Skip to content

Instantly share code, notes, and snippets.

Created November 16, 2017 13:27
What would you like to do?
import os
import sys
import struct
import binaryninja
def touch(fname, times=None):
with open(fname, 'a'):
os.utime(fname, times)
bv = binaryninja.BinaryViewType['ELF'].open(sys.argv[1])
symbols = ['@')[0] for s in bv.get_symbols() if'@GOT')]
symbols = filter(lambda x: not x in ['__gmon_start__', '__libc_start_main'], symbols)
def change_lib_call_mapping(mapping):
for k,v in mapping.items():
ka = bv.get_symbols_by_name(k)[0].address
va = bv.get_symbols_by_name(v)[0].address
refs = bv.get_code_refs(ka)
for r in refs:
if, 1) == '\xe8':
nv = struct.pack('<i',va-(r.address+5))
bv.write(r.address+1, nv)
def change_plt_mapping(mapping):
vals = {}
for v in mapping.values():
a = bv.get_symbols_by_name(v+'@GOT')[0].address
plta = struct.unpack('<Q',,8))[0]
vals[v] =, 5)
for k,v in mapping.items():
a = bv.get_symbols_by_name(k+'@GOT')[0].address
plta = struct.unpack('<Q',,8))[0]
bv.write(plta, vals[v])
# define the imported symbols to swap
mapping = \
# swap the symbols
# save the modified binary
patched_binary = sys.argv[1]+'_patched'
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment