naruto
我说的是这种骚操作?
/* compile : gcc -m32 -no-pie ./test.c */
/* libc : libc-2.27.so */
#include <stdio.h>
#include <stdlib.h>
unsigned int a[1];
int main(){
puts("test\n");
printf("%p\n",a);
unsigned int addr = (unsigned int)(&a);
addr -= 0x14;
unsigned int p = *(int*)addr;
printf("0x%x\n",p);
unsigned int base = p-0x67b40;
unsigned int s = base+0x3d200;
printf("0x%x\n",s);
a[-5] = s;
puts("/bin/sh\x00");
return 0;
}
Potatso?在大黑阔面前耍斧头?