I've hex-edited a string in an Android ELF binary.
Now, it won't run, and gives the error message CANNOT LINK EXECUTABLE, presumably due to a bad checksum.
Does anybody have a tool to fix the checksum?
-
Did You replaced string in ELF with SAME SIZE string, or add a different amount of bytes? Can You test the concept by replacing this string with something with same size and execute it? – Denis Laskov Apr 10 '13 at 17:47
-
1Would this actually be an Android ELF file? – 0xea Apr 10 '13 at 20:42
-
Can you attach the output of objdump -x and readelf -a of the file? – ŹV - Apr 10 '13 at 23:53
-
It's an android ELF. – user1636717 Apr 11 '13 at 8:07
Add a comment
|
ELF itself doesn't specify any kind of checksum. Your link error is likely due to an incorrect edit which changed some offsets within the file. If you don't adjust the offsets, you have to replace a string with a string that is no longer than the original, and you cannot add new fields unless you have a known amount of slack space available.
Use readelf -a to check the ELF file headers, and compare old with new.
-
It wasn't the string I edited it was a symbol name with the same name :-O. Bad luck and me not checking if my constant appears more than once in the file. – user1636717 Apr 11 '13 at 9:07
I'd suggest using HT Editor for all your ELF fun.
HT is a file editor/viewer/analyzer for executables. The goal is to combine the low-level functionality of a debugger and the usability of IDEs. We plan to implement all (hex-)editing features and support of the most important file formats.
That's what it's made for. There are other tools of course.
-
-
not sure what checksum is user1636717 speaking of really, that's why i asked what kind of ELF is it – 0xea Apr 10 '13 at 20:52
