They're not overwriting the whole su elf file

I didn't say anything about this.

Looks to me like they are starting at the start:

https://github.com/theori-io/copy-fail-CVE-2026-31431/issues/54#issuecomment-4351460190

chunk_offset = 0
while chunk_offset < len(payload_bytes):
    patch_chunk(target_fd, chunk_offset, payload_bytes[chunk_offset : chunk_offset + 4])

You do have to look into patch_chunk but it appears that all it does is add 4. That is, this stuff is being written directly after the magic cookie at the start. Or possibly that 4 is an artifact of the cryptography socket they are using. I don't know.

Doing that via C would be tricky and painful - you'd have to compile it and then extract a piece of the machine code from that compiled binary

It's not at all painful. I compile stand-alone code using C compilers for embedded systems all the time. Yes, it's a bit tricky. But this whole thing is tricky, isn't it?

Some of these options to cc might be enlightening. Or maybe not, this isn't quite all you need to do:

for compiling: -nostdinc -ffreestanding -static -fno-PIC

for linking, all those plus: -nostartfiles

There's more to it than this, you may need to get the results out of the ELF into just the binary code representation. That would require post-link processing. Again, not sexy to do so. Also, you'd still be ELF-only unless you start adding even more smarts about how to pick parts out of other compiled binaries. Luckily linux uses ELF (everywhere I think) in all the timeframe mentioned.

It's waaaay easier

I didn't say anything about easy or difficult. Why, after talking about assembling are you now wanting to complain about difficulty?

In fact I'm not even sure how you would invoke syscall from C without asm section and without calling exec function

I am.

man 2 syscall

UNIX is a bootstrappable system. Without writing special assembly to retarget. That requires the system be able to be constructed from C code (and a proper compiler).

Your idea would only work if you overwritten the whole su binary with a new elf file

Wrong. You don't know how to do this so you think it can't be done. Interesting. What happens if we apply the fact that 99% of us didn't know how to do this exploit in the first place? Does it then become impossible?

edit: Actually if they could overwrite the whole file, they would have just overwritten su with /bin/sh, which tells me that was not possible and they could only patch part of the file.

I don't think that would accomplish their goals. You don't get real uid 0 that way, only euid 0. Sure, there are ways to leverage that including one obvious one. But it's more stuff they have to put into their script, it wouldn't look as flashy or be as small.

I do expect that there is a potential limitation of one page they can write over. 4K or 16K depending on the architecture. Not because it's not possible to write over more, but because as is mentioned in the writeup the dirty flag is not set on the pages which are overwritten. So if those pages are paged out and back in they will be back to their old contents. So keeping the changes within one page really minimizes the chances of failure.

Not that I ever said they should write over all of /bin/sh. I never mentioned anything large.

I think given you don't know this stuff and I apparently do says maybe your choice of "tell me you've never written an exploit" was ill considered. Would you like to try this again with both of us not assuming we're the only one on here who knows what they are doing?