diff options
Diffstat (limited to 'README.md')
-rw-r--r-- | README.md | 16 |
1 files changed, 7 insertions, 9 deletions
@@ -11,23 +11,21 @@ Only the last 12 bits are checked, because randomization usually works on page size level. $ ./find printf 260 - archive-eglibc (id 2.15-0ubuntu10_amd64) - archive-glibc (id 2.19-10ubuntu2_i386) - archive-glibc (id 2.19-10ubuntu2_i386) + archive-glibc (id libc6_2.19-10ubuntu2_i386) Find a libc from the leaked return address into __libc_start_main. $ ./find __libc_start_main_ret a83 - ubuntu-trusty-i386 (id 2.19-0ubuntu6.6_i386) - archive-eglibc (id 2.19-0ubuntu6_i386) - ubuntu-utopic-i386 (id 2.19-10ubuntu2.3_i386) - archive-glibc (id 2.19-10ubuntu2_i386) - archive-glibc (id 2.19-15ubuntu2_i386) + ubuntu-trusty-i386-libc6 (id libc6_2.19-0ubuntu6.6_i386) + archive-eglibc (id libc6_2.19-0ubuntu6_i386) + ubuntu-utopic-i386-libc6 (id libc6_2.19-10ubuntu2.3_i386) + archive-glibc (id libc6_2.19-10ubuntu2_i386) + archive-glibc (id libc6_2.19-15ubuntu2_i386) Dump some useful offsets, given a libc ID. You can also provide your own names to dump. - $ ./dump 2.19-0ubuntu6.6_i386 + $ ./dump offset___libc_start_main_ret = 0x19a83 offset_system = 0x00040190 offset_dup2 = 0x000db590 |