4 ms·
So what's stopping the attacker from searching the libc export table for the right syscall wrapper?
by haecceity 7y ago
So what's stopping the attacker from searching the libc export table for the right syscall wrapper?
- saagarjha 7y agoASLR, for one.
- haecceity 7y agoCan't they use dlopen to find libc?
- asveikau 7y agodlopen is a dynamically linked function, so they would have to find that too. Its location will also be randomized. Note we are talking about exploit code here, i.e. you have just exploited a buffer overflow, not ELF code loaded in a well behaved fashion.
- saagarjha 7y agoThere are easier ways to leak libc, such as reading from the stack or the GOT, but these would require more work than a simple ROP chain.