<p>I've normally seen this when analyzing malware.  The authors do this to to prevent static analysis tools like <code>strings</code> from working.  Additionally, such authors might load functions by using <code>dlopen</code> and <code>dlsym</code> to get functions that they need.</p>

<p>For example, in the code snippet below;</p>

<pre><code>printf("Hello World");
</code></pre>

<p>I would see the string "Hello World" in the output of <code>strings</code> and by looking at the import section of the elf file, I'd see that the program is making use of <code>printf</code>.  So without running the program it is possible to get a sense of what it is doing.</p>

<p>Now lets assume that the author wrote a function <code>char* decrypt(int)</code>.  This function take an index into a sting table (which each string is encrypted) and returns the decrypted string.  The above one line of code would now <strong>notionally</strong> look like</p>

<pre><code>void* pfile = dlopen(decrypt(3));
void* pfunct = dlsym(pfile, decrypt(15));
pfunct(decrypt(5));
</code></pre>

<p>Again, remember that the above is closer to pseudo-code then actually compileable code.  Now in this case using static analysis tools we would not see the strings or the function names (in the import section).  </p>

<p>Additionally, if we were attempting to reverse engineer the code we would need to take time to decrypt the strings and work through the logic to determine what functions are being called.  It's not that this can't be done but it will slow down that analyst, which means that it will be longer till a mitigation for the malware is created.</p>

<p>And now to your question;</p>

<blockquote>
  <p>Are there easy ways to hide text that is compiled into an ELF? Be that
  with easy compiler/linking options. I imagine a decoder could be
  inserted at main() but how could the text section be easily encoded?</p>
</blockquote>

<p>There is not compiler / linker option that does this.  The author of this would need to choose to do this, write the appropriate functions (i.e. decrypt) above and write a utility to produce the encrypted forms of the strings.  Additionally, as others have suggested once this is done, the entire application can be encryped/compressed (think of a self-extracting zip file) thus the only thing you see initially with static analysis tools would be the stub to decrypt of decompress the file.</p>

<p>see <a href="https://www.ioactive.com/pdfs/ZeusSpyEyeBankingTrojanAnalysis.pdf" rel="nofollow noreferrer">https://www.ioactive.com/pdfs/ZeusSpyEyeBankingTrojanAnalysis.pdf</a> for an example of this.  (granted this is Windows based, but the techniques for encryption and dynamically loading functions is the same.  Look at section on API calls)</p>

<p>If interested you can also see; <a href="https://www.researchgate.net/publication/224180021_On_the_analysis_of_the_Zeus_botnet_crimeware_toolkit" rel="nofollow noreferrer">https://www.researchgate.net/publication/224180021_On_the_analysis_of_the_Zeus_botnet_crimeware_toolkit</a> and <a href="https://arxiv.org/pdf/1406.5569.pdf" rel="nofollow noreferrer">https://arxiv.org/pdf/1406.5569.pdf</a></p>
How to basically encrypt text in an ELF binary?
<p>I've seen some binary files where the developer was a bit paranoid it seems and obfuscated all text in a binary. I hadn't seen anything like it before and didn't find any obvious options to compile an ELF with hidden text. Even standard OS API strings were hidden which was strange given they are usually visible.</p>

<p>These programs wouldn't exactly have any text that isn't exposed when it runs. Except unknown text. But hiding the whole lot just red flags and it makes it look suspicious.</p>

<p>Are there easy ways to hide text that is compiled into an ELF? Be that with easy compiler/linking options. I imagine a decoder could be inserted at main() but how could the text section be easily encoded?</p>

<p>I can imagine a custom way to do it would be to have an implicit decoder in the code with a key. Then use that key to encode text of the ELF. So that it is easily encoded.</p>