Cryptor

A lightweight utility for encrypting executable binaries and running them directly from memory without touching the filesystem.

What is Cryptor?

Cryptor is a two-part tool that:

1. Encrypts any executable binary (ELF format) and embeds it as a C byte array in a header file
2. Decrypts and executes the binary entirely in RAM using Linux's memfd_create system call

The encryption uses a simple but effective two-step algorithm:

• Byte reversal for obfuscation
• XOR cipher with a user-provided passphrase

The decryptor uses memfd_create to create an anonymous file in memory, writes the decrypted binary to it, and executes it via fexecve - meaning the executable never touches the disk during runtime.

Use Cases

Security Research & Testing:

• Malware analysis and reverse engineering practice
• Studying in-memory execution techniques
• Understanding Linux memory file descriptors and process manipulation

Penetration Testing (Authorized Only):

• Executing tools during red team engagements without leaving disk artifacts
• Bypassing basic file-based detection mechanisms
• Demonstrating memory-only execution techniques

Educational Purposes:

• Learning about Linux system calls (memfd_create, fexecve)
• Understanding encryption/decryption implementations
• Studying process forking and execution models

Software Distribution:

• Protecting proprietary binaries from casual inspection
• Embedding utilities within a single executable
• Creating self-contained tools with encrypted payloads

CTF Competitions:

• Packing challenge binaries
• Creating stealthy challenge infrastructure
• Practicing offensive security techniques

Quick Start

Assuming you want to encrypt and pack /usr/bin/socat:

1. Build the cryptor tool:

   make cryptor
   

2. Encrypt your binary:

   ./cryptor /usr/bin/socat payload.h enc_payload secret_passphrase
   

   This creates payload.h containing the encrypted binary as a C array.

3. Build the decryptor (links with payload.h):

   make decryptor
   

4. Run the decrypted binary from memory:

   ./decryptor secret_passphrase [arguments_to_pass_to_binary...]