Deep Dive Into ELF Binaries - ELF Binary Structure for Pentesters/CyberSecurity

[@KadirAksu28]

Amazing video! Thank you for this, it really clears everything and makes it more understandable!!

[@PinkDraconian]

Thank you! Glad you liked it!

[@d4vid8959]

At 15:10 it should be: Stack is *first* in last out

[@PinkDraconian]

My bad! That's what I meant! Thanks for letting me know!

[@hexadecimalhexadecimal5241]

LIFO

[@programspecific4995]

Amazing job! Really great presentation.

[@PinkDraconian]

Thank you very much!

[@fusca14tube]

I like this kind of videos. Please, continue and thank you.

[@PinkDraconian]

Thanks a million, will do!

[@xenoidaltu601]

KDE has a new program called ELF Dissector. Please review it!

[@PinkDraconian]

Cool stuff! Will check it out for sure!

[@LinuxSploitOfficial]

Well Explained

[@lilwarkake2817]

Great video thanks

[@PinkDraconian]

Thanks!

[@RamRevivo]

loved it, thank you very much 🙏

[@PinkDraconian]

You're welcome 😊

[@hopnguyen3177]

good job bro

[@PinkDraconian]

Thanks!

[@DN-dd4db]

thanks

[@TracerPortable]

So in static compiled binaries procedure link table does not exist? Everything is in global offset table?

[@PinkDraconian]

It doesn't need it, but often when compiling binaries statically you will still see a PLT however this is just a misimplementation as you can strip the PLT from the binary and it will still work!

[@TracerPortable]

@@PinkDraconian Thanks, that's interesting I think I'm going to play with this a little

[@shivangupadhyay8002]

the dynamic libs we link to , are also elf ?

[@PinkDraconian]

Exactly. Both the binaries and the shared libraries are in the ELF format!

[@rtlinsn5085]

You didn't provide a novel new info about this topic ... just repeated info from other KZbin videos

[@PinkDraconian]

Hey! I'm sorry that I wasn't able to teach you anything new! I'd don't believe that repeating information is something bad, people learn in different ways.

[@asssheeesh2]

​@@PinkDraconian Thats such a wholesome reply. Subscribed

[@PinkDraconian]

@@asssheeesh2 Thank you! That's lovely to hear!

[@NoportOfbot]

15:18 Thats not correct, a stack is Last in First out

[@PinkDraconian]

Isn't that exactly what I'm saying? Like a stack of plates at a restaurant, the last plate in is the first plate out?

[@rahatmughal958]

Is there no 'Import' function section in ELF like in PE file?

[@PinkDraconian]

There is no such section in ELF files. An equivalent could be found in 2 tables, .dynstr and .dynsym.

[@AHN1444]

if possible to rename symbols? I have an elf library for which I need to remove a lot of export functions, is there a realistic way to do it? I only have the compiled elf not source

[@PinkDraconian]

I'm not sure I fully understand the question 😬

[@AHN1444]

@@PinkDraconian I have this game server which loads a elf .so library with the game skills. Using elfpatch I was able to make the game server load a duplicated skill library, and I wanted to rename the skill function names to create new ones. After days I found in IDA where each one of them was added to some kind of map (inside a static_initialization_and_destruction_0 function), so I try there to change the int for some new number and it worked, the game recognized the new skill id, but the function it called was not from the new duplicated lib, I called the original function in the original .so lib.. Now I am trying to write a new lib with new skills but I have to call a function to register the new skill and that function is in the original lib, don't know yet how to call that function from this secondary lib that I want to make. the function name is GNET::Skill::Skill and acording to IDA it takes a pointer and an int ID, the pointer I supose is the skill function address, So I have to write a lib with one new skill function, and call this GNET::Skill function with the address of my function and an ID. But I don't know how to do it, how to call it from my lib, and how to link it so the compiler acepts it.

[@PinkDraconian]

That sounds like a really interesting project! The specifics of how to do that are also unknown to me, but keep on grinding your gears on it and I'm sure you'll figure it out!