Show HN: ELF Injector

24 dillstead 2 7/29/2025, 3:00:02 PM github.com ↗
The ELF Injector allows you to "inject" arbitrary-sized relocatable code chunks into ELF executables. The code chunks will run before the original entry point of the executable runs.

Included in the project are sample chunks as well as a step-by-step tutorial on how it works.

It's a mix of C and assembly and currently runs on 32-bit ARM though it's easy to port to other architectures.

Comments (2)

Retr0id · 2h ago
One of the challenges of ELF injection/infection is that you might break assumptions made by the original ELF regarding its layout, particularly for dynamic ELFs (which often parse .dynamic at runtime, etc.)

How many different target ELFs have you tried it with, and are there any that don't work?

dillstead · 1h ago
I wrote the project entirely for fun, as a learning experience and because of that I have not extensively tested it. At the moment only ELF files of type ET_EXEC can be injected.

I was careful to only inject the thunk (the code that loads the actual relocatable code chunk the the user injects) into the available padding at the end of the text segment, injecting anything larger runs the risk of "sliding" the next segment (usually the data segment) over thereby breaking references to static data from code.