IDA PltPatcher
C++ 2
// Overview
Recovers the PLT stubs IDA gives up on in ELF binaries. It walks the dynamic relocations from PT_DYNAMIC instead of matching stub shapes, points every GOT slot at its real extern, turns the stubs into named thunks and applies library prototypes, so calls come back with names and arguments. A C++ port of GAMMACASE's PltPatcher with ELF32/ELF64, i386, ARM, x86_64 and AArch64 support, running on Windows, Linux and macOS.
// Built with
C++IDA Pro SDKELFPLT
// The problem
IDA recognises PLT stubs by their shape. When a linker lays them out differently, IDA warns that it could not patch the PLT and leaves the database with unnamed GOT slots and calls that carry neither names nor arguments.
// Approach
- Walks DT_JMPREL straight from PT_DYNAMIC, the table the dynamic loader itself has to use, so the stub layout stops mattering.
- Repoints every GOT slot at its extern, creating missing externs, and turns each stub into a named FUNC_THUNK the decompiler folds away.
- Applies prototypes from the loaded type libraries, C and mangled C++ alike, so calls come back with their arguments.
// Engineering challenges
- The ELF header is not guaranteed to sit at min_ea, so it is validated before parsing to survive relocated loads and memory dumps.
- Hex-Rays drops a thunk's guessed type when the extern behind it has none, so a callback writes it back as definite first.
- Never overwriting names set by hand, with the whole run wrapped in a single undo point.