Ryan elfmaster O'Neill

libelfmaster. Secure ELF parsing/loading library for forensics reconstruction of malware, and robust reverse engineering tools

ftrace. POSIX Function tracing

skeksi_virus. Devestating and awesome Linux X86_64 ELF Virus

ecfs. extended core file snapshot format

maya. Highly advanced Linux anti-exploitation and anti-tamper binary protector for ELF.

saruman. ELF anti-forensics exec, for injecting full dynamic executables into process image (With thread injection)

dsym_obfuscate. Obfuscates dynamic symbol table

kdress. Transform vmlinuz into a fully debuggable vmlinux that can be used with /proc/kcore

dt_infect. ELF Shared library injector using DT_NEEDED precedence infection. Acts as a permanent LD_PRELOAD

binflow. This is the new ftrace (https://github.com/elfmaster/ftrace) - Much faster, better resolution but not complete yet! :)

sherlocked. Universal script packer-- transforms any type of script into a protected ELF executable, encrypted with anti-debugging.

linker_preloading_virus. An example of hijacking the dynamic linker with a custom interpreter who loads and executes modular viruses

taskverse. A tool like /bin/ps but uses /proc/kcore for walking the tasklist; this finds hidden processes

kprobe_rootkit. Linux kernel rootkit using kprobes (From http://phrack.org/issues/67/6.html)

libelfmaster_examples. Simple ELF tools written to demonstrate libelfmaster capabilities.

ecfs_exec. Be able to execute memory snapshots so they can start running where they left off.

shiva. Shiva is a programmable dynamic linker for loading ELF microprograms

static_binary_mitigations. relros.c applies RELRO to static binaries, and static_to_dyn.c applies ASLR to static binaries.

davinci. Transforms any file into a protected ELF executable

scop_virus_paper. ELF Virus infection techniques that work with SCOP (Secure code partitioned) executables

fork_trace. C++

avu32. anti virus 32bit. my first attempt (in 2008) to write prototype for detecting/disinfecting unix ELF viruses

ee-ecfs. A version of ECFS (Extended core file snapshot) technology that was revamped for the DARPA EBOSS program-- ELF core-files with rich ABI enhancements for automated vulnerability research.

canaryism. Canaryism will tell you which functions are protected with gcc stack canaries

packt_book. C

interpx_documentation.

unix_virus_anniversary.

shiva_blogposts. Multiple blogposts are maintained here.

shiva_presentations.

veriexec.linux. Veriexec implementation for Linux

scripts. Python

bcc. BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

sentinel. Sentinel is a command line tool able to protect Windows 32 bit programs against exploits targeted by attackers or viruses. It can protect your programs against 0-day attacks or publicly known bugs.

binutils-gdb. Unofficial mirror of sourceware binutils-gdb repository. Updated daily.

linux. Linux kernel source tree

seventh_gate. C

poetry. Transcribing my poetry from 19yrs ago

unread. .eh_frame unwind information parser

openssh-portable. Portable OpenSSH