Questions tagged [libc]

C standard library for the C programming language as specified in the C specification (ANSI C, C99, C11, ...).

Filter by
Sorted by
Tagged with
1
vote
1answer
34 views

GDB exited when running library

I'm new with gdb and I have spent hours looking for direction but I can't find any. I need to analyze an executable to find how this program process the arguments and where the output came from. I ...
0
votes
0answers
48 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
1
vote
0answers
14 views

Locating Exit/Abort Functions from Static Analysis

Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware. My ...
1
vote
1answer
99 views

How to use the libc.so.6 file?

I'm new to Linux operating system. Last day, I practice "heap exploitation", and they give me an ELF file, and a libc.so.6 file, and they said I must debug/exploit with that libc file, but I don't ...
2
votes
2answers
615 views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
1
vote
0answers
132 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
0
votes
1answer
469 views

How can I intercept syscall libc function in C++ without writing any code in C file

How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file. Please give an example.
0
votes
2answers
88 views

`dmi libc puts~GLOBAL` does not show puts, just putspent?

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation" [0x080483d0]> dmi libc puts~&GLOBAL, puts:0 532 0x000fdd60 0xf7e0bd60 GLOBAL FUNC 1181 putspent [0x080483d0]&...
1
vote
1answer
2k views

Found the adress of a function LIBC without GDB

How to calculate the address of a function in the LIBC, when ASLR is not active. I only have the address where to load the LIBC (with ldd /bin/bash). Thank you for the explanations EDIT: When I use ...
0
votes
1answer
81 views

Why is j_free function and free_ptr pointer needed in glibc?

I am disassembling libc-2.23.so, there exists a thunk method called j_free which jumps at the location pointed to by free_ptr pointer in glibc. Why do those even exist while free() itself is exported?
9
votes
2answers
7k views

How does glibc malloc work?

Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
1
vote
2answers
1k views

Recognizing CLib functions in Ollydbg or IDA

I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I ...
3
votes
1answer
167 views

Exploitability of Stack-based Buffer Overflows on functions ending with fclose()

I have been discussing the effectiveness of GNU libc's fclose() function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a ...
0
votes
0answers
72 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...