I have a powerpc computer that takes ELF files for its code. I have made a tool that allows me to extract and inject segments successfully, but I am missing a small piece of information regarding the modifications I would like to make. How can I call the original code, and how can I store the variables that need to be global?

I can change where the exported functions point, which is all I need to enable the changes that I want. I am not completely sure how I should implement the stub for the functions in ASM to call some C code without messing with the stack or registers unless I explicitly want that to happen. My thought is to make a few small functions that branch out to a second stub that would handle all the state management to prepare for the C code. I was thinking I can use this "dual stage stub" in order to have the first part of the originalText+function*4 and do some easy math for that, and only need to change the exported functions whenever I add/remove a hooked function.

Edit: I figured I should add some clarification to this. I mainly want to have the program connect to a remote device and log some stuff. So I require an active socket connection to be maintained using method calls. I am also using a proprietary OS that has a slightly modified ELF format, but the only extra is the zLib compression.

Edit 2: Ok, I understand the calling better. I was overcomplicating this some, just need the one branch. I also found an address to stick a malloc'd pointer for my data. Now all I need to figure out is how to get GCC to do a relitave jump when calling an address with a PIE. Since I am tacking my code on the end I know I am X away, but I do not know the real address because my exacutable can move in memory.

1 Answer 1


Ok, after more research I came up with an answer to this problem.

You only need the one branch handler, since I could branch into the C code just fine because they share the same calling method.

I ran out of space in the text segment before memory was getting mapped over my code, so I had to do some more invasive things via a different method.

Now to make GCC play nice with the relative function calls I told it my code was located at 0x00000000+sizeof(.text) so it would use relative branches to the elf and absolute to the system stuff that does not move.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.