Gallopsled / Gallopsled/pwntools
DynELF._lookup returns GOT entry instead of PLT entry
- Dominant language
- Python
- Stars
- 13.7k
- Forks
- 1.9k
- Avg merge
- 6d 23h
- Merged PRs (30d)
- 3
Description
# Pwntools version
v4.13.0beta0
# Issue
The `_lookup` method returns PLT entries when a binary is provided, and GOT entries when no binary is provided.
I guess the expected result is to return a PLT entry in every case?
# Repro
In `test.c`:
```c
#include
#include
int main()
{
void *addr;
printf("main @ %p\n", main);
while (1) {
puts("addr:");
scanf("%p", &addr);
write(1, addr, 0x100);
puts("END");
puts("END");
}
}
```
In `poc.py`:
```python
#!/bin/env python3
from pwn import *
context.binary = exe = ELF("./test")
io = process("./test")
io.recvuntil(b" @ ")
main = int(io.recvline(keepends=False).strip().decode(), 16)
info(f"main @ {main:#x}")
exe.address = main - exe.sym['main']
@MemLeak
def leak(addr):
io.sendlineafter(b"addr:\n", f"{addr:#x}".encode())
return io.recvuntil(b"END\nEND\n", drop=True)
dynelf = DynELF(leak, main)
assert dynelf._lookup(b'printf') == exe.got.printf
dynelf = DynELF(leak, main, elf=exe)
assert dynelf._lookup(b'printf') == exe.plt.printf
```
Contributor guide
Assessment
This issue has not been assessed yet.