How to calculate the address of a function in the LIBC, when ASLR is not active. I only have the address where to load the LIBC (with ldd /bin/bash).

Thank you for the explanations


When I use your method I do not get the good result, although it is good in general (I do not understand why)

libc base adress

ldd ch33 linux-gate.so.1 => (0xb7fff000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e46000) /lib/ld-linux.so.2 (0x80000000)

system offset:

gdb -q /lib/i386-linux-gnu/libc.so.6 gdb$ print system $1 = {<text variable, no debug info>} 0x40310 <__libc_system>

I then calculate 0x40310 + 0xb7e46000 = 0xb7e86310

However, i should get 0xb7e64310

because: ~$ gdb ch33 gdb$ r Starting program: /challenge/app-systeme/ch33/ch33 ... gdb$ p system $1 = {<text variable, no debug info>} 0xb7e64310 <__libc_system>

  • Did you found an answer for this, I also get randomized addresses for libc functions. I checked ASLR in my system its disabled + binary is compiled with -fno-stack-protector flag so I don't know why libc addresses changes, did you found an answer?
    – 0x01Brain
    Apr 27, 2020 at 11:02

1 Answer 1


This can be done using


$ objdump -TC /lib/x86_64-linux-gnu/libc.so.6 | grep " printf$"

0000000000064e80 g    DF .text  00000000000000c3  GLIBC_2.2.5 printf


$ readelf -Ws /lib/x86_64-linux-gnu/libc.so.6 | grep " printf@@GLIBC_2.2.5"
   627: 0000000000064e80   195 FUNC    GLOBAL DEFAULT   13 printf@@GLIBC_2.2.5


$ nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep " printf$"
0000000000064e80 T printf


$ ldd ./shellpointcode               
    linux-vdso.so.1 (0x00007fff3f1e1000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3f9213f000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f3f92732000)
$ gdb -q /lib/x86_64-linux-gnu/libc.so.6
pwndbg: loaded 171 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from /lib/x86_64-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug//lib/x86_64-linux-gnu/libc-2.27.so...done.
pwndbg> print printf
$1 = {int (const char *, ...)} 0x64e80 <__printf>

Then the effective address of printf would be

0x64e80+0x7f3f9213f000 = 0x7f3f921a3e80
  • This method does not work, I edited my message to see
    – ken
    Sep 15, 2018 at 14:48
  • The title of the question says “without gdb”
    – julian
    Sep 15, 2018 at 15:09
  • @ken The loading addresses are different sometimes in gdb and ldd although idk why
    – sudhackar
    Sep 15, 2018 at 15:23
  • @SYS_V I have edited the answer to keed gdb as the last option.
    – sudhackar
    Sep 15, 2018 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.