Linux ELF Binary Layout

The Executable and Linkable Format (ELF) is the standard binary format for Unix-like systems (Linux, FreeBSD) for executables, object code, shared libraries, and core dumps.

ELF Header

Starts with the magic number 7F 45 4C 46 (Del + "ELF"). It identifies the file class (32-bit or 64-bit), endianness, ABI version, machine architecture (e.g., x86_64, ARM), and the entry point address.

Segments and Sections

ELF files have a dual nature depending on whether they are being linked or executed:

• Program Headers (Segments): Used at runtime by the OS loader. They describe memory segments (e.g., LOAD, DYNAMIC, INTERP).
• Section Headers (Sections): Used at link time by tools like `ld`. Common sections include .text (code), .rodata (read-only data), and .bss (uninitialized data).

Malware Evasion in ELF

Attackers often manipulate ELF files to evade detection or hinder reverse engineering:

• Stripping Sections: Removing section headers using tools like strip makes analysis harder for disassemblers, though the program headers remain intact for execution.
• UPX Packing: Compressing the binary to hide strings and static signatures.
• Infecting Existing Binaries: Injecting malicious code into the padding space between segments of a legitimate binary (e.g., modifying the .text segment).