3 ms·
Can't they use dlopen to find libc?
by haecceity 7y ago
Can't they use dlopen to find libc?
- asveikau 7y agodlopen is a dynamically linked function, so they would have to find that too. Its location will also be randomized. Note we are talking about exploit code here, i.e. you have just exploited a buffer overflow, not ELF code loaded in a well behaved fashion.
- saagarjha 7y agoThere are easier ways to leak libc, such as reading from the stack or the GOT, but these would require more work than a simple ROP chain.