Re:Adding code to an existing ELF file
by nneonneo on Monday May 09, 2022 @03:15PM
(#31318486)
I've had great success using Frida (https://frida.re/) to do stuff like this recently. Frida injects a V8 runtime into the target process, enabling you to use JavaScript to dynamically patch/inspect/modify code and data, with all of the JavaScript running inside the target process so there's minimal impact on performance. They provide a nice Python API for remotely controlling the process.
It works on rooted devices, debuggable apps, and can also be added to an existing APK with minimal effort (just patch a single Java class and add a native library - there are scripts to do it for you).
Re:Adding code to an existing ELF file
by franga2000 on Monday May 09, 2022 @05:06PM
(#31319755)
Just a year or two ago I would've laughed at the idea of using an injected JavaScript engine to do dynamic instrumentation, but now I rarely go a week without using Frida for either work or personal projects and enjoy every moment of it.
It's one of those tools that is clearly made by someone who completely gets how it's going to be used. Every time you want it to do something "new", it turns out there's already a short paragraph in the docs that you skimmed over explaining either how to do it or pointing you at an "extension" that can.
Re:Adding code to an existing ELF file
by eatonphil on Monday May 09, 2022 @11:04AM
(#31314998)
Very neat! Less hacky than I expected. It looks like it all just reads in the ELF file, makes the change to the ELF data structures in memory and then writes back out a new ELF file?
Re:Adding code to an existing ELF file
by Diggsey on Monday May 09, 2022 @07:10PM
(#31321093)
That's cool :) I think it would be a lot easier to inject the payload at runtime though - the only problem I had when doing this was I got the wrong instruction set initially (thumb vs non-thumb).
Re:Adding code to an existing ELF file
by sim7c00 on Monday May 09, 2022 @12:17PM
(#31316026)
looks like a neat way around the hell of patching relocations. though, if you'd want to modify the binary arbitrarily and not hijack sections or such things, it might be nice to look into that.
It works on rooted devices, debuggable apps, and can also be added to an existing APK with minimal effort (just patch a single Java class and add a native library - there are scripts to do it for you).
It's one of those tools that is clearly made by someone who completely gets how it's going to be used. Every time you want it to do something "new", it turns out there's already a short paragraph in the docs that you skimmed over explaining either how to do it or pointing you at an "extension" that can.