{
  "added_at": "2026-10-19",
  "additional_evidence_urls": [
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/doc/e9tool-user-guide.md",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/doc/e9patch-programming-guide.md",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/build.sh",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/e9compile.sh",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/examples/win64_demo.c",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/examples/stdlib.c",
    "https://github.com/GJDuck/e9patch/tree/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/contrib",
    "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/LICENSE",
    "https://github.com/GJDuck/e9patch/releases/tag/v1.0.1",
    "https://github.com/GJDuck/e9patch/compare/v1.0.1...682ab1f7f0480aa45edf1fd94457e5ee2dd01043"
  ],
  "category": "dynamic-analysis",
  "description_en": "Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. The e9tool front end selects instructions with a matching language over disassembly attributes and patches them with built-in trampolines, calls into C or C++ functions compiled with e9compile.sh, or hand-written plugin trampolines; the e9patch back end accepts JSON-RPC commands so other tools can drive it. Optional modes add heuristic control-flow recovery for faster rewritten binaries or SIGILL-based fallbacks for full patch coverage.",
  "description_zh": "面向 x86-64 Linux ELF 可执行文件和共享库的静态二进制重写工具，无需恢复控制流即可插入插桩代码，并生成可直接替换原文件的二进制，方法源自 PLDI 2020 论文《无需控制流恢复的二进制重写》。前端 e9tool 用一套基于反汇编属性的匹配语言选择指令，再通过内置跳板、调用以 e9compile.sh 编译的 C/C++ 函数或手写的插件跳板进行修补；后端 e9patch 接收 JSON-RPC 命令，便于其他工具调用。可选模式包括借助启发式控制流恢复获得更快的重写结果，或借助 SIGILL 回退实现完全的修补覆盖。",
  "entry_url": "https://awesomerea.org/resources/e9patch/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/e9patch/",
  "evidence_url": "https://github.com/GJDuck/e9patch/blob/682ab1f7f0480aa45edf1fd94457e5ee2dd01043/README.md",
  "group": "tools",
  "id": "e9patch",
  "json_url": "https://awesomerea.org/resources/e9patch/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/e9patch/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/e9patch/index.md",
  "name": "E9Patch",
  "name_zh": "E9Patch 静态二进制重写工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirements": [
    "Latest release at review: v1.0.1, published 2026-06-22, with an amd64 Debian package; earlier 1.0.0 release candidates ran through rc10 (2025-04-16) before v1.0.0 on 2026-03-01. The reviewed master commit (2026-06-28) is one commit ahead of v1.0.1, fixing undefined behavior on empty trampoline template entries, and its VERSION file reads 1.0.1.",
    "build.sh builds e9patch and e9tool after checking for gcc, g++, make, binutils, xxd, markdown and zlib headers, and suggests Debian/Ubuntu package names; Zydis and libdw are vendored under contrib. Patch functions are compiled with e9compile.sh using gcc and freestanding flags. The README targets x86_64 Linux; the source also contains PE handling and a Windows example that calls itself a proof of concept, which the guides do not document.",
    "Input is the user's own ELF executable or shared object, and output is written to a.out or a.so by default. The guide notes that the built-in linear disassembler can mishandle binaries that mix code and data and accepts --use-disasm and --use-targets CSV files from other analyzers. The CFR mode is heuristic and less robust, and in the -100 mode a rewritten program's own attempts to install a SIGILL handler fail with ENOSYS.",
    "GPL-3.0, with specific files such as examples/stdlib.c under MIT as stated in their preambles."
  ],
  "requirements_zh": [
    "审阅时最新版本为 v1.0.1，发布于 2026-06-22，提供 amd64 Debian 软件包；此前 1.0.0 的候选版本一直发布到 rc10（2025-04-16），v1.0.0 于 2026-03-01 发布。所审阅的 master 提交（2026-06-28）比 v1.0.1 多一个提交，修复了跳板模板条目为空时的未定义行为，其 VERSION 文件为 1.0.1。",
    "build.sh 在检查 gcc、g++、make、binutils、xxd、markdown 和 zlib 头文件后构建 e9patch 与 e9tool，并提示对应的 Debian/Ubuntu 软件包名；Zydis 与 libdw 以源码形式随附在 contrib 目录下。修补函数需用 e9compile.sh 以 gcc 和独立环境（freestanding）编译选项编译。README 面向 x86_64 Linux；源码中另有 PE 处理代码和一个自称概念验证的 Windows 示例，但使用指南未作说明。",
    "输入为用户自己的 ELF 可执行文件或共享库，默认输出到 a.out 或 a.so。指南指出内置的线性反汇编器可能错误处理代码与数据混杂的二进制，因此支持通过 --use-disasm 和 --use-targets 读入其他分析工具生成的 CSV 文件。CFR 模式基于启发式，稳健性较低；在 -100 模式下，被重写的程序自行安装 SIGILL 处理函数时会以 ENOSYS 失败。",
    "GPL-3.0 许可证，examples/stdlib.c 等个别文件按其文件头声明采用 MIT。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://github.com/GJDuck/e9patch",
  "verification": "source-reviewed",
  "verified_at": "2026-10-19"
}