Question

I can replace a string inside an ELF binary if it has smaller or equal length but a segfault happens when replacing with a longer string. Why does it segfault? What other things must be changed so it works?

Answer 1

I can replace a string inside an ELF binary if it is less than or equal length

Depending on whether you are talking about a fully linked binary (ET_EXEC or ET_DYN) or an object file (ET_REL), your statement above may or may not be correct.

You can’t safely edit a string in .dynstr section of a fully-linked binary, because doing so would corrupt the dynamic symbol hashtable.

but a segfault happens when replacing with a longer string.

What did you expect? An ELF binary contains structured data. If you corrupt the structure of that data, you should expect all kinds of problems. You are lucky that you’ve got a segfault. It could have been much worse (e.g. it could have silently corrupted the data you write on disk).