I want to learn format string exploitation, where the usual objective is to overwrite .got.plt pointers to dynamically-linked functions.

Usually, the function's .plt entry should (lazy) resolve the function on first invocation, since the .got.plt entry points back to the .plt entry.

However, in my case the .got.plt entry points to some obscure function - not to one instruction after the jmp in the .plt entry!

Finally, by observation the R/W/X bits on the binary's sections, the .got.plt is read-only!

How can I disable this protection that apparently is enabled by default?

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.