温故——格式化字符串Leak Canary

PWN入门笔记

main函数开启canary时栈分布:

当堆栈向下(低地址)增长时,以FP地址(EBP)为基准,函数参数的偏移量是正值,而局部变量的偏移量是负值

upload successful

upload successful
在程序结束处寻找canary的值:

upload successful

详细过程:

upload successful

upload successful
此时edx的值即canary的值:

upload successful
计算偏移:

upload successful

读取:

1
2
3
#./binary_200  
%15$x
f1339a00