2

Is there any way to rebase an ELF file? (i want to load an elf binary at 0x40000000, not at 0x08040000 which is typical base)

I found this tool(prelink, http://en.wikipedia.org/wiki/Prelink), but it's only used for .so libraries.

I tried to modify the addr field of .text section header, but it didn't work.

1 Answer 1

5

The short answer is no, you can't.

The medium answer is : it wouldn't be easy. The general case is undecidable.

If your program has not been compiled to be position-independant, there are probably some references to constant memory addresses. Especially as soon as you make a call to a function defined in an external library, the PLT/GOT mechanism uses known addresses. But if you can disassemble and analyze the program, you may fix them. But deciding whether an 32 bits word will be used as an address or as an integer is undecidable. It may work in simple programs, but don't expect to make it work on obfuscated programs without a lot of work.

And I'm not aware of a tool doing that.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.