ZayoELF Analyzer

ZayoELF is a static ELF analysis tool built with pyelftools and rich. It inspects a binary without executing it and presents header, section, segment, symbol, and dynamic tag information in a readable terminal format or exports it as JSON. The tool also implements several security checks found in utilities such as checksec and readelf, including NX, PIE, RELRO, and Stack Canary detection.

Purpose

This project was developed to make ELF file structures easier to understand and to document and accelerate static analysis workflows.

Technologies

• Python 3
• pyelftools
• rich

Installation

pip install -r requirements.txt

Usage

Standard terminal output:

python3 zayoelf.py /bin/ls

To save the output in JSON format:

python3 zayoelf.py /bin/ls --json rapor.json

Features

• File Information: MD5, SHA1, and SHA256 hashes; interpreter path; build ID; and ABI tag details.
• ELF Header: Core header information including class, endianness, type, and entry point.
• Security Mitigations: PIE, NX, RELRO (Full/Partial/None), Stack Canary, and Stripped status.
• Dynamic Tags: RPATH, RUNPATH, SONAME, and DT_NEEDED dependency information.
• Symbol Statistics: Local/Global/Weak counts and separation of imported and exported symbols.
• Entropy Analysis: Shannon entropy calculation for every section header.
• Critical Weakness Detection: Dedicated warnings for segments marked both writable and executable (RWX) and sections marked W+X.
• String Extraction: Extracts printable ASCII strings from the binary.
• Suspicious Import Scanning: Checks the symbol table for libc functions commonly found in malware, including system, ptrace, execve, and socket.

Limitations

• Performs static analysis only and does not execute the binary in memory.
• Calculates entropy per section rather than providing a single entropy value for the entire file.
• Uses a simple regular expression for string extraction and does not provide every feature available in GNU strings.
• Some symbol-based checks, such as stack canary detection, may be incomplete for stripped binaries whose symbol tables have been removed.

Example

python3 zayoelf.py /bin/bash

The tool displays the following information in order:

1. File information and hash values
2. ELF Header
3. Security Mitigations (Checksec)
4. Critical Findings and Warnings, if any
5. Symbol Statistics
6. Section and Segment Tables
7. Dependent Libraries
8. Noteworthy Imported Functions
9. String Preview and Statistical Summary