2

I want to patch an ELF executable to insert a function call (the function s2e_rawmon_loadmodule and its dependencies are to be linked statically, preferably) at the beginning.

This answer seems to have a nice set of pointers. If I have understood correctly, dynamic instrumentation using PIN/Valgrind/DynamoRIO alters the address space. The addresses of the subsequent instructions get changed which I don't want.

For static instrumentation, ERESI project could have been useful. But, it looks like the project has been abandoned for long. I am not being able to build the tool on Ubuntu 14.04 due to compilation issues.

Can anybody help me out with some workaround?

Improve this question
9
  • I don't understand if the function you want to call is already in the binary or not, and/or if you want to modify just one binary or to design a generic way to do it. I'd say you could just create a new section manually, drop your code in it (and the first few instructions of OEP), and put a JMP at the OEP.
    – user2823000
    Commented Sep 22, 2015 at 9:14
  • would you post the link to your compilation issues ?
    – w s
    Commented Sep 22, 2015 at 9:26
  • OK, I built it on ubuntu 14.04. The only issue I encountered was usage of word __unbounded in entry.c which ( word __unbounded) can be freely removed without any problem.
    – w s
    Commented Sep 22, 2015 at 9:40
  • @ws Yes, it works fine with __unbounded deleted. But, does that affect the functionality anyway?
    – sherlock
    Commented Sep 22, 2015 at 10:14
  • @Dillinur No, the code does not reside in the binary.
    – sherlock
    Commented Sep 22, 2015 at 10:14

1 Answer 1

Reset to default
1

It seems that you're trying to run some code in the context of the binary before anything meaningful happens.

You should read some resources about ELF infection, for example on vxheavens or here.

But since you're trying to inject/execute s2e_rawmon_loadmodule from s2e, maybe you should just use a debugger instead, because I'm quite sure that this is not how it's supposed to be used.

Improve this answer
2
  • How come a debugger help me in injecting a function while the target binary is running on a Debian guest inside s2e framework? Of course, s2e_rawmon_loadmodule is supposed to be used while source is available. In my case, source is missing, only binary is assumed to be present.
    – sherlock
    Commented Sep 23, 2015 at 1:38
  • 2
    Because you didn't mentioned that the software was running on a host inside the s2e framework ;)
    – jvoisin
    Commented Sep 23, 2015 at 17:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.