I have a CTF related question and I was wondering if someone can point me to the right direction.

I work on OSX Yosemite and I was going through some wargames and older CTF challenges. My goal is to execute the ELF binary of the challenge "natively" into my iterm (after I scp it locally) although I realize that only MACH binaries may be executed by the underlying system.

Nevertheless, is such a thing possible through emulation perhaps (e.g. QEMU), or any other method, in order to avoid opening a whole VM just to run a binary?

Thank you in advance.

migrated from security.stackexchange.com Aug 28 '15 at 23:15

This question came from our site for information security professionals.

  • This issue is relevant to security as it is found mostly in security CTFs and wargames (that's how i got stuck on this). I believe that the security community has higher chances of coming across this specific topic. I will try there as well though. – nilminus Aug 28 '15 at 20:14
  • 3
    Your question is not about security, it is about running binaries. – Neil Smithline Aug 28 '15 at 20:37

On its own, ELF binaries mean nothing. Few binaries run alone - You'd need supporting libraries, APIs and ABIs and other shiny things.

When running QEMU you still need most of the OS - just that its not tied as closely with the host system I suspect.

In theory if you had something like 'wine' but acting as a linux(or other *nix syle OS) -> OS X compatibility layer you could get what you want, but such a beast does not exist.

SO no, you can't run an arbitary, precompiled ELF binary on OS X

  • 1
    this question regards a security scenario that's rather niche in the superuser space. imagine a static binary (libs compiled into the image rather than dynamically linked) that an attacker wants to place on a target system and run (that's a basic CTF security game scenario). it won't need external libs, though your point about ABIs (eg syscalls) is a fair one. you're right in the general case, but this question is specifically not about the general case. imho it shouldn't have been moved from the security site. – quixotic Feb 12 '17 at 0:40

The answer is probably: Depends on how the ELF file was generated.

Based on this article, and this sentence:

  • A common misconception is that ELF files are just for executables...
  • We already have seen they can be used for partial pieces ...

Not all ELF files will be executed, even if you have a proper setup.

Based on this article, there is a group pf ELF files called FatELF:

  • FatELF is a file format that embeds multiple ELF binaries for different architectures into one file
  • Ship one file that works across Linux and FreeBSD

Based on this page from Apple

  • The BSD portion of the OS X kernel is derived primarily from FreeBSD

So, for Mac OS X, FatELF is the "beginning of the answer".

And finally, based on this page:

Object file converter

This utility can be used for converting object files between COFF/PE, OMF, ELF and Mach-O formats for all 32-bit and 64-bit x86 platforms. Can modify symbol names in object files. Can build, modify and convert function libraries across platforms. Can dump object files and executable files. Also includes a very good disassembler supporting the SSE4, AVX, AVX2, AVX512, FMA3, FMA4, XOP and Knights Corner instruction sets. Source code included (GPL).

You have a chance to active what you want.

PS: there is another page about XBinary, I didn't analyze it.

This document discusses XBinary, a new software that lets you add kernel-level support for executing files in arbitrary binary formats on Mac OS X

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.