Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

DynELF._lookup returns GOT entry instead of PLT entry #2381

Open
ValekoZ opened this issue Apr 2, 2024 · 0 comments
Open

DynELF._lookup returns GOT entry instead of PLT entry #2381

ValekoZ opened this issue Apr 2, 2024 · 0 comments

Comments

@ValekoZ
Copy link
Contributor

ValekoZ commented Apr 2, 2024

Pwntools version

v4.13.0beta0

Issue

The _lookup method returns PLT entries when a binary is provided, and GOT entries when no binary is provided.
I guess the expected result is to return a PLT entry in every case?

Repro

In test.c:

#include <stdio.h>
#include <unistd.h>

int main()
{
    void *addr;
    printf("main @ %p\n", main);

    while (1) {
        puts("addr:");
        scanf("%p", &addr);
        write(1, addr, 0x100);
        puts("END");
        puts("END");
    }
}

In poc.py:

#!/bin/env python3

from pwn import *

context.binary = exe = ELF("./test")

io = process("./test")

io.recvuntil(b" @ ")
main = int(io.recvline(keepends=False).strip().decode(), 16)

info(f"main @ {main:#x}")

exe.address = main - exe.sym['main']

@MemLeak
def leak(addr):
    io.sendlineafter(b"addr:\n", f"{addr:#x}".encode())
    return io.recvuntil(b"END\nEND\n", drop=True)


dynelf = DynELF(leak, main)
assert dynelf._lookup(b'printf') == exe.got.printf

dynelf = DynELF(leak, main, elf=exe)
assert dynelf._lookup(b'printf') == exe.plt.printf
@ValekoZ ValekoZ changed the title DynELF._lookup returns got entry instead of PV entry DynELF._lookup returns GOT entry instead of PLT entry Apr 2, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant