7

I'm on a Linux machine with ASLR disabled. Running ldd on a binary gives me the following result :

linux-gate.so.1 =>  (0xb7fe1000)
libc.so.6 => /lib/i386-linux-gnu/libc.so.6 (0xb7e5c000)
/lib/ld-linux.so.2 (0xb7fe2000)

Does this mean that libc.so.6 will be loaded at the address 0xb7e5c000? I'm trying to build a ROP chain for an old CTF challenge and I'd like to get gadgets from the library. I'm looking to know the base address of the library so that I can add it to the offsets of the gadgets.

  • If you want to create a ROP just for recreational purpose, you may just compile your binary with the -static option. It will statically link the libc to the executable and, thus, increase drastically the number of potential gadgets. – perror May 3 '13 at 16:35
  • 1
    @blahfish: not worth its own answer, but have a look over this – 0xC0000022L May 3 '13 at 18:44
10

In fact, ldd is loading the libraries on-the-fly to list what libraries are needed. So, on this run, you can say that libc.so.6 has been loaded at 0xb7e5c000, but you have no warranty that it will always be the case. Even with no ASLR, it is mainly depending on the loading order of the libraries that might vary from one run to another.

Nevertheless, assuming you have no ASLR, and speaking about the libc, which will be very likely to be the first loaded library anyway, you can safely assume that it will loaded at this address most of the time.

6

Yes, the base address of libc.so.6 should be 0xb7e5c000 for that binary. You can verify this by catting /proc/<pid>/maps while your application is running.

  • Hmmm. That contradicts perror answer... – Mellowcandle May 3 '13 at 16:31
  • 1
    perror gave a much more detailed answer, obviously; he posted it as I was typing mine, else I would have left well enough alone. :) I don't see much of a contradiction though; as he said, with libc and no ASLR, this address should be the same. Pre-ASLR ret2libc and ROP exploits generally rely on the address of libc not changing. – devttys0 May 3 '13 at 16:44
  • @Mellowcandle: I agree with devttys0, our both answers end up with the same conclusion. I did just try to be more accurate on what hypothesis were to be taken into account (and why). – perror May 3 '13 at 20:46
  • I agree with you. Deleting my comment... – Mellowcandle May 4 '13 at 5:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy