0x09. Forensics

There are various motivations for infecting binary files. On the positive side, Blue Army can achieve binary protection through binary patching; On the contrary, the Red Army can achieve viruses, botnets, and backdoors through binary infections. Elfspirit has initially implemented the function of checking whether binary files have been modified. For deeper checks, readers need to use reverse engineering or our written IDA plugin to directly check dangerous instructions such as trampoline functions.