1

I am trying to do a academic experiments and basically what I am trying to do is

insert and remove some garbage instructions like these into the ELF or PE file.

Pop eax NOP NOP NOP Push eax

So my questions are how to insert certain instructions without change its original functionality.

It seems that I need to update the all the corresponding entries and tables according to the ELF/PE format, but basically how to do this and what should be updated ....?

After a search, I have not find some useful information or code related to this issue, so I wondering if anyone could give some help..? I really appreciate it!

Improve this question

1 Answer 1

Reset to default
2

Manual fixup of all branches would be rather tedious. So get a disassembler and an assembler, disassemble the file, insert your dummy command sequences, then reassemble. There's still a chance the code would break. Some executables deliberately check the integrity of their code as a copy protection measure.

If the executable was signed via Authenticode, you won't be able to restore the signature. The whole point of the digital signature is to prevent tampering of this sort.

Improve this answer
Sign up to request clarification or add additional context in comments.

5 Comments

Hi Seva, Thank you a lot for your answer, but basically I still have some questions: 1: In general, How to accurately disassemble binary? I haven't find certain solution. tools like IDA pro can not create a compilable assemble file, and basically, binary transformation solutions in recent academic top conference paper usually use IDA pro to make the transformation and patch to the original binary file.. Could you please give me some details about this topic..? THank you!
What's more, I know that advanced virus like metamorphic virus would use a "disassemble" --> "transformation" --> "reassemble" process to achieve the metamorphic, but basically the code of virus are relatively easy to disassemble, and the metamorphic virus maker are fully understanding of their own virus so do a ad-hoc disassembly is not a big deal.. but how to do a general disassembly approach towards legacy binary code?
Basically I want to insert some garbage instructions into certain legacy ELF/PE file to make the address of library functions randomized without the help of ASLR.
Morphing your own code - written in assembly with morphing in mind in the first place - is quite different than morphing someone else's code that might contain explicit countermeasures. That said, what's the target of the effort - research, software product, homework? It's a tricky job, and the very fact that you're out on SO seeking pointers from strangers doesn't sound well for the eventual outcome.
Hi Seva, this is part of a research work I am conducting now, and it seems that insertion towards ELF/PE is tedious and I am not sure whether I can make it. So maybe I will try another way to achieve our goal, giving up this insertion effort... anyway, thank you a lot for your kind reply!

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.