Skip to main content
ZombieMutex

30 results · ↑ ↓ navigate · Enter open · Esc close

← Rust & Go security tooling

Security implementation / Rust

ELFGuard

Offline ELF64 hardening analysis

I built a zero-dependency Rust analyzer for ELF program headers and dynamic linking metadata. It finds executable-stack declarations, writable/executable load segments, PIE evidence and partial/full RELRO without loading or executing the binary.

What I was trying to prove

I wanted hardening reviews to explain the exact evidence behind a finding. A claim like 'PIE enabled' means little if the parser quietly confuses shared libraries with position-independent executables or reads past a malformed header.

ELFGuard: untrusted binary bytes never become executable input

Untrusted local ELF → offline Rust parser. This tool reads metadata; it never loads the ELF.

  1. 01 · Input

    ELF64 bytes

    Untrusted file / ≤64 MiB CLI cap

  2. 02 · Boundary

    Checked parser

    Header bounds, offsets, lengths

  3. 03 · Analysis

    Program + dynamic headers

    PT_LOAD · GNU_STACK · RELRO · BIND_NOW

  4. 04 · Output

    Evidence report

    PIE / NX / W^X / RELRO, including unknown

Failure path: Malformed, overflowed or unsupported ELF → explicit error, never execute, and never report missing evidence as safe.

Enforcement: Range checks and format validation enforce parser safety; findings describe metadata rather than exploitability.

Architecture of the implemented reference system, not a production deployment diagram.

Implementation decisions

  • Implemented bounded little-endian ELF64 parsing with checked offsets, checked arithmetic and explicit rejection for unsupported formats.
  • Extracted PT_GNU_STACK, PT_LOAD, PT_INTERP, PT_GNU_RELRO and PT_DYNAMIC, then evaluated dynamic tags for eager binding before reporting RELRO strength.
  • Kept unknown states explicit: a missing GNU_STACK entry does not certify that the stack is non-executable, and ET_DYN alone does not establish an executable is PIE.
  • Added structured fixtures for executable-stack and RWX segments, full/partial RELRO, non-PIE, unknown metadata and malformed binary ranges.

Adversarial paths and trust boundaries

  • Untrusted binary metadata may be truncated, maliciously oversized or internally inconsistent. Parser behavior must be bounded and must not panic.
  • Writable and executable mappings weaken code/data separation. The tool flags mapping metadata but does not infer an exploitable primitive.
  • RELRO claims require both a GNU_RELRO segment and eager binding; otherwise lazy relocation entries may remain writable.

Test evidence

  • cargo test --offline: 6/6 library tests passed on Apple Silicon, including 10,000 deterministic mutated ELF inputs without parser panic.
  • cargo clippy --offline --all-targets -- -D warnings: passed.
  • Input is never executed and the tool performs no network operations.
Captured execution evidenceRead raw terminal output
Rendered capture of an actual cargo test and Clippy run showing six passing ELFGuard unit tests
Local Cargo test and Clippy output captured on Apple Silicon; image rendered from the recorded stdout.

Reproduce locally

cd examples/elfguard
cargo test --offline
cargo clippy --offline --all-targets -- -D warnings
cargo run --release -- /path/to/authorized/elf

Run against fixtures or binaries you own or are authorized to inspect. The complete working project remains in my private site repository; the published downloads provide reviewable source and tests, not a public GitHub repository.

What I am not claiming

  • ELF64 little-endian only. No Mach-O or PE parsing.
  • Does not certify a stack canary, host ASLR, CET, BTI, PAC or exploitability.
  • Static metadata analysis, not a loader or an executable sandbox.