forensicsProeasy

Forenser Retaddr

spbctf

Task: given a raw x86_64 Linux stack VMA dump, find the return address of main. Solution: parse argv/envp/auxv to anchor the layout, walk the saved-rbp/return-address chain from the top of the live stack, and identify main's frame whose return address points into libc (__libc_start_call_main wrapper introduced in glibc 2.34), not into _start.

$ ls tags/ techniques/
x86_64memory_dumpglibcreturn_addressnon_piestack_forensicsstack_frame_walkingrbp_chainlibc_start_call_mainprocess_stack
stack_memory_analysisqword_alignment_scansaved_rbp_chain_walkingauxv_parsingargv_envp_recognitionframe_pointer_reconstructionglibc_startup_semantics
🔒

Permission denied (requires tier.pro)

Sign in to access full writeups

Sign in with GitHub to continue. No email required.

$sign in

$ grep --similar

Similar writeups