pwnlibc: Building a libc identification tool

2024-08-01

Why pwnlibc?

When exploiting buffer overflows on modern Linux systems, you need to know the exact libc version to calculate offsets. Traditionally, this involved manually searching database websites. pwnlibc automates this entire process.

## How It Works

1. Extract leaked address from target
2. Hash the lower 12 bits against known libc databases
3. Match and identify the exact libc version
4. Automatically download the matching libc
5. Calculate all needed offsets

## Architecture

``
pwnlibc/
├── core/
│ ├── identifier.py # Main identification logic
│ ├── database.py # Remote database queries
│ └── downloader.py # Automatic libc download
├── api/
│ └── client.py # Python API
└── cli/
└── main.py # CLI interface
``

## Key Challenges

- Handling partial leaks (only lower bits)
- Supporting multiple libc databases
- Race conditions in database queries
- Cross-platform compatibility