Simple assembler file wrongly identified as 'elfcrypt'
- Dominant language
- C++
- Stars
- 8.6k
- Forks
- 1k
- PR merge metrics
- No merged PRs in 30d
Description
Subject: https://github.com/rfalke/decompiler-subjects/blob/master/from_holdec/linux_syscall_syscall/x64_elf/subject.exe
Output:
```
....
// Detected compiler/packer: elfcrypt (1.0)
...
```
But looking at https://github.com/rfalke/decompiler-subjects/blob/master/from_holdec/linux_syscall_syscall/source.s and the Makefile there is no elfcrypt involved.
Contributor guide
No contributing guide indexed for this repository
Research direction
Compare the reported subject.exe output with source.s and the accompanying Makefile to confirm that no elfcrypt step is involved. Trace the detection that produces “elfcrypt (1.0)” and identify why this binary is classified that way; done means the sample is no longer reported as elfcrypt.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- cpp
- Domain
- reverse-engineering
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 42/100