Linux project injection demo. Creates an memory-only file descriptor to write executable to, and then executes it using a fake process name of "injectedprocess".
$ go build memfd_launch.go
$ ./memfd_launch --inject
Injecting into process...
File descriptor is 3
Bytes written to memfd 2030005 at path /proc/self/fd/3
$ ps $(pidof injectedprocess)
PID TTY STAT TIME COMMAND
173277 ? Ssl 0:00 injectedprocess
- This work is derived from https://www.guitmz.com/linux-elf-runtime-crypter/ / https://github.com/guitmz/ezuri and should work on multiple architectures.
- https://medium.com/confluera-engineering/reflective-code-loading-in-linux-a-new-defense-evasion-technique-in-mitre-att-ck-v10-da7da34ed301
- golang/go#227