Delicious & Malicious Code Analysis / News: Recent posts

This is a proof-of-concept that can modify an Linux ELF executable in a way that it still performs normally, but libbfd programs like the Gnu Debugger (GDB) cannot read.

Further detales about this and other bugs in "Debugging Debuggers, Design Flaws of GDB and LibBFD".

Nightmode lists the strings and functions of a Linux ELF executable without executing the binary. This is intended for quick analysis of Malicious Code such as trojans and viruses.

Nightmode reports the memory location, size, and the number of function or system calls. Nightmode also uses lcamtuf's fingerprint code to identify known functions.

This is a proof-of-concept that can modify an Linux ELF executable in a way that it still performs normally, but crashes the Gnu Debugger (GDB).

Shstrndx exploits a bug in GDB by modifiing the ELF header to misreport the location of the Section Header String Index.

The exploit will be incorporated in the next version of Maladjusted, and will be further detailed in "Debugging Debuggers, Design Flaws of GDB and LibBFD".