redballoonsecurity / ofrak

OFRAK: unpack, modify, and repack binaries.
https://ofrak.com
Other
1.85k stars 127 forks source link

Add ElfLoadAlignmentModifier #302

Closed whyitfor closed 1 year ago

whyitfor commented 1 year ago

One sentence summary of this PR (This should go in the CHANGELOG!) Add ElfLoadAlignmentModifier, which reclaims unused alignment bytes between PT_LOAD segments in ELFs as free space.

Please describe the changes in your request. Add the ElfLoadAlignmentModifier, a free space creation technique that adds unused alignment bytes between PT_LOAD segments in ELF binaries to the segments, creating free space without increasing the ELF binary footprint. The modifier's file has example usage with an experimental CLI interface:

% python3 ofrak/core/elf/load_alignment_modifier.py --file test_ofrak/components/assets/elf/hello_elf_exec -o hello_elf_exec_freed
[+] Free space found by ElfLoadAlignmentFreeSpaceModifier: Allocatable(free_space_ranges={<MemoryPermissions.R: 4>: [Range(0x400438, 0x401000), Range(0x402128, 0x402e10)], <MemoryPermissions.RX: 5>: [Range(0x4011cd, 0x402000)]})
[+] MemoryPermissions.R free space: 0x18b0 bytes
[+] MemoryPermissions.RX free space: 0xe33 bytes
[+] Output file written to hello_elf_exec_freed
It took 0.025 seconds to run the OFRAK script