# ELF, Mach-O, And Unix Payload Playbook

Load this playbook for Linux ELF, macOS Mach-O, fat Mach-O, Unix shell payloads, embedded shell scripts, and Unix-side loaders.

## Tools

Preferred: `file`, hash tooling, `strings`, `rg`, `yara`, `objdump`, `llvm-objdump`, `readelf`, `nm`, `rabin2`, `r2`, `binwalk`, `7z`, `exiftool`, `python3`.

macOS-specific: `otool`, `lipo`, `codesign`, `spctl`, `plutil`.

Useful: Ghidra headless `analyzeHeadless`, `upx`, `capa` when applicable.

Ask before installing missing blocking tools.

## Workflow

1. Identify ELF/Mach-O/fat Mach-O/script/wrapper format, architecture, endianness, interpreter, libraries, symbols, sections, segments, entry point, rpaths, entitlements/signature where applicable, entropy, overlays, and packing.
2. Extract strings and search URLs, domains, IPs, user agents, paths, shell commands, credentials, tokens, crypto material, config paths, persistence names, and fallback infrastructure.
3. Inspect imports/symbols/xrefs for sockets, DNS, HTTP/TLS, curl/libcurl, OpenSSL/CommonCrypto, compression, process execution, ptrace/debug checks, VM/sandbox checks, privilege, and file operations.
4. Inspect embedded archives, scripts, configs, plists, launch agents, service files, cron entries, shell profile edits, systemd units, login items, and hidden paths.
5. Use `r2`, `rabin2`, `objdump`, `readelf`, `otool`, and Ghidra headless to trace C2/config construction, decoder logic, and stage loading.
6. Reconstruct XOR, RC4, AES, custom encodings, compression, path construction, and shell command generation with deterministic helper scripts.
7. If a stage URL is authorized for retrieval, download it using parent logic and analyze it as a new stage.
8. Save extracted scripts, plists/service files, configs, decoded infrastructure, native-library notes, disassembly/decompiler notes, and stages.

## Edge Cases And Anti-Loop Rules

- Follow the core Token Budget And Anti-Loop Mode.
- Never execute ELF, Mach-O, shell payloads, launch agents, service files, or extracted scripts.
- If one parser fails, switch to `readelf`, `objdump`, `rabin2`, `r2`, `otool`, `lipo`, Ghidra, `binwalk`, or raw carving.
- Do not claim unpacking/decompression/config recovery unless the artifact has type, size, hashes, and readable structure.
- Verify plist/launch agent/entitlement/codesign evidence on macOS and cron/systemd/init/profile evidence on Linux before claiming persistence.

## Report Requirements

Include binary type, architecture, linked libraries, persistence artifacts, C2/drop/stage URLs with origin, shell commands, decoder algorithms, embedded or downloaded stages with hashes, family/toolkit candidates, confidence, and limits.