I have an ARM executable binary file and I want to patch it at precise virtual addresses. Is there any safe (and automated) way to perform this task ?

Any scripts or tools are welcome!


If you are on linux a simple group of commands as readelf, printf and dd can do the job.

For exemple if you have the binary MyBin in elf format and you want to patch the following condition located at 0x418966 in memory :

jnz     loc_418706 ; 0x418966: 0f 85 9a fd ff ff

Firstly you must to find informations about the .text section of the binary file:

$ readelf --wide -S MyBin | grep '.text\|Name\|Off'
  [Nr] Name              Type            Address          Off    Size   ES Flg Lk Inf Al
  [13] .text             PROGBITS        0000000000414670 014670 0dfa82 00  AX  0   0 16


  • the .text section start in the binary file at 0x014670
  • the .text section is loaded in memory at 0x414670

Then you must Compute the instruction offset in the binary file relative to the .text section:

0x418966 - 0x414670 = 0x42f6
0x014670 + 0x42f6 = 0x18966

Here the instruction to patch is located at 0x18966 in the binary file.

Here I patch the binary with a nop and a near jump (jmp e9 [cd]). printf '\x90\xe9' | dd of=MyBin bs=1 seek=100710 count=3 conv=notrunc

Have fun ;)

  • why do I need the .text section? do you know tool for windows? – ida Mar 13 '18 at 19:47

You need to know information about the .text because the executable code is classicaly store in this section if the binary is not obsucated or custom compiled. I think you need to learn about what is a binary file and how it is loaded in memory.

  • I talking about embedded my binary not run on linux/windows – ida Mar 13 '18 at 20:52
  • But there is no OS in your embedded system? Expose the system entirely? Maybe you are working with a firmware, if it document, learn about what is the file format of the binary and how it is loaded in memory, the basic !! If there is not doc, it's more hard and time consuming, full reverse – user23611 Mar 13 '18 at 21:22

Not the answer you're looking for? Browse other questions tagged or ask your own question.