BINPATCH(1)

NAME
binpatch - trivial binary patch applicator

SYNOPSIS
binpatch file=... size=... offset=... compare=... skip=... replace=...

DESCRIPTION
The binpatch utility can read and replace a small section of a given file. It is designed for use in those instances where a problem exists with a given binary that cannot be reconstructed from source code, but the required change can be implemented by replacing a few bytes in the existing binary. All arguments must be given.

EXAMPLES
Given a binary called “a.out” of 10713 bytes in size with the following text segment:

    % objdump -h a.out

    a.out:     file format elf32-i386

    Sections:
    Idx Name          Size      VMA       LMA       File off  Algn
    [...]
      9 .text         00000be4  08048968  08048968  00000968  2**2
                      CONTENTS, ALLOC, LOAD, READONLY, CODE
    [...]
    % objdump -d -j .text a.out
    [...]
     8048b0f:       83 ef 04                sub    $0x4,%edi
     8048b12:       ff d0                   call   *%eax
     8048b14:       83 fe ff                cmp    $0xffffffff,%esi
    [...]

where we wish to elide the call through %eax by replacing it with a series of nop (or “no operation”) instructions (the machine code for this on the i386 platform is 0x90), we first calculate the offset into the file of the previous sub instruction. To do this, we take the address of the sub instruction as given by the dissassembly output, subtract the “LMA” and add the “File off” values from the objdump output (note that bc(1) expects hexadecimal values to be given using upper case):

    % bc
    ibase=16
    8048B0F-08048968+00000968
    2831

The region of the binary we want to compare to before applying the patch is the concatenation of the relevant machine codes from the dissassembly dump (83ef04ffd083feff) and the replacement is simply two nop instructions (9090), that will replace the ffd0 of the original call. The offset of the replacement is 3, since that is the number of bytes in the sub instruction. From this we have our patch:

    % binpatch file=a.out size=10713 offset=2831 \
      compare=83ef04ffd083feff skip=3 replace=9090
    % objdump -d -j .text a.out
    [...]
     8048b0f:       83 ef 04                sub    $0x4,%edi
     8048b12:       90                      nop
     8048b13:       90                      nop
     8048b14:       83 fe ff                cmp    $0xffffffff,%esi
    [...]

And thus the call is removed.

DIAGNOSTICS
The diagnostics are terse and almost unhelpful, but are more verbose than users of ed(1) might be used to. They typically mention the command line argument that was in error.

SEE ALSO
bc(1), objdump(1), patch(1)

AUTHORS
Andrew Brown <atatat@netbsd.org>