I extracted the libc.so.6 from within a vulnerable image used for exploitation purposes. I open up the shared object in IDA and I look at the symbols inside the "Exports" tab. I find "free"; upon visiting the function however, its body seems to do something rather different from what I'd expect from a dlmalloc free implementation. What am I missing?

  • Are there any version symbols in your libc.so? Maybe you're not dealing with the standard glibc, but a very old version, or µlibc, or even a version that has custom implementations of some functions, trading memory footprint for speed, or vice versa. – Guntram Blohm supports Monica Aug 22 '15 at 12:13
  • The machine has a dynamically compiled binary that has a vulnerable binary(that can be exploited due to how dlmalloc works). ldd shows that the binary depends on this shared object. – user1743 Aug 22 '15 at 12:15

I could not figure out why this problem happens. However, I just dumped "free" from within gdb, opened it up in IDA and it works just fine.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy