gremlin
gremlin copied to clipboard
Works with libc6 2.37
I have updated inject_so.py to work with the current libc6, v2.37, as well as python 3.11. It also gives you the error string if the ldopen should fail. I did move some of the code into functions.
The fixes were needed, as:
- Injecting code at the rip then calling libc is risky, as the injected code may rewrite the function you are calling if rip is in libc.
- I found you needed your own stack when calling libc. Perhaps overwriting data on the stack is possible without this?
- ldd is merging into libc, so __libc_dlopen_mode is probably replaced by dlopen
- When finding the function offset in libc, you need to take into account the maps offset.
- various differences between python 2 and 3
It works for many executables. I did notice it struggled injecting into /bin/bash. My theory is that this uses signal handling with a signal action which confuses the stack and rip, and so with int3 is never reached. Perhaps signal masking would solve this, but it is fine for my experiments.