Redback: Advanced Static Binary Injection
summary
Redback is a static binary injector that injects high-level object files compiled from C/C++ into existing executables by appending new sections, fixing headers, merging relocation (.reloc) and import tables, and adjusting dynamic-link metadata. It supports PE, Mach-O and ELF and runs on Windows, macOS, Linux and BSD. The tool clones object sections, relocates symbols, updates dyld/PLT/GOT entries, and demoed injecting a DLL into hello1.exe so the modified EXE prints "injected" instead of the original output.
AI-written summary · about
chapters (13)
- 0:00Start
- 1:26Static Binary Injection
- 2:45Shellcode
- 4:28Reasons Why You Want Static Binary Injection
- 8:31Challenges
- 8:54Fix Metadata Output Executable File
- 9:26Relocation
- 15:55Pointer Relocation
- 16:33Sample Code
- 23:11Optional Headers
- 29:40Demo
- 33:08Conclusion
- 33:55Question in Answer Session
related talks
40mFantastic Red-Team Attacks and How to Find Them
27mDetecting (un)Intentionally Hidden Injected Code by Examining Page Table Entries
50m.NET Reversing and Exploitation for Cool Kids
39mBackdooring Hardware Devices by Injecting Malicious Payloads on Microcontrollers
49mProcess Injection Techniques - Gotta Catch Them All
45mFinding Vulnerabilities through Static Analysis and Scripting
40mDirty Bin Cache: A New Code Injection Poisoning Binary Translation Cache
56mHacking .NET(C#) Applications: The Black Arts (ASM attacks)