patchkit: binary patching from Python

def simple_patch(pt):

    # nop out a jump at the entry point

    pt.patch(pt.entry, hex='90' * 5)



    # inject assembly into the binary and return the address

    addr = pt.inject(asm='mov eax, 1; ret')



    # hook the entry point to make it call addr (ret will run the original entry point)

    pt.hook(pt.entry, addr)

def replace_free(pt):

    # pretend free() is at this address:

    old_free = 0x804fc4



    # inject a function to replace free()

    new_free = pt.inject(c=r'''

    void free_stub(void *addr) {

        printf("stubbed free(%p)\n", addr);

    }

    ''')



    # patch the beginning of free() with a jump to our new function

    pt.patch(old_free, jmp=new_free)

addr = search(data)

hook(addr, new_addr)

patch(addr, *compile arg*)

addr = inject(*compile arg*)



*compile arg* is any of the following:

  raw='data'

  hex='0bfe'

  asm='nop'

  jmp=0xaddr

  c='void func() { int a; a = 1; }' (only supported on inject, not patch)