ahv·vor 14 Jahren·discussWell, here are two plots from the data earlier today showing some patterns: http://i.imgur.com/q2Qc0.pngLeft one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers were 64-bit little endian integers.
ahv·vor 15 Jahren·discussOr if you know the distro, it is trivial to get the package containing the su executable and locate the address.
ahv·vor 15 Jahren·discussAlso works on Arch with minor modifications.Had to change 'exit@plt' to '<exit@plt' where it searches for the relevant function and change the program run from /bin/su to /bin/mount.
Left one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers were 64-bit little endian integers.