ElfMaster

Innovative thought leader, #phrack author, reversing, exploitation and kernel hacking. Shiva binary patching technology:

[ElfMaster @ryan_elfmaster]

Shiva JIT binary patching engine, made open source under the MIT license at DEFCON. https://t.co/R2wvvT8O7A

[Phrack Zine @phrack]

The Phrack 73 prophile of @halvarflake

A must-read from one of the legends of vulnerability research.

https://t.co/Esdy97Q2Kc

[ElfMaster @ryan_elfmaster]

Check out my latest blogpost.
"Shiva modules for detecting advanced persistent threats in Linux: Shiva vs. Saruman": https://t.co/lUoysAUMxS

The other day I released an updated version of Saruman for anti-forensics executable injection. This is essentially an APT (Advanced persistent threat) tool for stealthy injection of a program into a remote process. Very helpful for the offensive side, giving them a good way to hide their processes without needing a kernel rootkit.

But what about the defensive side? Today I release a threat detection module for detecting Saruman thread injection. This threat detection engine was designed as a Shiva module in less than one day, and is a great example of how Linux threat detection and exploit mitigation monitors can be rapidly designed and installed with Shiva.

[ElfMaster @ryan_elfmaster]

@vxunderground Been there, done that. Good job, stay strong! This too shall pass. It's one of the hardest things you can ever do.

[ElfMaster @ryan_elfmaster]

Saruman is an anti-forensics executable injector with thread injection, allowing a program to run on a thread of execution within a remote process. (Originally found at https://t.co/waQK7LUIUv)

It's been 10 years and I finally re-wrote it from scratch just this last week and tested it on Ubuntu 24.

https://t.co/8i27DRVkZo

It may come in handy for some of you folks.

[ElfMaster @ryan_elfmaster]

Take peek at this demo video illustrating Shiva's power across 4 separate use-cases involving binary hacking that in past days would have required advanced knowledge of ELF internals and reversing.

Demo video content:
1. Game hacking, add 31337 lives to ./pacman with a simple Shiva patch
2. Fixing redis memory corruption vulnerability CVE-2025-46817 on-the-fly
3. Implementing Fine-Grained ASLR for x86_64 Linux with a custom Shiva module
4. Use Shiva to splice code into functions by source line-number with DWARF enhancements

Demo Video: https://t.co/CgDgNuKShR
Shiva software: https://t.co/MYfyikAJu7

[ElfMaster @ryan_elfmaster]

@RetroNewsNow To think I played Dennis Garrison 33 years ago on that television show ❤️😎

[ElfMaster @ryan_elfmaster]

Pleased to announce the release of my paper in tmp.0ut issue 5: Fine grained load-time ASLR for ELF executables in X86_64 Linux (https://t.co/4knH0geqhS) this issue is absolutely loaded with Gems and Treasures of the underground!

[tmp.0ut @tmpout]

We are pleased to release tmp.0ut 5 Volume!

Get your viruses, rootkits, strange ELFs, weird machines, tiny files, cool art, and phresh beats here!!

https://t.co/tZLM50HOc0

[ElfMaster @ryan_elfmaster]

@franciscapra @Comic_Con @CThomasjane @SuperPRGuy Looking good buddy!

[ElfMaster @ryan_elfmaster]

@lynxwatch_ Shiva modules can be powerful for building anti-tamper runtime engines as well.

[ElfMaster @ryan_elfmaster]

Granular ASLR for ELF executables in Linux, implemented in C with a Shiva ELF microprogram: https://t.co/RfMdUL5vLA
Building in-process security mitigations for Linux is efficient, pragmatic, and easy with Shiva https://t.co/MYfyikAJu7 -- A custom dynamic linker for ELF micropatching with relocatable code. Shiva not only loads and installs granular runtime patches but it can run ELF microprograms that execute before https://t.co/fwa764qu96 has been executed, allowing for powerful instrumentation capabilities. https://t.co/VMtm40rWyr

This implementation of gASLR works on ELF binaries that are compiled and linked with:
gcc -Wl,--emit-relocs -mcmodel=large -fPIC -pie

Requirements: PIE, large code model, and preserved .text relocations (e.g. .rela.text section). This prototype module uses the .text relocation information in its endeavours to re-write the code-layout with randomly ordered functions. Future versions will work with small code model binaries and randomly re-order PLT entries and global data in addition to functions.

The source code for this prototype of gASLR is here: https://t.co/zZPnp8W3iq

[ElfMaster @ryan_elfmaster]

Linux Game Cheats with Shiva!
Get 31337 lives in Pac-Man with a Shiva patch. Shiva is a custom dynamic linker for binary patching in Linux. This example applies a load-time patch to the classic game on x86_64 (ARM64 support also available). Write your patch in C as a relocatable object, then run the binary with Shiva as the loader. Simple, clean, and powerful. Full demo: https://t.co/tDwZSm0aZ0

[Julien Vanegue @jvanegue]

Slides for my invited talk at @IEEESSP #langsec: "Large Language Models for Software Autospecification" - https://t.co/MeTDySLa1H joint work with @shubhamdugare and @TarunSures41845 at @TechAtBloomberg This is the new thing to pay attention to for software defense.

[ElfMaster @ryan_elfmaster]

@count3rmeasure Thank you Justice! Let me know if you have any questions :)

[ElfMaster @ryan_elfmaster]

His contact info is [email protected]
206-399-9420

[ElfMaster @ryan_elfmaster]

If anyone is looking for next-level innovative art-work for their security projects, logos, etc. I would highly recommend that you talk to Mick O'Neill his website is (https://t.co/6D6jHrjFZ8) -- he did the WhyCon 40th edition of Phrack Cover, and my Shiva artwork as seen on (https://t.co/MYfyikAJu7) -- He is very nice to work with, and a visionary for anything you want done. Also an excellent video game graphic designer.

[ElfMaster @ryan_elfmaster]

I should have mentioned the Title of my ERIS submission, so that it can be looked up in the ERIS Market place. The title is "Advancing ELF binary patching and microprogram loading for security patching, hardening, and beyond"

[ElfMaster @ryan_elfmaster]

Good evening. I am excited to announce that Shiva, Arcana Research's advanced binary patching solution has been competitively assessed by the Defense Advanced Research Projects Agency (DARPA) and has been deemed "awardable" in the Expedited Research Innovation System (ERIS) Marketplace, making it available to view and easily procurable by the Department of War.

Shiva: https://t.co/MYfyikAJu7
Shiva github: https://t.co/VMtm40rWyr

ERIS program: https://t.co/jLDgazv0Sv

@DARPA

#DARPA #ERIS #BinaryPatching #innovation #NationalSecurity