Questions tagged [libc]

C standard library for the C programming language as specified in the C specification (ANSI C, C99, C11, ...).

Filter by
Sorted by
Tagged with
10
votes
2answers
9k views

How does glibc malloc work?

Wishing to dig in the internals of dynamic memory allocation on Linux, the best I could find is an article titled Understanding glibc malloc. The explanation, though detailed, is not quite ...
3
votes
1answer
235 views

Exploitability of Stack-based Buffer Overflows on functions ending with fclose()

I have been discussing the effectiveness of GNU libc's fclose() function to thwart successful exploitation of trivial vulnerabilities due to segmentation fault when called without a valid pointer to a ...
2
votes
2answers
1k views

How to help IDA to auto complete libc functions?

I have a x86_64 ELF binary which is statically compiled. With some digging, I have found the C library is musl. In IDA Pro 7.0, the decompiled pseudo code shows sycalls as inline assembly code. But in ...
1
vote
1answer
67 views

Ida Pro doesn't recognize known function

I open statically Arm binary with Ida Pro. While I reversing I find out some function like strstr and memcpy and etc. That Ida doesn't understand that those function are strstr and memcpy(for example) ...
1
vote
1answer
306 views

How to use the libc.so.6 file?

I'm new to Linux operating system. Last day, I practice "heap exploitation", and they give me an ELF file, and a libc.so.6 file, and they said I must debug/exploit with that libc file, but I don't ...
1
vote
1answer
3k views

Found the adress of a function LIBC without GDB

How to calculate the address of a function in the LIBC, when ASLR is not active. I only have the address where to load the LIBC (with ldd /bin/bash). Thank you for the explanations EDIT: When I use ...
1
vote
2answers
2k views

Recognizing CLib functions in Ollydbg or IDA

I'm just learning Olly/IDA and writing simple programs in C and looking at the .EXE code in Ollydbg and IDA. Below I have a simple printf Hello World program which I compile in Visual Studio 6. I ...
1
vote
2answers
104 views

debugging an older version of libc

I'm trying to understand heap exploitation better. Therefore, I compiled the following file: https://github.com/shellphish/how2heap/blob/master/glibc_2.25/fastbin_dup_into_stack.c I have the newest ...
1
vote
1answer
45 views

GDB exited when running library

I'm new with gdb and I have spent hours looking for direction but I can't find any. I need to analyze an executable to find how this program process the arguments and where the output came from. I ...
1
vote
0answers
14 views

Locating Exit/Abort Functions from Static Analysis

Similar to this question, I'm interested in locating exit and abort style functions in a firmware - any function call that in fact terminates the execution, by statically analyzing the firmware. My ...
1
vote
0answers
205 views

How can a segfault happen during the libc exit call on Linux?

I'm relatively new to reverse engineering, and I've decided to practise using the challenges from pwnable.tw. Currently, I am working on the "Silver Bullet" challenge. While testing, I have noticed ...
0
votes
1answer
586 views

How can I intercept syscall libc function in C++ without writing any code in C file

How can intercept libc function in C++ using LD_PRELOAD. I want to write code only in C++ file and all the logic of symbol fishing (dlsym) must be in C++ file. Please give an example.
0
votes
2answers
117 views

`dmi libc puts~GLOBAL` does not show puts, just putspent?

On the tutorial by Megabeets, "A journey into Radare 2 – Part 2: Exploitation" [0x080483d0]> dmi libc puts~&GLOBAL, puts:0 532 0x000fdd60 0xf7e0bd60 GLOBAL FUNC 1181 putspent [0x080483d0]&...
0
votes
1answer
99 views

Why is j_free function and free_ptr pointer needed in glibc?

I am disassembling libc-2.23.so, there exists a thunk method called j_free which jumps at the location pointed to by free_ptr pointer in glibc. Why do those even exist while free() itself is exported?
0
votes
0answers
68 views

system doesn't invoke /bin/sh

I am learning libc shellcode attacks and trying to execute /bin/sh from system I can execute other commands from system like whoami and ls -a but can not run /bin/sh the following works string = b&...
0
votes
0answers
163 views

exploiting a binary using ret2libc

I ran into this binary at a CTF : https://github.com/auehc/AUCTF-2020/tree/master/Pwn/House%20of%20Madness I first tried to exploit it and get a shell using ret2libc technique, however I didn't ...
0
votes
0answers
73 views

dlmalloc free pointers

I was looking at the implementation of "free" in my current dlmalloc(both the source and the disassembly). However, I could not find the code section the inserts the FD and BK into free chunks. What ...