Hence, i started crawling the binary using GNU strings with the aim of identifying a function name which could somehow tell me it was performing the protection check. As it was not stripped, all the symbols were inside it. The binary was an ELF 64-bit LSB executable, x86-64, version 1 (GNU/Linux), dynamically linked, interpreter /lib64/l, for GNU/Linux 2.6.32, not stripped. Finding the Function Which Performs the Protection Check I am not encouraging you to perform anything that is against the law. For the sake of example, I will call the application vulnbin.ĭisclaimer: Bypassing binary protection mechanisms may be an illegal activity. I redacted names and other elements that could reveal sensitive details. Note that the one discussed is a real example of a real application.

Patching the binary to change the function to always tell 'Hey, the check is OK!'īelow I would like to briefly share these activities.Finding the function which performs the protection check.The protection mechanism implemented was meant to only allow a binary to be run in presence of a valid license. In my case, I was asked to try and bypass the protection mechanism implemented. This will allow you to control how a binary behaves, even when you don't have access to the source code and you can't recompile it. In this gist I show how to disassemble and modify a Linux executable binary to change the body of a function.

Disassemble and Modify an Binary To Change a Function

Linux disassembler dump