In the main, the canary is located right after the size of the local variable, but is there a different way to calculate that position in the thread stack? The canary doesn't seem to be visible after the thread stack's local variable size.

After calling pthread, use find like a lecture to obtain the canary value from the input and use the address minus the value of the beginning of the stack (the first address when the value was entered) as an offset, and an arbitrary canary is placed at the beginning of the stack + (canary - stack start address), and when viewed from exit, the canary is not covered. What could be the problem?

! [] (https://dreamhack-media.s3.ap-northeast-2.amazonaws.com/attachments/0122dfa6541ed1b95d5a3541a966fce9d7a0d2338a672ffe870635e032c5241a.png) I don't know why ! [] (https://dreamhack-media.s3.ap-northeast-2.

<unknown>I am leaking the canary and doing the bof overwrite the stack canary with the leaked canary and it doesnt pop the shell I get Leave comment: * stack smashing detected*: terminated? Any

Even if I create a thread and cover Master Canary, it doesn't work... Should I take input from within a thread function and cover it??? No matter how much I thought about it, I couldn't think of a method... could you give me some hint??

! [IS THE THREAD CANARY OFFSET TOO BIG, PWNTOOLS SHOULD ON SENDING THIS PAYLOAD TOP OVERWRITE THE CANARY] (https://dreamhack-media.s3.amazonaws.com/attachments/d943a53a3578c206935bb39ea1164a05f02e236b3

I know that the `fs_base' command only works after a specific version of gdb, but how do I get fs_base from gdb if it doesn't work...? haha Also, even when I print out the value of the fs register, it only shows the following (this is the value I printed after running thread_routine!) ! [image.png] (https://dreamhac

I found out Master Canary, and I'm trying to get a shell as shown below using menu 3. I'm not dying from stack smashing, but (the canary seems to have passed) [*] Got EOF while reading in interactive keeps getting errors. What's wrong? giveshell = elf.symbo

I found something that looked like a flaw in the program. In the beginning of main function, size and idx are defined without NULL-initialization. And they has 64bit size because their type is `si

On the local side, the canary leaks well, so EX succeeded, but on the remote, the canary doesn't leak because the offset is different. Is there a solution?