5

Basically I want to replace MOVS R1, #0x0 with MOV.W R1, #0x123, since later instruction requires 4 bytes it is impossible to simply replace in HEX code.

I am using IDA Pro for analyzing native android library. I read about codecaves but my text segment don't have free space to add new data.

Since i'm newbie to this, any tutorials are welcome.

1 Answer 1

7

As you need just 2 more bytes, you don't need a large code cave. Out of the box, there are four things you can try:

  • It's very likely you have a function or 2 in your text segment that are present in some source code, but never called. Look for loc_XXXX labels that have the standard function prefix (push ....,LR) and the suffix (pop ....,PC) a few dozen bytes later. Reuse these functions for your code cave.
  • Check if there are any redundant instructions in your code. Maybe you can omit 2 bytes somewhere nearby and move the rest around.
  • Often, function starts are aligned to 16 byte boundaries. There might be a few spare bytes between your current function and the next. These can show up like nop.w in assembly, or f3af 8000 in hex.
  • You could use the text of a rarely used error message for your code cave. Replace "ThisIsALongErrorMessage\0" with "LongError\0" and you've gained some bytes, at the expense of the clarity of an error message you're never likely to see anyway. This is a bit harder, since your text is probably in some section that isn't marked executable, and you'll have to fiddle with the ELF headers to fix this.
1
  • Thanks.. I've found some debugging messages in same function so i'll omit calls to __android_log_print for getting some space. Jun 8, 2015 at 12:31

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.