0

I'm not sure about all tools. But afaik at least with Frida functions are patched and new code is added to other memory regions and then jumped to. The rest of the code layout stays the same. Is there any dynamic instrumentation tool which kind of shifts code. For example instead of jumping to a different region instructions are added before or after a function. Since this would shift addresses it won't work by default. You need to calculate new addresses. Can any tool handle that?

1

Doing it that way is harder to automate since the tool will need to adjust many local relative addresses (function calls, data access, etc).

It may be technically possible but might depend on availability of code cave locations and unused section alignments.

Doing so dynamically (which is what Frida is used for) has the additional difficulty of requiring this to happen atomicly. Think of what'll happen if while you're moving a function to make more room for your hook, that function is called in another thread - this will break the execution.

It is often a lot easier to just create a remote stub and jump to it, why isn't that enough?

2
  • The background was less about "standard" instrumentation but more about using this for some kind of binary rewriting or ASLR at finer granularity.
    – nimpi
    Nov 13 '21 at 23:14
  • What's wrong with allocating a new memory region as part of the binary rewriting?
    – NirIzr
    Nov 15 '21 at 13:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.