How to SUCCESSFULLY add a code section to an executable file in Linux?

Question

I am in Linux, and I have seen this question a few times but never, nobody answered how to really make this work.

I need to add a section to an already compiled binary. Lets say for a moment is an ELF file. I'm using objcopy so this should be generic for any format because objcopy uses libbfd that handles many formats.

My process is as follows.

I create the bytecode for a section I want to append to an already compiled ELF file. Let's name this file bytecode.bin

Then I do:

objcopy --add-section .mysection=bytecode.bin \
--set-section-flags .mysection=code,contents,alloc,load,readonly \
myprogram myprogram_edited

Then I adjust the VMA of the secition:

objcopy --adjust-section-vma .mysection=$((16#XXXXX)) myprogram_edited myprogram_edited

Where XXXXXX is the new VMA address for the section.

I get the warning:

objcopy: stIbZt3t: warning: allocated section `.mysection' not in segment

When I do:

objdump -d myprogram_edited

I see:

Disassembly of section .mysection:

0000000000201011 <.mysection>:
...
...

So I see the section is created OK and the VMA adjusted. But the section is not mapped to segments, so it can't be loaded at runtime.

How can I solve this?

EDIT:

I opted for using Intel's PIN tool. Very useful and powerful for RI and binary injection.

Answer 1

libbfd is not a magic wand, it is in fact pretty limited (it's one of the reasons why GDB cannot debug files without a section table). In particular, objcopy won't add PHT entries for you, so you will have to extend or adjust the PHT manually. You can either do it manually with a hex editor or try using a library such as libelf (it gives you necessary primitives but you'll need to implement the logic yourself).

Answer 2

Maybe you can look at LIEF:

GitHub page: https://github.com/lief-project/LIEF

Site: https://lief.quarkslab.com

Answer 3

I ended up using Intel PIN

Edit: I know this isn't actually an answer to the question. I was trying to change the behavior of a native executable and thought that I needed to change the binary on disk, when actually a binary instrumentation tool was enough for my purpuse.