Android ARM32 ROP level8学习笔记
首先Android上的ASLR是伪ASLR,因为所有程序都是由zygote fork出来的,因此系统中的所有library的基址都是相同的,并且和zygote的内存布局一样,可以通过cat /proc/xxx/maps得到证实:
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 |
#!bash root@hammerhead:/ # cat /proc/1698/maps 400e8000-400ed000 r-xp 00000000 b3:19 8201 /system/bin/app_process 400ed000-400ee000 r--p 00004000 b3:19 8201 /system/bin/app_process 400ee000-400ef000 rw-p 00005000 b3:19 8201 /system/bin/app_process 400ef000-400fe000 r-xp 00000000 b3:19 8248 /system/bin/linker 400fe000-400ff000 r-xp 00000000 00:00 0 [sigpage] 400ff000-40100000 r--p 0000f000 b3:19 8248 /system/bin/linker 40100000-40101000 rw-p 00010000 b3:19 8248 /system/bin/linker 40101000-40104000 rw-p 00000000 00:00 0 40104000-40105000 r--p 00000000 00:00 0 40105000-40106000 rw-p 00000000 00:00 0 [anon:libc_malloc] 40106000-40109000 r-xp 00000000 b3:19 49324 /system/lib/liblog.so 40109000-4010a000 r--p 00002000 b3:19 49324 /system/lib/liblog.so 4010a000-4010b000 rw-p 00003000 b3:19 49324 /system/lib/liblog.so 4010b000-40153000 r-xp 00000000 b3:19 49236 /system/lib/libc.so 40153000-40155000 r--p 00047000 b3:19 49236 /system/lib/libc.so 40155000-40158000 rw-p 00049000 b3:19 49236 /system/lib/libc.so root@hammerhead:/ # cat /proc/1720/maps 400e8000-400ed000 r-xp 00000000 b3:19 8201 /system/bin/app_process 400ed000-400ee000 r--p 00004000 b3:19 8201 /system/bin/app_process 400ee000-400ef000 rw-p 00005000 b3:19 8201 /system/bin/app_process 400ef000-400fe000 r-xp 00000000 b3:19 8248 /system/bin/linker 400fe000-400ff000 r-xp 00000000 00:00 0 [sigpage] 400ff000-40100000 r--p 0000f000 b3:19 8248 /system/bin/linker 40100000-40101000 rw-p 00010000 b3:19 8248 /system/bin/linker 40101000-40104000 rw-p 00000000 00:00 0 40104000-40105000 r--p 00000000 00:00 0 40105000-40106000 rw-p 00000000 00:00 0 [anon:libc_malloc] 40106000-40109000 r-xp 00000000 b3:19 49324 /system/lib/liblog.so 40109000-4010a000 r--p 00002000 b3:19 49324 /system/lib/liblog.so 4010a000-4010b000 rw-p 00003000 b3:19 49324 /system/lib/liblog.so 4010b000-40153000 r-xp 00000000 b3:19 49236 /system/lib/libc.so 40153000-40155000 r--p 00047000 b3:19 49236 /system/lib/libc.so 40155000-40158000 rw-p 00049000 b3:19 49236 /system/lib/libc.so |