lifting blobs to ELF

sometimes you get some random blob (no doubt full of proprietary crap) and you go, hmmm, this is really cool but it would be a lot better if it were in ELF format

maybe that's just me

objcopy

objcopy is okay but it'll produce some weird ELFs sometimes and i never really bothered to get a good understanding of the command line options that are available. it's kind of cursed tbh

also you'll need to use a version of objcopy built for your target, for example arm-none-eabi-objcopy. the command is simple

whatever-objcopy -I binary -O elf32-little blob.bin blob.elf

this creates an ELF with a single .data section. you can use --change-section-address .data=<address> to specify the address of the section (this would be the image base if you know it. if you don't, try rbasefind)

gcc (yes gcc)

another trick is to use the .incbin assembler directive and "compile" with gcc. you still need a target-specific toolchain of course. but if you need to "link" the blob in certain ways during lifting, this will give you more obvious control. however IME you have to use a gcc toolchain that is specifically for a bare metal ABI, not linux, or it'll do wacky things like not listening to your linker script which is pretty epic

make an assembly file

.section .blob
.global blob
blob:
.incbin "blob.bin"

and a linker script

haskal but like, linker scripts are cursed and obtuse

yes,

SECTIONS {
    . = 0x13370000;
    .blob : { *(.blob) }
}

now compile

whatever-gcc -nostdlib -T myscript.ld -o myelf.elf myasm.S

the useful thing is this is extensible to multiple sections at different addresses, in case you have some sort of split blob with multiple parts that you need to lift into one single elf. you'll wanna do an objdump -x to make sure it did the right thing though

what if it weren't like this?

i'm planning an elf lifter that i will write as soon as i stop yak shaving something else. it will hopefully be more customizable, powerful, and multi-arch without needing gigantic gcc toolchains. i've needed this too many times not to warrant writing a custom tool honestly. and gnu tools suck a lot and like to give you weird unhelpful error messages and not do what you want and it's kind of a pain to deal with

🦈

that's all the posting i have for today. like and subscribe for shomks