dynamic linkers


  • shell dropping: cp $0 /tmp/M;(sed 1d $0|lzcat)>$_;exec $_;
  • fishypack : In-memory memfd/execveat-based decompressor (Deprecated in favor of vondehi)
  • vondehi: Next-generation in-memory memfd/execveat-based decompressor (See list of known bugs)
    • autovndh: script that bruteforces all possible gzip/lzma/xz/... options and automatically places a vondehi decompression stub at the beginning
  • oneKpaq: Generic PAQ-based (de)compressor for 32-bit x86


  • ghostsyn
  • 4klang, ForkedKlang . Note that the replayer code is 32-bit only! You'll need some hacks to make it work on 64-bit.
  • Clinkster, replayer is 32-bit only as well.
  • Oidos, replayer is once more 32-bit only.
  • Axiom is "supposed" to work

See here for some synth example setup code, together with some Linux-specific patches to get some of the replayers to work.