probeleak
usage: probeleak [-h] [--max-distance MAX_DISTANCE] [--point-to POINT_TO]
[--max-ptrs MAX_PTRS] [--flags FLAGS]
[address] [count]
Pointer scan for possible offset leaks.
Positional arguments
Positional Argument | Help |
address | Leak memory address (default: $sp) |
count | Leak size in bytes (default: 64) |
Optional arguments
Short | Long | Help |
-h | --help | show this help message and exit |
| --max-distance | Max acceptable distance between memory page boundary and leaked pointer (default: 0) |
| --point-to | Mapping name of the page that you want the pointers point to |
| --max-ptrs | Stop search after find n pointers, default 0 (default: 0) |
| --flags | flags of the page that you want the pointers point to. [e.g. rwx] |
Examples
> probeleak $rsp 0x64
Leaks 0x64 bytes starting at stack pointer and search for valid pointers.
> probeleak $rsp 0x64 --max-dist 0x10
As above, but pointers may point 0x10 bytes outside of memory page.
> probeleak $rsp 0x64 --point-to libc --max-ptrs 1 --flags rwx
Leaks 0x64 bytes starting at stack pointer and search for one valid pointer
which points to a libc rwx page.