2

Is there any way to rebase an ELF file? (i want to load an elf binary at 0x40000000, not at 0x08040000 which is typical base)

I found this tool(prelink, http://en.wikipedia.org/wiki/Prelink), but it's only used for .so libraries.

I tried to modify the addr field of .text section header, but it didn't work.

1 Answer 1

5

The short answer is no, you can't.

The medium answer is : it wouldn't be easy. The general case is undecidable.

If your program has not been compiled to be position-independant, there are probably some references to constant memory addresses. Especially as soon as you make a call to a function defined in an external library, the PLT/GOT mechanism uses known addresses. But if you can disassemble and analyze the program, you may fix them. But deciding whether an 32 bits word will be used as an address or as an integer is undecidable. It may work in simple programs, but don't expect to make it work on obfuscated programs without a lot of work.

And I'm not aware of a tool doing that.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.