Bug Hunter Diary

08 p[0] = 0x41414141;09 printf (“RELRO: %p\n”, p);1011 return 0;12 }Listing C-1: Example code used to demonstrate RELRO (testcase.c)I compiled the program with Partial RELRO support:linux$ gcc -g -Wl,-z,relro -o testcase testcase.cI then checked the resulting binary with my checksec.sh script: 11linux$ ./checksec.sh --file testcaseRELRO STACK CANARY NX PIE FILEPartial RELRO No canary found NX enabled No PIE testcaseNext I used objdump to gather the GOT address of the printf()library function used in line 9 of Listing C-1 and then tried to overwritethat GOT entry:linux$ objdump -R ./testcase | grep printf0804a00c R_386_JUMP_SLOT printflinux$ gdb -q ./testcaseI started the test program in gdb in order to see exactly what washappening:(gdb) run 0804a00cStarting program: /home/tk/BHD/testcase 0804a00cProgram received signal SIGSEGV, Segmentation fault.0x41414141 in ?? ()(gdb) info registers eipeip 0x41414141 0x41414141Result: If only Partial RELRO is used to protect an ELF binary, itis still possible to modify arbitrary GOT entries to gain control of theexecution flow of a process.Test Case 2: Full RELROThis time, I compiled the test program with Full RELRO support:linux$ gcc -g -Wl,-z,relro,-z,now -o testcase testcase.clinux$ ./checksec.sh --file testcaseRELRO STACK CANARY NX PIE FILEFull RELRO No canary found NX enabled No PIE testcase184 Appendix C