Found the adress of a function LIBC without GDB

Question

How to calculate the address of a function in the LIBC, when ASLR is not active. I only have the address where to load the LIBC (with ldd /bin/bash).

Thank you for the explanations

EDIT:

When I use your method I do not get the good result, although it is good in general (I do not understand why)

libc base adress

ldd ch33 linux-gate.so.1 => (0xb7fff000) libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e46000) /lib/ld-linux.so.2 (0x80000000)

system offset:

gdb -q /lib/i386-linux-gnu/libc.so.6 gdb$ print system $1 = {<text variable, no debug info>} 0x40310 <__libc_system>

I then calculate 0x40310 + 0xb7e46000 = 0xb7e86310

However, i should get 0xb7e64310

because: ~$ gdb ch33 gdb$ r Starting program: /challenge/app-systeme/ch33/ch33 ... gdb$ p system $1 = {<text variable, no debug info>} 0xb7e64310 <__libc_system>

Answer 1

This can be done using

objdump:

$ objdump -TC /lib/x86_64-linux-gnu/libc.so.6 | grep " printf$"

0000000000064e80 g    DF .text  00000000000000c3  GLIBC_2.2.5 printf

readelf:

$ readelf -Ws /lib/x86_64-linux-gnu/libc.so.6 | grep " printf@@GLIBC_2.2.5"
   627: 0000000000064e80   195 FUNC    GLOBAL DEFAULT   13 printf@@GLIBC_2.2.5

nm:

$ nm -D /lib/x86_64-linux-gnu/libc.so.6 | grep " printf$"
0000000000064e80 T printf

gdb:

$ ldd ./shellpointcode               
    linux-vdso.so.1 (0x00007fff3f1e1000)
    libc.so.6 => /lib/x86_64-linux-gnu/libc.so.6 (0x00007f3f9213f000)
    /lib64/ld-linux-x86-64.so.2 (0x00007f3f92732000)
$ gdb -q /lib/x86_64-linux-gnu/libc.so.6
pwndbg: loaded 171 commands. Type pwndbg [filter] for a list.
pwndbg: created $rebase, $ida gdb functions (can be used with print/break)
Reading symbols from /lib/x86_64-linux-gnu/libc.so.6...Reading symbols from /usr/lib/debug//lib/x86_64-linux-gnu/libc-2.27.so...done.
done.
pwndbg> print printf
$1 = {int (const char *, ...)} 0x64e80 <__printf>

Then the effective address of printf would be

0x64e80+0x7f3f9213f000 = 0x7f3f921a3e80