Gallopsled / Gallopsled/pwntools

DynELF._lookup returns GOT entry instead of PLT entry

Open
#2,381 1 comment 0 reactions 0 assignees View on GitHub
backport-required bug
Dominant language
Python
Stars
13.7k
Forks
1.9k
Avg merge
6d 23h
Merged PRs (30d)
3

Description

# Pwntools version
v4.13.0beta0

# Issue
The `_lookup` method returns PLT entries when a binary is provided, and GOT entries when no binary is provided.
I guess the expected result is to return a PLT entry in every case?

# Repro

In `test.c`:
```c
#include
#include

int main()
{
void *addr;
printf("main @ %p\n", main);

while (1) {
puts("addr:");
scanf("%p", &addr);
write(1, addr, 0x100);
puts("END");
puts("END");
}
}
```

In `poc.py`:

```python
#!/bin/env python3

from pwn import *

context.binary = exe = ELF("./test")

io = process("./test")

io.recvuntil(b" @ ")
main = int(io.recvline(keepends=False).strip().decode(), 16)

info(f"main @ {main:#x}")

exe.address = main - exe.sym['main']

@MemLeak
def leak(addr):
io.sendlineafter(b"addr:\n", f"{addr:#x}".encode())
return io.recvuntil(b"END\nEND\n", drop=True)

dynelf = DynELF(leak, main)
assert dynelf._lookup(b'printf') == exe.got.printf

dynelf = DynELF(leak, main, elf=exe)
assert dynelf._lookup(b'printf') == exe.plt.printf
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.