Patching a binary file with dd - Revision history

Leo at 22:21, 14 June 2020

2020-06-14T22:21:36Z

← Older revision		Revision as of 22:21, 14 June 2020
Line 1:		Line 1:
	Suppose I know an instruction in a particular offset after disassembling a binary file. You can use ~~{{code\|~~dd}} to change or patch a file.		Suppose I know an instruction in a particular offset after disassembling a binary file. You can use the [[dd]] utility to change or patch a file.
	{{highlight\|lang=terminal\|code=		{{highlight\|lang=terminal\|code=
	<nowiki>		<nowiki>

Leo: Leo moved page Patching binary to Patching a binary file with dd: More descriptive name

2020-06-14T22:20:48Z

Leo moved page Patching binary to Patching a binary file with dd: More descriptive name

← Older revision		Revision as of 22:20, 14 June 2020
(No difference)

Leo: Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

2019-09-01T06:22:04Z

Text replacement - "Category:Linux{{Navbox Linux}}" to "{{Navbox Linux}}Category:Linux"

← Older revision		Revision as of 06:22, 1 September 2019
Line 47:		Line 47:
	This will effectively disable the limitation by always jumping regardless of the count.		This will effectively disable the limitation by always jumping regardless of the count.

	[[Category:Linux]]~~{{Navbox Linux}}~~		{{Navbox Linux}}[[Category:Linux]]

Leo: Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

2019-09-01T05:11:23Z

Text replacement - "{{Navbox Linux}}{{Navbox Linux}}" to "{{Navbox Linux}}"

← Older revision		Revision as of 05:11, 1 September 2019
Line 47:		Line 47:
	This will effectively disable the limitation by always jumping regardless of the count.		This will effectively disable the limitation by always jumping regardless of the count.

	[[Category:Linux]]~~{{Navbox Linux}}~~{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}

Leo: Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

2019-09-01T05:07:37Z

Text replacement - "Category:Linux" to "Category:Linux{{Navbox Linux}}"

← Older revision		Revision as of 05:07, 1 September 2019
Line 47:		Line 47:
	This will effectively disable the limitation by always jumping regardless of the count.		This will effectively disable the limitation by always jumping regardless of the count.

	[[Category:Linux]]{{Navbox Linux}}		[[Category:Linux]]{{Navbox Linux}}{{Navbox Linux}}

Leo: formatting

2019-09-01T02:17:41Z

formatting

← Older revision		Revision as of 02:17, 1 September 2019
Line 1:		Line 1:
	Suppose I know an instruction in a particular offset after disassembling a binary file. You can use `dd` to change or patch a file ~~like so~~.		Suppose I know an instruction in a particular offset after disassembling a binary file. You can use {{code\|dd}} to change or patch a file.
			{{highlight\|lang=terminal\|code=
	dd if=nprobe bs=1 count=6 skip=$((0x1430C)) \| xxd		<nowiki>
	6+0 records in		dd if=nprobe bs=1 count=6 skip=$((0x1430C)) \| xxd
	6+0 records out		6+0 records in
	6 bytes (6 B) copied, 0.000122275 s, 49.1 kB/s		6+0 records out
	0000000: 0f84 5401 0000 ..T...		6 bytes (6 B) copied, 0.000122275 s, 49.1 kB/s
			0000000: 0f84 5401 0000 ..T...
			</nowiki>
			}}
	I want to change the above from a jz to jnz like so:		I want to change the above from a jz to jnz like so:
	echo "0F 85 54 01 00 00" \| udcli -64 -x		{{highlight\|lang=terminal\|code=
	0000000000000000 0f8554010000 jnz 0x15a		<nowiki>
			# echo "0F 85 54 01 00 00" \| udcli -64 -x
			0000000000000000 0f8554010000 jnz 0x15a
			</nowiki>
			}}
	Overwrite the byte (or bytes) like so:		Overwrite the byte (or bytes) like so:
	printf '\x0f\x85' \| dd conv=notrunc of=nprobe bs=1 seek=$((0x1430C))		{{highlight\|lang=terminal\|code=
	2+0 records in		<nowiki>
	2+0 records out		# printf '\x0f\x85' \| dd conv=notrunc of=nprobe bs=1 seek=$((0x1430C))
	2 bytes (2 B) copied, 0.00097866 s, 2.0 kB/s		2+0 records in
			2+0 records out
			2 bytes (2 B) copied, 0.00097866 s, 2.0 kB/s
			</nowiki>
			}}
	Verify:		Verify:
	~~[root@localhost bin]~~# dd if=nprobe bs=1 count=6 skip=$((0x1430C)) \| xxd		{{highlight\|lang=terminal\|code=
	6+0 records in		<nowiki>
	6+0 records out		# dd if=nprobe bs=1 count=6 skip=$((0x1430C)) \| xxd
	6 bytes (6 B) copied, 0.000136555 s, 43.9 kB/s		6+0 records in
	0000000: 0f85 5401 0000 ..T...		6+0 records out
			6 bytes (6 B) copied, 0.000136555 s, 43.9 kB/s
			0000000: 0f85 5401 0000 ..T...
			</nowiki>
			}}

	To patch libnprobe so that it doesn't stop after 25000:		To patch libnprobe so that it doesn't stop after 25000:
	printf '\x0f\x85' \| dd conv=notrunc of=/usr/local/lib/libnprobe-7.1.150608.so bs=1 seek=$((0x47e97))		{{highlight\|lang=terminal\|code=
	dd if=/usr/local/lib/libnprobe-7.1.150608.so bs=1 count=6 skip=$((0x47e97)) \| xxd		<nowiki>
	0000000: 0f85 d700 0000		# printf '\x0f\x85' \| dd conv=notrunc of=/usr/local/lib/libnprobe-7.1.150608.so bs=1 seek=$((0x47e97))
			dd if=/usr/local/lib/libnprobe-7.1.150608.so bs=1 count=6 skip=$((0x47e97)) \| xxd
			0000000: 0f85 d700 0000
			</nowiki>
			}}

	This will effectively disable the limitation by always jumping regardless of the count.		This will effectively disable the limitation by always jumping regardless of the count.

			[[Category:Linux]]{{Navbox Linux}}

10.1.1.22 at 15:11, 9 June 2015

2015-06-09T15:11:31Z

← Older revision		Revision as of 15:11, 9 June 2015
Line 26:		Line 26:

	To patch libnprobe so that it doesn't stop after 25000:		To patch libnprobe so that it doesn't stop after 25000:
	printf '\~~x3d~~\~~xff\xff\x7f\xff~~' \| dd conv=notrunc of=/usr/local/lib/libnprobe-7.1.150608.so bs=1 seek=$((~~0x47ead~~))		printf '\x0f\x85' \| dd conv=notrunc of=/usr/local/lib/libnprobe-7.1.150608.so bs=1 seek=$((0x47e97))
	dd if=/usr/local/lib/libnprobe-7.1.150608.so bs=1 count=6 skip=$((~~0x47ead~~)) \| xxd		dd if=/usr/local/lib/libnprobe-7.1.150608.so bs=1 count=6 skip=$((0x47e97)) \| xxd
	0000000: ~~3dff ff7f ff0f =....~~.		0000000: 0f85 d700 0000

			This will effectively disable the limitation by always jumping regardless of the count.

10.1.1.3 at 05:04, 9 June 2015

2015-06-09T05:04:55Z

← Older revision		Revision as of 05:04, 9 June 2015
Line 23:		Line 23:
	6 bytes (6 B) copied, 0.000136555 s, 43.9 kB/s		6 bytes (6 B) copied, 0.000136555 s, 43.9 kB/s
	0000000: 0f85 5401 0000 ..T...		0000000: 0f85 5401 0000 ..T...


			To patch libnprobe so that it doesn't stop after 25000:
			printf '\x3d\xff\xff\x7f\xff' \| dd conv=notrunc of=/usr/local/lib/libnprobe-7.1.150608.so bs=1 seek=$((0x47ead))
			dd if=/usr/local/lib/libnprobe-7.1.150608.so bs=1 count=6 skip=$((0x47ead)) \| xxd
			0000000: 3dff ff7f ff0f =.....

10.1.1.3: Created page with "Suppose I know an instruction in a particular offset after disassembling a binary file. You can use `dd` to change or patch a file like so. dd if=nprobe bs=1 count=6 skip=$(..."

2015-06-09T03:18:49Z

Created page with "Suppose I know an instruction in a particular offset after disassembling a binary file. You can use `dd` to change or patch a file like so. dd if=nprobe bs=1 count=6 skip=$(..."

New page

Suppose I know an instruction in a particular offset after disassembling a binary file. You can use `dd` to change or patch a file like so.

dd if=nprobe bs=1 count=6 skip=$((0x1430C)) | xxd
6+0 records in
6+0 records out
6 bytes (6 B) copied, 0.000122275 s, 49.1 kB/s
0000000: 0f84 5401 0000 ..T...

I want to change the above from a jz to jnz like so:
echo "0F 85 54 01 00 00" | udcli -64 -x
0000000000000000 0f8554010000 jnz 0x15a

Overwrite the byte (or bytes) like so:
printf '\x0f\x85' | dd conv=notrunc of=nprobe bs=1 seek=$((0x1430C))
2+0 records in
2+0 records out
2 bytes (2 B) copied, 0.00097866 s, 2.0 kB/s

Verify:
[root@localhost bin]# dd if=nprobe bs=1 count=6 skip=$((0x1430C)) | xxd
6+0 records in
6+0 records out
6 bytes (6 B) copied, 0.000136555 s, 43.9 kB/s
0000000: 0f85 5401 0000 ..T...