Show HN: ELF Injector

https://news.ycombinator.com/rss Hits: 5
Summary

ELF Injector Injects a relocatable code chunk of arbitrary size into an ELF executable that will run before the original entry point of the executable. Building NOTE: The code can only build and run on a 32-bit ARM processor as it contains a mix of C and assembly. Build elf_injector : ~/elf_injector $ make all gcc -Werror -std=gnu99 -fno-builtin -Wall -Wextra -O2 -c src/elf_injector.c -o elf_injector.o gcc -nostdlib elf_injector.o -o elf_injector gcc -Werror -std=gnu99 -fno-builtin -Wall -Wextra -O2 -c src/test.c -o test.o gcc test.o -o test ~/elf_injector $ Build the relocatable code chunks : ~/elf_injector $ cd chunks ~/elf_injector $ make all cc -Werror -std=gnu99 -fno-builtin -Wall -Wextra -nostdlib -mgeneral-regs-only -fpie -O2 -o greeting_strip greeting_strip.c objdump -d -S greeting_strip > greeting_strip.asm objcopy -O binary --only-section=.text greeting_strip greeting_strip.bin cc -Werror -std=gnu99 -fno-builtin -Wall -Wextra -nostdlib -mgeneral-regs-only -fpie -O2 -o startup_dump_strip startup_dump_strip.c objdump -d -S startup_dump_strip > startup_dump_strip.asm objcopy -O binary --only-section=.text startup_dump_strip startup_dump_strip.bin cc -Werror -std=gnu99 -fno-builtin -Wall -Wextra -nostdlib -mgeneral-regs-only -fpie -O2 -o copy_chunk_strip copy_chunk_strip.c objdump -d -S copy_chunk_strip > copy_chunk_strip.asm objcopy -O binary --only-section=.text copy_chunk_strip copy_chunk_strip.bin ~/elf_injector $ Running The elf_injector command line utility inserts a code chunk into an ELF executable and has a simple command line interface: ~/elf_injector $ ./elf_injector usage: elf_injector <exec> <chunk> <entry offset> exec is the executable to inject the chunk into. It must be an executable, not a shared library. chunk is a binary file containing the code to inject, and entry_offset is the offset in bytes from the beginning of the chunk from which to start execution. The resulting output file is the same name as exec albeit with a .injected extension....

First seen: 2025-07-29 15:41

Last seen: 2025-07-29 19:42