How to call a func in an executable binary?

Question

I have a binary with a func that I can disassemble. What are simple ways for me to call it with arbitrary args and observe its return val and behavior?

Ideally, I'd like to do this:

• Within gdb (or gdb-peda)
• From C (ie linking to the executable as if its a lib)
• Via Python scripts (I recall reading about a Python script to do this, but can't find it)

I'm operating on Linux, but this question is relevant to other OS as well.

Answer 1

LIEF

If the binary is a PIE, exporting functions via the LIEF binary instrumentation framework should allow you to call the function you are interested in as if it was a function in a shared object.

• Example: LIEF - Transforming an ELF executable into a library

LD_PRELOAD

If the binary is dynamically linked and contains code for setting up the standard C runtime environment e.g. __libc_start_main calling main(), you can hook these functions with LD_PRELOAD and interpose your own code via shared library injection which calls the target function directly with arguments of your choosing.

• Example: Modern Vulnerability Research Techniques on Embedded Systems
• Example: Hook main() using LD_PRELOAD

Qiling emulator

Using the Qiling emulator, you can record the state of the program and then replay the target function in GDB. Since the code is being emulated, it is straightforward to manipulate any aspect of the process' state (registers, memory, etc.)

• Example: qiling/examples/hello_x8664_linux_part_debug.py

DBI

Using Frida, Pin, DynamoRIO etc. you can basically make the program do what you want at run time, in this case hook a function, manipulate its arguments and observe the subsequent behavior.

• Example: Getting Started with Frida : Hooking a Function and Replacing its Arguments
• Example: Pin 3.21 User Guide: Finding the Value of Function Arguments

Trampolining with e9patch

e9patch is a static binary rewriting tool that allows one to change/insert code prior to run time.

• Example: e9tool user guide
• Example: e9afl

There are probably even more ways to do this, such as process snapshotting with ptrace and /proc and then manipulating registers and memory with ptrace, emulation with PANDA, emulation with Unicorn, emulation with QEMU, possibly even ELF parasite code or inserting code that calls the target function using LD_PRELOAD together with __attribute__ ((constructor)) injected_function(). You have a lot of options.