Nyxelf – static and dynamic ELF malware analysis

Nyxelf is a graphical analysis framework for investigating suspicious Linux ELF binaries with static and dynamic techniques.

It combines established binary-analysis utilities and Python libraries with a custom QEMU sandbox, giving analysts one environment for inspecting executable structure, observing runtime behaviour and translating machine code into more readable forms. The program is aimed specifically at Linux malware and ELF reverse engineering, with a PyWebView interface used to present results. Its dynamic workflow uses a small Buildroot-generated guest image so potentially hostile binaries can be examined away from the analyst’s normal system.

This is free and open source software.

Key Features

• Inspects ELF headers, sections, symbols and variable data as part of static analysis.
• Uses readelf, objdump and pyelftools to gather structural information about executable files.
• Disassembles binaries and produces C-like pseudocode with Capstone, radare2/r2pipe and angr.
• Attempts to recover useful data from read-only and data sections.
• Runs targets inside a QEMU-based sandbox built from a minimal Buildroot image.
• Uses bpftrace to record process activity, system calls, file interactions and selected kernel tracepoints.
• Captures network activity with tcpdump and can preserve packet captures for later inspection.
• Incorporates Valgrind into the dynamic-analysis environment for additional runtime observations.
• Can attempt automatic unpacking of UPX-compressed binaries before analysis.
• Provides adjustable syscall-trace verbosity, string-length filtering and options to write QEMU logs to files.
• Includes optional generative-AI summarisation of dynamic-analysis traces; this is a user-selectable feature rather than a requirement for the core workflow.
• Presents analysis through a graphical interface with syntax highlighting for easier inspection of low-level output.

Website: github.com/M3rcuryLake/Nyxelf
Support:
Developer: Ankit Mukherjee
License: MIT License

Nyxelf is written in Python. Learn Python with our recommended free books and free tutorials.

Explore our comprehensive directory of recommended free and open source software. Our carefully curated collection spans every major software category. This directory is part of our ongoing series of informative articles for Linux enthusiasts. It features hundreds of detailed reviews, along with open source alternatives to proprietary solutions from major corporations such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. You’ll also find interesting projects to try, hardware coverage, free programming books and tutorials, and much more. Discovered a useful open source Linux program that we haven’t covered yet? Let us know by completing this form.