Is it possible to add a label to an ELF executable and then call that label? If so, how?

Question

Let's say we have this simple "hello world" nasm code that will be compiled to an ELF executable:

global main

section .data
    message db "Hello World!", 0x00

section .text

main:
    call    hello
    ret

hello:
    lea     rdi, [rel message]
    call    puts
    ret
.end:

Is it possible to add a label called decrypt into the compiled ELF executable and then subsequently call it (with/without the source code)?

global main

section .data
    message db "Hello World!", 0x00

section .text

main:
    call    decrypt                              <---------------Addition
    call    hello
    ret

decrypt:                                         <---------------Addition
    DECRYPTOR_SECTION hello, hello.end-hello     <---------------Addition
    ret                                          <---------------Addition

hello:
    lea     rdi, [rel message]
    call    puts
    ret
.end:

Answer 1

I am not sure what your intent is.

If you mean you have to add a function and call it before main after the source is compiled, then yes it is definitely possible. All you have to do is run through some hoops like finding a code cave, assembling the new code in code cave, and detouring the first instruction of main to call your new function and return back to main's next instruction.

If you mean I want the function to be sequential then it might be possible if you can destroy and recreate the assembly in-place (kinda tough).

And no there is no label you need to calculate relative address / absolute address of the newly added function and use one form of e8 or ff25 call

Having source can help you in understanding the assembly but you have to play in assembly only if you have to patch a compiled executable.

A program prior to addition of encrypt proc will look like this (a simple msgbox in windows notice both caption and text are pointing to a string which is unintelligible)

You may need to implement the commented out source code inline for decrypting

.386
.model flat, stdcall
option casemap:none
include \masm32\include\windows.inc
include \masm32\include\kernel32.inc
includelib kernel32.lib
include \masm32\include\user32.inc
includelib user32.lib

.data
Encrypted   db 217,243,234,245,252,249,255,254,183,227,176,228,229
            db 228,255,226,249,241,252,176,254,255,190,162,144

.code
start:
    ;call decrypt
    call hello
    invoke ExitProcess,NULL

; decrypt proc
    ; xor ecx,ecx
    ; complete:
    ; lea esi , Encrypted 
    ; add esi,ecx
    ; movzx eax , byte ptr ds:[esi]
    ; xor eax ,090h
    ; mov byte ptr ds:[Encrypted + ecx], al
    ; add ecx,1
    ; cmp byte ptr ds:[Encrypted + ecx - 1 ],0
    ; jne complete
    ; ret
; decrypt endp


hello proc
    invoke MessageBox, NULL,addr Encrypted, addr Encrypted, MB_OK
    ret
hello endp 

end start

After you implement your decrypt proc some where in existing free space (called code cave) it may look like this

Now you have to destroy the first call jmp here decrypt add the code that you destroyed and jump back to the next correct sequential instruction post the destroyed code

CPU Disasm
Address       Command                                            Comments
00152000      XOR     ECX, ECX
00152002      /LEA     ESI, [154000]
00152008      |ADD     ESI, ECX
0015200A      |MOVZX   EAX, BYTE PTR DS:[ESI]
0015200D      |XOR     EAX, 00000090
00152012      |MOV     BYTE PTR DS:[ECX+154000], AL
00152018      |ADD     ECX, 1
0015201B      |CMP     BYTE PTR DS:[ECX+153FFF], 0
00152022      \JNE     SHORT 00152002
00152024      RETN