Adding code to an existing ELF file

https://dropbear.sh/blog/elf-patching.html

by dropbear3 • 4 years ago

103 9 4 years ago

eatonphil• 4 years ago

Very neat! Less hacky than I expected. It looks like it all just reads in the ELF file, makes the change to the ELF data structures in memory and then writes back out a new ELF file?

sim7c00• 4 years ago

looks like a neat way around the hell of patching relocations. though, if you'd want to modify the binary arbitrarily and not hijack sections or such things, it might be nice to look into that.

garaetjjte• 4 years ago

When I needed to "destatify" executable, to patch statically compiled library functions to shared imports I used LIEF library: https://milek7.pl/.stuff/galdocs/destaticizer.py

OnlyMortal• 4 years ago

Code can also be added to mach-o binaries. An old OSX copy protection system did this.

nneonneo• 4 years ago

I've had great success using Frida (https://frida.re/) to do stuff like this recently. Frida injects a V8 runtime into the target process, enabling you to use JavaScript to dynamically patch/inspect/modify code and data, with all of the JavaScript running inside the target process so there's minimal impact on performance. They provide a nice Python API for remotely controlling the process.

It works on rooted devices, debuggable apps, and can also be added to an existing APK with minimal effort (just patch a single Java class and add a native library - there are scripts to do it for you).

franga2000• 4 years ago

Just a year or two ago I would've laughed at the idea of using an injected JavaScript engine to do dynamic instrumentation, but now I rarely go a week without using Frida for either work or personal projects and enjoy every moment of it.

It's one of those tools that is clearly made by someone who completely gets how it's going to be used. Every time you want it to do something "new", it turns out there's already a short paragraph in the docs that you skimmed over explaining either how to do it or pointing you at an "extension" that can.

randomhodler84• 4 years ago

This is a great write up dropbear, I learned a few things! Please keep blogging, this is some quality content!

Diggsey• 4 years ago

That's cool :) I think it would be a lot easier to inject the payload at runtime though - the only problem I had when doing this was I got the wrong instruction set initially (thumb vs non-thumb).

lajun• 4 years ago

Could you share your method?

Adding code to an existing ELF file

Related Stories