@subvisor

... rs, and the fields after can be overwritten. This allows for a program header overlay at 0x38, shrinking the combined header size from 120 to 112. In @subvisor's write up about this trick [1], e_ehsize was set to 0x38 to reflect the total size of the ELF header. The fuzzing attempting before showed that this can actually be any number, because the ELF loader assumes that you're following the spec. Check out their post for more info about this and other fun things! REFS: [1] https://ftp.lol/posts/small-elf.html 3.2 The 0x31 Overlay This was first publicly demonstrated by Twitter user @f1ac5, who posted a binary [1] that printed ...