Show HN: A (marginally) useful x86-64 ELF executable in 301 bytes • Hacker News Board

Re: Show HN: A (marginally) useful x86-64 ELF executable in 301 bytes

#21

Post by auguzanellato » Fri, Apr 10, 2026, 6:31 AM UTC

benj111 wrote: post #17

bregma wrote: post #11

As always with these admirable hacks, I feel compelled to point out these are not really ELF executables but just small files you can trick the x86_64 Linux kernel into loading. I mean they're very clever and legit and kudos to the people who develop these exploits, but they're not ELF.

I'd agree it's not standards compliant. But if it's accepted as an ELF by Linux, in what way is it not an ELF? Or to flip it round. If Linux accepts something as an ELF that isn't, then it isn't an ELF loader. Would you describe a web browser that doesn't score 100% on a rendering test as not a browser?

The analogy would be more like a browser that somehow manages to render utterly broken HTML (yes, they actually do)

Re: Show HN: A (marginally) useful x86-64 ELF executable in 301 bytes

#22

Post by meribold » Sat, Apr 11, 2026, 7:58 PM UTC

anonymous67453 wrote: post #15

Dell 5440 $ git clone https://github.com/meribold/btry ... $ make as -mx86-used-note=no btry.s -o btry.o objcopy -O binary btry.o btry chmod +x btry $ ./btry Segmentation fault ./btry $ strace -f ./btry execve("./btry", ["./btry"], 0x7ffc1a562078 /* 57 vars */) = -1 ENOMEM (Cannot allocate memory) $ file btry btry: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), statically linked, corrupted section header size

I fixed the most likely culprit now (excessively large p_memsz value). It cost a few bytes; the new executable size is 307 bytes.

Re: Show HN: A (marginally) useful x86-64 ELF executable in 301 bytes

#23

Post by meribold » Sat, Apr 11, 2026, 8:15 PM UTC

qcoudeyr wrote: post #18

This commit ( https://github.com/meribold/btry/commit/75cba2be52cc8fbdc72b... ) worked for me !

The new latest version (commit 806789e4d454b, 307 bytes) should also work. It no longer sets p_memsz to something unreasonably large, which was most likely the issue with the 301-byte and 298-byte versions from a few days ago.