Upgrade to Pro — share decks privately, control downloads, hide ads and more …

ret2dl_resolve(x86_64)

 ret2dl_resolve(x86_64)

in YOKARO-MON勉強会

Avatar for appBana

appBana

May 05, 2018
Tweet

Other Decks in Programming

Transcript

  1. Elf64_Rela r_offset (size=0x8) r_info (size=0x8) r_addend (size=0x8) typedef struct {

    Elf64_Addr r_offset; /* Address */ Elf64_Xword r_info; /* Relocation type and symbol index */ Elf64_Sxword r_addend; /* Addend */ } Elf64_Rela;
  2. Elf64_Sym st_name (size=0x4) st_info (size=0x1) st_other (size=0x1) st_shndx (size=0x2) st_value

    (size=0x8) st_size (size=0x8) typedef struct { Elf64_Word st_name; /* Symbol name (string tbl index) */ unsigned char st_info; /* Symbol type and binding */ unsigned char st_other; /* Symbol visibility */ Elf64_Section st_shndx; /* Section index */ Elf64_Addr st_value; /* Symbol value */ Elf64_Xword st_size; /* Symbol size */ } Elf64_Sym;
  3. .rela.plt .dynstr .dynsym puts Elf64_Rela __libc_start_m ain Elf64_Rela  

     puts ELF64_Sym __libc_start_m ain ELF64_Sym    libc.so.6¥x00 puts¥x00 __libc_start_main ¥x00 ...
  4. .rela.plt .dynstr .dynsym puts Elf64_Rela __libc_start_m ain Elf64_Rela  

     puts ELF64_Sym __libc_start_m ain ELF64_Sym libc.so.6¥x00 puts¥x00 __libc_start_main ¥x00 ...    .rela.plt reloc_offset Elf64_Rela 
  5. .rela.plt .dynstr .dynsym puts Elf64_Rela __libc_start_m ain Elf64_Rela puts ELF64_Sym

    __libc_start_m ain ELF64_Sym    libc.so.6¥x00 puts¥x00 __libc_start_main ¥x00 ... .dynsym r_info >> 32 Elf64_Sym    
  6. .rela.plt .dynstr .dynsym puts Elf64_Rela __libc_start_m ain Elf64_Rela puts ELF64_Sym

    __libc_start_m ain ELF64_Sym    libc.so.6¥x00 puts¥x00 __libc_start_main ¥x00 ... .dynstr st_name      
  7. puts()Elf64_Rela = rela.plt + puts()rela_offset * Elf64_Rela  = 0x400398

    + 0x0 * 0x18 = 0x400398 r_info = puts()Elf64_Symindex << 32 | R_386_JMP_SLOT = 0x1 << 32 | 0x7 = 0x0000000100000007
  8. puts()Elf64_Sym = .dynsym + puts()Elf64_Relar_info << 32* Elf64_Sym  =

    0x4002b8 + 0x1 * 0x18 = 0x4002d0 st_name = 0xb st_info = 0x12
  9. .rela.plt .dynstr .dynsym puts Elf64_Rela __libc_start_m ain Elf64_Rela  

     puts ELF64_Sym __libc_start_m ain ELF64_Sym    libc.so.6¥x00 puts¥x00 __libc_start_main ¥x00 ...