3 ms·
But the readme says: The payload executable is extracted to a temporary file. When running as root, this is done by mounting a tmpfs file system and lazily unm
by adito 7y ago
But the readme says:
The payload executable is extracted to a temporary file. When running as root, this is done by mounting a tmpfs file system and lazily unmounting it before the extraction.
- dimkr1 7y agoWhen not running as root, it doesn't use a tmpfs. Also, papaw replaces /proc/self/exe with an empty file. And it has some basic anti-debugging, like locking of the payload to RAM so it cannot be recovered by reading it from a swap partition.