linker-fake-load-unwrapper

Use when analyzing Android AArch64 ELF files protected by a special linker-style fake PT_LOAD wrapper, impossible high-address LOAD segments, entry-point translation such as e_entry minus fake p_vaddr, XOR runtime decryptors, embedded ELF carving, shell-looking ELF second stages, or when a user mentions linker 加固/脱壳/通杀. Provides static and dynamic workflows…

Independent GitHub snapshot · Automated classification · Original documentation governs