tunz/binch

A light ELF binary patch tool in python urwid

NOTE

This repository is not maintained. Please use binch-go instead. I just rewrote this in Go since python is slow and keystone python library is not maintained well.

---

a light BINary patCH tool

A light ELF binary patch tool in python urwid. It helps to patch a ELF binary in a few steps.

Now, it only supports x86, x86_64, and ARM(experimental).

Usage

$ ./binch [binary name]

Shortcuts

g: Go to a specific address. (if not exists, jump to nearest address)
d: Remove a current line. (Fill with nop)
q: Quit.
s: Save a modified binary to a file.
enter: Modify a current line.
h: Modify hex bytes of a current line.
f: follow the address of jmp or call instructions.

binch's Issues

Jump to a symbol

Using 'g' shortcut, it should be able to jump to a symbol, not a specific address number.

Moreover, it would be nice to add a new symol to a specific address.

Code insertion

If new code is inserted, it can break following codes.

So, we have to know some information such as the size of extra bytes, or dependencies of each code.

Support ARM

Currently, it uses NASM to assemble a code.
But, NASM does not support ARM. So, we need to find an another assembler for ARM.

ditch llvm-mc?

is it a right time to ditch llvm-mc and use Keystone (www.keystone-engine.org) for assembling?
Keystone has a very simple API, so it is easy to plug in binch: http://www.keystone-engine.org/docs/tutorial.html

cheers.

Handling "dword ptr"

Currently disassembler shows instructions like:

mov rsi, qword ptr [rdi]

But the assembler does not accept "ptr" keyword, it wants:

mov rsi, qword [rdi]

So it is inconvinient to remove "ptr" by hand.