ELF Patcher with C

Patch ELF binaries using C code and GNU linker features instead of raw assembly.

Quick Start

1. Copy templates from assets/ directory
2. Customize patch_at, patch_size, and external symbols in linkerscript
3. Write patch logic in C using SECTION(".patch.code.*") attribute
4. Compile: gcc -c binpatch.c -o binpatch.o -fno-pic -fno-pie -nostdlib
5. Link: ld -T binpatch.ld binpatch.o -o patch.bin -nostdlib --oformat binary
6. Apply: dd if=patch.bin of=target bs=1 seek=0xADDR conv=notrunc

Core Technique

This method leverages two GNU Linker features:

1. Symbol Definition

Define symbols at specific addresses in linkerscript:

my_puts = 0x42069;

Reference in C:

extern void (*my_puts)(char *);

2. Section Placement

Force sections to specific virtual addresses:

SECTIONS {
    . = 0xdeadbeefcafebabe;  /* Location counter */
    .patch ALIGN(1) : SUBALIGN(1) {  /* No alignment */
        KEEP(*(.patch))
    }
}

C Code Pattern

#define SECTION(x) __attribute__((section(x)))

SECTION(".patch.data.message")
const char msg[] = "Hello from patch!";

SECTION(".patch.code.entry")
void patch_entry() {
    puts(msg);  /* 'puts' defined in linkerscript */
}

Linker Script Pattern

patch_at = 0x01139;      /* Target address */
patch_size = 511;        /* Available bytes */
puts = 0x1030;           /* PLT entry */

SECTIONS {
    . = patch_at;
    .patch ALIGN(1) : SUBALIGN(1) {
        KEEP(*(.patch.code.*))
        KEEP(*(.patch.data.*))
    }
    ASSERT(SIZEOF(.patch) <= patch_size, "patch too big")
}

Resources

scripts/

• apply_patch.py - Python script to apply binary patch to target file

references/

• technique.md - Detailed technical documentation and considerations

assets/

• binpatch.c - Template for patch C code
• binpatch.ld - Template for linker script
• Makefile - Build automation template

Important Considerations

• PIE binaries: Use -fno-pic -fno-pie flags for non-PIE code
• Size limits: ASSERT in linkerscript validates patch fits
• ABI matching: May need assembly stubs for calling conventions
• External symbols: Set to actual PLT/GOT addresses from target binary

Extensions

This technique enables:

• Other languages (Rust, Zig, Nim) for patch generation
• Cross-platform patches (platform-specific only in linker script)
• PE/Mach-O compatibility
• Embedded dynamic symbol resolvers

Read references/technique.md for full technical details.