How do I install the Patchelf skill?

Run npx skillmds@latest add aeondave/patchelf in your terminal (requires Node.js), paste this page's agent-chat prompt into Claude, Cursor, or any MCP-connected agent, or download the SKILL.md file and copy it into your agent's skills directory.

Is Patchelf safe to use?

This skill has not completed SkillMD's automated safety review yet. SkillMD never runs a skill's scripts for you; review the SKILL.md before installing.

Which AI agents work with Patchelf?

This skill is tagged as working with Claude Code, Claude.ai, OpenAI Codex. SKILL.md is an open format, so most agents that read a skills directory can load it too.

Is Patchelf free to use?

Yes. Installing skills from SkillMD is free. This skill is licensed under GPL-3.

Who published Patchelf?

AeonDave (@aeondave) published this skill. Their other Agent Skills are listed on their SkillMD profile.

Patchelf by aeondave — Agent Skill

Name: Patchelf
Author: AeonDave

File contents

patchelf

Patch existing ELF metadata without recompiling the target.

When to use patchelf

Use patchelf when you need to:

force an ELF to use a specific dynamic loader
point a binary at a custom libc or bundled libraries
trim or rewrite RPATH/RUNPATH entries
add, remove, or replace DT_NEEDED dependencies
change a shared library SONAME

This is especially useful in exploit labs, portable bundles, and offline ELF repair workflows.

Quick Start

# Set custom loader
patchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 ./prog

# Set custom RPATH
patchelf --set-rpath '$ORIGIN/libs' ./prog

# Replace one needed library with another
patchelf --replace-needed libold.so libnew.so ./prog

High-Value Operations

Change interpreter

patchelf --set-interpreter /path/to/ld-linux.so.2 ./prog

Use when a binary must run with a matching loader for a bundled libc.

Set or shrink RPATH

patchelf --set-rpath /opt/app/lib:/other/lib ./prog
patchelf --shrink-rpath ./prog
patchelf --shrink-rpath --allowed-rpath-prefixes /usr/lib:/opt/app/lib ./prog

Change dependencies

patchelf --remove-needed libfoo.so.1 ./prog
patchelf --add-needed libbar.so.1 ./prog
patchelf --replace-needed libold.so.1 libnew.so.1 ./prog

Change shared library SONAME

patchelf --set-soname libcustom.so.1 ./libtarget.so

Canonical Exploit-Lab Workflow

cp ./vuln ./vuln.patched
patchelf --set-interpreter ./ld-linux-x86-64.so.2 ./vuln.patched
patchelf --set-rpath '$ORIGIN' ./vuln.patched

Then verify with ldd, readelf, or by executing under a controlled directory.

Practical Notes

Always patch a copy first.
Verify before and after with readelf -l, readelf -d, and ldd.
Prefer $ORIGIN-based RPATHs for portable bundles.
Use patchelf for loader/runtime metadata, not for arbitrary code patching.

Caveats

ELF only.
Bad interpreter or dependency changes can make the binary unloadable.
Patching dependency layout does not fix ABI mismatches by itself.

Resources

No bundled scripts/, references/, or assets/. Use upstream README for build/install variants and the complete option set.

---name: patchelfdescription: Auth/lab ref: ELF patching utility for changing interpreters, RPATH/RUNPATH, DT_NEEDED entries, and SONAME fields.license: GPL-3.0---# patchelfPatch existing ELF metadata without recompiling the target.## When to use patchelfUse patchelf when you need to:- force an ELF to use a specific dynamic loader- point a binary at a custom libc or bundled libraries- trim or rewrite RPATH/RUNPATH entries- add, remove, or replace `DT_NEEDED` dependencies- change a shared library `SONAME`This is especially useful in exploit labs, portable bundles, and offline ELF repair workflows.## Quick Start```bash# Set custom loaderpatchelf --set-interpreter /lib64/ld-linux-x86-64.so.2 ./prog# Set custom RPATHpatchelf --set-rpath '$ORIGIN/libs' ./prog# Replace one needed library with anotherpatchelf --replace-needed libold.so libnew.so ./prog```## High-Value Operations### Change interpreter```bashpatchelf --set-interpreter /path/to/ld-linux.so.2 ./prog```Use when a binary must run with a matching loader for a bundled libc.### Set or shrink RPATH```bashpatchelf --set-rpath /opt/app/lib:/other/lib ./progpatchelf --shrink-rpath ./progpatchelf --shrink-rpath --allowed-rpath-prefixes /usr/lib:/opt/app/lib ./prog```### Change dependencies```bashpatchelf --remove-needed libfoo.so.1 ./progpatchelf --add-needed libbar.so.1 ./progpatchelf --replace-needed libold.so.1 libnew.so.1 ./prog```### Change shared library SONAME```bashpatchelf --set-soname libcustom.so.1 ./libtarget.so```## Canonical Exploit-Lab Workflow```bashcp ./vuln ./vuln.patchedpatchelf --set-interpreter ./ld-linux-x86-64.so.2 ./vuln.patchedpatchelf --set-rpath '$ORIGIN' ./vuln.patched```Then verify with `ldd`, `readelf`, or by executing under a controlled directory.## Practical Notes- Always patch a copy first.- Verify before and after with `readelf -l`, `readelf -d`, and `ldd`.- Prefer `$ORIGIN`-based RPATHs for portable bundles.- Use patchelf for loader/runtime metadata, not for arbitrary code patching.## Caveats- ELF only.- Bad interpreter or dependency changes can make the binary unloadable.- Patching dependency layout does not fix ABI mismatches by itself.## ResourcesNo bundled `scripts/`, `references/`, or `assets/`.Use upstream README for build/install variants and the complete option set.

Frequently asked questions

Patchelf