libc_base 구하기

libc_base 구하기

from pwn import *
 
 
elf = ELF('./a.out')
#rop = ROP(elf)
libc = ELF("/lib/i386-linux-gnu/libc.so.6")
 
printf_system_offset = libc.symbols['printf'] - libc.symbols['system']
 
 
 
printf_plt = elf.plt['printf']
printf_got = elf.got['printf']
 
write_plt = elf.plt['write']
write_got = elf.got['write']
 
 
 
libc_start_main = elf.plt['__libc_start_main']
 
 
 
print '[*] printf@plt : %s' % str(hex(printf_plt))
print '[*] printf@got : %s' % str(hex(printf_got))
print '[*] write@plt : %s' % str(hex(write_plt))
print '[*] write@got : %s' % str(hex(write_got))
print '[*] printf - system : %s(%s)' % (str(hex(printf_system_offset)), str(int(printf_system_offset)))
 
print '[*] lib_strat_main : %s' % str(hex(libc_start_main))
 
 
 
출처: http://crattack.tistory.com/entry/함수-offset-계산-방법 [Security & Reverse]

 

__libc_start_main이 libc_base인듯...?