{"topic":{"id":12652,"title":"test1 写入的地址位置","slug":"topic","categoryId":58,"createdAt":"2024-05-22 08:51:10.824897","bumpedAt":"2024-05-22 10:40:15.765989","views":216,"postsCount":3,"highestPostNumber":3,"likeCount":4,"closed":false,"pinned":false,"pinnedGlobally":false,"pinnedAt":null,"pinnedUntil":null,"isBanner":false,"excerpt":"如图会出现 segmentation fault，但是我并没有修改 addr 的表达式，为什么在这里出错了而 test0 并没有出错呢 🤔 在这种情况下，你需要填入地址的位置不变，而需要填入的内容变成了 re.sym的value 再加上addend。","deletedAt":null,"isAnonymous":false,"category":{"id":58,"name":"计算机系统导论","slug":"ics","color":"3AB54A"},"author":{"id":1081,"username":"KON","name":null,"avatarUrl":"/uploads/image/9f/35/9f3549f065dc7f323da5ebdb5fce01f65bbf19dbd566d5b3d817a08a7b59e7fd.avif"},"tags":[]},"posts":[{"id":33997,"postNumber":1,"raw":"![图片|690x216](/uploads/image/68/f1/68f1ff0a2439dcb21cc881b02c85605abf760bdb310cff3aeace62d0c780deb6.avif)\n\n如图会出现 `segmentation fault`，但是我并没有修改 `addr` 的表达式，为什么在这里出错了而 `test0` 并没有出错呢 :thinking:\n> 在这种情况下，你需要填入地址的位置不变，而需要填入的内容变成了 `re.sym`的`value` 再加上`addend`。","cooked":"

$\"图片\"$

如图会出现 segmentation fault，但是我并没有修改 addr 的表达式，为什么在这里出错了而 test0 并没有出错呢 🤔

\n
在这种情况下，你需要填入地址的位置不变，而需要填入的内容变成了 re.sym的value 再加上addend。
\n

\n","createdAt":"2024-05-22 08:51:10.930684","updatedAt":"2024-05-22 08:51:10.930684","replyToPostNumber":null,"replyCount":0,"likeCount":0,"wordCount":82,"liked":false,"bookmarked":false,"polls":[],"reactions":[],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":1081,"username":"KON","name":null,"avatarUrl":"/uploads/image/9f/35/9f3549f065dc7f323da5ebdb5fce01f65bbf19dbd566d5b3d817a08a7b59e7fd.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":34000,"postNumber":2,"raw":"遇到了同样的问题，linker 报 segmentation fault。\n\n此处是运行时内存情况\n![image|690x395](/uploads/image/aa/b5/aab53883a70b9c1ae53456c3b6736ef9a5f65a2797d01f620e549ab2bff8618a.avif)\n\n\n此处是 test1 objdump 之后的代码\n![image|690x284](/uploads/image/9a/98/9a9850d58a6a996db00c98679b2a79e8276a5fafe9f6e6d039087a7659c42ff5.avif)\n\n\n可见写入地址没有问题，可能是题目漏洞","cooked":"

遇到了同样的问题，linker 报 segmentation fault。

此处是运行时内存情况
\n $\"image\"$

此处是 test1 objdump 之后的代码
\n $\"image\"$

可见写入地址没有问题，可能是题目漏洞

\n","createdAt":"2024-05-22 09:23:28.394602","updatedAt":"2024-05-22 09:23:28.394602","replyToPostNumber":null,"replyCount":0,"likeCount":1,"wordCount":52,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"👍️","count":1,"users":[{"id":1081,"username":"KON","name":null}],"hasReacted":false},{"reaction":"❤️","count":1,"users":[{"id":1081,"username":"KON","name":null}],"hasReacted":false}],"wiki":false,"version":1,"publicVersion":1,"deletedAt":null,"isAnonymous":false,"user":{"id":340,"username":"卡冈图亚","name":"Breski","avatarUrl":"/uploads/image/ba/d3/bad35303ba63abad7e1347bb429056d369489ab4f0b238ca4c0e464511be73e0.avif","admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}},{"id":34012,"postNumber":3,"raw":"我也遇到了，需要将写入位置计算中的 textAddr 改成 textOff\n >> 随后，我们需要知道 `RelocEntry` 指示的需要修改的源代码的位置，这个值由 `re.offset` 指示。而由于当前 object 在链接成可执行文件时，还包含若干其它.o，所以需要加上 `textAddr`，才能得到真正需要修改的地址。\n\n就是这一句话中应该是加上 textOff 而不是 textAddr\n\n然而为什么 test0 中可以通过？通过 gdb 调试看到，test0 中 textOff 和 textAddr 是相等的，因此可以通过\n\n![image|214x97](/uploads/image/08/8c/088c5b4b3d1bdb850aa850963447f82f78decf044f4d868fd2f1aac34cb56441.avif)\n\n\n而在 test1 中这两个值并不相等\n\n![image|213x102](/uploads/image/d0/0d/d00d30f8ccf9b4446701c1a0256b04709d95bd26e36972f246c9a297c7ff2696.avif)\n\n\n后续 test2 和 test3 不会到写入内存这一步，test4 和 test5 中 textAddr 和 textOff 都相等，使用 textOff 也能通过\n\n不知道是实验指导中有误还是实验设计有误","cooked":"

我也遇到了，需要将写入位置计算中的 textAddr 改成 textOff

\n
\n
随后，我们需要知道 RelocEntry 指示的需要修改的源代码的位置，这个值由 re.offset 指示。而由于当前 object 在链接成可执行文件时，还包含若干其它.o，所以需要加上 textAddr，才能得到真正需要修改的地址。
\n
\n

就是这一句话中应该是加上 textOff 而不是 textAddr

然而为什么 test0 中可以通过？通过 gdb 调试看到，test0 中 textOff 和 textAddr 是相等的，因此可以通过

$\"image\"$

而在 test1 中这两个值并不相等

$\"image\"$

后续 test2 和 test3 不会到写入内存这一步，test4 和 test5 中 textAddr 和 textOff 都相等，使用 textOff 也能通过

不知道是实验指导中有误还是实验设计有误

\n","createdAt":"2024-05-22 10:02:31.922863","updatedAt":"2024-05-22 10:19:55.574253","replyToPostNumber":null,"replyCount":0,"likeCount":3,"wordCount":219,"liked":false,"bookmarked":false,"polls":[],"reactions":[{"reaction":"❤️","count":3,"users":[{"id":1081,"username":"KON","name":null},{"id":3332,"username":"rijin","name":"\");drop table;--"},{"id":3373,"username":"zxia","name":null}],"hasReacted":false}],"wiki":false,"version":2,"publicVersion":2,"deletedAt":null,"isAnonymous":false,"user":{"id":2850,"username":"lyinx","name":"lyinx","avatarUrl":null,"admin":false,"moderator":false,"signatureRaw":null,"signatureCooked":null}}],"hasMore":false,"lastReadPostNumber":3,"hasUrlPostNumber":true}