Skip to content

Commit

Permalink
v1.3
Browse files Browse the repository at this point in the history
  • Loading branch information
bash-c committed Aug 19, 2018
1 parent 7897aed commit a10ebdc
Show file tree
Hide file tree
Showing 3 changed files with 16 additions and 7 deletions.
2 changes: 2 additions & 0 deletions README.md
Expand Up @@ -176,6 +176,8 @@ libc6-amd64_2.27-3ubuntu1_i386.so

- v1.2 -- Updata install.sh. Now the installation can be finished in seconds.

- v1.3 -- fix a bug about local libc with symbolic link. Thanks to [f0110vv3r](https://github.com/f0110vv3r)

### more
- Though it works perfect on [libc-databases](https://github.com/niklasb/libc-database) now(*Alpha-v1.0*). But I'm not sure whether it works well on other libcs so issues are welcome.

Expand Down
2 changes: 1 addition & 1 deletion install.sh
Expand Up @@ -3,6 +3,6 @@ wget -q https://raw.githubusercontent.com/0x01f/main_arena_offset/master/main_ar
sudo mv main_arena /usr/local/bin/main_arena
sudo chmod +x /usr/local/bin/main_arena
echo "Done! Enjoy it!"
echo "Usage:"
echo -n "Usage:"
echo -e "\033[0;35m$\033[0m \033[01;31mmain_arena\033[0m \033[1;32myour_libc_path\033[0m"
echo "Star it on github <https://github.com/0x01f/main_arena_offset> if you like it."
19 changes: 13 additions & 6 deletions main_arena
Expand Up @@ -2,8 +2,8 @@
# set -eux

:<<DESCRIPTION
This is a simple script to get main_arena offset of a given libc.
Usage: main_arena your_libc
This is a simple shell script to get main_arena offset of a given libc.
Usage: $ main_arena your_libc
avaiable on <https://github.com/0x01f/main_arena_offset>
DESCRIPTION

Expand Down Expand Up @@ -58,17 +58,24 @@ function printInfo()
getOffset
function getOffset()
{
mallocHook=$(objdump -j .data -d $1|grep __malloc_hook@ |cut -d " " -f 1)
libc=$1
# deal with local libc(in case of symbolic link)
if [[ $(file $libc) =~ "symbolic link" ]]
then
libc=$(dirname $libc)"/"$(readlink $libc)
fi

mallocHook=$(objdump -j .data -d $libc|grep __malloc_hook@ |cut -d " " -f 1)
let mallocHook=16#$mallocHook
# 32-bit
if [[ $(file $1) =~ "32-bit" ]]
if [[ $(file $libc) =~ "32-bit" ]]
then
let mainArena=($mallocHook+0x18)
printInfo "$mallocHook" $mainArena
fi

# 64-bit
reallocHook=$(objdump -j .data -d $1|grep __realloc_hook@ |cut -d " " -f 1)
reallocHook=$(objdump -j .data -d $libc|grep __realloc_hook@ |cut -d " " -f 1)
let reallocHook=16#$reallocHook
((offset=$mallocHook-$reallocHook))

Expand All @@ -77,6 +84,6 @@ function getOffset()
}

:<<get_result
get result.
get result by calling getOffset.
get_result
getOffset $1

0 comments on commit a10ebdc

Please sign in to comment.