AwesomeREA.org

Tool

E9Patch

Static binary rewriter for x86-64 Linux ELF executables and shared objects that inserts instrumentation without control-flow recovery and writes a drop-in replacement binary, following the PLDI 2020 paper Binary Rewriting without Control Flow Recovery. The e9tool front end selects instructions with a matching language over disassembly attributes and patches them with built-in trampolines, calls into C or C++ functions compiled with e9compile.sh, or hand-written plugin trampolines; the e9patch back end accepts JSON-RPC commands so other tools can drive it. Optional modes add heuristic control-flow recovery for faster rewritten binaries or SIGILL-based fallbacks for full patch coverage.

Requirements and limitations

  • Latest release at review: v1.0.1, published 2026-06-22, with an amd64 Debian package; earlier 1.0.0 release candidates ran through rc10 (2025-04-16) before v1.0.0 on 2026-03-01. The reviewed master commit (2026-06-28) is one commit ahead of v1.0.1, fixing undefined behavior on empty trampoline template entries, and its VERSION file reads 1.0.1.
  • build.sh builds e9patch and e9tool after checking for gcc, g++, make, binutils, xxd, markdown and zlib headers, and suggests Debian/Ubuntu package names; Zydis and libdw are vendored under contrib. Patch functions are compiled with e9compile.sh using gcc and freestanding flags. The README targets x86_64 Linux; the source also contains PE handling and a Windows example that calls itself a proof of concept, which the guides do not document.
  • Input is the user's own ELF executable or shared object, and output is written to a.out or a.so by default. The guide notes that the built-in linear disassembler can mishandle binaries that mix code and data and accepts --use-disasm and --use-targets CSV files from other analyzers. The CFR mode is heuristic and less robust, and in the -100 mode a rewritten program's own attempts to install a SIGILL handler fail with ENOSYS.
  • GPL-3.0, with specific files such as examples/stdlib.c under MIT as stated in their preambles. The README's scalability, speed and overhead claims, including rewriting web browsers over 100 MB, were not tested, and the downstream projects it lists were not reviewed. No binaries were rewritten.

About this entry

Type
Tool
Category
Debugging and dynamic analysis
Relationship
Foundation tool
Targets
Binary

Sources reviewed

The description was reviewed against primary sources. This does not establish runtime testing, security auditing or verified compatibility.

Primary sources

  1. README.md GitHub · GJDuck/e9patch · Revision 682ab1f
  2. doc/e9tool-user-guide.md GitHub · GJDuck/e9patch · Revision 682ab1f
  3. doc/e9patch-programming-guide.md GitHub · GJDuck/e9patch · Revision 682ab1f
  4. build.sh GitHub · GJDuck/e9patch · Revision 682ab1f
  5. e9compile.sh GitHub · GJDuck/e9patch · Revision 682ab1f
  6. examples/win64_demo.c GitHub · GJDuck/e9patch · Revision 682ab1f
  7. examples/stdlib.c GitHub · GJDuck/e9patch · Revision 682ab1f
  8. contrib GitHub · GJDuck/e9patch · Revision 682ab1f
  9. LICENSE GitHub · GJDuck/e9patch · Revision 682ab1f
  10. https://github.com/GJDuck/e9patch/releases/tag/v1.0.1
  11. https://github.com/GJDuck/e9patch/compare/v1.0.1...682ab1f7f0480aa45edf1fd94457e5ee2dd01043