blob: a6bbb8fe9d4ae8a5ba04644435ec04e6513e0e1f (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
|
## Building a libc offset database
Fetch all the configured libc versions and extract the symbol offsets.
It will not download anything twice, so you can also use it to update your
database:
$ ./get
You can also add a custom libc to your database.
$ ./add /usr/lib/libc-2.21.so
Find all the libc's in the database that have a given name at the given address.
Only the last 12 bits are checked, because randomization usually works on page
size level.
$ ./find printf 260
archive-glibc (id libc6_2.19-10ubuntu2_i386)
Find a libc from the leaked return address into __libc_start_main.
$ ./find __libc_start_main_ret a83
ubuntu-trusty-i386-libc6 (id libc6_2.19-0ubuntu6.6_i386)
archive-eglibc (id libc6_2.19-0ubuntu6_i386)
ubuntu-utopic-i386-libc6 (id libc6_2.19-10ubuntu2.3_i386)
archive-glibc (id libc6_2.19-10ubuntu2_i386)
archive-glibc (id libc6_2.19-15ubuntu2_i386)
Dump some useful offsets, given a libc ID. You can also provide your own names
to dump.
$ ./dump libc6_2.19-0ubuntu6.6_i386
offset___libc_start_main_ret = 0x19a83
offset_system = 0x00040190
offset_dup2 = 0x000db590
offset_recv = 0x000ed2d0
offset_str_bin_sh = 0x160a24
|
