Questions tagged [libc]
C standard library for the C programming language as specified in the C specification (ANSI C, C99, C11, ...).
16
questions
0
votes
0answers
67 views
system doesn't invoke /bin/sh
I am learning libc shellcode attacks and trying to execute /bin/sh from system
I can execute other commands from system like whoami and ls -a but can not run /bin/sh
the following works
string = b&...
1
vote
1answer
56 views
debugging an older version of libc
I'm trying to understand heap exploitation better. Therefore, I compiled the following file:
https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c
I have the newest ...
1
vote
1answer
44 views
GDB exited when running library
I'm new with gdb and I have spent hours looking for direction but I can't find any.
I need to analyze an executable to find how this program process the arguments and where the output came from. I ...
0
votes
0answers
111 views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
1
vote
0answers
14 views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
1
vote
1answer
194 views
How to use the libc.so.6 file?
I'm new to Linux operating system.
Last day, I practice "heap exploitation", and they give me an ELF file, and a libc.so.6 file, and they said I must debug/exploit with that libc file, but I don't ...
2
votes
2answers
1k views
How to help IDA to auto complete libc functions?
I have a x86_64 ELF binary which is statically compiled. With some digging,
I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code
shows sycalls as inline assembly code. But in ...
1
vote
0answers
193 views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
0
votes
1answer
538 views
How can I intercept syscall libc function in C++ without writing any code in C file
How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file.
Please give an example.
0
votes
2answers
116 views
`dmi libc puts~GLOBAL` does not show puts, just putspent?
On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation"
[0x080483d0]> dmi libc puts~&GLOBAL, puts:0
532 0x000fdd60 0xf7e0bd60 GLOBAL FUNC 1181 putspent
[0x080483d0]&...
1
vote
1answer
3k views
Found the adress of a function LIBC without GDB
How to calculate the address of a function in the LIBC, when ASLR is not active.
I only have the address where to load the LIBC (with ldd /bin/bash).
Thank you for the explanations
EDIT:
When I use ...
0
votes
1answer
92 views
Why is j_free function and free_ptr pointer needed in glibc?
I am disassembling libc-2.23.so, there exists a thunk method called j_free which jumps at the location pointed to by free_ptr pointer in glibc. Why do those even exist while free() itself is exported?
9
votes
2answers
8k views
How does glibc malloc work?
Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
1
vote
2answers
1k views
Recognizing CLib functions in Ollydbg or IDA
I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I ...
3
votes
1answer
211 views
Exploitability of Stack-based Buffer Overflows on functions ending with fclose()
I have been discussing the effectiveness of GNU libc's fclose() function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a ...
0
votes
0answers
73 views
dlmalloc free pointers
I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
