我正在 x86_64 Linux 上进行面向返回的编程开发。然而,我的研究导致在 64 位 Linux 机器上不可能利用 ROP,因为所有代码段都加载在空字节前导地址中。这是真的吗?
Gdb,Sections:
(gdb) i file
`/home/******/Desktop/BOF/lib64', file type elf64-x86-64.
Entry point: 0x400ffc
0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag
0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id
0x00000000004001d8 - 0x00000000004002f8 is .rela.plt
0x00000000004002f8 - 0x0000000000400312 is .init
0x0000000000400320 - 0x00000000004003e0 is .plt
0x00000000004003e0 - 0x0000000000494808 is .text
0x0000000000494810 - 0x000000000049614c is __libc_freeres_fn
0x0000000000496150 - 0x00000000004961f8 is __libc_thread_freeres_fn
0x00000000004961f8 - 0x0000000000496201 is .fini
0x0000000000496220 - 0x00000000004b6224 is .rodata
0x00000000004b6228 - 0x00000000004b6230 is __libc_atexit
0x00000000004b6230 - 0x00000000004b6288 is __libc_subfreeres
0x00000000004b6288 - 0x00000000004b6290 is __libc_thread_subfreeres
0x00000000004b6290 - 0x00000000004c32ac is .eh_frame
0x00000000004c32ac - 0x00000000004c33b9 is .gcc_except_table
0x00000000006c3ea0 - 0x00000000006c3ec0 is .tdata
0x00000000006c3ec0 - 0x00000000006c3ef8 is .tbss
0x00000000006c3ec0 - 0x00000000006c3ed0 is .init_array
0x00000000006c3ed0 - 0x00000000006c3ee0 is .fini_array
0x00000000006c3ee0 - 0x00000000006c3ee8 is .jcr
0x00000000006c3f00 - 0x00000000006c3ff0 is .data.rel.ro
0x00000000006c3ff0 - 0x00000000006c4000 is .got
0x00000000006c4000 - 0x00000000006c4078 is .got.plt
0x00000000006c4080 - 0x00000000006c56f0 is .data
0x00000000006c5700 - 0x00000000006c8308 is .bss
0x00000000006c8308 - 0x00000000006c8338 is __libc_freeres_ptrs
0x0000000000400190 - 0x00000000004001b0 is .note.ABI-tag
0x00000000004001b0 - 0x00000000004001d4 is .note.gnu.build-id
0x00000000004001d8 - 0x00000000004002f8 is .rela.plt
0x00000000004002f8 - 0x0000000000400312 is .init
0x0000000000400320 - 0x00000000004003e0 is .plt
0x00000000004003e0 - 0x0000000000494808 is .text
0x0000000000494810 - 0x000000000049614c is __libc_freeres_fn
0x0000000000496150 - 0x00000000004961f8 is __libc_thread_freeres_fn
0x00000000004961f8 - 0x0000000000496201 is .fini
0x0000000000496220 - 0x00000000004b6224 is .rodata
0x00000000004b6228 - 0x00000000004b6230 is __libc_atexit
0x00000000004b6230 - 0x00000000004b6288 is __libc_subfreeres
0x00000000004b6288 - 0x00000000004b6290 is __libc_thread_subfreeres
0x00000000004b6290 - 0x00000000004c32ac is .eh_frame
0x00000000004c32ac - 0x00000000004c33b9 is .gcc_except_table
0x00000000006c3ea0 - 0x00000000006c3ec0 is .tdata
0x00000000006c3ec0 - 0x00000000006c3ef8 is .tbss
0x00000000006c3ec0 - 0x00000000006c3ed0 is .init_array
0x00000000006c3ed0 - 0x00000000006c3ee0 is .fini_array
0x00000000006c3ee0 - 0x00000000006c3ee8 is .jcr
0x00000000006c3f00 - 0x00000000006c3ff0 is .data.rel.ro
0x00000000006c3ff0 - 0x00000000006c4000 is .got
0x00000000006c4000 - 0x00000000006c4078 is .got.plt
0x00000000006c4080 - 0x00000000006c56f0 is .data
0x00000000006c5700 - 0x00000000006c8308 is .bss
0x00000000006c8308 - 0x00000000006c8338 is __libc_freeres_ptrs