1

In order to patch a x86 elf file on Linux, I'm struggling to insert a specific assembler instruction into the binary file without overwriting any of the preexisting instructions.

I've been reading quite extensively Radare2 documentation regarding this matter, and so far found none of the commands described by the doc (wa, wo, wex, i in the visual mode and even the visual assembler) giving me the ability to carry it out.
All of these commands do actually overwrite the instruction located at the offset in which the new instruction gets written.

Knowing that the mov instruction I plan to insert would take at the very most 8 bytes, I've extended the size of the binary file accordingly, via the r2 command 

r+ 8

My aim was then to shift all the instructions at the target offset so as to "make room" for the instruction to insert, but couldn't find any command that gets the job done.

Here is a typical example of what I'm aiming at :

Part of the original binary dump : 

0x0804848a c745f8000000. mov dword [local_8h], 0 0x08048491 c745f4000000. mov dword [local_ch], 0 0x08048498 8b4508 mov eax, dword [arg_8h] 0x0804849b 890424 mov dword [esp], eax 0x0804849e e8e1feffff call sym.imp.strlen

Binary dump after patching :

0x0804848a c745f8000000. mov dword [local_8h], 0 0x08048491 c745f4000000. mov dword [local_ch], 0 0x08048498 c745fc000000. mov dword [local_4h], 0 ; inserted instruction 0x0804849f 8b4508 mov eax, dword [arg_8h] ; following instructions get shifted from here 0x08048492 890424 mov dword [esp], eax 0x08048495 e8e1feffff call sym.imp.strlen

Is that even possible ?

Improve this question
7
  • 1
    wex should be able to do this. Are you sure it isn't? Worked for me just now. Try something like wex c745fc000000 @ 0x08048498 Commented Jun 29, 2018 at 15:47
  • @Megabeets No it doesn't, it overwrites the instruction at 0x08048491, for some reason (actually the instruction 0x08048491 c745f4000000. mov dword [local_ch], 0). Commented Jun 29, 2018 at 16:41
  • 1
    Weird. I think it's a bug. It works for me just great. Anyway, for shifting you can use wes. So try something like wes 0x08048491 8 Commented Jun 29, 2018 at 16:50
  • @Megabeets My bad, actually it does write at the specified address, but then it stamps out a whole bunch of the following instructions. Commented Jun 29, 2018 at 17:03
  • 1
    I'm not sure I understood. But anyway, keep in mind that if you shift part of your binary, it might cause really wrong results both in relative and absolute addresses and references. Commented Jun 29, 2018 at 17:06

1 Answer 1

Reset to default
2

Before insert some asm instructions, sometimes you have to enlarge the section .text. try it like below :

oo+ ; reopen file with write permission iO r/.text/biggersize ; biggersize = size of section..text + 8 s 0x08048498 wen 8 wx c745fc000000
Improve this answer
0

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.