Skip to main content
16 votes

How does glibc malloc work?

For understanding how dynamic memory allocation (the malloc, free, calloc, realloc library functions) really works there is no substitute for reading the source code of malloc(). It is well commented: ...
julian's user avatar
  • 7,176
10 votes

How does glibc malloc work?

There are several quite good references about the exploitation of the heap in software security, one of my favorite is probably the 'binary hacking course' from LiveOverflow. You can look at the ...
perror's user avatar
  • 19.1k
3 votes

Why is j_free function and free_ptr pointer needed in glibc?

In ELF, all symbols are global. it means that a symbol in another module (e.g. main executable) can override the glibc's free. that's why all calls to it go through a GOT pointer. On the first call, ...
Igor Skochinsky's user avatar
  • 36.8k
3 votes

How to help IDA to auto complete libc functions?

Here are the required steps using Igor Skochinsky's answer: Clone musl git repository: git clone --depth=1 git://git.musl-libc.org/musl Compile the code: cd musl; ./configure; make -s -j2 Extract ...
Biswapriyo's user avatar
  • 1,569
2 votes
Accepted

How to help IDA to auto complete libc functions?

Inline syscalls are rarely used on their own even in minimal libraries like musl. Usually there are wrapper functions around the syscall which is what actually ends up in the binary. So what you can ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes

How can I intercept syscall libc function in C++ without writing any code in C file

If you want to intercept only library calls, you can insert your hooks in the GOT of the executable or at the dynamic loader resolver pointer (GOT[2]). I don't have sample code at hand, but this ...
Igor Skochinsky's user avatar
  • 36.8k
2 votes
Accepted

`dmi libc puts~GLOBAL` does not show puts, just putspent?

This is right, and it was caused by using the wrong grep (the ~ character) in the article. This was due the fact that the output of dmi libc is different on different machines and also, the syntax of ...
Megabeets's user avatar
  • 8,999
1 vote

Ida Pro doesn't recognize known function

I think you are looking for something called FLIRT signature. You can use them to identify common definitions from various libraries. You just need to download the flirt signatures, and let IDA do the ...
Niraeth's user avatar
  • 189
1 vote

debugging an older version of libc

libc versions are tied to the corresponding ld.so (dynamic linker) versions. You have a few options: Run the program in a Docker container with an OS that corresponds to the target libc. (For example,...
nneonneo's user avatar
  • 1,283
1 vote

How to use the libc.so.6 file?

I can almost guarantee 'they' are wanting you to perform a return to libc exploit. Some good references return to libc paper open source lab ret to libc lab (updated -- in 2020 -- version of the ...
kr1tzy's user avatar
  • 11
1 vote
Accepted

Found the adress of a function LIBC without GDB

This can be done using objdump: $ objdump -TC /lib/x86_64-linux-gnu/libc.so.6 | grep " printf$" 0000000000064e80 g DF .text 00000000000000c3 GLIBC_2.2.5 printf readelf: $ readelf -Ws /lib/...
sudhackar's user avatar
  • 2,709

Only top scored, non community-wiki answers of a minimum length are eligible