在没有gdb的情况下获取libc（execve）中函数的地址

Question

I'm trying to automate a return-to-libc attack based on the exploitation of a buffer overflow vulnerabulity (on a x86-32 linux machine). I need a way to find the address of execve function in libc without using gdb:

(gdb) p execve
$1 = {} 0xf7ec1b30

The ASLR protection is disabled so as to allow this technique.

Is there a way to get the address of a function in libc as execve? With a program or any other automatable way? (no gdb because isn't automatable in a bash script or a C program).

Any advice is welcome.

Answer 1

Is this a trick question or does something like this not work:

#include <stdio.h>
#include <stdlib.h>
#include <unistd.h>

int
main (int argc, char **argv)
{
  void *a = execv;
  printf ("execv is at %p\n", a);
  exit (0);
}

Works here.

Answer 2

If you are trying to get this information for a script, perhaps the nm utility would help?

example: nm {libraryPath} | grep execve