Question

我有一个简单的方案,有初步的全球变量,I m试图用斜体读取数据部分。

Restrictions: I have no r permission to the elf. I don t have root privilege, so I don t have r permission to the target program s /proc/PID/maps.

My attempts: I know the size of the text section. Running LD_SHOW_AUXV=1 ./target tells me that the program has aslr. I wrote another snippet to see if $rip at the beginning of the program is the same as its base address

//from target program
    printf("base: %lx
", getauxval(AT_BASE));

and

//from tracer program
        ptrace( PTRACE_GETREGS, my_pid, NULL, &regs );
        printf("rip: %lx
", regs.rip);

我

rip: 7fa86c82b140
base: 7fa86c811000

只有目标方案才能获得/proc/PID/maps and auxv,而且可直接使用简易机场。现在要做什么? 我考虑了使用辅助器具的注射指示,但目标方案没有“带”;sys/auxv.h> Library。

最新情况:

由于不同档案的记忆测绘可能不是连续的,我再次进行了试验,但这一次根本的特权是读/proc/PID/map。

rip: 7f55e1354140
header: 56214add2040
entry: 56214add3080

摘自/proc/PID/map

56214add2000-56214add3000 r--p 00000000 08:01 3145841                    /home/kali/Desktop/target
56214add3000-56214add4000 r-xp 00001000 08:01 3145841                    /home/kali/Desktop/target
...
7f55e133b000-7f55e1360000 r-xp 00001000 08:01 4202628                    /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2

因此,在连接器上实际上有1美元,然后才能进入。

由于离进程记忆的上端非常接近,因此我能否向前看,把它看成辅助工具,因为在环境变数之后,它应该是正确的? 或者,我可以简单地推一下<代码>的回报价值。 LD_SHOW_AUXV=1 /target to my痕量?

Answer 1

Normally the ELF header is mapped into the process s memory as the very first page, below .text and other sections of code and data. Since RIP is most likely pointing somewhere within .text, you could start from that address and do a binary search backward, looking for the first page which is mapped. You can identify whether a page is mapped by seeing whether PTRACE_PEEKTEXT (or PEEKDATA, they are actually the same) succeeds. (Note that you can t determine success or failure from the return value; you have to set errno = 0 before the call and see if it remains zero afterward.) As a check, that page should have x7f E L F as its first four bytes (i.e. the first dword would be 0x464c457f).

一旦你发现该标题,你就可以将其加以压缩,以找到<代码>的“数据

友情链接