Reverse Engineering Stack Exchange is a question and answer site for researchers and developers who explore the principles of a system through analysis of its structure, function, and operation. It only takes a minute to sign up.
Sign up to join this community
How do I go about patching ARM7 binary code for an ELF Shared Object during run-time? To elaborate, I want to patch a specific routine during run-time for my own application.
I tried googling to check how to do this, but I can't find anything. I don't need the entire answer, what I need is: what functions I should use, and I can figure out the rest on my own.
The platform is ARM7 processors, specifically, mobile phones running the Android OS.
Thank you in advance.
Depending if the memory is protected, you will have to give yourself permission to write to the specified area, mprotect, and then you can just memcpy over your code to the specified area.
The larger issue you run into when modifying code at runtime is cache coherency
ARM processors have 2 caches that you have to worry about, the ICache (instruction cache) and the DCache (data cache). When you self modify code, you end up changing instructions in the DCache but not necessarily in memory, or more importantly the ICache, therefor these caches become out of sync. You must take some steps to ensure these caches are "clean"/in sync. Flushing the DCache ensures that the changes made in DCache get written to memory.
Flushing the DCache forces the ICache to re-fetch instructions (aka your modified code). On ARM linux there is a syscall call cacheflush that takes care of this. Depending on how you are modifying memory/in what context, there is an issue of chicken or the egg, as your newly modified code cant contain the cache flush as the caches will already be out of sync, therefor there are other ways to force a cache flush, such as forcing a context switch, i.e. a sleep, when you don't have the ability to programmatically flush the cache.
In fact you need mprotect (to gain a privilege to write to code area) and memcpy or any other thing to write to the memory.
Please note that ARM is built on Harvard architecture and after writing the code you'll possibly need to do something with code cache.
Take a look at this project. It patches Thumb and ARM instruction-set on the fly.
