Carving ELF Files

Re:Carving ELF Files by Moneysac on Sunday July 21, 2024 @03:22PM (#41027441)

Interesting article. Did you try unblob as an alternative? It is capable of extracting multiple file formats including elf binaries.

[ Parent | on HN ]

Re:Carving ELF Files by joren485 on Sunday July 21, 2024 @04:19PM (#41027790)

Thanks!

I haven't really looked at alternative carvers (but I am aware that many great options exist). I didn't know unblob yet. Thanks for the suggestion!

Looking at the code, they use the same methodology as I describe in the post [0]. They do, however, also check for the end of the last segment, which is interesting.

[0] https://github.com/onekey-sec/unblob/blob/112da43587c80cc3a7...

[ Parent | on HN ]