3 ms·
On ubuntu's versions of bash and zsh `environ` symbol address is set to 0. nhi requires `environ` address to be specified, before program even starts (I can ela
by strang1ato 5y ago
On ubuntu's versions of bash and zsh `environ` symbol address is set to 0. nhi requires `environ` address to be specified, before program even starts (I can elaborate on that if you wish).
On every other distro `environ` address is set (I tested it on debian, fedora and arch). If you build bash or zsh from source `environ` will be also set to non-zero value.
I don't know if the symbol addresses are the only difference though.
- tyingq 5y agoOh, I guess Ubuntu ships bash and zsh stripped then. Here's a post on using gdb to find the environment in a stripped binary: https://security.stackexchange.com/questions/13194/finding-environment-variables-with-gdb-to-exploit-a-buffer-overflow https://security.stackexchange.com/questions/13194/finding-e... And this post has a diagram: https://shankaraman.wordpress.com/tag/finding-environment-variable-address-using-gdb/ https://shankaraman.wordpress.com/tag/finding-environment-va...
- strang1ato 5y agoThanks for the research. I will definitely check these links out.