Questions tagged [libc]
C standard library for the C programming language as specified in the C specification (ANSI C, C99, C11, ...).
21
questions
0
votes
0
answers
21
views
Why can't I resolve the 'system' dynamic addresss in ret_2_libc exploit?
First and foremost, I am a noob pwner. The problem at hand is from TryHackMe.com > pwn101 > pwn109. A simple ret_2_libc in which you exploit a simple buffer overflow, leak the addresses of gets()...
0
votes
0
answers
43
views
Dynamically linked busibox won't work
I am hacking an ARM-based device that is coming with a lightweight busybox:
[/mnt/sdcard/busybox]## busybox
BusyBox v1.24.1 (2017-09-29 00:55:28 PDT) multi-call binary.
BusyBox is copyrighted by many ...
- 131
1
vote
0
answers
53
views
problem with LD_PRELOAD
Hell0!!!
I try ld_preload by pwntools and take it...
How can I fix this problem???
- 39
2
votes
0
answers
127
views
How to get the address of a glibc private symbol at runtime programmatically?
I am trying to get the address of a private function in GLIBC.
For instance - the function __run_prefork_handlers().
I have done it with gdb, using info symbol __run_prefork_handlers and info address ...
- 121
2
votes
1
answer
375
views
Ida Pro doesn't recognize known function
I open statically Arm binary with Ida Pro.
While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example)
...
0
votes
0
answers
83
views
system doesn't invoke /bin/sh
I am learning libc shellcode attacks and trying to execute /bin/sh from system
I can execute other commands from system like whoami and ls -a but can not run /bin/sh
the following works
string = b&...
- 109
2
votes
2
answers
563
views
debugging an older version of libc
I'm trying to understand heap exploitation better. Therefore, I compiled the following file:
https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c
I have the newest ...
- 21
1
vote
1
answer
67
views
GDB exited when running library
I'm new with gdb and I have spent hours looking for direction but I can't find any.
I need to analyze an executable to find how this program process the arguments and where the output came from. I ...
- 13
0
votes
0
answers
310
views
exploiting a binary using ret2libc
I ran into this binary at a CTF :
https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness
I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
- 1
1
vote
0
answers
22
views
Locating Exit/Abort Functions from Static Analysis
Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware.
My ...
- 1,848
2
votes
1
answer
1k
views
How to use the libc.so.6 file?
I'm new to Linux operating system.
Last day, I practice "heap exploitation", and they give me an ELF file, and a libc.so.6 file, and they said I must debug/exploit with that libc file, but I don't ...
2
votes
2
answers
2k
views
How to help IDA to auto complete libc functions?
I have a x86_64 ELF binary which is statically compiled. With some digging,
I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code
shows sycalls as inline assembly code. But in ...
- 1,559
1
vote
0
answers
281
views
How can a segfault happen during the libc exit call on Linux?
I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge.
While testing, I have noticed ...
0
votes
1
answer
818
views
How can I intercept syscall libc function in C++ without writing any code in C file
How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file.
Please give an example.
- 111
0
votes
2
answers
142
views
`dmi libc puts~GLOBAL` does not show puts, just putspent?
On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation"
[0x080483d0]> dmi libc puts~&GLOBAL, puts:0
532 0x000fdd60 0xf7e0bd60 GLOBAL FUNC 1181 putspent
[0x080483d0]&...
- 1,769
1
vote
1
answer
5k
views
Found the adress of a function LIBC without GDB
How to calculate the address of a function in the LIBC, when ASLR is not active.
I only have the address where to load the LIBC (with ldd /bin/bash).
Thank you for the explanations
EDIT:
When I use ...
- 33
1
vote
1
answer
220
views
Why is j_free function and free_ptr pointer needed in glibc?
I am disassembling libc-2.23.so, there exists a thunk method called j_free which jumps at the location pointed to by free_ptr pointer in glibc. Why do those even exist while free() itself is exported?
- 1,361
12
votes
2
answers
11k
views
How does glibc malloc work?
Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
- 1,361
1
vote
2
answers
2k
views
Recognizing CLib functions in Ollydbg or IDA
I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I ...
- 169
3
votes
1
answer
348
views
Exploitability of Stack-based Buffer Overflows on functions ending with fclose()
I have been discussing the effectiveness of GNU libc's fclose() function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a ...
0
votes
0
answers
76
views
dlmalloc free pointers
I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...
user1743