[landfill] is a Python library for dumping a running Linux process from memory and rebuilding it into an ELF file that can then be run on any system. It is heavily based on the [process dumper] tool by ilo. The library works by attaching to a process using ptrace and then rebuilding the program using only the auxv vector found on the stack. It supports both 32bit and 64bit.
First the Python dependencies must be installed:
git clone git://github.com/cloudburst/pyptrace.git
git clone git://github.com/cloudburst/Elf.git
git clone git://github.com/cloudburst/landfill.git
Then:
>>> import landfill
>>> l = landfill.landfill(pid)
>>> l.rebuild_elf()
A sample utility is also included as sample/dump_process_from_memory.py that will fill in the pid at runtime.
- ilo - Advances in remote-exec AntiForensics
- grugq & scut - Armouring the ELF: Binary encryption on the UNIX platform
- Chris Rohlf - No Section Header? No Problem
- Chris Rohlf - Resolving ELF Relocation Name / Symbols
- herm1t - INT 0x80? No, thank you!
- Add file launching
- Add stricter bounds checking
- Remove ptrace dependency with kernel module
- Add section rebuilding
- Add symbol rebuilding
- Add core file rebuilding