> For the complete documentation index, see [llms.txt](https://cajac.gitbook.io/ctf-notes/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cajac.gitbook.io/ctf-notes/bin-exp/find-memory-address-of-function.md).

# Find memory address of function

## Find functions

To find the virtual memory address of functions such as `win()` or `read_flag()` we can:

### Find functions with gdb

To find a virtual address of a function with `gdb`

```bash
gdb -q -ex "info func" -ex "quit" <binary> | grep -i <func_name>
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Pwn/Easy_Pwn/El_Mundo/challenge]
└─$ gdb -q -ex "info func" -ex "quit" el_mundo | grep read_flag 
0x00000000004016b7  read_flag
```

</details>

### Find functions with nm

Or use `nm`

```bash
nm -a <binary> | grep <func_name>
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Pwn/Easy_Pwn/El_Mundo/challenge]
└─$ nm -a el_mundo | grep read_flag
00000000004016b7 T read_flag
```

</details>

### Find functions with objdump

This can also be done with `objdump`

```bash
objdump -t <binary> | grep -i <func_name>
```

<details>

<summary>Example run</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Pwn/Easy_Pwn/El_Mundo/challenge]
└─$ objdump -t el_mundo | grep read_flag
00000000004016b7 g     F .text  00000000000000e8              read_flag
```

</details>

### Find functions with pwntools

We can also let `pwntools` examine the binary and **dynamically** find the address for us

```python
exe = context.binary = ELF('./binary')
# more code here
win_addr = p64(exe.sym.win)
```

### Find functions with readelf

Finally, we can use `readelf`

```bash
readelf -s <binary> | grep <func_name>
```

or more specifically

```bash
readelf -s <binary> | grep <func_name> |  awk '{print $2,$8}'
```

<details>

<summary>Example runs</summary>

```bash
┌──(kali㉿kali)-[/mnt/…/Pwn/Easy_Pwn/El_Mundo/challenge]
└─$ readelf -s el_mundo | grep read_flag
    49: 00000000004016b7   232 FUNC    GLOBAL DEFAULT   15 read_flag

┌──(kali㉿kali)-[/mnt/…/Pwn/Easy_Pwn/El_Mundo/challenge]
└─$ readelf -s el_mundo | grep read_flag | awk '{print $2,$8}'
00000000004016b7 read_flag
```

</details>

## Resources

GDB (The GNU Project Debugger) - Documentation: <https://sourceware.org/gdb/documentation/>

GDB (The GNU Project Debugger) - Homepage: <https://sourceware.org/gdb/>

grep - Linux manual page: <https://man7.org/linux/man-pages/man1/grep.1.html>

objdump - Linux manual page: <https://man7.org/linux/man-pages/man1/objdump.1.html>

pwntools - Documentation: <https://docs.pwntools.com/en/stable/index.html>

pwntools - GitHub: <https://github.com/Gallopsled/pwntools>