# NullSection | An Anti-Reversing Tool That Applies A Technique That Overwrites The Section Header With Nullbytes **URL:** \ **Category:** Tools & Scripts\ **Tags:** tools\ **Created:** [February 26, 2024, 11:21pm UTC](https://onehack.st/t/nullsection-an-anti-reversing-tool-that-applies-a-technique-that-overwrites-the-section-header-with-nullbytes/276439 "2024-02-26T23:21:50Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![NoBody](https://onehack.st/user_avatar/onehack.st/nobody/32/163880_2.png) [@NoBody](https://onehack.st/u/NoBody)\ **Post date:** [February 26, 2024, 11:21pm UTC](https://onehack.st/t/nullsection-an-anti-reversing-tool-that-applies-a-technique-that-overwrites-the-section-header-with-nullbytes/276439/1 "2024-02-26T23:21:50Z")
![image](https://onehack.st/uploads/default/original/3X/f/1/f158d6cec5bb3430e9fbe83b11de1c2be096c0a0.jpeg) # NullSection NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes. ### Install ```auto git clone https://github.com/MatheuZSecurity/NullSection cd NullSection gcc nullsection.c -o nullsection ./nullsection ``` ### Advantage When running nullsection on any ELF, it could be .ko rootkit, after that if you use Ghidra/IDA to parse ELF functions, nothing will appear no function to parse in the decompiler for example, even if you run readelf -S / path /to/ elf the following message will appear “There are no sections in this file.” Make good use of the tool! #### Note ```auto We are not responsible for any damage caused by this tool, use the tool intelligently and for educational purposes only. ``` ## GitHub: > **[GitHub - MatheuZSecurity/NullSection: NullSection is an Anti-Reversing tool that applies...](https://github.com/MatheuZSecurity/NullSection)** > > NullSection is an Anti-Reversing tool that applies a technique that overwrites the section header with nullbytes.