ahv·14 ปีที่แล้ว·discussWell, here are two plots from the data earlier today showing some patterns: http://i.imgur.com/q2Qc0.pngLeft one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers were 64-bit little endian integers.
ahv·15 ปีที่แล้ว·discussOr if you know the distro, it is trivial to get the package containing the su executable and locate the address.
ahv·15 ปีที่แล้ว·discussAlso works on Arch with minor modifications.Had to change 'exit@plt' to '<exit@plt' where it searches for the relevant function and change the program run from /bin/su to /bin/mount.
Left one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers were 64-bit little endian integers.