Syscall

Last month I wrote a [post](https://www.guitmz.com/running-elf-from-memory/) about the `memfd_create` syscall and left some ideas in the end. Today I'm here to show an example of such ideas implemented in an ELF runtime crypter (kinda lame, I know, but good for this demonstration).

What is it?

Glad you asked. Ezuri is a small Go crypter that uses AES to encrypt a given file and merges it with a stub that will decrypt and execute the file from memory (using the previously mentioned memfd_create syscall). My original goal was to write it in Assembly but that would require more time so it is a task for the future.

Something that always fascinated me was running code directly from memory. From [Process Hollowing](https://www.adlice.com/runpe-hide-code-behind-legit-process/) (aka RunPE) to `PTRACE` [injection](https://blog.xpnsec.com/linux-process-injection-aka-injecting-into-sshd-for-fun/). I had some success playing around with it in `C` in the past, without using any of the previous mentioned methods, but unfortunately the code is lost somewhere in the forums of `VXHeavens` (sadly no longer online) but the code was buggy and worked only with Linux 32bit systems (I wish I knew about [shm_open](http://man7.org/linux/man-pages/man3/shm_open.3.html) back then, which is sort of an alternative for the syscall we are using in this post, mainly targeting older systems where `memfd_create` is not available).

Overview and code

Recently, I have been trying to code in assembly a bit, I find it very interesting and I believe every developer should understand at least the basics of it. I chose FASM as my assembler because I think it is very simple, powerful and I like its concepts (like same source, same output). More information about its design can be found here. Anyway, I have written a small tool, memrun, that allows you to run ELF files from memory using the memfd_create syscall, which is available in Linux where kernel version is >= 3.17.