2
  • objcopy(1) can edit .symtab (among many other things), but not .dynsym.
  • elfedit(1) can modify small amount of header values
  • patchelf(1) can modify other dynamic information (interpreter, libraries, soname), but not dynamic symbols.

But what tool should I use to edit dynamic symbol table, e.g. add new symbol or copy symbol from .symtab?

1 Answer 1

1

LIEF is a tool for elf modification and is able to edit the dynamic symbol table:

# version 0.13.2-1
from lief import *

elf = ELF.parse("/bin/ls")

# make existing symbol dynamic
for symbol in elf.symbols:
    if symbol.name.startswith("snake"):
        elf.add_dynamic_symbol(symbol)

# make a single symbol dynamic
if sym := elf.get_symbol("python"):
    elf.add_dynamic_symbol(sym)

# add completely new symbol
sym = ELF.Symbol()
sym.name = "rattlesnake"
# make sure to use new reference that
# `add_*` functions return
sym = elf.add_dynamic_symbol(sym)
sym.type = ELF.SYMBOL_TYPES.FUNC
sym.binding = ELF.SYMBOL_BINDINGS.GLOBAL
for i, section in enumerate(elf.sections):
    if section.name == ".text":
        sym.shndx = i
        sym.value = section.virtual_address + 0x1337
        break

# save patched file
elf.write("patched")

We can confirm that the modification did take place:

$ readelf --dyn-syms -W patched | grep rattle
   120: 0000000000006357     0 FUNC    GLOBAL DEFAULT   12 rattlesnake

LIEF has c and c++ bindings as well, more documentation about those can be found on their website.

(I also used it recently to patch a build of gdb that did not export the proper symbols for libthread_db.so.1)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.