3

How do I go about patching ARM7 binary code for an ELF Shared Object during run-time? To elaborate, I want to patch a specific routine during run-time for my own application.

I tried googling to check how to do this, but I can't find anything. I don't need the entire answer, what I need is: what functions I should use, and I can figure out the rest on my own.

The platform is ARM7 processors, specifically, mobile phones running the Android OS.

Thank you in advance.

  • 1
    You probably meant "ARMv7", not ARM7 (yes, there's a difference). ARM7 CPUs can't run Android. – Igor Skochinsky Feb 24 '14 at 19:21
  • 1
    ARM7 is a very old microarchitecture while ARMv7 is a new instruction set (before ARMv8) – phuclv Jan 24 '15 at 17:29
5

Depending if the memory is protected, you will have to give yourself permission to write to the specified area, mprotect, and then you can just memcpy over your code to the specified area.

The larger issue you run into when modifying code at runtime is cache coherency

ARM processors have 2 caches that you have to worry about, the ICache (instruction cache) and the DCache (data cache). When you self modify code, you end up changing instructions in the DCache but not necessarily in memory, or more importantly the ICache, therefor these caches become out of sync. You must take some steps to ensure these caches are "clean"/in sync. Flushing the DCache ensures that the changes made in DCache get written to memory.

Flushing the DCache forces the ICache to re-fetch instructions (aka your modified code). On ARM linux there is a syscall call cacheflush that takes care of this. Depending on how you are modifying memory/in what context, there is an issue of chicken or the egg, as your newly modified code cant contain the cache flush as the caches will already be out of sync, therefor there are other ways to force a cache flush, such as forcing a context switch, i.e. a sleep, when you don't have the ability to programmatically flush the cache.

  • Thanks a lot for the detailed information about caches and flushing. Very helpful. – Jeroen Wiert Pluimers Feb 26 '14 at 13:41
3

In fact you need mprotect (to gain a privilege to write to code area) and memcpy or any other thing to write to the memory.

Please note that ARM is built on Harvard architecture and after writing the code you'll possibly need to do something with code cache.

0

Take a look at this project. It patches Thumb and ARM instruction-set on the fly.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.