5

I know no one that works as of today (i.e., kernels not way too old) and I wonder if anybody found or knows any protector for Linux either commercial, open source, used in malware, etc...

5

There is a nice article on Linux binary code protection at http://www.intel-assembler.it/portale/5/linux-binary-code-protection/linux-binary-code-protection.asp.

If your target is to protect your binary Sentinel HASP supports Linux.

As for the old ones as you mention most of them don't work anymore, elf-encrypter Shiva, Burneye etc. IF I had to guess what will be the most common in Linux malware it will be the most common packer that's is used in windows too, UPX.

5

ZVrba's Phrack article on cryptexec: Next-generation runtime binary encryption is a good read and it doesn't rely on additional kernel functionality:

This article describes a method to control the target program that doesn't does not rely on any assistance from the OS kernel or processor hardware. The method is implemented in x86-32 GNU AS (AT&T syntax). Once the controlling method is devised, it is relatively trivial to include on-the-fly code decryption.

0

The majority of modern ELF binaries are protected using UPX or a variant thereof. 1,2 However, custom packers have been observed in the wild, including both UPX based- and non-UPX based-custom packers.




References

  1. Understanding Linux Malware

  2. Modern Linux Malware Exposed

  3. Unboxing Linux/Mumblehard (2015) - ESET

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.