Skip to content

Instantly share code, notes, and snippets.

@linuxthor
Last active October 21, 2020 14:11
Show Gist options
  • Save linuxthor/8253be6ac192df523824e6bccdb944d9 to your computer and use it in GitHub Desktop.
Save linuxthor/8253be6ac192df523824e6bccdb944d9 to your computer and use it in GitHub Desktop.
ELF overwrites itself in memory while executing
; linuxthor
;
; ELF destruct
;
; this file, when executed, will overwrite it's own image in memory
;
; nasm -f bin -o elfdestruct elfdestruct.asm
BITS 64
org 0x010000
ehdr:
db 0x7F, "ELF", 2, 1, 1, 0 ; e_ident
key:
dq 0 ; el_reservado
dw 2 ; e_type
dw 0x3e ; e_machine
dd 1 ; e_version
dq _start ; e_entry
dq phdr - $$ ; e_phoff
dq 0 ; e_shoff
dd 0 ; e_flags
dw ehdrsize ; e_ehsize
dw phdrsize ; e_phentsize
dw 1 ; e_phnum
dw 0 ; e_shentsize
dw 0 ; e_shnum
dw 0 ; e_shstrndx
ehdrsize equ $ - ehdr
phdr:
dd 1 ; p_type loadable
dd 7 ; p_flags rwx perm
dq 0 ; p_offset
dq $$ ; p_vaddr
dq $$ ; p_paddr
dq filesize ; p_filesz
dq filesize ; p_memsz
dq 0 ; p_align
phdrsize equ $ - phdr
inline_data:
string db 'This ELF will self destruct..',0x0d,0x0a,
db 'Goodbye!!',0x0d,0x0a,0
len equ $-string
_start:
mov rax, 1 ; sys_write
mov rdi, 1
mov rsi, string
mov rdx, len
syscall
mov rcx, 128
mov rax, 0x9090909090909090
mov rdi, ehdr
rep stosd
filesize equ $-$$
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment