Skip to content

Instantly share code, notes, and snippets.

@romainthomas
Last active November 22, 2017 12:10
Show Gist options
  • Save romainthomas/9df6c252df363abcb6481d267d530cfb to your computer and use it in GitHub Desktop.
Save romainthomas/9df6c252df363abcb6481d267d530cfb to your computer and use it in GitHub Desktop.
POC to transform a binary into a library
#!/usr/bin/env python3.6
import lief
import pathlib
from lief.ELF import Symbol
from lief import Logger
Logger.set_level(lief.LOGGING_LEVEL.INFO)
CURRENT_DIR = pathlib.PosixPath(".").resolve().as_posix()
# Assume that we figured out the address of the 'check' function at 0xB4C
CHECK_ADDR = 0xB4C
crackme = lief.parse(f"{CURRENT_DIR}/crackme.bin")
# Create a symbol for this address
check = Symbol()
check.name = "check"
check.type = lief.ELF.SYMBOL_TYPES.FUNC
check.binding = lief.ELF.SYMBOL_BINDINGS.GLOBAL
check.visibility = lief.ELF.SYMBOL_VISIBILITY.DEFAULT
check.value = CHECK_ADDR
check.shndx = 12 # .text section
# Add it as an exported symbol
crackme.add_dynamic_symbol(check)
crackme.write(f"{CURRENT_DIR}/libcrackme.so")
# Now we have access to the 'check' function as follow
# #include <iostream>
# extern "C" {
# bool check(const char* input);
# }
#
# int main(int argc, char** argv) {
# if (argc != 2) {
# std::cerr << "Usage: " << argv[0] << " <string>" << std::endl;
# return 1;
# }
# std::cout << std::boolalpha << check(argv[1]); << std::endl;
# return 0;
# }
# Compilation
# g++ play.cpp -L. -lcrackme -o play.bin
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment