elfedit

elfedit [options] elf-file...
elfedit [-e|--elf-header] [field=value...] elf-file...
elfedit [-p|--program-header] [field=value...] elf-file...
elfedit [-s|--section-header] [field=value...] elf-file...
elfedit [-d|--dynamic-section] [-a|--add-dyn-tag TAG=VALUE] [-x|--remove-dyn-tag TAG] [-r|--replace-dyn-tag TAG=OLD=NEW] elf-file...

-e, --elf-header
    Selects the ELF header for editing. Field assignments (e.g., e_entry=0x8000) follow this option.

-p, --program-header
    Selects program headers for editing. Field assignments (e.g., p_flags=0x7) follow this option.

-s, --section-header
    Selects section headers for editing. Field assignments (e.g., sh_flags=ALLOC|EXECINSTR) follow this option.

-d, --dynamic-section
    Selects the dynamic section for editing. This option must be followed by dynamic tag specific options.

-a TAG=VALUE, --add-dyn-tag TAG=VALUE
    Adds a new dynamic tag with a specified name and value to the dynamic section.

-x TAG, --remove-dyn-tag TAG
    Removes an existing dynamic tag by its name from the dynamic section.

-r TAG=OLD=NEW, --replace-dyn-tag TAG=OLD=NEW
    Replaces the value of an existing dynamic tag from OLD to NEW.

--output FILE
    Writes the modified ELF file to a new FILE instead of modifying the input file(s) in place.

--help
    Displays usage information and exits.

--version
    Displays the version of elfedit and exits.

elfedit is a powerful command-line utility from the GNU Binutils suite designed for direct manipulation of ELF (Executable and Linkable Format) files. It provides granular control over various components of an ELF binary, including the ELF header, program headers, section headers, and the dynamic section. Unlike tools like objcopy that perform higher-level transformations, elfedit allows for precise modifications of specific ELF fields and flags.

This utility is invaluable for tasks requiring deep insight into or alteration of executable and object file structures. Common use cases include adjusting entry points, modifying program segment permissions (e.g., read, write, execute flags), changing section attributes, or manipulating dynamic linker tags (such as DT_NEEDED or DT_RPATH). While immensely flexible, elfedit requires a solid understanding of the ELF specification to be used safely and effectively, as incorrect modifications can easily corrupt a binary.

elfedit directly modifies ELF binaries. Incorrect usage can lead to irreversible file corruption, making the executable or object file unusable. Users must have a thorough understanding of the ELF file format and the specific fields they intend to alter. It is highly recommended to work on copies of files or use the --output option to prevent data loss.

For editing ELF, program, or section headers, fields are assigned using the name=value syntax. Values can be numeric (decimal or hexadecimal, e.g., 0x8000) or symbolic for flags (e.g., ALLOC|EXECINSTR), depending on the field type. Refer to the ELF specification or readelf output for valid field names.

By default, elfedit modifies the input ELF file(s) in place. To preserve the original file, always use the --output option or make a backup before running the command.

elfedit is part of the GNU Binutils package, a collection of programming tools for creating and managing binary programs, libraries, and assembly code. Binutils has been a cornerstone of the GNU toolchain since the late 1980s, providing essential utilities for software development on Unix-like systems. elfedit was developed to offer fine-grained, low-level control over ELF file structures, addressing needs not fully covered by other tools like objcopy for highly specific modifications required in debugging, security analysis, or advanced linker scenarios. Its evolution aligns with the ongoing development of the ELF standard and the increasing complexity of modern binaries.

readelf(1), objdump(1), objcopy(1), patchelf(1), ld(1)