avast / avast/retdec

Simple assembler file wrongly identified as 'elfcrypt'

Open
#813 1 comment 0 reactions 0 assignees View on GitHub
Q-question
Dominant language
C++
Stars
8.6k
Forks
1k
PR merge metrics
No merged PRs in 30d

Description

Subject: https://github.com/rfalke/decompiler-subjects/blob/master/from_holdec/linux_syscall_syscall/x64_elf/subject.exe

Output:
```
....
// Detected compiler/packer: elfcrypt (1.0)
...
```

But looking at https://github.com/rfalke/decompiler-subjects/blob/master/from_holdec/linux_syscall_syscall/source.s and the Makefile there is no elfcrypt involved.

Contributor guide

No contributing guide indexed for this repository

Research direction

Compare the reported subject.exe output with source.s and the accompanying Makefile to confirm that no elfcrypt step is involved. Trace the detection that produces “elfcrypt (1.0)” and identify why this binary is classified that way; done means the sample is no longer reported as elfcrypt.

Written by the indexing model from the issue text.

Assessment

Tech stack
cpp
Domain
reverse-engineering
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
42/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.