ELFLoader: Another In Memory Loader Post
ID: 992e684a-01d4-5092-8bae-c227014e5697
STIX ID: report--992e684a-01d4-5092-8bae-c227014e5697
Feed Name: TrustedSec blog
This blog post details how to build in-memory ELF loaders for Linux and macOS (analogous to BOFs for Windows), covering ELF header and section structures, parsing and loading sections, handling relocations, setting memory protections, resolving symbols via dlsym (libc/libSystem), build flags for object files, and executing the entry point; it emphasizes portability and reuse of capabilities across *nix and Windows agents.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
