PDA

View Full Version : linux executable protector/obfuscator


Shub-nigurrath
September 26th, 2011, 10:21
Hi all,
I was recently wondering if there are some good ELF executable protectors (just like those available on Windows) for Linux. Free or commercial solutions and if someone ever did a classification of their strength..

Could you point me to some resources?

TIA,
Shub

Darkelf
September 26th, 2011, 14:55
Well actually there isn't a real protector for linux.
The there are two packers known to me: UPX and gzexe (part of gzip) and a third one I heard of but wasn't able to find. gzexe is a bit different from packers under Win because it creates a script that unpacks and loads the packed file. UPX is the same as in Win. I was searching around a bit for protectors for Linux when I did some research for my Bachelor thesis. Whenever I asked people about it, I was told that there is no need for it since most programs are open-source anyway. Commercial programs made for linux that need some kind of protection almost always use Flexlm.
I thought about making one myself but decided against it, because I didn't want to do anything nobody needs and time was too valuable for a POC.

Regards
darkelf

Shub-nigurrath
September 26th, 2011, 15:54
UPX and gzexe are just elf compactors, but there's at least a situation where flexlm can't be used despite there's still need for a protector. Embedded systems usually have linux OSes, there's need to protect the internal algos against tampering and usually no data connections. For these situations there's no solutions apparently?

I found a phrack paper
Armouring the ELF: Binary encryption on the UNIX platform (http://www.phrack.org/issues.html?id=5&issue=58)

and another paper here http://www.intel-assembler.it/portale/5/linux-binary-code-protection/linux-binary-code-protection.asp

but there's some readymade tool?

Woodmann
September 26th, 2011, 21:02
Gizmo.

Woodmann

Shub-nigurrath
September 27th, 2011, 02:33
Quote:
[Originally Posted by Woodmann;91148]Gizmo.

Woodmann


uh, well something less cryptic? I have few possible interpretations of your post :-) Could you help me with some more phrasal alphabetic sequences -hehe-

Kayaker
September 27th, 2011, 05:54
I did find a ref to Gizmo ELF encryptor under Ostatic, but it's no longer available. Mostly I got hits about one of Santa's little helpers though..

What about Shiva?

Also, there are a couple of articles on Binary Protection at 0xf001's archived page

http://home.pages.at/f001/

Shub-nigurrath
September 28th, 2011, 04:05
thanks,
I also found these two interesting tools

elf-encrypter http://elf-encrypter.sourceforge.net/
shiva, http://www.securiteam.com/tools/5XP041FA0U.html

don't still know how strong they are but will try and eventually report here my results.

meanwhile if someone has a copy of the Gizmo please share it.

Edited: Sorry Kayaker, I didn't notice you already mentioned Shiva in advance -ghgh-

Woodmann
September 28th, 2011, 21:14
Howdy,

I've been looking for it but have had no luck so far .

Woodmann