title: Replacing Binary function in a Shared Object with a custom One (Under MIPSEL)
body: <p>I'm trying to break inside a device of mine which has a MIPSEL core (Little endian MIPS). I mainly want to do that because the software that came on it is kinda broken and doesn't works as intended (and the manufacturer won't help me out because i don't buy thousands of units monthly).</p>
  
  <p>This device has a telnet console and i have already a firmware upgrade which modifies a Shared Object (a .so file) which has relocatable code. There's one function i know is called on that .so when i access a certain feature of this device and i've already done a binary to modify /etc/passwd so i can telnet in (this can be done after i manually flash my custom firmware myself).</p>
  
  <p>I've already "objdump" both files and have the dissasembly of both.</p>
  
  <p>My question is:</p>
  
  <p>How can i replace a given function from the original library with my custom one so i can run my code on the box? I know objcopy can work, but its kinda difficult to get documentation on it to achieve this.</p>
  
  <p>What i want to do is kind like a virus, although i don't want to distribute it nor break into other's peoples devices (btw, this device i'm talking about is VERY rare).</p>
  
  <p><strong>UPDATE</strong></p>
  
  <p>I manually merged the binaries, copying my custom function "binarily" and then changing the relocation literals by hand. I took care to only use external functions that were already linked to the original shared object. However, i locked myself out from the device because i modified a function that is (strangely) used on device startup and the main binary which has the weakness that let me update it stopped working.</p>