📚 OpenRCE is preserved as a read-only archive. Launched at RECon Montreal in 2005. Registration and posting are disabled.








Flag: Tornado! Hurricane!

 Forums >>  Brainstorms - General  >>  Static binary manipulation

Topic created on: April 21, 2009 20:56 CDT by stevem .

I'm looking at statically modifying binaries (ELF and PE), i.e. replacing instructions, adding new functions and instructions, etc.

What's the best approach for doing this? Ideally I'd like to do this in Python.

  seokwoochoi     April 22, 2009 00:15.52 CDT
If you add new instructions, the addresses in operands should be changed.
So, adding a new executable section after the end of the executable file will be OK.

  stevem     April 22, 2009 01:01.12 CDT
Sorry, I should've been more specific. I'd like to know of any C or Python libraries that can be used to do this, and any approaches others have taken.

So far I figure I can probably use pydasm or libdisasm directly, and write back to the binary using basic binary I/O calls.

Any thoughts?

  simpleuser   April 22, 2009 02:39.15 CDT
Microsoft detours
Code Snippet Creator

  seokwoochoi     April 23, 2009 00:38.55 CDT
The code snippet creator maybe easier to start with.
Years ago, I used pefile + pyasm + IDAPro to create PE file manipulation utility that can modify functions.

  trufae   April 23, 2009 02:28.02 CDT
radare let you to do this in interactive mode or automated in radare scripting or from ruby,python,perl or lua. It also supports multiple syntax for assembling (frontends for nasm,gas,olly,..) and PE/Elf/Mach0/Class information is supported too.

If you need something else, let me know

Note: Registration is required to post to the forums.

There are 31,328 total registered users.


Recently Created Topics
[help] Unpacking VMP...
Mar/12
Reverse Engineering ...
Jul/06
let 'IDAPython' impo...
Sep/24
set 'IDAPython' as t...
Sep/24
GuessType return une...
Sep/20
About retrieving the...
Sep/07
How to find specific...
Aug/15
How to get data depe...
Jul/07
Identify RVA data in...
May/06
Question about memor...
Dec/12


Recent Forum Posts
Finding the procedur...
rolEYder
Question about debbu...
rolEYder
Identify RVA data in...
sohlow
let 'IDAPython' impo...
sohlow
How to find specific...
hackgreti
Problem with ollydbg
sh3dow
How can I write olly...
sh3dow
New LoadMAP plugin v...
mefisto...
Intel pin in loaded ...
djnemo
OOP_RE tool available?
Bl4ckm4n


Recent Blog Entries
halsten
Mar/14
Breaking IonCUBE VM

oleavr
Oct/24
Anatomy of a code tracer

hasherezade
Sep/24
IAT Patcher - new tool for ...

oleavr
Aug/27
CryptoShark: code tracer ba...

oleavr
Jun/25
Build a debugger in 5 minutes

More ...


Recent Blog Comments
nieo on:
Mar/22
IAT Patcher - new tool for ...

djnemo on:
Nov/17
Kernel debugger vs user mod...

acel on:
Nov/14
Kernel debugger vs user mod...

pedram on:
Dec/21
frida.github.io: scriptable...

capadleman on:
Jun/19
Using NtCreateThreadEx for ...

More ...


Imagery
SoySauce Blueprint
Jun 6, 2008

[+] expand

View Gallery (11) / Submit