From b3ea4a4361eb5b0966ab489e562294ba3df0c553 Mon Sep 17 00:00:00 2001 From: Niklas Baumstark Date: Tue, 17 Mar 2015 12:03:32 +0100 Subject: add ubuntu libc6-i386 packages --- README.md | 16 +++++++--------- 1 file changed, 7 insertions(+), 9 deletions(-) (limited to 'README.md') diff --git a/README.md b/README.md index 0dcc28b..b89178c 100644 --- a/README.md +++ b/README.md @@ -11,23 +11,21 @@ Only the last 12 bits are checked, because randomization usually works on page size level. $ ./find printf 260 - archive-eglibc (id 2.15-0ubuntu10_amd64) - archive-glibc (id 2.19-10ubuntu2_i386) - archive-glibc (id 2.19-10ubuntu2_i386) + archive-glibc (id libc6_2.19-10ubuntu2_i386) Find a libc from the leaked return address into __libc_start_main. $ ./find __libc_start_main_ret a83 - ubuntu-trusty-i386 (id 2.19-0ubuntu6.6_i386) - archive-eglibc (id 2.19-0ubuntu6_i386) - ubuntu-utopic-i386 (id 2.19-10ubuntu2.3_i386) - archive-glibc (id 2.19-10ubuntu2_i386) - archive-glibc (id 2.19-15ubuntu2_i386) + ubuntu-trusty-i386-libc6 (id libc6_2.19-0ubuntu6.6_i386) + archive-eglibc (id libc6_2.19-0ubuntu6_i386) + ubuntu-utopic-i386-libc6 (id libc6_2.19-10ubuntu2.3_i386) + archive-glibc (id libc6_2.19-10ubuntu2_i386) + archive-glibc (id libc6_2.19-15ubuntu2_i386) Dump some useful offsets, given a libc ID. You can also provide your own names to dump. - $ ./dump 2.19-0ubuntu6.6_i386 + $ ./dump offset___libc_start_main_ret = 0x19a83 offset_system = 0x00040190 offset_dup2 = 0x000db590 -- cgit v1.2.3