3 ms·
"Ubuntu has oddly compiled bash and zsh binaries which are missing some data required by nhi." That's interesting...could you share a bit more about that?
by tyingq 5y ago
"Ubuntu has oddly compiled bash and zsh binaries which are missing some data required by nhi."
That's interesting...could you share a bit more about that?
- strang1ato 5y agoOn ubuntu's versions of bash and zsh `environ` symbol address is set to 0. nhi requires `environ` address to be specified, before program even starts (I can elaborate on that if you wish). On every other distro `environ` address is set (I tested it on debian, fedora and arch). If you build bash or zsh from source `environ` will be also set to non-zero value. I don't know if the symbol addresses are the only difference though.
- tyingq 5y agoOh, I guess Ubuntu ships bash and zsh stripped then. Here's a post on using gdb to find the environment in a stripped binary: https://security.stackexchange.com/questions/13194/finding-environment-variables-with-gdb-to-exploit-a-buffer-overflow https://security.stackexchange.com/questions/13194/finding-e... And this post has a diagram: https://shankaraman.wordpress.com/tag/finding-environment-variable-address-using-gdb/ https://shankaraman.wordpress.com/tag/finding-environment-va...
- strang1ato 5y agoThanks for the research. I will definitely check these links out.