Awesome REA
中文Star on GitHubStar1.1k stars
Star on GitHubStar1.1k stars

Tool

E9Patch

Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. The e9tool front end selects instructions with a matching language over disassembly attributes and patches them with built-in trampolines, calls into C or C++ functions compiled with e9compile.sh, or hand-written plugin trampolines; the e9patch back end accepts JSON-RPC commands so other tools can drive it. Optional modes add heuristic control-flow recovery for faster rewritten binaries or SIGILL-based fallbacks for full patch coverage.

Targets
Binary
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Sources reviewed

Requirements & limits

  • Latest release at review: v1.0.1, published 2026-06-22, with an amd64 Debian package; earlier 1.0.0 release candidates ran through rc10 (2025-04-16) before v1.0.0 on 2026-03-01. The reviewed master commit (2026-06-28) is one commit ahead of v1.0.1, fixing undefined behavior on empty trampoline template entries, and its VERSION file reads 1.0.1.
  • build.sh builds e9patch and e9tool after checking for gcc, g++, make, binutils, xxd, markdown and zlib headers, and suggests Debian/Ubuntu package names; Zydis and libdw are vendored under contrib. Patch functions are compiled with e9compile.sh using gcc and freestanding flags. The README targets x86_64 Linux; the source also contains PE handling and a Windows example that calls itself a proof of concept, which the guides do not document.
  • Input is the user's own ELF executable or shared object, and output is written to a.out or a.so by default. The guide notes that the built-in linear disassembler can mishandle binaries that mix code and data and accepts --use-disasm and --use-targets CSV files from other analyzers. The CFR mode is heuristic and less robust, and in the -100 mode a rewritten program's own attempts to install a SIGILL handler fail with ENOSYS.
  • GPL-3.0, with specific files such as examples/stdlib.c under MIT as stated in their preambles.

About this entry

The description was reviewed against primary sources.

Report an outdated entry Suggest a translation fix

Related entries

Matched by the same code repository or publication identifier.

Primary sources

  1. README.md GitHub · GJDuck/e9patch · Revision 682ab1f
  2. doc/e9tool-user-guide.md GitHub · GJDuck/e9patch · Revision 682ab1f
  3. doc/e9patch-programming-guide.md GitHub · GJDuck/e9patch · Revision 682ab1f
  4. build.sh GitHub · GJDuck/e9patch · Revision 682ab1f
  5. e9compile.sh GitHub · GJDuck/e9patch · Revision 682ab1f
  6. examples/win64_demo.c GitHub · GJDuck/e9patch · Revision 682ab1f
  7. examples/stdlib.c GitHub · GJDuck/e9patch · Revision 682ab1f
  8. contrib GitHub · GJDuck/e9patch · Revision 682ab1f
  9. LICENSE GitHub · GJDuck/e9patch · Revision 682ab1f
  10. https://github.com/GJDuck/e9patch/releases/tag/v1.0.1
  11. https://github.com/GJDuck/e9patch/compare/v1.0.1...682ab1f7f0480aa45edf1fd94457e5ee2dd01043

More in Native binaries

All 269 entries in Native binaries

↑↓ move↵ open⌘↵ new tab