A simple ELF crypter that encrypts ELF binary sections using RC4 encryption for on-disk protection.
ELFcrypt is a C-based tool that encrypts sections within ELF binaries using RC4 encryption to protect code from static analysis while stored on disk. It allows developers to mark specific functions for encryption, which are decrypted at runtime upon providing the correct passphrase. The tool helps obfuscate binary contents to hinder reverse engineering efforts.
Developers and security researchers working with ELF binaries on Linux who need to protect proprietary code or sensitive algorithms from casual inspection or analysis while binaries are at rest.
ELFcrypt offers a simple, focused solution for ELF encryption without complex dependencies, using proven RC4 encryption and providing both section-based and full-binary encryption options. Its lightweight design and straightforward integration make it accessible for basic binary protection needs.
Simple ELF crypter. Uses RC4 encryption.
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Written in C with no external dependencies, integration requires only including ELFcrypt.h and adding the CRYPTED macro to functions, as shown in example.c.
Encrypts specific ELF sections like .crypted, making disassembly output 'nonsensical rubbish' and hindering reverse engineering while binaries are at rest on disk.
ELFcrypt2 variant decrypts and executes payloads in memory via fexecve(), avoiding disk exposure during runtime, demonstrated with encrypting /bin/ls.
Supports passphrase input via the ELFCRYPT environment variable, enabling automation and script-friendly usage without interactive prompts.
Relies on RC4, which is cryptographically weak and deprecated, offering minimal protection against determined attackers with modern tools.
The README explicitly states that encrypted contents are vulnerable to memory dumps while running, providing no defense against dynamic analysis or debugging.
Depends on Linux-specific functions like memfd_create() and is limited to ELF format, reducing portability and requiring workarounds for older kernels.
Creating standalone binaries involves manual concatenation of stub and encrypted data (e.g., using cat), which is error-prone and lacks built-in tooling.