# E9Patch

> Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. The e9tool front end selects instructions with a matching language over disassembly attributes and patches them with built-in trampolines, calls into C or C++ functions compiled with e9compile.sh, or hand-written plugin trampolines; the e9patch back end accepts JSON-RPC commands so other tools can drive it. Optional modes add heuristic control-flow recovery for faster rewritten binaries or SIGILL-based fallbacks for full patch coverage.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-10-19
- Added to the catalog: 2026-10-19
- Original resource: <https://github.com/GJDuck/e9patch>
- Primary source: <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/README.md>
- Catalog page: <https://awesomerea.org/resources/e9patch/>
- Record JSON: <https://awesomerea.org/resources/e9patch/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/e9patch/index.md)

## Requirements & limits

- Latest release at review: v1.0.1, published 2026-06-22, with an amd64 Debian package; earlier 1.0.0 release candidates ran through rc10 (2025-04-16) before v1.0.0 on 2026-03-01. The reviewed master commit (2026-06-28) is one commit ahead of v1.0.1, fixing undefined behavior on empty trampoline template entries, and its VERSION file reads 1.0.1.
- build.sh builds e9patch and e9tool after checking for gcc, g++, make, binutils, xxd, markdown and zlib headers, and suggests Debian/Ubuntu package names; Zydis and libdw are vendored under contrib. Patch functions are compiled with e9compile.sh using gcc and freestanding flags. The README targets x86_64 Linux; the source also contains PE handling and a Windows example that calls itself a proof of concept, which the guides do not document.
- Input is the user's own ELF executable or shared object, and output is written to a.out or a.so by default. The guide notes that the built-in linear disassembler can mishandle binaries that mix code and data and accepts --use-disasm and --use-targets CSV files from other analyzers. The CFR mode is heuristic and less robust, and in the -100 mode a rewritten program's own attempts to install a SIGILL handler fail with ENOSYS.
- GPL-3.0, with specific files such as examples/stdlib.c under MIT as stated in their preambles.

## Primary sources

1. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/README.md>
2. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/doc/e9tool-user-guide.md>
3. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/doc/e9patch-programming-guide.md>
4. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/build.sh>
5. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/e9compile.sh>
6. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/examples/win64_demo.c>
7. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/examples/stdlib.c>
8. <https://github.com/GJDuck/e9patch/tree/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/contrib>
9. <https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/LICENSE>
10. <https://github.com/GJDuck/e9patch/releases/tag/v1.0.1>
11. <https://github.com/GJDuck/e9patch/compare/v1.0.1...682ab1f7f0480aa45edf1fd94457e5ee2dd01043>

## Related entries

Matched by the same code repository or publication identifier.

- [Binary Rewriting without Control Flow Recovery](https://awesomerea.org/papers/paper-e9patch/index.md) · Research paper

## More in Native binaries

- [Rellic](https://awesomerea.org/resources/rellic/index.md) · Tool
- [ghidra-delinker-extension](https://awesomerea.org/resources/ghidra-delinker-extension/index.md) · Tool
- [BinExport](https://awesomerea.org/resources/binexport/index.md) · Tool
- [Karta](https://awesomerea.org/resources/karta/index.md) · Tool
- [VTIL-Core](https://awesomerea.org/resources/vtil-core/index.md) · Tool
- [Frida Workbench for VSCode](https://awesomerea.org/resources/vscode-frida/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.