forensically\nreconstruct section headers and symbol tables using state-of-the-art\ntechniques, such as PT_GNU_EH_FRAME reconstruction for .symtab functions.\nThis library is also capable of seamlessly loading both 32bit and 64bit\nELF objects, vs. having to compile  two seperate libs for each\narchitecture. The downfall obviously being that this won't compile on\n32bit machines. I am now a guide on this project, as I put it into\nthe hands of the security and reverse engineering community. I am\ncurrently using it to build https://github.com/elfmaster/elf.arcana\nwhich is advancing the state of Linux/UNIX binary forensics and HIDS.\nAs I build Arcana, more edge cases come up.\n\n\n## Future Goals\n\n1. Userland debugging (non-ptrace) API similar to eresi e2dbg\n2. ELF patching, and injection. i.e. relocatable code injection + function hijacking etc.\n3. Dwarf VM bytecode injection similar to Sergey Bratus and James Oakley's Katana project\n4. Continuous advancement of forensically reconstructing all edge cases of broken binaries\n5. Explicit support for FreeBSD\n6. Explicit support for sparc, mips, arm, etc. Currently it implicitly supports many of the features\n7. A regression test suite\n8. Better Support for core-files, i.e. forensics reconstruction\n9. API Documentation\n\n## Current status\n\nWork in progress. Not fully fuzzed or tested. Needs adept ELF hackers\nand reverse engineers with a strong C skills. Has undergone several iterations\nof fuzzing done with AFL. Currently I am fixing and patching the code and a new\nalpha release tag will be committed pushed soon (By mid October 2018)\nThank you to all who have contributed their fuzzing efforts. I will create a\nproper area to name those who should be listed as contributors (Perhaps an Authors file).\n\n\n## Rules of development\n\nNetBSD coding style, submit a PR for review.\n\n## API Documentation\n\nThe best documentation is to read the code in libelfmaster/examples.\nelfparse.c is a simple version of readelf, but does not utilize every\nAPI function so make sure to look at all examples. This API needs someone\nto document it. \n\n","funding_links":[],"categories":["\u003ca id=\"e1fc1d87056438f82268742dc2ba08f5\"\u003e\u003c/a\u003e事件响应\u0026\u0026取证\u0026\u0026内存取证\u0026\u0026数字取证","Awesome Repositories","C","C (286)","\u003ca id=\"170048b7d8668c50681c0ab1e92c679a\"\u003e\u003c/a\u003e工具","\u003ca id=\"a63015576552ded272a242064f3fe8c9\"\u003e\u003c/a\u003eELF","\u003ca id=\"ecb63dfb62722feb6d43a9506515b4e3\"\u003e\u003c/a\u003e新添加","Forensics"],"sub_categories":["\u003ca id=\"1fc5d3621bb13d878f337c8031396484\"\u003e\u003c/a\u003e取证\u0026\u0026Forensics\u0026\u0026数字取证\u0026\u0026内存取证","ELF binary format","\u003ca id=\"375a8baa06f24de1b67398c1ac74ed24\"\u003e\u003c/a\u003e信息收集\u0026\u0026侦查\u0026\u0026Recon\u0026\u0026InfoGather","\u003ca id=\"929786b8490456eedfb975a41ca9da07\"\u003e\u003c/a\u003e工具","Steganography"],"project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felfmaster%2Flibelfmaster","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Felfmaster%2Flibelfmaster","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Felfmaster%2Flibelfmaster/lists"}