andersch.dev

dandersch
<2025-01-07 Tue>
[ os ]

Executable Image

Executable images are files that contain machine code, metadata, and other information necessary for the operating system to load and run a program. Examples include ELF for Unix-based systems and PE for Windows.

Executable images include both executables (.exe) and dynamic-link libraries (.dll), with the difference being that the former can be an initial module for a process, while the DLL is a module that can only be loaded dynamically by an existing process.

The loaded equivalent of an executable image is a module.

The Executable & Linkable Format (ELF)

The Executable & Linkable Format (ELF) is a file format for executable images. Files of this format are called ELF executables, and can include executables, object code and shared libraries. It is the standard binary file format for Unix-like systems on x86 processors.

How to manually edit executables

  1. Get a plaintext hexdump of the executable, i.e. the hex values that make up the executable represented in ascii: xxd -plain /path/to/elf_file > elf_file.dump
  2. Edit hex values in a normal text editor vim elf_file.dump
  3. Write changes back to an executable file, i.e. revert an ascii hexdump into binary data xxd -plain -revert elf_file.dump > /path/to/elf_file

Script to turn hexdump-files (.dump) that contain comments (lines starting with '#') into executable files: 

#!/bin/bash
for f in *.dump
do
    a=`basename $f .dump`
    cut -d'#' -f1 <$f | xxd -plain -revert > $a
    chmod +x $a
done