Revolutionizing ELF Binary Patching with Shiva
Ryan O'Neill (ElfMaster) presents Shiva, a revolutionary JIT binary patching system and custom ELF interpreter that loads and links relocatable C patches at runtime.
Summary
The Evolution of ELF Binary Patching
Patching compiled Linux ELF binaries without source code has historically relied on fragile hex editing, text padding injection, or rudimentary binary hooks.
Introducing Shiva: A JIT ELF Interpreter and Linker
Ryan O'Neill (ElfMaster) introduces Shiva, an advanced JIT binary patching system that loads and dynamically links modular C-authored patch files directly into running processes.
Advanced Linker Chaining and Userland Execution
Shiva resurrects classic concepts like userland-exec while introducing novel multi-dynamic-linker chaining, function splicing, and binary transformation capabilities.
Maintaining Insecure Legacy Code and Red-Team Applications
Demonstrations highlight Shiva's dual-use potential: enabling engineers to hot-patch critical security flaws in legacy proprietary binaries while allowing red teams to inject modular in-memory implants.
Related talks
nullcon·31 min
Security researchers examine technical aspects of Goa 2023 | Reverse Engineering RGB Keyboard Backlights With Linux Kernel Drivers by Rishit.
CypherCon 7.0·24 min
Alex Cyr | CypherCon 7.0
Alex Cyr | CypherCon 7.0 explores Reverse-Engineering Nim Malware: Analyzing compiler for unknown languages.
Main Stage·41 min
Jeroen 'Jeroen' Domburg
Demonstrates hardware hacking and reverse engineering to run custom Linux kernels and open software on inexpensive USB webcams.