{"id":19053728,"url":"https://github.com/idanrosenzweig/elf-toolchain","last_synced_at":"2025-07-02T15:36:57.186Z","repository":{"id":211584519,"uuid":"729286181","full_name":"IdanRosenzweig/ELF-Toolchain","owner":"IdanRosenzweig","description":"A toolchain for ELF executables and malware containing a standalone loader, file stripper, data obfuscator and a packer","archived":false,"fork":false,"pushed_at":"2024-07-01T15:54:35.000Z","size":253,"stargazers_count":5,"open_issues_count":0,"forks_count":1,"subscribers_count":1,"default_branch":"master","last_synced_at":"2025-04-07T20:21:24.425Z","etag":null,"topics":["assembly","elf","elf-loader","linux","loader","malware-detection","obfuscation-algorithms","packing","x64","x86"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/IdanRosenzweig.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2023-12-08T20:10:19.000Z","updated_at":"2025-03-17T00:15:19.000Z","dependencies_parsed_at":"2024-11-08T23:33:53.448Z","dependency_job_id":"394359bc-c156-4bd5-b224-2c846234b9e5","html_url":"https://github.com/IdanRosenzweig/ELF-Toolchain","commit_stats":null,"previous_names":["idanrosenzweig/loader","idanrosenzweig/loader-and-packer","idanrosenzweig/elf-toolchain"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/IdanRosenzweig/ELF-Toolchain","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IdanRosenzweig%2FELF-Toolchain","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IdanRosenzweig%2FELF-Toolchain/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IdanRosenzweig%2FELF-Toolchain/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IdanRosenzweig%2FELF-Toolchain/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/IdanRosenzweig","download_url":"https://codeload.github.com/IdanRosenzweig/ELF-Toolchain/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/IdanRosenzweig%2FELF-Toolchain/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263166934,"owners_count":23424280,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["assembly","elf","elf-loader","linux","loader","malware-detection","obfuscation-algorithms","packing","x64","x86"],"created_at":"2024-11-08T23:33:48.518Z","updated_at":"2025-07-02T15:36:57.158Z","avatar_url":"https://github.com/IdanRosenzweig.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Toolchain for Loading, Packing and Obfuscating ELF Executables and Malware\n\n## overview\nA toolchain I developed for ELF executables and malware, containing:\n* standalone loader\n* file stripper\n* data obfuscator\n* packer\n\n\nThe **ELF loader** is a standalone software that efficiently parses and loads ELF executables onto Linux. The loader supports:\n* both statically linked \u0026 dynamically linked executables\n* NX/DEP mapping protection\n* PIE and non-PIE code (userspace ASLR)\n* RELRO mode\n* program stack initialization\n* ELF auxiliary vector initialization\n* both independent jump tail invocation and interpreter-dependent invocation\n\nThe loader is independent of any other tools, and can be used independent for loading ELF files into the operating system.\n\n\nThe **file stripper** would remove any unnecessary sections and segments off ELF executables, leaving a minimalist file which preserves its execution behaviour.\nMore precisely, the stripper would remove any debugging, notes, or unrelated information stored in the executable, leaving only relevant segments and needed sections.\nThe file stripper is independent of other software in the toolchain, and can be used as a separate tool.\n\n\nThe **ELF obfuscator** would change the internal structure of ELF executable, without removing any existing data, while preserving the original behaviour of the executable.\nMore precisely, it would randomize and shuffle segments of the executable, and possible and sections too.\nThe ELF obfuscator is independent of other software in the toolchain, and can be used as a separate tool.\n\n\nThe **packer** is a sophisticated software that takes ELF executable and generates a new executable which has the same behaviour as the original one, but the original code is encrypted, compressed and encoded.\nTherefore, static analysis over the packed executable would produce meaningless results.\n\nThe packer software can be split into two parts:\n* The **data obfuscator** part is responsible for applying various layers of encryption, compression, and encoding over a given data.\n  All it does essentially is taking a file, obfuscating its content and producing a \"key file\" which can be used to deobfuscate the data back in the future.\n* The **runtime unpacking** part is responsible for deobfuscating the file back, and just loading it to the operating system.\\\n  it uses the ELF loader implemented in the toolchain to load the file (without using any operating system api, in contrast to other packers)\n\nAs a whole, the packer would:\n1. take ELF executable file\n2. obfuscate its content by encrypting, compressing and encoding multiple times (not to confuse with the ELF obfuscator)\n3. compile the resulting file and key along with the runtime unpacking software\n4. produce a final executable which is \"packed\"\n\n\n\u003cbr\u003e\u003cbr/\u003e\n(WARNING: stripped/obfuscated executables produces by the toolchain are considered corrupted and invalid. Regular OS loader will not load them. Most probably, the only loader capable of handling them is the one implemented in this toolchain)\n\n## build\nto build the ELF loader, execute `build_elf_loader.sh` at the top directory.\nthis will create a subdirectory `build` which would contain the loader.\n\nto build the ELF stripper, execute `build_elf_stripper.sh` at the top directory.\nthis will create a subdirectory `build` which would contain the elf stripper.\n\nto build the ELF obfuscator, execute `build_elf_obfuscator.sh` at the top directory.\nthis will create a subdirectory `build` which would contain the elf obfuscator.\n\nto pack some executable, execute `pack_executable.sh \u003cpath_to_the_executable\u003e` at the top directory.\nthis will generate a packed executable named `packed_file` at the current working directory.\n\nto clean all builds, execute `clean_build.sh`.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidanrosenzweig%2Felf-toolchain","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fidanrosenzweig%2Felf-toolchain","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fidanrosenzweig%2Felf-toolchain/lists"}