Skip to content

Instantly share code, notes, and snippets.

@shellcromancer

shellcromancer/elf_invalid_version.yara

Created January 2, 2023 01:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save shellcromancer/2cba9f296da7e521b5dbb8de1ae56581 to your computer and use it in GitHub Desktop.
Save shellcromancer/2cba9f296da7e521b5dbb8de1ae56581 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
elf_invalid_version.yara
rule elf_invalid_version {
meta:
desc = "Identify ELF file that has mangled header info."
author = "@shellcromancer"
version = "1.0"
last_modified = "2023.01.01"
reference = "https://n0.lol/ebm/1.html"
reference = "https://tmpout.sh/1/1.html"
condition:
(
uint32(0) == 0x464c457f
and uint8(0x6) > 1 // ELF Version is greater value than in spec.
)
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment