ulexecve

ulexecve is a userland execve() implementation which helps you execute arbitrary ELF binaries on Linux from userland without the binaries ever having to touch storage. This is useful for red-teaming and anti-forensics purposes.

Systems & Infrastructure

Explore on GitHub Read Hacker News discussions

2Distinct people

2Mentions

0Explicit recommenders

217GitHub stars

REPOSITORY AT A GLANCE

What to know before exploring

What it is

GitHub

Where it is used

No documented product use has been verified yet.

What people are saying

No recommendation phrase was found in the indexed comments.

No classified warning is attached to this page. Read the discussions before treating silence as approval.

Also in these discussions

No other repository is repeatedly linked in the same discussions.

This week on Hacker News

Nov 7–Nov 14 UTC · Direct repository links and separately labeled related project stories. Indexed through 11/14/2026, 1:49:46 PM UTC.

No direct repository links were found in the indexed HN discussions over the past seven days. Older discussions are available below.

Mentions over time

HN mentions by hour2 dated mentions

Observed mentions: 2022-11-03 05:18:16 UTC to 2022-11-03 06:43:58 UTC.

Counts come from the repository’s dated source evidence. Index cutoff: 2026-11-02 08:16:59 UTC.

View mention counts and date ranges

UTC ranges include their start and exclude their end. Select a period to filter the source evidence.
Period	Start (UTC)	End (exclusive, UTC)	Mentions	Submissions	Comments
Nov 3, 05:00	2022-11-03 05:00:00 UTC	2022-11-03 06:00:00 UTC	1	0	1
Nov 3, 06:00	2022-11-03 06:00:00 UTC	2022-11-03 07:00:00 UTC	1	0	1

What Hacker News says

2 sources

meandmymey234·Nov 3, 2022

Definitely tricky. I solved it with a Python implementation by building up a big jumpbuffer so that the moment I leave Python-land I copy from temporary buffers to the right addresses and then ultimately jump at the entry point of the newly loaded binary. It's tricky and took quite some debugging to get right, but it's proven rather solid now. See https://github.com/anvilsecure/ulexecve/blob/main/ulexecve.p... for details. Especially the `CodeGenerator` classes with implementations in x86, x86-64 and aarch64.

In Can I exec a new process without an executable file? (2015)

ohwutwathere·Nov 3, 2022

Correct but in lots of scenarios (containers etc) you cannot execute ptrace() but you can execute mmap(), mprotect(), read(), write() which is all you really need. Edit: and fork(). See something I published just a month ago: https://github.com/anvilsecure/ulexecve/

In Can I exec a new process without an executable file? (2015)