`dmi libc puts~GLOBAL` does not show puts, just putspent?

Question

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation"

[0x080483d0]> dmi libc puts~&GLOBAL, puts:0
532 0x000fdd60 0xf7e0bd60 GLOBAL   FUNC 1181 putspent

[0x080483d0]> dmi libc system~&GLOBAL, system:0

[0x080483d0]> dmi libc exit~&GLOBAL, exit:0
147 0x000303d0 0xf7d3e3d0 GLOBAL   FUNC   33 exit

I can only see exit on my sistem. Neither the location of system nor puts shows with dmi. The search for puts shows putsspent and the search for system returns nothing.

Answer 1

This is right, and it was caused by using the wrong grep (the ~ character) in the article. This was due the fact that the output of dmi libc is different on different machines and also, the syntax of the dmi output was changed. The grep you showed (~&GLOBAL, exit:0) is indeed wrong.

The grep is there, for the first place, in order to filter functions that contain in them, the name of the function we are searching for (i.e puts, exit, system). This way, the reader could narrow down the results and keep only the relevant functions.

I came up with a better, more elegant, solution for the grep:

[0x7f99e22006a0]> dmi libc puts~ puts$
422 0x000809c0 0x7f99e1a809c0   WEAK   FUNC  512 puts

[0x7f99e22006a0]> dmi libc exit~ exit$
132 0x00043120 0x7f99e1a43120 GLOBAL   FUNC   26 exit

[0x7f99e22006a0]> dmi libc system~ system$
1403 0x0004f440 0x7f99e1a4f440   WEAK   FUNC   45 system

This will ensure that the user would get the expected results, and them only. This is now fixed in the article itself.

Answer 2

They're apparently not just GLOBAL, as the dmi command would leave you to believe,

1510 0x0003d200 0xf7d55200   WEAK   FUNC   55 system
454  0x00067b40 0xf7d7fb40   WEAK   FUNC  474 puts

And they're not GLOBAL in Megabeet tutorial either, so I think it's a typo,

In the first the ~&GLOBAL looks like it would work,

[0x080483d0]> dmi libc puts~&GLOBAL, puts:0
vaddr=0xf758f710 paddr=0x00062710 ord=6490 fwd=NONE sz=474 bind=GLOBAL type=FUNC name=puts

But in this one, there is no match for GLOBAL, his system is WEAK (like mine),

[0x080483d0]> dmi libc system~&GLOBAL, system:0
vaddr=0xf7569060 paddr=0x0003c060 ord=6717 fwd=NONE sz=55 bind=WEAK type=FUNC name=system

And, in this one, his exit is LOCAL.

[0x080483d0]> dmi libc exit~&GLOBAL, exit:0
vaddr=0xf755c180 paddr=0x0002f180 ord=5904 fwd=NONE sz=33 bind=LOCAL type=FUNC name=exit

For a follow up question, see

• Why are some libc symbols WEAK and others GLOBAL?