[英]Curious thing when finding environment variable address in gdb
Recently I'm doing some Return-to-libc attack experiment base on the paper Bypassing non-executable-stack during exploitation using return-to-libc with my Ubuntu11.10. 最近我正在做一些基于文件的Return-to-libc攻击实验。 在使用我的Ubuntu11.10 使用return-to-libc时 , 在开发过程中绕过非可执行堆栈 。
Before my experiment I closed the ALSR. 在我的实验之前,我关闭了ALSR。
According to the paper, I can find address of the environment variable SHELL="/bin/bash" in gdb(use gdb to debug the program I want to attack): 根据文章,我可以在gdb中找到环境变量SHELL =“/ bin / bash”的地址(使用gdb来调试我要攻击的程序):
But I found that this address is wrong when I try to use it to Return-to-libc experiment. 但是当我尝试将它用于Return-to-libc实验时,我发现这个地址是错误的 。
And then I write a simple program to get the environment variable address: 然后我编写一个简单的程序来获取环境变量地址:
When I run this program in the Terminal, I get the right address: 当我在终端中运行这个程序时,我得到了正确的地址:
With this address I can do the attack. 有了这个地址,我可以进行攻击。
I also find the related question about this. 我也找到了相关的问题 。 But the answers doesn't really make sense(the second one may be better).
但答案并没有多大意义(第二个可能更好)。
Just tell me some details about this, please. 请告诉我一些关于此的细节。
From your screenshots, I'll assume you're running on an 32-bit intel platform. 从截图中,我假设你在32位英特尔平台上运行。 I haven't spent the time to fully research an answer to this, but these are points worth noting:
我没有花时间充分研究这个问题的答案,但这些都值得注意:
x/100s **(char***)&environ
). x/100s **(char***)&environ
)。 0xBffff47A
, you're very close to the top of user address space (which ends at 0xC0000000
). 0xBffff47A
,您非常接近用户地址空间的顶部(以0xC0000000
结尾)。 So, my guess is that what's going on here is that: 所以,我的猜测是,这里发生的是:
_=/usr/bin/gdb
" when running under GDB, and I'll just bet that's only there when running under GDB. _=/usr/bin/gdb
”,我只是打赌只有在GDB下运行时才会这样。 The result is that, while your fixed pointer tends to land somewhere in the middle of the environment block, it doesn't land in the same place every time, since the environment itself is changing between runs. 结果是,虽然您的固定指针往往位于环境块中间的某处,但每次都不会落在同一个地方,因为环境本身在运行之间会发生变化。
声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.