Linux ELF Runtime Crypter
5 minute read Published:
Ezuri: A Simple Linux ELF Runtime Crypter Using memfd_create Syscall
"Even for Elves, they were stealthy little twerps. They'd taken our measure before we'd even seen them."
— Marshall Volnikov
Last month I wrote a [post](https://www.guitmz.com/running-elf-from-memory/) about the `memfd_create` syscall and left some ideas in the end. Today I'm here to show an example of such ideas implemented in an ELF runtime crypter (kinda lame, I know, but good for this demonstration).
What is it?
Glad you asked. Ezuri is a small Go crypter that uses AES to encrypt a given file and merges it with a stub that will decrypt and execute the file from memory (using the previously mentioned memfd_create syscall). My original goal was to write it in Assembly but that would require more time so it is a task for the future.