Evil ELFs and Dishonest DWARFs (Jack Baker)
Engineers explore architecture and security mechanisms for Evil ELFs and Dishonest DWARFs (Jack Baker).
Summary
Abusing Debug Symbols
Jack Baker’s LayerOne talk “Evil ELFs and Dishonest DWARFs” subverts ELF debug information to hinder reverse engineering—not by misnaming functions but by breaking analyst tools. Targets include IDA Pro with Hex-Rays, Ghidra, radare2, and GDB dynamic analysis.
Breaking Static Analysis Trust
Static tools infer program structure without execution—disassembling variable-length x86, finding function boundaries, and decompiling types. Baker crafts malicious DWARF and symbol data exploiting those trust assumptions, causing truncated functions, wrong boundaries, and decompiler failures rather than exploiting memory corruption in the tools themselves.
Stripping Detection and Response
Because attacks rely on debug symbols, stripped binaries lack rich DWARF; Baker demonstrates dynamically detecting stripping and adapting techniques across stripped, basic symtab, and full debug symbol tiers. The research shows metadata poisoning can defeat analysts even when code behavior remains unchanged.
Related talks
LayerOne 2025·34 min
Security researchers examine technical aspects of WINE for Video Game Hackers (Jack Baker).
LayerOne Information Security Conference·37 min
Jack Baker
Industry experts analyze emerging threats surrounding LayerOne 2021 - Jack Baker - Lessons from Hacking Video Games.
Videos·28 min
Industry experts analyze emerging threats surrounding Hackerzvoice NDH2k14 Talks : Mr Jack "Cut your own keys".