gdb showing different address for the same function?

Question

So I want to practice doing a ret2libc attack and I'm playing around with gdb on this simple program

// File: retlib.c

#include <stdio.h>
#include <stdlib.h>

int main()
{
    printf("system = %p\n", system);
    char c[] = "echo 123";
    system(c);

    return 0;
}

Now notice this

Reading symbols from ./retlib...(no debugging symbols found)...done.
(gdb) p system
$1 = {<text variable, no debug info>} 0x4004b0 <system@plt>
(gdb) b main
Breakpoint 1 at 0x4005ea
(gdb) r
Starting program: /home/users/mickey/retlib 

Breakpoint 1, 0x00000000004005ea in main ()
(gdb) p system
$2 = {<text variable, no debug info>} 0x7ffff7a523a0 <__libc_system>
(gdb) c
Continuing.
system = 0x4004b0
123
[Inferior 1 (process 11593) exited normally]

My question is, why do I get 2 different outputs of the system function address. And even after I start running the program the gdb command says one thing, and printf says another. I notice that the tags for each address are different, but why is this happening? Any help would be appreciated!

@JohnnyMopp Yes but the second time I type p system it gives me a different address. — Da Mike
– Da Mike, Commented Jul 10, 2020 at 20:17
Reading symbols from ./retlib...(no debugging symbols found)...done. Are you compiling with -g flag on? — David Ranieri
– David Ranieri, Commented Jul 10, 2020 at 20:23
printf("system = %p\n", system); is not specified way to print a function address, It is UB. printf("system = %p\n", (void*) system); is marginally better. There is no great way to certainly print a function address — chux
– chux, Commented Jul 10, 2020 at 20:25
@DavidRanieri uhm actually no I did not add that flag for some reason... But I tried it with the -g flag on and same thing happened. — Da Mike
– Da Mike, Commented Jul 10, 2020 at 20:33

Manuel · Accepted Answer · 2020-07-10 20:21:28Z

1

Before running the program, gdb will give you the procedure linkage table (.plt) address, after running, the libc function address.

answered Jul 10, 2020 at 20:21

Manuel

2,5821 gold badge15 silver badges17 bronze badges

Sign up to request clarification or add additional context in comments.

3 Comments

Da Mike Over a year ago

And which one is a valid return address for using in a return libc attack?

Manuel Over a year ago

@DaMike See this

Marco Bonelli Over a year ago

@DaMike no difference, either one ends up calling system.

Collectives™ on Stack Overflow

gdb showing different address for the same function?

1 Answer 1

3 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

3 Comments

Your Answer

Sign up or log in

Post as a guest

Related