Woody-Woodpacker

A 42 school project that implements a binary packer for 64-bit ELF executables. The packer encrypts the executable's code sections and injects a decryption routine that executes at runtime.

🎯 About

Woody-Woodpacker is a program that takes a 64-bit ELF binary as input and creates a new encrypted version called woody. When executed, the woody binary:

1. Decrypts itself at runtime
2. Prints "....WOODY...." to stdout as proof of injection
3. Executes normally with the original binary's behavior

This project explores:

• Binary file formats (ELF structure)
• Code injection techniques
• Encryption/decryption algorithms
• Low-level programming in C
• Reverse engineering concepts

⚙️ How It Works

Packing Process

Original Binary → [Woody-Woodpacker] → Encrypted Binary (woody)

1. Parse ELF header - Read and analyze the ELF file structure
2. Locate code sections - Identify segments/sections to encrypt
3. Encrypt code - Apply encryption algorithm to the code
4. Inject decryption stub - Add decryption routine to the binary
5. Modify entry point - Redirect execution to decryption stub
6. Write new binary - Create the woody executable

Execution Process

./woody → Decrypt code → Print "....WOODY...." → Execute original program

🔧 Prerequisites

• GCC or Clang compiler
• Make
• Linux operating system (for ELF binary support)
• Basic understanding of:
  • C programming
  • ELF file format
  • Assembly language (x86-64)

🚀 Installation

# Clone the repository
git clone https://gitlab.com/Aurh1l/woody-woodpacker.git
cd woody-woodpacker

# Compile the project
make

# The woody_woodpacker executable is now ready
./woody_woodpacker

💻 Usage

Basic Usage

./woody_woodpacker <binary_file>

This creates a new file called woody in the current directory.

Example

# Pack a binary
./woody_woodpacker /bin/ls

# Execute the packed binary
./woody
# Output: ....WOODY....
# [then normal ls output]

Verification

# Compare original and packed binary behavior
/bin/ls -la
./woody -la

# Both should produce the same output (after "....WOODY....")

🔍 Technical Details

ELF File Structure

The packer manipulates the following ELF components:

• ELF Header - Main file header containing metadata
• Program Headers - Segment information for loading
• Section Headers - Section information for linking
• Code Segments - .text section containing executable code

Encryption Algorithm

The project typically uses a simple encryption method such as:

• RC4 - Stream cipher

Injection Technique

Segment Padding Infection (Silvio Cesare method):

1. Increase segment size in program header
2. Inject decryption stub in padding area
3. Modify entry point to jump to stub
4. Stub decrypts code and jumps to original entry point

Memory Layout

┌─────────────────────────┐
│   ELF Header            │
├─────────────────────────┤
│   Program Headers       │
├─────────────────────────┤
│   Decryption Stub       │ ← Injected code
├─────────────────────────┤
│   Encrypted .text       │ ← Original code (encrypted)
├─────────────────────────┤
│   Other sections        │
├─────────────────────────┤
│   Section Headers       │
└─────────────────────────┘

📝 License

This project is part of the 42 school curriculum and is intended for educational purposes only.

⚠️ Disclaimer

This tool is created for educational purposes as part of the 42 school curriculum. Use responsibly and only on binaries you own or have permission to modify. The authors are not responsible for any misuse of this software.