Skip to content

Instantly share code, notes, and snippets.

@lattera
Created July 8, 2011 00:41
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save lattera/1070871 to your computer and use it in GitHub Desktop.
Save lattera/1070871 to your computer and use it in GitHub Desktop.
PLT/GOT Resolution Bug
EXPORTED_SYM PLT *GetAllPLTs(HIJACK *hijack)
{
struct link_map *linkmap;
char *libname;
PLT *plt=NULL;
ElfW(Dyn) *dyn=NULL;
unsigned long addr;
if (!(IsAttached(hijack))) {
SetError(hijack, ERROR_NOTATTACHED);
return NULL;
}
linkmap = hijack->linkhead;
do {
if (!(linkmap))
break;
libname = read_str(hijack, (unsigned long)linkmap->l_name);
if (IsFlagSet(hijack, F_DEBUG_VERBOSE))
fprintf(stderr, "[*] Loading from %s\n", libname);
addr = (unsigned long)linkmap->l_ld;
do {
dyn = read_data(hijack, addr, sizeof(ElfW(Dyn)));
if (!(dyn))
break;
if (dyn->d_tag == DT_PLTGOT)
break;
addr += sizeof(ElfW(Dyn));
} while (dyn->d_tag != DT_NULL);
if (!(dyn) || dyn->d_tag == DT_NULL)
continue;
if (!(plt)) {
plt = malloc(sizeof(PLT));
} else {
plt->next = malloc(sizeof(PLT));
plt = plt->next;
}
memset(plt, 0x00, sizeof(PLT));
plt->libname = libname;
plt->p.ptr = (unsigned long)dyn->d_un.d_ptr;
} while ((linkmap = get_next_linkmap(hijack, (unsigned long)(linkmap->l_next))) != NULL);
return plt;
}
@lattera
Copy link
Author

lattera commented Jul 8, 2011

I'm having trouble with PLT/GOT resolution. The explanation of the problem can be found on my tech blog, http://0xfeedface.org/blog/2011-07-07/lattera/shared-objecs-pltgot

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment