Hello everyone! I have a task where I need to add new section to the elf, but I cannot shift the addresses of other sections, so a simple "add" of the new section doesn't do the trick for me (since it expands the program header and shifts the (almost) whole program by 0x1000.
I thought I would move the program header to the end of the file, so no old segments / sections are moved when I add new sections. Could you give me a hint if its easily achievable and point me into an approach that you would use for this task?
Could you please tell me something more about this error in glibc? I need to be able to input the changes programmatically and I don't think there is any universal way to find a "cave".
After some trails and errors I got to the point where I got an error (which apparently is in agreement with the ELF format doc) that PHDR segment needs to be before any LOAD segment. But I saw that in one of my .so files, the program header doesn't have its own segment and is instead contained in LOAD segment. I wonder if there is an option to add a LOAD segment at the end of the file and put header there. But I fear it may just fall under the same error category. What do you think?
Also do you know about any tools that will help me check my modified binaries and give a verbose feedback, why the binary is malformed?
You mentioned investigating the loader error. Could you give me some hints how I should attempt to investigate my crash?
If the crash comes from ld-XXX.so you can try to compile the loader with debug symbol (c.f. glibc) to know where it fails
Hey all. I just started using lief a few days ago and couldn’t find the following in the documentation.
Quick question, can I edit a binary's content with lief? For example:
binary0 = lief.parse("/home/xxx/dbt/add0arm")
text = binary0.get_section(".text")
text.content.insert(1,0x99) OR text.content = 0x99
Still 79 :(
Seems like I can access, but not edit? I could edit with the C API, though?
also you said that you are doing this for non-pie binary. Is this approach not working for PIE shard objects?
It should also work for pie binaries but I didn't test
and I see in the code that you use different add_segment for E_TYPE::ET_EXEC and E_TYPE::ET_DYN. Why is that needed?
It's all the relocating mechanism (pie vs non-pie)
/45into whatever's at the 45th byte of the PE's string table)