pwninit
pwninit copied to clipboard
Use build id to lookup debug symbols for libc >= 2.31
I found that they use "build id" from version 2.31
While preparing #282 I remember testing something similar to this, but I would get some empty files for libcs older than 2.34. I'll check if this is really the case later today or tomorrow
While preparing #282 I remember testing something similar to this, but I would get some empty files for libcs older than 2.34. I'll check if this is really the case later today or tomorrow This is before I used your code
I changed "2.34" to "2.31" and it worked for me
@robbert1978 While the change seems to work for the specific libc you're testing, it also causes a few regressions:
Files:
libc6_2.31-0ubuntu9_amd64.so
libc6_2.31-0ubuntu9_amd64.so: 19383256 bytes -> 2029224 bytes
libc.so.6: 19383256 bytes -> 2029224 bytes
libc6_2.33-0ubuntu5_i386.so
libc6_2.33-0ubuntu5_i386.so: 12343416 bytes -> 2059156 bytes
libc.so.6: 12343416 bytes -> 2059156 bytes
libc6_2.32-0ubuntu3.2_i386.so
libc6_2.32-0ubuntu3.2_i386.so: 11649236 bytes -> 2055092 bytes
libc.so.6: 11649236 bytes -> 2055092 bytes
libc6_2.31-0ubuntu9.9_i386.so
libc.so.6: 2020588 bytes -> 7070572 bytes
libc6_2.31-0ubuntu9.9_i386.so: 2020588 bytes -> 7070572 bytes
libc6_2.32-0ubuntu3_i386.so
libc.so.6: 11649172 bytes -> 2055092 bytes
libc6_2.32-0ubuntu3_i386.so: 11649172 bytes -> 2055092 bytes
libc6_2.31-0ubuntu9.7_i386.so
libc.so.6: 17014256 bytes -> 2020556 bytes
libc6_2.31-0ubuntu9.7_i386.so: 17014256 bytes -> 2020556 bytes
libc6_2.32-0ubuntu3_amd64.so
libc.so.6: 13759760 bytes -> 1995896 bytes
libc6_2.32-0ubuntu3_amd64.so: 13759760 bytes -> 1995896 bytes
libc6_2.31-0ubuntu9.9_amd64.so
libc.so.6: 2029592 bytes -> 7459456 bytes
libc6_2.31-0ubuntu9.9_amd64.so: 2029592 bytes -> 7459456 bytes
libc6_2.31-0ubuntu9_i386.so
libc.so.6: 16996364 bytes -> 2018664 bytes
libc6_2.31-0ubuntu9_i386.so: 16996364 bytes -> 2018664 bytes
Total: 0 new files, 0 deleted files, 18 modified files
Warnings:
warning: failed detecting libc version (is the libc an Ubuntu glibc?): failed finding version string: 159
warning: failed unstripping libc: eu-unstrip exited with failure: exit status: 1: 140 -23
warning: failed unstripping libc: libc deb error: failed to find file in data.tar: 58 +30 -2
Total: 357 +30 -25
Notice how some libcs shrunk down in size, since they don't have symbols anymore after this change - the ones I'm more worried about are libc6_2.31-0ubuntu9_amd64.so
and libc6_2.32-0ubuntu3_amd64.so
, since 32bit challenges are relatively rare.
I suspect some extra logic, maybe even just trying both ways, is needed
So is there any way to unstrip libc for versions above 2.34?
So is there any way to unstrip libc for versions above 2.34?
Check my small tool, I've tested it with libc 2.35 and 2.37. Maybe it will useful for you.