Skip to content

Load a statically-linked ELF binary(x86 architecture) without the execve syscall.

License

Notifications You must be signed in to change notification settings

0xbigshaq/runtime-unpack

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 

History

5 Commits
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

runtime-unpack

Load a statically-linked ELF binary(x86 architecture) without the execve syscall.

directory_structure

Compiling

Build & pack using make: build

Running

After compiling, you can use the ./bin/loader binary to run the dummy programs in bin/samples/tests/*.packed.

The loader will unpack the elf in memory, map the segments to the right places in virtual memory, resolve symbols and pass execution to the unpacked program's main().

sample 1 (loops, calculations and I/O): run_sample_1

sample 2 (system commands):

run_sample_2

There are more sample programs in the tests directory.

Notes

This is not a shiny tool but rather a tiny PoC code that will (hopefully) help beginners who are trying to learn more about the concept of packers. The loader is compiled with debug info so you can fire-up gdb and step through the C code to see how the magic is done.

It is also a great introduction if you're a researcher who's trying to learn about how the linux kernel loads an elf (which is far more complicated in reality)

About

Load a statically-linked ELF binary(x86 architecture) without the execve syscall.

Resources

License

Stars

Watchers

Forks