Nyxelf – static and dynamic ELF malware analysis

Nyxelf is a graphical analysis framework for investigating suspicious Linux ELF binaries with static and dynamic techniques.

It combines established binary-analysis utilities and Python libraries with a custom QEMU sandbox, giving analysts one environment for inspecting executable structure, observing runtime behaviour and translating machine code into more readable forms. The program is aimed specifically at Linux malware and ELF reverse engineering, with a PyWebView interface used to present results. Its dynamic workflow uses a small Buildroot-generated guest image so potentially hostile binaries can be examined away from the analyst’s normal system.

This is free and open source software.

Key Features

• Inspects ELF headers, sections, symbols and variable data as part of static analysis.
• Uses readelf, objdump and pyelftools to gather structural information about executable files.
• Disassembles binaries and produces C-like pseudocode with Capstone, radare2/r2pipe and angr.
• Attempts to recover useful data from read-only and data sections.
• Runs targets inside a QEMU-based sandbox built from a minimal Buildroot image.
• Uses bpftrace to record process activity, system calls, file interactions and selected kernel tracepoints.
• Captures network activity with tcpdump and can preserve packet captures for later inspection.
• Incorporates Valgrind into the dynamic-analysis environment for additional runtime observations.
• Can attempt automatic unpacking of UPX-compressed binaries before analysis.
• Provides adjustable syscall-trace verbosity, string-length filtering and options to write QEMU logs to files.
• Includes optional generative-AI summarisation of dynamic-analysis traces; this is a user-selectable feature rather than a requirement for the core workflow.
• Presents analysis through a graphical interface with syntax highlighting for easier inspection of low-level output.

Website: github.com/M3rcuryLake/Nyxelf
Support:
Developer: Ankit Mukherjee
License: MIT License

Nyxelf is written in Python. Learn Python with our recommended free books and free tutorials.

Related Software

Read our verdict in the software roundup.

LinuxLinks helps you discover the best free and open source software for Linux. Explore our extensive collection of recommended applications, including alternatives to popular proprietary software. We also publish software reviews, Linux tutorials, hardware reviews, free programming books and articles covering the wider open source community. Browse our Linux resources to discover more. Know a useful free and open source Linux application we haven't covered? Suggest a program for inclusion. Has your software been featured on LinuxLinks? Display one of our Featured on LinuxLinks badges on your website or GitHub README.