GJDuck / e9patch

A powerful static binary rewriting tool
GNU General Public License v3.0
986 stars 67 forks source link

Obtaining a section's (e.g., .text) start/end address as an argument to a trampoline #61

Closed jjang3 closed 1 year ago

jjang3 commented 1 year ago

Hello,

This may be a simple question, but I have difficulty getting the correct command to obtain the address for my trampoline code.

To summarize, I aim to obtain the start and end addresses of the .text section as an argument for my trampoline.

For instance, given the following address range:

  [13] .plt.got          PROGBITS        00000000000011b0 0011b0 000008 08  AX  0   0  8
  [14] .text             PROGBITS        00000000000011c0 0011c0 0007e1 00  AX  0   0 16
  [15] .fini             PROGBITS        0000000000002000 002000 000009 00  AX  0   0  4

I am trying to get the address of 0x11c0 and 0x19a0 as argument values for the trampoline.

The command that I am using is as follows: ./e9tool -M 'addr=0x1000' -P 'entry("&.text.start","&.text.end")@print' ../input_file.out

How I came to the above command is that I noticed in Section 2.7 Exclusion (on the user guide) that you could use .text.end to denote the end range of addresses you want to omit, so I was hoping the same type of option could work as an argument for a trampoline.

And then I also noticed

&Name | const void * | The runtime address of the named section/symbol/PLT/GOT entry
(static)&Name | const void * | The ELF address of the named section/symbol/PLT/GOT entry

This made me think it is possible to get the .start / .end address of the .text section.

Please let me know if this is possible or not! Thank you for your time. Kind regards

GJDuck commented 1 year ago

Thanks for the report. It seems there are at least two problems:

  1. Arguments like &".text" were being interpreted as address-of-a-string-constant (not allowed) rather than address-of-section/symbol, as per the docs.
  2. There is no support for the .start and .end syntax for patch arguments.

I have fixed (1.) at least. I'll look into fixing (2.) but that is a more major change.

jjang3 commented 1 year ago

Thank you very much for your swift reply! This gave me a closure that I need to find a different solution, at least temporarily outside of E9Patch. Thank you again.

GJDuck commented 1 year ago

I will implement (2.) but may take a day or two.

GJDuck commented 1 year ago

The start/end syntax should now be fully supported.

jjang3 commented 1 year ago

Thank you very much!