<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Linux ELF Malware Analysis — API Reference

## readelf

```bash
readelf -h sample.elf       # ELF header (arch, type, entry)
readelf -S sample.elf       # Section headers
readelf -l sample.elf       # Program headers (segments)
readelf -s sample.elf       # Symbol table
readelf -d sample.elf       # Dynamic section (libs, imports)
readelf -r sample.elf       # Relocations
readelf -n sample.elf       # Notes (build ID, etc.)
readelf --wide -a sample.elf  # All info, wide format
```

## objdump

```bash
objdump -d sample.elf           # Disassemble .text
objdump -D sample.elf           # Disassemble all sections
objdump -t sample.elf           # Symbol table
objdump -T sample.elf           # Dynamic symbol table
objdump -x sample.elf           # All headers
objdump -s -j .rodata sample.elf  # Dump specific section
```

## strace

```bash
strace -f ./sample                      # Trace with child processes
strace -f -e trace=network ./sample     # Network calls only
strace -f -e trace=file ./sample        # File operations only
strace -f -e trace=process ./sample     # Process operations
strace -f -e trace=memory ./sample      # Memory operations
strace -c ./sample                      # Call statistics summary
strace -o output.log ./sample           # Output to file
strace -t -T ./sample                   # Timestamps + call duration
```

## ltrace

```bash
ltrace -f ./sample             # Library call trace
ltrace -e '*' ./sample         # All library calls
ltrace -e 'malloc+free' ./sample  # Specific functions
ltrace -c ./sample             # Call statistics
```

## LIEF (Python)

```bash
pip install lief
```

```python
import lief
binary = lief.parse("sample.elf")

# Header
binary.header.machine_type        # Architecture
binary.header.entrypoint           # Entry point
binary.header.file_type            # ELF type (EXEC, DYN, etc.)

# Sections
for s in binary.sections:
    s.name, s.size, s.offset, bytes(s.content)

# Imports/Exports
binary.imported_functions           # List of imported functions
binary.exported_functions           # List of exported functions
binary.libraries                    # Required shared libraries

# Security
binary.is_pie                       # Position Independent Executable
binary.has_nx                       # NX bit (non-executable stack)
```

## QEMU User-Mode Emulation

```bash
# ARM
qemu-arm-static ./sample_arm
qemu-arm-static -L /usr/arm-linux-gnueabi/ ./sample_arm

# MIPS Little Endian
qemu-mipsel-static ./sample_mips
qemu-mipsel-static -L /usr/mipsel-linux-gnu/ ./sample_mips

# With strace
qemu-arm-static -strace ./sample_arm 2>trace.log

# With GDB server
qemu-arm-static -g 1234 ./sample_arm &
gdb-multiarch -ex "target remote :1234" ./sample_arm
```

## GDB with GEF

```bash
gdb -q ./sample
# In GDB:
gef> info functions          # List functions
gef> disas main             # Disassemble main
gef> b *0x401000            # Breakpoint at address
gef> r                      # Run
gef> vmmap                  # Memory map
gef> heap chunks            # Heap inspection
gef> checksec               # Security features
```

## Rootkit Detection

```bash
rkhunter --check             # Rootkit hunter
chkrootkit                   # Check for rootkits
unhide sys                   # Find hidden processes
cat /etc/ld.so.preload       # LD_PRELOAD hijack check
bpftool prog list           # BPF program enumeration
```
