anyone know of any interesting ELF binary patching tricks? like LD_PRELOAD but u got root access and wanna make things permanent

· · Web · 7 · 7 · 5

my current "best idea" for replacing a symbol in a .so permanently is:

sed -i 's/my_symbol/#y_symbol/'
create a shared library that defines my_symbol and dynamically links with, and name it

basically then everyone who links with will also get, but the name of the my_symbol we want to override is mangled, so it has to take the one we defined

@libc @SuricrasiaOnline if you fill ldconfig's cache with bogus data, you could probably create some wtf situations

@SuricrasiaOnline i actually had to do something like this at work; objcopy has an option to rename symbols (even dynamically) but not for the dynamic loader section

i resorted to writing a script that basically did what i did in a hex editor to rename symbols. thanks binutils

@SuricrasiaOnline wow twitter absolutely blew this one off the site, i had to switch over to here to see it

@SuricrasiaOnline i've never dug into these kinds of stuff, but isn't there stuff for doing it? my system has patchelf and elfedit, and i thought there was some other binary patching stuff in some less standard package i can't otherwise recall?

@ze woah never heard of either of those, I'll take a look

@SuricrasiaOnline no guarantees that they're relevant, but good luck :)

@SuricrasiaOnline Nix uses patchelf extensively, mostly for setting the RPATH and interpreter of elf files to custom things. It also uses a patched version of ld iirc.

@SuricrasiaOnline tmp.0ut ( has some stuff about something like this. you could try something like but instead of changing the elf entry point, you just change the address for the symbol

@SuricrasiaOnline tl;dr, append your new code and change an unneeded program header to PT_LOAD to load the new code

@SuricrasiaOnline FreeBSD has elfctl(1) in base. it's for twiddling bits in a notes header that tell the kernel something about your binary.

a writup of what the bits do:
how it's twiddled:

@SuricrasiaOnline Not super interesting, but still useful: You can set a library lookup path within the ELFdynamic section in the "RUNPATH" string via -Wl,-rpath . It should also be possible to patch this in the header with medium effort.

Sign in to participate in the conversation

cybrespace: the social hub of the information superhighway jack in to the mastodon fediverse today and surf the dataflow through our cybrepunk, slightly glitchy web portal support us on patreon or liberapay!