Search code examples
binaryelfportable-executablemachine-code

How to add machine code at the end of an executable file on Windows(PE) or Linux(ELF)?


Detail

I know that it is possible to add code in the famous 'code caves', but they are limited in terms of space, so I would like to add codes in this file without using these spaces, and for that I would have to add extra bytes to the file (at the end so that jmps and memory access are not affected).

But I can't find any application that allows me to do this, I have cutter and x96dbg and they only allow changing existing bytes.

Main

So I would like to know which tool I can use to do what I want, if it is possible to do what I want.

Secondary

Note: From what I've been researching, changing the size of a binary by adding extra codes to it causes a series of complications, because if added at the beginning, it ruins all the jmps and the read sections and the read/write sections. If that's the reason for not adding extra codes (with new bytes), why wouldn't adding the code at the end of the binary be a solution? And how exactly does one section that can only read and one that can read and write work? Essentially, they are all editable bytes that can be read and written, right?


Solution

  • For ELF binaries, you could simply append whatever bytes you want to the end of the file.

    However, the appended data will not be loaded into memory. To get this data loaded, you would have to modify one of the executable segments in your binary to "cover" the newly-added data. You can see the segments using readelf -Wl a.out.

    If you are lucky and the executable LOAD segment can be modified the cover the new data, then patching the main .text to jump to the new executable code and then jumping back will work.

    P.S.

    I can't find any application that allows me to do this

    Stackoverflow is not the place to ask for applications.