Generic anti-reverse engineering tricks such as detecting breakpoints using checksums or exact match, stripping symbol information, incorporating data encryption, or using custom exception/signal handlers (setting them using the signal syscall we discussed previously) will work perfectly for ELF files pretty much the same way as for PE.
There are multiple ways the malware can take advantage of the ELF structure in order to complicate the analysis. The two most popular ways are as follows:
- Make the sample unusual, but still follow the ELF specification: In this case, malware complies with the documentation, but there are no compilers that would generate such code. An example of such a technique could be a wrong target OS specified in the header (we know that it can actually be 0, which means this value is largely ignored by programs). Another example is a stripped section table, which is, as we saw earlier, actually optional for executable files...
