Well, here are two plots from the data earlier today showing some patterns: http://i.imgur.com/q2Qc0.png Left one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers…
Or if you know the distro, it is trivial to get the package containing the su executable and locate the address.
Also works on Arch with minor modifications. Had to change 'exit@plt' to '<exit@plt' where it searches for the relevant function and change the program run from /bin/su to /bin/mount.
Well, here are two plots from the data earlier today showing some patterns: http://i.imgur.com/q2Qc0.png Left one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers…
Or if you know the distro, it is trivial to get the package containing the su executable and locate the address.
Also works on Arch with minor modifications. Had to change 'exit@plt' to '<exit@plt' where it searches for the relevant function and change the program run from /bin/su to /bin/mount.