While studying the lecture, I understood that when calculating the address of a system function, it would be to find out the address of the read function by reading the read function's got and find out the starting address of the library by finding the difference between this value and libc.symbols ["read"], but I have some questions here, so I have a question. “/lib/x86_64-Linux-gnu/libc-2.27.s in the course

read = u64 (p.recvn (6) +b "\ x00"*2) Why am I only getting 6 bytes from here???

Keyerror = 'read' and the read function was clearly used, what's the problem

payload += p64 (pop_rdi) + p64 (0) payload += p64 (pop_rsi_r15) + p64 (read_got) + p64 (0) payload += p64 (read_plt) First of all, I don't really understand this code. The first one is the part where p64 (0) is appended after it. I'm not sure why the function's arguments were followed by this.

There seems to be a difference between the binary file provided and the libc version uploaded to the server. I think the libc version is determined the moment it is compiled independently of the OS (because the PLT, GOT value is fixed). Instead, is the actual address of the function determined by which OS (an environment with different libc versions installed) the compiled binary runs on?

First, I wrote the code like this. from pwn import* def slog (name, addr): return success (“: “.join ([name, hex (addr)])) context (arch = 'amd64', os = 'Linux', log_level = 'debug') p = process ('. /rop ') e = E

The problem was solved locally, but remote attempts keep failing. Seems like the previous ones also had the same problem, but there is no clear answer. When I checked with Wireshark, the puts gadget ran normally, and the payload was sent normally afterwards, but the server sent a shutdown signal for some reason. Either it's a libc version issue, or the third argument in the read gadget is correct

After modifying the code presented in class to the offset I checked on the libc website, I was puzzled because EOF popped up. Currently, since gdb is used in the local environment, the rax register contains a 0x00 value and cannot be read. So I'm in the middle of solving the problem remotely, but I'm stumped because I can't check if it's overwritten. 1 from pw

When I wrote the code and exploited it according to the method described in the exercise, it runs in the local environment, but no matter how hard I tried, it didn't run in the remote environment, so I tried the return to csu technique. First, I tried to find the address of libc_csu 0x00000000004007ea <+90>: pop rbx 0x0000000000400

This is a problem that occurred during the course content exercise. ! [Capture.PNG] (https://dreamhack-media.s3.ap-northeast-2.amazonaws.com/attachments/95200ebb6c82f61fd5ac52702ebf7a955b502bb692aadf625199528568312072.PNG “Capture.PNG”) The code was written as above, and libc's