Live data from Hacker News

PatchELF: Simple utility for modifying existing ELF executables and libraries

github.com

21–30 of 42 posts

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#21

Patchelf is almost always broken, and when they merge fixes they don't release a new version right away. Between 2014-2019 running patchelf+strip would corrupt binaries, after the fix running patchelf twice on the same binary would corrupt it. And now patchelf doesn't work on all binaries, there's a bugfix merged https://github.com/NixOS/patchelf/pull/230 merged Nov 19, 2020, but no release since then. Also patchelf…

I'm not really sure why it has to be that hard, like, why don't we just use base64-encoded JSON or something?

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#22

Patchelf is almost always broken, and when they merge fixes they don't release a new version right away. Between 2014-2019 running patchelf+strip would corrupt binaries, after the fix running patchelf twice on the same binary would corrupt it. And now patchelf doesn't work on all binaries, there's a bugfix merged https://github.com/NixOS/patchelf/pull/230 merged Nov 19, 2020, but no release since then. Also patchelf…

[deleted]

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#23

Earlier quoted context omitted.

Got a link to more reading on this? Super interested.

It’s an easy way to modify the binary to load extra code, which can alter how it behaves.

Sure, but only if you have write access to the binary. If you have that you can already replace it with anything you like, so I am not seeing the privilege escalation there.

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#24
post #21

Patchelf is almost always broken, and when they merge fixes they don't release a new version right away. Between 2014-2019 running patchelf+strip would corrupt binaries, after the fix running patchelf twice on the same binary would corrupt it. And now patchelf doesn't work on all binaries, there's a bugfix merged https://github.com/NixOS/patchelf/pull/230 merged Nov 19, 2020, but no release since then. Also patchelf…

I'm not really sure why it has to be that hard, like, why don't we just use base64-encoded JSON or something?

> why don't we just use base64-encoded JSON or something?

Base64 would be counterproductive, increasing both space and parsing time... presumably out of fear that JSON would contain a naughty byte for a greenfield file format. It would be much better to just design tho format to not have any naughty bytes.

Parsing time for exacutables and libraries is definitely on the critical startup path. You really want a length-delimited format, or better yet, one where offsets to various structures are stored at fixed offsets so you can find everything in O(1) time with a tiny constant factor.

Compiler writers and tool authors are perfectly comfortable working with binary file formats. There's nothing more inherently future-compatible about JSON than a forward-compatible binary format like flatbuffers. Having to escape and then unescape naughty bytes is a huge downside for text-based formats that are hardly ever read by humans.

On a side note, Zlib DEFLATE / gzip / LZMA etc. aren't magic for getting rid of space overheads. Try gzip -9'ing your system's wordlist, now convert it to UTF-16 and gzip -9'ing it. You'll see a several percentage increase in size, despite an entropy change of at most a constant and small number of bits (-log2(P(UTF-16)/P(UTF-8)). I've frequently seen huge JSON proponents use hand-wavy arguments that gzip will reduce any size differences to zero.

It's also nice if the file format is very close to being able to just be mmap()ed into the process's address space and only require minimal patching to a minimum number of pages in order to be an optimized in-memory representation.

Also, there's a huge amount of momentum behind executable formats. Incremental improvements by adding new features in new segment types or appending new fields to old data structures (where there's no ambiguity) is much preferred to wholly new formats.

So, creating a new debugging symbol section that's just flatbuffers is workable. Replacing the whole ecosystem with base64-'d JSON would have way more downsides than upsides.

On another side note, you need to be very careful with JSONifying floating point values. Many libraries don't give you bit-perfect round-tripping of IEEE-754 double precision values.

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#25
post #10

https://nixos.org/guides/nix-pills/automatic-runtime-depende... Part of the excellent "nix pills" guide on why things are the way they are in Nix, and why this tool was created. The whole series is a pretty easy evening read if you have experience in functional languages (like haskell), and really helps you appreciate what nix is doing. One of my main reservations about Nix and introducing it at work is basically req…

I'm working on it now at my work, partially following some advocacy in the last Nix thread on here a month or so back. I think the biggest barrier for me is that you can't really be only partially in— like, you sort of can, but you lose a lot of the benefits if you have impure builds linking to a bunch of filesystem stuff.

So yeah, you need sufficient buy-in that you can spend the effort required to basically port your entire system to a new operating system and packaging scheme. And depending how big your system is, that might be a lot of work that has to happen upfront before any real value is delivered.

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#26
post #24
post #21

Earlier quoted context omitted.

I'm not really sure why it has to be that hard, like, why don't we just use base64-encoded JSON or something?

> why don't we just use base64-encoded JSON or something? Base64 would be counterproductive, increasing both space and parsing time... presumably out of fear that JSON would contain a naughty byte for a greenfield file format. It would be much better to just design tho format to not have any naughty bytes. Parsing time for exacutables and libraries is definitely on the critical startup path. You really want a length-…

YHBT. HAND.

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#27

Apart from adapting proprietary or hard-to-compile software to non-FHS distros like NixOS or Guix, what are the usecases of patchelf?

Needing a LD_PRELOAD on a system where LD_PRELOAD is blocked. Sure it still requires you to have rights to create+run a executable. But it's a much better model then LD_PRELOAD as it can only be used on executable you can write to, which normally means you your user/group but not other user/group owned executables. Which is especially relevant with suid/sgid. You can also use this, to patch a library which is compile…

Yeah, I've been using it to set rpath on some files that needed to be packaged in a particular way...

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#28
I built a (research) library a few years ago to rewrite ELF binaries; our research projects ran into a lot of limitations with doing incremental patches to a binary (ELF has a lot of redundant representations of the same data). For us, parsing the binary into a normalized representation, modifying that, and re-serializing worked — we could make more intrusive changes to the binary, and (almost? I don’t recall anything breaking) everything in the Debian repos still ran after the binaries has been rewritten.

I expect the library is now woefully out of date, and documentation is mostly in the form of conference talk slides:

https://github.com/jbangert/mithril

there’s also https://github.com/aclements/libelfin (parsing only, supports dwarf); https://github.com/bx/elf-bf-tools (Turing machine inside elf relocations) and of course the “olg guard” of ELF reversing tools ERESI/elfsh (website seems down; GitHub mirror on https://github.com/thorkill/eresi).

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#29
post #10

https://nixos.org/guides/nix-pills/automatic-runtime-depende... Part of the excellent "nix pills" guide on why things are the way they are in Nix, and why this tool was created. The whole series is a pretty easy evening read if you have experience in functional languages (like haskell), and really helps you appreciate what nix is doing. One of my main reservations about Nix and introducing it at work is basically req…

I'm working on it now at my work, partially following some advocacy in the last Nix thread on here a month or so back. I think the biggest barrier for me is that you can't really be only partially in— like, you sort of can, but you lose a lot of the benefits if you have impure builds linking to a bunch of filesystem stuff. So yeah, you need sufficient buy-in that you can spend the effort required to basically port yo…

You can be partially in :-)

I highly recommend using the Nix package manager alongside whatever you're comfortable with. That way you can `nix shell -p foobar` when you need a package quickly or fallback to brew/apt/etc if you're not yet comfortable addressing the situation in Nix.

Re: PatchELF: Simple utility for modifying existing ELF executables and libraries

#30
post #24

Earlier quoted context omitted.

> why don't we just use base64-encoded JSON or something? Base64 would be counterproductive, increasing both space and parsing time... presumably out of fear that JSON would contain a naughty byte for a greenfield file format. It would be much better to just design tho format to not have any naughty bytes. Parsing time for exacutables and libraries is definitely on the critical startup path. You really want a length-…

YHBT. HAND.

Heh. Hopefully some of the production systems I work with are also well-played trollings.
Post reply on HN