Search for integer declared variables in an ELF executable using a hex editor

Question

I want to change the value of an integer declared variable in an executable file using a hex editor, just suppose that I know that the type of the variable int is specified in the code, and the variable:

int value = 1337;

I want to edit the executable using a hex editor to search for the value 1337 and change it to something else, I tried ghex in ubuntu, but I don’t know how to look for it, I converted it to hex, but I didn’t find him, thanks in advance guys.

Answer 1

readelf ( ). -s , grep .

readelf -s a.out | grep value

, :

    64: 000000000060102c     4 OBJECT  GLOBAL DEFAULT   24 value

, 64- value. 0x60102c, 4 . , , . :

• , ,
• , ( "", , ELF).

readelf. -s .

readelf -S a.out

. , 60102c, , 60102c Address Address + Size. , , .data.

Section Headers:
  [Nr] Name              Type             Address           Offset
       Size              EntSize          Flags  Link  Info  Align
  ...
  [21] .dynamic          DYNAMIC          0000000000600e28  00000e28
       00000000000001d0  0000000000000010  WA       6     0     8
  [22] .got              PROGBITS         0000000000600ff8  00000ff8
       0000000000000008  0000000000000008  WA       0     0     8
  [23] .got.plt          PROGBITS         0000000000601000  00001000
       0000000000000028  0000000000000008  WA       0     0     8
  [24] .data             PROGBITS         0000000000601028  00001028
       0000000000000008  0000000000000000  WA       0     0     4
  [25] .bss              NOBITS           0000000000601030  00001030
       0000000000000008  0000000000000000  WA       0     0     4
  [26] .comment          PROGBITS         0000000000000000  00001030
       000000000000002c  0000000000000001  MS       0     0     1

, .data 601028 601028+8 = 601030. value , :

  60102c       Address of `value`
- 601028       Start address of .data section
--------
       4

, value 4 .data. , .data? Offset. .data 1028. , value:

  1028         File offset of .data section
+    4         Offset of `value` in .data section
-------
  102c         File offset of `value`

---

, , . 1337. 0x539. ( "endianness" ). Intel x86 . , , , , ( "" ) , - ( ).

, 1337 ( 4- int) :

39 05 00 00

" " (, Motorola 68k) :

00 00 05 39

---

, ELF , offset 102c, :

ELF CRC, , , !