1

How to calculate the address of a function in the LIBC, when ASLR is not active. I only have the address where to load the LIBC (with ldd /bin/bash).

Thank you for the explanations

EDIT:

When I use your method I do not get the good result, although it is good in general (I do not understand why)

libc base adress

ldd ch33 linux-gate.so.1 => (0xb7fff000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e46000) /lib/ld-linux.so.2 (0x80000000)

system offset:

gdb -q /lib/i386-linux-gnu/libc.so.6 gdb$ print system $1 = {<text variable, no debug info>} 0x40310 <__libc_system>

I then calculate 0x40310 + 0xb7e46000 = 0xb7e86310

However, i should get 0xb7e64310

because: ~$ gdb ch33 gdb$ r Starting program: /challenge/app-systeme/ch33/ch33 ... gdb$ p system $1 = {<text variable, no debug info>} 0xb7e64310 <__libc_system>

1

This can be done using

objdump:

$ objdump -TC /lib/x86_64-linux-gnu/libc.so.6 | grep " printf$"

0000000000064e80 g    DF .text  00000000000000c3  GLIBC_2.2.5 printf

readelf:

$ readelf -Ws /lib/x86_64-linux-gnu/libc.so.6 | grep " printf@@GLIBC_2.2.5"
   627: 0000000000064e80   195 FUNC    GLOBAL DEFAULT   13 printf@@GLIBC_2.2.5

nm:

$ nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep " printf$"
0000000000064e80 T printf

gdb:

$ ldd ./shellpointcode               
    linux-vdso.so.1 (0x00007fff3f1e1000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3f9213f000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f3f92732000)
$ gdb -q /lib/x86_64-linux-gnu/libc.so.6
pwndbg: loaded 171 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from /lib/x86_64-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug//lib/x86_64-linux-gnu/libc-2.27.so...done.
done.
pwndbg> print printf
$1 = {int (const char *, ...)} 0x64e80 <__printf>

Then the effective address of printf would be

0x64e80+0x7f3f9213f000 = 0x7f3f921a3e80
  • This method does not work, I edited my message to see – ken Sep 15 '18 at 14:48
  • The title of the question says “without gdb” – julian Sep 15 '18 at 15:09
  • @ken The loading addresses are different sometimes in gdb and ldd although idk why – sudhackar Sep 15 '18 at 15:23
  • @SYS_V I have edited the answer to keed gdb as the last option. – sudhackar Sep 15 '18 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.