Test results for the glibc-2.16 library on x86

Summary

Total tests	1836
Passed / Failed tests	1682 / 154
Warnings	45
Verdict	Test Failed

Problem Summary

Received signal	FPE	1
Received signal	SEGV	152
Hanged execution		1

Failed Tests (154)

[+] Received signal FPE (1 problem)

search.h, libc-2.16.so
[+] hsearch ( ENTRY __item, ACTION __action )

received signal FPE

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

#include <stdlib.h>

#include <search.h>

int main(int argc, char *argv[])

{

char key [] = {

'A',

'B',

'C',

'D',

'\0'};

void* data = malloc(256);

ENTRY __item = {.key = key, .data = data};

hsearch(__item, FIND); //target call

return 0;

}

to the top

[+] Received signal SEGV (152 problems)

netdb.h, libanl-2.16.so
[+] getaddrinfo_a ( int __mode, struct gaicb** __list, int __ent, struct sigevent* __sig )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93

#include <stdlib.h>

#include <netdb.h>

int main(int argc, char *argv[])

{

socklen_t ai_addrlen = (socklen_t) malloc(sizeof(unsigned int)*256);

struct sockaddr ai_addr = {

.sa_family = AF_INET,

.sa_data = {

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N'}};

struct addrinfo ar_request = {

.ai_flags = 0,

.ai_family = 1,

.ai_socktype = 0,

.ai_protocol = 2,

.ai_addrlen = ai_addrlen,

.ai_addr = &ai_addr,

.ai_canonname = "ai_canonname",

.ai_next = 0};

struct gaicb __list_elem [] = {

(struct gaicb) {

.ar_name = "ar_name",

.ar_service = "ar_service",

.ar_request = &ar_request,

.ar_result = &ar_request,

.__return = 3,

.__unused = {

4}},

(struct gaicb) {

.ar_name = "ar_name",

.ar_service = "ar_service",

.ar_request = &ar_request,

.ar_result = &ar_request,

.__return = 4,

.__unused = {

4}},

(struct gaicb) {

.ar_name = "ar_name",

.ar_service = "ar_service",

.ar_request = &ar_request,

.ar_result = &ar_request,

.__return = 5,

.__unused = {

4}},

(struct gaicb) {

.ar_name = "ar_name",

.ar_service = "ar_service",

.ar_request = &ar_request,

.ar_result = &ar_request,

.__return = 6,

.__unused = {

4}},

(struct gaicb) {0}};

struct gaicb* __list [] = {

__list_elem,

0};

timer_t __timerid [] = {

malloc(256),

0};

struct sigevent __sig;

timer_create(8, &__sig, __timerid);

getaddrinfo_a(

__list,

&__sig); //target call

return 0;

}

argz.h, libc-2.16.so
[+] argz_delete ( char** __argz, size_t* __argz_len, char* __entry )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <argz.h>

int main(int argc, char *argv[])

{

char* __argz = 0;

unsigned int __argz_len = 0;

char __entry [] = {

'A',

'B',

'C',

'D',

'\0'};

argz_delete((char**)&__argz, &__argz_len, __entry); //target call

return 0;

}

[+] argz_extract ( char const* __argz, size_t __len, char** __argv )

received signal SEGV

#include <argz.h>

int main(int argc, char *argv[])

{

argz_extract("__argz", 6, argv); //target call

return 0;

}

ctype.h, libc-2.16.so
[+] __tolower_l ( int __c, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

__locale_t __l = duplocale(0);

__tolower_l(1, __l); //target call

return 0;

}

[+] __toupper_l ( int __c, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

__locale_t __l = duplocale(0);

__toupper_l(1, __l); //target call

return 0;

}

[+] isalnum_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isalnum_l(1, duplocale(0)); //target call

return 0;

}

[+] isalpha_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isalpha_l(1, duplocale(0)); //target call

return 0;

}

[+] isblank_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isblank_l(1, duplocale(0)); //target call

return 0;

}

[+] iscntrl_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

iscntrl_l(1, duplocale(0)); //target call

return 0;

}

[+] isdigit_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isdigit_l(1, duplocale(0)); //target call

return 0;

}

[+] isgraph_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isgraph_l(1, duplocale(0)); //target call

return 0;

}

[+] islower_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

islower_l(1, duplocale(0)); //target call

return 0;

}

[+] isprint_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isprint_l(1, duplocale(0)); //target call

return 0;

}

[+] ispunct_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

ispunct_l(1, duplocale(0)); //target call

return 0;

}

[+] isspace_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isspace_l(1, duplocale(0)); //target call

return 0;

}

[+] isupper_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isupper_l(1, duplocale(0)); //target call

return 0;

}

[+] isxdigit_l ( int p1, __locale_t p2 )

received signal SEGV

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

isxdigit_l(1, duplocale(0)); //target call

return 0;

}

[+] tolower_l ( int __c, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

__locale_t __l = duplocale(0);

tolower_l(1, __l); //target call

return 0;

}

[+] toupper_l ( int __c, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <ctype.h>

int main(int argc, char *argv[])

{

__locale_t __l = duplocale(0);

toupper_l(1, __l); //target call

return 0;

}

dirent.h, libc-2.16.so
[+] alphasort ( struct dirent const** __e1, struct dirent const** __e2 )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent* __e1 = readdir(__dirp);

struct dirent* __e2 = readdir(__dirp);

alphasort((struct dirent const**)&__e1, (struct dirent const**)&__e2); //target call

return 0;

}

[+] alphasort64 ( struct dirent64 const** __e1, struct dirent64 const** __e2 )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent64* __e1 = readdir64(__dirp);

struct dirent64* __e2 = readdir64(__dirp);

alphasort64((struct dirent64 const**)&__e1, (struct dirent64 const**)&__e2); //target call

return 0;

}

[+] dirfd ( DIR* __dirp )

received signal SEGV

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

dirfd(__dirp); //target call

return 0;

}

[+] readdir ( DIR* __dirp )

received signal SEGV

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

readdir(__dirp); //target call

return 0;

}

[+] readdir64 ( DIR* __dirp )

received signal SEGV

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

readdir64(__dirp); //target call

return 0;

}

[+] readdir64_r ( DIR* __dirp, struct dirent64* __entry, struct dirent64** __result )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent64* __entry = readdir64(__dirp);

struct dirent64* __result = 0;

readdir64_r(__dirp, __entry, (struct dirent64**)&__result); //target call

return 0;

}

[+] readdir_r ( DIR* __dirp, struct dirent* __entry, struct dirent** __result )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent* __entry = readdir(__dirp);

struct dirent* __result = 0;

readdir_r(__dirp, __entry, (struct dirent**)&__result); //target call

return 0;

}

[+] rewinddir ( DIR* __dirp )

received signal SEGV

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

rewinddir(__dirp); //target call

return 0;

}

[+] scandir ( char const* __dir, struct dirent*** __namelist, int(*__selector)(struct dirent const*), int(*__cmp)(struct dirent const**, struct dirent const**) )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#include <dirent.h>

//auxiliary function

int

__selector(struct dirent const* p1){

return 1;

}

//auxiliary function

int

__cmp(struct dirent const** p1, struct dirent const** p2){

return 2;

}

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent* __namelist = readdir(__dirp);

struct dirent* *__namelist_p = (struct dirent* *)&__namelist;

struct dirent* **__namelist_pp = &__namelist_p;

scandir(

"testdata/",

(struct dirent***)__namelist_pp,

&__selector,

&__cmp); //target call

return 0;

}

[+] scandir64 ( char const* __dir, struct dirent64*** __namelist, int(*__selector)(struct dirent64 const*), int(*__cmp)(struct dirent64 const**, struct dirent64 const**) )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#include <dirent.h>

//auxiliary function

int

__selector(struct dirent64 const* p1){

return 1;

}

//auxiliary function

int

__cmp(struct dirent64 const** p1, struct dirent64 const** p2){

return 2;

}

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent64* __namelist = readdir64(__dirp);

struct dirent64* *__namelist_p = (struct dirent64* *)&__namelist;

struct dirent64* **__namelist_pp = &__namelist_p;

scandir64(

"testdata/",

(struct dirent64***)__namelist_pp,

&__selector,

&__cmp); //target call

return 0;

}

[+] scandirat ( int __dfd, char const* __dir, struct dirent*** __namelist, int(*__selector)(struct dirent const*), int(*__cmp)(struct dirent const**, struct dirent const**) )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

#include <dirent.h>

//auxiliary function

int

__selector(struct dirent const* p1){

return 2;

}

//auxiliary function

int

__cmp(struct dirent const** p1, struct dirent const** p2){

return 3;

}

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent* __namelist = readdir(__dirp);

struct dirent* *__namelist_p = (struct dirent* *)&__namelist;

struct dirent* **__namelist_pp = &__namelist_p;

scandirat(

"testdata/",

(struct dirent***)__namelist_pp,

&__selector,

&__cmp); //target call

return 0;

}

[+] scandirat64 ( int __dfd, char const* __dir, struct dirent64*** __namelist, int(*__selector)(struct dirent64 const*), int(*__cmp)(struct dirent64 const**, struct dirent64 const**) )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29

#include <dirent.h>

//auxiliary function

int

__selector(struct dirent64 const* p1){

return 2;

}

//auxiliary function

int

__cmp(struct dirent64 const** p1, struct dirent64 const** p2){

return 3;

}

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent64* __namelist = readdir64(__dirp);

struct dirent64* *__namelist_p = (struct dirent64* *)&__namelist;

struct dirent64* **__namelist_pp = &__namelist_p;

scandirat64(

"testdata/",

(struct dirent64***)__namelist_pp,

&__selector,

&__cmp); //target call

return 0;

}

[+] seekdir ( DIR* __dirp, long __pos )

received signal SEGV

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

seekdir(__dirp, 1L); //target call

return 0;

}

[+] telldir ( DIR* __dirp )

received signal SEGV

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

telldir(__dirp); //target call

return 0;

}

[+] versionsort ( struct dirent const** __e1, struct dirent const** __e2 )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent* __e1 = readdir(__dirp);

struct dirent* __e2 = readdir(__dirp);

versionsort((struct dirent const**)&__e1, (struct dirent const**)&__e2); //target call

return 0;

}

[+] versionsort64 ( struct dirent64 const** __e1, struct dirent64 const** __e2 )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <dirent.h>

int main(int argc, char *argv[])

{

DIR* __dirp = opendir("__name");

struct dirent64* __e1 = readdir64(__dirp);

struct dirent64* __e2 = readdir64(__dirp);

versionsort64((struct dirent64 const**)&__e1, (struct dirent64 const**)&__e2); //target call

return 0;

}

envz.h, libc-2.16.so
[+] envz_merge ( char** __envz, size_t* __envz_len, char const* __envz2, size_t __envz2_len, int __override )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <envz.h>

int main(int argc, char *argv[])

{

char* __envz = 0;

unsigned int __envz_len = 0;

envz_merge(

(char**)&__envz,

&__envz_len,

"__envz2",

1); //target call

return 0;

}

ether.h, libc-2.16.so
[+] ether_ntoa ( struct ether_addr const* __addr )

received signal SEGV

#include <netinet/ether.h>

int main(int argc, char *argv[])

{

struct ether_addr* __addr = ether_aton("__asc");

ether_ntoa(__addr); //target call

return 0;

}

[+] ether_ntoa_r ( struct ether_addr const* __addr, char* __buf )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <stdlib.h>

#include <netinet/ether.h>

int main(int argc, char *argv[])

{

struct ether_addr* __addr = ether_aton("__asc");

char* __buf = (char*) malloc(sizeof(char)*256);

ether_ntoa_r(__addr, __buf); //target call

return 0;

}

gshadow.h, libc-2.16.so
[+] putsgent ( struct sgrp const* __g, FILE* __stream )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <wchar.h>

#include <stdio.h>

#include <gshadow.h>

int main(int argc, char *argv[])

{

struct sgrp* __g = getsgent();

FILE* __stream = fopen("testdata/sample.txt", "r+");

putsgent(__g, __stream); //target call

//finalization

fclose(__stream);

return 0;

}

in.h, libc-2.16.so
[+] getsourcefilter ( int __s, uint32_t __interface_addr, struct sockaddr const* __group, socklen_t __grouplen, uint32_t* __fmode, uint32_t* __numsrc, struct sockaddr_storage* __slist )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162

#include <stdlib.h>

#include <netinet/in.h>

int main(int argc, char *argv[])

{

uint32_t __interface_addr = (uint32_t) malloc(sizeof(unsigned int)*256);

struct sockaddr __group = {

.sa_family = AF_INET,

.sa_data = {

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N'}};

uint32_t* __fmode = (uint32_t*) malloc(sizeof(uint32_t)*256);

uint32_t* __numsrc = (uint32_t*) malloc(sizeof(uint32_t)*256);

struct sockaddr_storage __slist [] = {

(struct sockaddr_storage) {

.ss_family = 2,

.__ss_align = 3,

.__ss_padding = {

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D'}},

(struct sockaddr_storage) {

.ss_family = 4,

.__ss_align = 5,

.__ss_padding = {

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T'}},

(struct sockaddr_storage) {

.ss_family = 6,

.__ss_align = 7,

.__ss_padding = {

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J'}},

(struct sockaddr_storage) {

.ss_family = 8,

.__ss_align = 9,

.__ss_padding = {

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z'}},

(struct sockaddr_storage) {0}};

getsourcefilter(

__interface_addr,

&__group,

256,

__fmode,

__numsrc,

__slist); //target call

return 0;

}

[+] inet6_option_init ( void* __bp, struct cmsghdr** __cmsgp, int __type )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

#include <stdlib.h>

#include <netinet/in.h>

int main(int argc, char *argv[])

{

void* __bp = malloc(256);

void* msg_name = malloc(256);

void* iov_base = malloc(256);

struct iovec msg_iov = {.iov_base = iov_base, .iov_len = 4};

void* msg_control = malloc(256);

struct msghdr __mhdr = {

.msg_name = msg_name,

.msg_namelen = 4,

.msg_iov = &msg_iov,

.msg_iovlen = 4,

.msg_control = msg_control,

.msg_controllen = 4,

.msg_flags = 0};

struct cmsghdr* __cmsgp = __cmsg_nxthdr(&__mhdr, 0);

inet6_option_init(__bp, (struct cmsghdr**)&__cmsgp, 0); //target call

return 0;

}

langinfo.h, libc-2.16.so
[+] nl_langinfo_l ( nl_item __item, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <langinfo.h>

int main(int argc, char *argv[])

{

__locale_t __l = duplocale(0);

nl_langinfo_l(1, __l); //target call

return 0;

}

locale.h, libc-2.16.so
[+] freelocale ( __locale_t __dataset )

received signal SEGV

#include <locale.h>

int main(int argc, char *argv[])

{

__locale_t __dataset = duplocale(0);

freelocale(__dataset); //target call

return 0;

}

[+] newlocale ( int __category_mask, char const* __locale, __locale_t __base )

received signal SEGV

#include <locale.h>

int main(int argc, char *argv[])

{

__locale_t __base = duplocale(0);

newlocale(0, "__locale", __base); //target call

return 0;

}

[+] uselocale ( __locale_t __dataset )

received signal SEGV

#include <locale.h>

int main(int argc, char *argv[])

{

__locale_t __dataset = duplocale(0);

uselocale(__dataset); //target call

return 0;

}

mntent.h, libc-2.16.so
[+] endmntent ( FILE* __stream )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <wchar.h>

#include <stdio.h>

#include <mntent.h>

int main(int argc, char *argv[])

{

FILE* __stream = fopen("testdata/sample.txt", "r+");

endmntent(__stream); //target call

//finalization

fclose(__stream);

return 0;

}

monetary.h, libc-2.16.so
[+] strfmon_l ( char* __s, size_t __maxsize, __locale_t __loc, char const* __format, ... )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

#include <locale.h>

#include <monetary.h>

int main(int argc, char *argv[])

{

char __s [] = {

'A',

'B',

'C',

'D',

'\0'};

__locale_t __loc = duplocale(0);

strfmon_l(

__s,

__loc,

"%d",

(char*)0); //target call

return 0;

}

netdb.h, libc-2.16.so
[+] gethostbyaddr_r ( void const* __addr, __socklen_t __len, int __type, struct hostent* __result_buf, char* __buf, size_t __buflen, struct hostent** __result, int* __h_errnop )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#include <stdlib.h>

#include <netdb.h>

int main(int argc, char *argv[])

{

void* __addr = malloc(256);

struct hostent __result_buf;

char __buf [] = {

'A',

'B',

'C',

'D',

'\0'};

struct hostent* __result = 0;

int* __h_errnop = (int*) malloc(sizeof(int)*256);

gethostbyaddr_r(

__addr,

256,

&__result_buf,

__buf,

256,

(struct hostent**)&__result,

__h_errnop); //target call

return 0;

}

[+] gethostbyname2_r ( char const* __name, int __af, struct hostent* __result_buf, char* __buf, size_t __buflen, struct hostent** __result, int* __h_errnop )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#include <stdlib.h>

#include <netdb.h>

int main(int argc, char *argv[])

{

struct hostent __result_buf;

char __buf [] = {

'A',

'B',

'C',

'D',

'\0'};

struct hostent* __result = 0;

int* __h_errnop = (int*) malloc(sizeof(int)*256);

gethostbyname2_r(

"__name",

&__result_buf,

__buf,

256,

(struct hostent**)&__result,

__h_errnop); //target call

return 0;

}

[+] gethostbyname_r ( char const* __name, struct hostent* __result_buf, char* __buf, size_t __buflen, struct hostent** __result, int* __h_errnop )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22

#include <stdlib.h>

#include <netdb.h>

int main(int argc, char *argv[])

{

struct hostent __result_buf;

char __buf [] = {

'A',

'B',

'C',

'D',

'\0'};

struct hostent* __result = 0;

int* __h_errnop = (int*) malloc(sizeof(int)*256);

gethostbyname_r(

"__name",

&__result_buf,

__buf,

256,

(struct hostent**)&__result,

__h_errnop); //target call

return 0;

}

[+] gethostent_r ( struct hostent* __result_buf, char* __buf, size_t __buflen, struct hostent** __result, int* __h_errnop )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

#include <stdlib.h>

#include <netdb.h>

int main(int argc, char *argv[])

{

struct hostent __result_buf;

char __buf [] = {

'A',

'B',

'C',

'D',

'\0'};

struct hostent* __result = 0;

int* __h_errnop = (int*) malloc(sizeof(int)*256);

gethostent_r(

&__result_buf,

__buf,

256,

(struct hostent**)&__result,

__h_errnop); //target call

return 0;

}

regex.h, libc-2.16.so
[+] re_compile_fastmap ( struct re_pattern_buffer* __buffer )

received signal SEGV

1
2
3
4
5
6
7
8

#include <stdlib.h>

#include <regex.h>

int main(int argc, char *argv[])

{

struct re_pattern_buffer* __buffer = (struct re_pattern_buffer*) malloc(sizeof(struct re_pattern_buffer)*256);

re_compile_fastmap(__buffer); //target call

return 0;

}

[+] re_match ( struct re_pattern_buffer* __buffer, char const* __string, int __length, int __start, struct re_registers* __regs )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

#include <stdlib.h>

#include <regex.h>

int main(int argc, char *argv[])

{

struct re_pattern_buffer* __buffer = (struct re_pattern_buffer*) malloc(sizeof(struct re_pattern_buffer)*256);

regoff_t* start = (regoff_t*) malloc(sizeof(regoff_t)*256);

struct re_registers __regs [] = {

(struct re_registers) {.num_regs = 1, .start = start, .end = start},

(struct re_registers) {.num_regs = 2, .start = start, .end = start},

(struct re_registers) {.num_regs = 3, .start = start, .end = start},

(struct re_registers) {.num_regs = 4, .start = start, .end = start},

(struct re_registers) {0}};

re_match(

__buffer,

"__string",

__regs); //target call

return 0;

}

[+] re_match_2 ( struct re_pattern_buffer* __buffer, char const* __string1, int __length1, char const* __string2, int __length2, int __start, struct re_registers* __regs, int __stop )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#include <stdlib.h>

#include <regex.h>

int main(int argc, char *argv[])

{

struct re_pattern_buffer* __buffer = (struct re_pattern_buffer*) malloc(sizeof(struct re_pattern_buffer)*256);

regoff_t* start = (regoff_t*) malloc(sizeof(regoff_t)*256);

struct re_registers __regs [] = {

(struct re_registers) {.num_regs = 1, .start = start, .end = start},

(struct re_registers) {.num_regs = 2, .start = start, .end = start},

(struct re_registers) {.num_regs = 3, .start = start, .end = start},

(struct re_registers) {.num_regs = 4, .start = start, .end = start},

(struct re_registers) {0}};

re_match_2(

__buffer,

"__string1",

"__string2",

__regs,

5); //target call

return 0;

}

[+] re_search ( struct re_pattern_buffer* __buffer, char const* __string, int __length, int __start, int __range, struct re_registers* __regs )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

#include <stdlib.h>

#include <regex.h>

int main(int argc, char *argv[])

{

struct re_pattern_buffer* __buffer = (struct re_pattern_buffer*) malloc(sizeof(struct re_pattern_buffer)*256);

regoff_t* start = (regoff_t*) malloc(sizeof(regoff_t)*256);

struct re_registers __regs [] = {

(struct re_registers) {.num_regs = 2, .start = start, .end = start},

(struct re_registers) {.num_regs = 3, .start = start, .end = start},

(struct re_registers) {.num_regs = 4, .start = start, .end = start},

(struct re_registers) {.num_regs = 5, .start = start, .end = start},

(struct re_registers) {0}};

re_search(

__buffer,

"__string",

256,

__regs); //target call

return 0;

}

[+] re_search_2 ( struct re_pattern_buffer* __buffer, char const* __string1, int __length1, char const* __string2, int __length2, int __start, int __range, struct re_registers* __regs, int __stop )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

#include <stdlib.h>

#include <regex.h>

int main(int argc, char *argv[])

{

struct re_pattern_buffer* __buffer = (struct re_pattern_buffer*) malloc(sizeof(struct re_pattern_buffer)*256);

regoff_t* start = (regoff_t*) malloc(sizeof(regoff_t)*256);

struct re_registers __regs [] = {

(struct re_registers) {.num_regs = 2, .start = start, .end = start},

(struct re_registers) {.num_regs = 3, .start = start, .end = start},

(struct re_registers) {.num_regs = 4, .start = start, .end = start},

(struct re_registers) {.num_regs = 5, .start = start, .end = start},

(struct re_registers) {0}};

re_search_2(

__buffer,

"__string1",

"__string2",

__regs,

6); //target call

return 0;

}

search.h, libc-2.16.so
[+] hsearch_r ( ENTRY __item, ACTION __action, ENTRY** __retval, struct hsearch_data* __htab )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28

#include <stdlib.h>

#include <search.h>

int main(int argc, char *argv[])

{

char key [] = {

'A',

'B',

'C',

'D',

'\0'};

void* data = malloc(256);

ENTRY __item = {.key = key, .data = data};

ENTRY* __retval [] = {

&__item,

0};

struct hsearch_data __htab;

hcreate_r(4, &__htab);

hsearch_r(

__item,

FIND,

__retval,

&__htab); //target call

return 0;

}

setjmp.h, libc-2.16.so
[+] _longjmp ( struct __jmp_buf_tag* __env, int __val )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#include <setjmp.h>
int main(int argc, char *argv[])
{
struct __jmp_buf_tag __env = {
.__jmpbuf = {
0,
1,
2,
3,
4,
5},
.__mask_was_saved = 0,
.__saved_mask = (__sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}}};
_longjmp(&__env, 1); //target call
return 0;
}

[+] longjmp ( struct __jmp_buf_tag* __env, int __val )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#include <setjmp.h>
int main(int argc, char *argv[])
{
struct __jmp_buf_tag __env = {
.__jmpbuf = {
0,
1,
2,
3,
4,
5},
.__mask_was_saved = 0,
.__saved_mask = (__sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}}};
longjmp(&__env, 1); //target call
return 0;
}

[+] siglongjmp ( struct __jmp_buf_tag* __env, int __val )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#include <setjmp.h>
int main(int argc, char *argv[])
{
struct __jmp_buf_tag __env = {
.__jmpbuf = {
0,
1,
2,
3,
4,
5},
.__mask_was_saved = 0,
.__saved_mask = (__sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}}};
siglongjmp(&__env, 1); //target call
return 0;
}

shadow.h, libc-2.16.so
[+] putspent ( struct spwd const* __p, FILE* __stream )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <wchar.h>

#include <stdio.h>

#include <shadow.h>

int main(int argc, char *argv[])

{

struct spwd* __p = getspent();

FILE* __stream = fopen("testdata/sample.txt", "r+");

putspent(__p, __stream); //target call

//finalization

fclose(__stream);

return 0;

}

spawn.h, libc-2.16.so
[+] posix_spawn_file_actions_addopen ( posix_spawn_file_actions_t* __file_actions, int __fd, char const* __path, int __oflag, mode_t __mode )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

#include <sys/stat.h>

#include <fcntl.h>

#include <spawn.h>

int main(int argc, char *argv[])

{

posix_spawn_file_actions_t __file_actions;

int __fd = open("testdata/sample.txt", O_RDWR);

posix_spawn_file_actions_addopen(

&__file_actions,

__fd,

"testdata/sample.txt",

0); //target call

return 0;

}

stdio.h, libc-2.16.so
[+] fclose ( FILE* __stream )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <wchar.h>

#include <stdio.h>

int main(int argc, char *argv[])

{

FILE* __stream = fopen("testdata/sample.txt", "r+");

fclose(__stream); //target call

//finalization

fclose(__stream);

return 0;

}

[+] gets ( char* __s )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <wchar.h>

#include <stdio.h>

int main(int argc, char *argv[])

{

char __s [] = {

'A',

'B',

'C',

'D',

'\0'};

gets(__s); //target call

return 0;

}

[+] pclose ( FILE* __stream )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <wchar.h>

#include <stdio.h>

int main(int argc, char *argv[])

{

FILE* __stream = fopen("testdata/sample.txt", "r+");

pclose(__stream); //target call

//finalization

fclose(__stream);

return 0;

}

stdlib.h, libc-2.16.so
[+] getsubopt ( char** __optionp, char*const* __tokens, char** __valuep )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <stdlib.h>

int main(int argc, char *argv[])

{

char* __optionp = 0;

char* __tokens [] = {

(char*const)__optionp,

0};

char* __valuep = 0;

getsubopt((char**)&__optionp, (char*const*)__tokens, (char**)&__valuep); //target call

return 0;

}

[+] initstate_r ( unsigned int __seed, char* __statebuf, size_t __statelen, struct random_data* __buf )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __statebuf [] = {

'A',

'B',

'C',

'D',

'\0'};

struct random_data __buf;

initstate_r(

__statebuf,

&__buf); //target call

return 0;

}

[+] qsort ( void* __base, size_t __nmemb, size_t __size, __compar_fn_t __compar )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include <stdlib.h>

//auxiliary function

int

__compar(void const* p1, void const* p2){

return 1;

}

int main(int argc, char *argv[])

{

void* __base = malloc(256);

qsort(

__base,

256,

&__compar); //target call

return 0;

}

[+] qsort_r ( void* __base, size_t __nmemb, size_t __size, __compar_d_fn_t __compar, void* __arg )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

#include <stdlib.h>

//auxiliary function

int

__compar(void const* p1, void const* p2, void* p3){

return 1;

}

int main(int argc, char *argv[])

{

void* __base = malloc(256);

void* __arg = malloc(256);

qsort_r(

__base,

256,

&__compar,

__arg); //target call

return 0;

}

[+] random_r ( struct random_data* __buf, int32_t* __result )

received signal SEGV

1
2
3
4
5
6
7
8

#include <stdlib.h>

int main(int argc, char *argv[])

{

struct random_data __buf;

int32_t __result = 0;

random_r(&__buf, &__result); //target call

return 0;

}

[+] realpath ( char const* __name, char* __resolved )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __resolved [] = {

'A',

'B',

'C',

'D',

'\0'};

realpath("__name", __resolved); //target call

return 0;

}

[+] setstate_r ( char* __statebuf, struct random_data* __buf )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __statebuf [] = {

'A',

'B',

'C',

'D',

'\0'};

struct random_data __buf;

setstate_r(__statebuf, &__buf); //target call

return 0;

}

[+] strtod_l ( char const* __nptr, char** __endptr, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <locale.h>

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __nptr = 'A';

char* __endptr = 0;

__locale_t __loc = duplocale(0);

strtod_l(&__nptr, (char**)&__endptr, __loc); //target call

return 0;

}

[+] strtof_l ( char const* __nptr, char** __endptr, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <locale.h>

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __nptr = 'A';

char* __endptr = 0;

__locale_t __loc = duplocale(0);

strtof_l(&__nptr, (char**)&__endptr, __loc); //target call

return 0;

}

[+] strtol_l ( char const* __nptr, char** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __nptr = 'A';

char* __endptr = 0;

__locale_t __loc = duplocale(0);

strtol_l(

&__nptr,

(char**)&__endptr,

__loc); //target call

return 0;

}

[+] strtold_l ( char const* __nptr, char** __endptr, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <locale.h>

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __nptr = 'A';

char* __endptr = 0;

__locale_t __loc = duplocale(0);

strtold_l(&__nptr, (char**)&__endptr, __loc); //target call

return 0;

}

[+] strtoll_l ( char const* __nptr, char** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __nptr = 'A';

char* __endptr = 0;

__locale_t __loc = duplocale(0);

strtoll_l(

&__nptr,

(char**)&__endptr,

__loc); //target call

return 0;

}

[+] strtoul_l ( char const* __nptr, char** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __nptr = 'A';

char* __endptr = 0;

__locale_t __loc = duplocale(0);

strtoul_l(

&__nptr,

(char**)&__endptr,

__loc); //target call

return 0;

}

[+] strtoull_l ( char const* __nptr, char** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <stdlib.h>

int main(int argc, char *argv[])

{

char __nptr = 'A';

char* __endptr = 0;

__locale_t __loc = duplocale(0);

strtoull_l(

&__nptr,

(char**)&__endptr,

__loc); //target call

return 0;

}

string.h, libc-2.16.so
[+] strcasecmp_l ( char const* __s1, char const* __s2, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <string.h>

int main(int argc, char *argv[])

{

__locale_t __loc = duplocale(0);

strcasecmp_l("__s1", "__s2", __loc); //target call

return 0;

}

[+] strcoll_l ( char const* __s1, char const* __s2, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <string.h>

int main(int argc, char *argv[])

{

__locale_t __l = duplocale(0);

strcoll_l("__s1", "__s2", __l); //target call

return 0;

}

[+] strerror_l ( int __errnum, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <string.h>

int main(int argc, char *argv[])

{

__locale_t __l = duplocale(0);

strerror_l(1, __l); //target call

return 0;

}

[+] strncasecmp_l ( char const* __s1, char const* __s2, size_t __n, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <locale.h>

#include <string.h>

int main(int argc, char *argv[])

{

__locale_t __loc = duplocale(0);

strncasecmp_l(

"__s1",

"__s2",

__loc); //target call

return 0;

}

[+] strxfrm_l ( char* __dest, char const* __src, size_t __n, __locale_t __l )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include <locale.h>

#include <string.h>

int main(int argc, char *argv[])

{

char __dest [] = {

'A',

'B',

'C',

'D',

'\0'};

__locale_t __l = duplocale(0);

strxfrm_l(

__dest,

"__src",

__l); //target call

return 0;

}

termios.h, libc-2.16.so
[+] cfgetispeed ( struct termios const* __termios_p )

received signal SEGV

#include <termios.h>

int main(int argc, char *argv[])

{

struct termios* __termios_p = 0; //can't initialize

cfgetispeed(__termios_p); //target call

return 0;

}

[+] cfgetospeed ( struct termios const* __termios_p )

received signal SEGV

#include <termios.h>

int main(int argc, char *argv[])

{

struct termios* __termios_p = 0; //can't initialize

cfgetospeed(__termios_p); //target call

return 0;

}

[+] cfmakeraw ( struct termios* __termios_p )

received signal SEGV

#include <termios.h>

int main(int argc, char *argv[])

{

struct termios* __termios_p = 0; //can't initialize

cfmakeraw(__termios_p); //target call

return 0;

}

[+] cfsetispeed ( struct termios* __termios_p, speed_t __speed )

received signal SEGV

1
2
3
4
5
6
7
8

#include <termios.h>

int main(int argc, char *argv[])

{

struct termios* __termios_p = 0; //can't initialize

speed_t __speed = cfgetispeed(__termios_p);

cfsetispeed(__termios_p, __speed); //target call

return 0;

}

[+] cfsetospeed ( struct termios* __termios_p, speed_t __speed )

received signal SEGV

1
2
3
4
5
6
7
8

#include <termios.h>

int main(int argc, char *argv[])

{

struct termios* __termios_p = 0; //can't initialize

speed_t __speed = cfgetispeed(__termios_p);

cfsetospeed(__termios_p, __speed); //target call

return 0;

}

[+] cfsetspeed ( struct termios* __termios_p, speed_t __speed )

received signal SEGV

1
2
3
4
5
6
7
8

#include <termios.h>

int main(int argc, char *argv[])

{

struct termios* __termios_p = 0; //can't initialize

speed_t __speed = cfgetispeed(__termios_p);

cfsetspeed(__termios_p, __speed); //target call

return 0;

}

[+] tcsetattr ( int __fd, int __optional_actions, struct termios const* __termios_p )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <sys/stat.h>

#include <fcntl.h>

#include <termios.h>

int main(int argc, char *argv[])

{

int __fd = open("testdata/sample.txt", O_RDWR);

struct termios* __termios_p = 0; //can't initialize

tcsetattr(__fd, 0, __termios_p); //target call

return 0;

}

time.h, libc-2.16.so
[+] mktime ( struct tm* __tp )

received signal SEGV

#include <time.h>

int main(int argc, char *argv[])

{

struct tm* __tp = getdate("__string");

mktime(__tp); //target call

return 0;

}

[+] strftime ( char* __s, size_t __maxsize, char const* __format, struct tm const* __tp )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

#include <time.h>

int main(int argc, char *argv[])

{

char __s [] = {

'A',

'B',

'C',

'D',

'\0'};

struct tm* __tp = getdate("__string");

strftime(

__s,

"__format",

__tp); //target call

return 0;

}

[+] strftime_l ( char* __s, size_t __maxsize, char const* __format, struct tm const* __tp, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

#include <locale.h>

#include <time.h>

int main(int argc, char *argv[])

{

char __s [] = {

'A',

'B',

'C',

'D',

'\0'};

struct tm* __tp = getdate("__string");

__locale_t __loc = duplocale(0);

strftime_l(

__s,

"__format",

__tp,

__loc); //target call

return 0;

}

[+] strptime_l ( char const* __s, char const* __fmt, struct tm* __tp, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <locale.h>

#include <time.h>

int main(int argc, char *argv[])

{

struct tm* __tp = getdate("__string");

__locale_t __loc = duplocale(0);

strptime_l(

"__s",

"__fmt",

__tp,

__loc); //target call

return 0;

}

[+] time ( time_t* __timer )

received signal SEGV

1
2
3
4
5
6
7
8

#include <time.h>

int main(int argc, char *argv[])

{

struct tm* __tp = getdate("__string");

time_t __timer = mktime(__tp);

time(&__timer); //target call

return 0;

}

[+] timegm ( struct tm* __tp )

received signal SEGV

#include <time.h>

int main(int argc, char *argv[])

{

struct tm* __tp = getdate("__string");

timegm(__tp); //target call

return 0;

}

[+] timelocal ( struct tm* __tp )

received signal SEGV

#include <time.h>

int main(int argc, char *argv[])

{

struct tm* __tp = getdate("__string");

timelocal(__tp); //target call

return 0;

}

ucontext.h, libc-2.16.so
[+] setcontext ( ucontext_t const* __ucp )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99

#include <stdlib.h>

#include <ucontext.h>

int main(int argc, char *argv[])

{

void* ss_sp = malloc(256);

struct _libc_fpstate fpregs = {

.cw = 1,

.sw = 2,

.tag = 3,

.ipoff = 4,

.cssel = 5,

.dataoff = 6,

.datasel = 7,

._st = {

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 8},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 9},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 10},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 1},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 2},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 3},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 4},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 5}},

.status = 6};

ucontext_t __ucp = {

.uc_flags = 0,

.uc_link = 0,

.uc_stack = (stack_t) {.ss_sp = ss_sp, .ss_flags = 0, .ss_size = 4},

.uc_mcontext = (mcontext_t) {

.gregs = {

0, 1, 2, 3,

4, 5, 6, 7,

8, 9, 10, 11,

12, 13, 14, 15,

16, 17, 18},

.fpregs = &fpregs,

.oldmask = 0,

.cr2 = 7},

.uc_sigmask = (__sigset_t) {

.__val = {

0, 1, 2, 3,

4, 5, 6, 7,

8, 9, 10, 11,

12, 13, 14, 15,

16, 17, 18, 19,

20, 21, 22, 23,

24, 25, 26, 27,

28, 29, 30, 31}},

.__fpregs_mem = fpregs};

setcontext(&__ucp); //target call

return 0;

}

[+] swapcontext ( ucontext_t* __oucp, ucontext_t const* __ucp )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125

#include <stdlib.h>

#include <ucontext.h>

int main(int argc, char *argv[])

{

void* ss_sp = malloc(256);

struct _libc_fpstate fpregs = {

.cw = 1,

.sw = 2,

.tag = 3,

.ipoff = 4,

.cssel = 5,

.dataoff = 6,

.datasel = 7,

._st = {

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 8},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 9},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 10},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 1},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 2},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 3},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 4},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 5}},

.status = 6};

ucontext_t __oucp = {

.uc_flags = 0,

.uc_link = 0,

.uc_stack = (stack_t) {.ss_sp = ss_sp, .ss_flags = 0, .ss_size = 4},

.uc_mcontext = (mcontext_t) {

.gregs = {

0, 1, 2, 3,

4, 5, 6, 7,

8, 9, 10, 11,

12, 13, 14, 15,

16, 17, 18},

.fpregs = &fpregs,

.oldmask = 0,

.cr2 = 7},

.uc_sigmask = (__sigset_t) {

.__val = {

0, 1, 2, 3,

4, 5, 6, 7,

8, 9, 10, 11,

12, 13, 14, 15,

16, 17, 18, 19,

20, 21, 22, 23,

24, 25, 26, 27,

28, 29, 30, 31}},

.__fpregs_mem = fpregs};

void* ss_sp_1 = malloc(256);

ucontext_t __ucp = {

.uc_flags = 0,

.uc_link = 0,

.uc_stack = (stack_t) {.ss_sp = ss_sp_1, .ss_flags = 0, .ss_size = 4},

.uc_mcontext = (mcontext_t) {

.gregs = {

0, 1, 2, 3,

4, 5, 6, 7,

8, 9, 10, 11,

12, 13, 14, 15,

16, 17, 18},

.fpregs = &fpregs,

.oldmask = 0,

.cr2 = 8},

.uc_sigmask = (__sigset_t) {

.__val = {

0, 1, 2, 3,

4, 5, 6, 7,

8, 9, 10, 11,

12, 13, 14, 15,

16, 17, 18, 19,

20, 21, 22, 23,

24, 25, 26, 27,

28, 29, 30, 31}},

.__fpregs_mem = fpregs};

swapcontext(&__oucp, &__ucp); //target call

return 0;

}

wchar.h, libc-2.16.so
[+] wcscasecmp_l ( wchar_t const* __s1, wchar_t const* __s2, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

__locale_t __loc = duplocale(0);

wcscasecmp_l(L"__s1", L"__s2", __loc); //target call

return 0;

}

[+] wcscat ( wchar_t* __dest, wchar_t const* __src )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __dest [] = {

L'A',

L'B',

L'C',

L'D',

L'\0'};

wcscat(__dest, L"__src"); //target call

return 0;

}

[+] wcscoll_l ( wchar_t const* __s1, wchar_t const* __s2, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

__locale_t __loc = duplocale(0);

wcscoll_l(L"__s1", L"__s2", __loc); //target call

return 0;

}

[+] wcsftime ( wchar_t* __s, size_t __maxsize, wchar_t const* __format, struct tm const* __tp )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include <time.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __s [] = {

L'A',

L'B',

L'C',

L'D',

L'\0'};

struct tm* __tp = getdate("__string");

wcsftime(

__s,

L"__format",

__tp); //target call

return 0;

}

[+] wcsftime_l ( wchar_t* __s, size_t __maxsize, wchar_t const* __format, struct tm const* __tp, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21

#include <locale.h>

#include <time.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __s [] = {

L'A',

L'B',

L'C',

L'D',

L'\0'};

struct tm* __tp = getdate("__string");

__locale_t __loc = duplocale(0);

wcsftime_l(

__s,

L"__format",

__tp,

__loc); //target call

return 0;

}

[+] wcsncasecmp_l ( wchar_t const* __s1, wchar_t const* __s2, size_t __n, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

__locale_t __loc = duplocale(0);

wcsncasecmp_l(

L"__s1",

L"__s2",

__loc); //target call

return 0;

}

[+] wcstod_l ( wchar_t const* __nptr, wchar_t** __endptr, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __nptr = L'A';

wchar_t* __endptr = 0;

__locale_t __loc = duplocale(0);

wcstod_l(&__nptr, (wchar_t**)&__endptr, __loc); //target call

return 0;

}

[+] wcstof_l ( wchar_t const* __nptr, wchar_t** __endptr, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __nptr = L'A';

wchar_t* __endptr = 0;

__locale_t __loc = duplocale(0);

wcstof_l(&__nptr, (wchar_t**)&__endptr, __loc); //target call

return 0;

}

[+] wcstol_l ( wchar_t const* __nptr, wchar_t** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __nptr = L'A';

wchar_t* __endptr = 0;

__locale_t __loc = duplocale(0);

wcstol_l(

&__nptr,

(wchar_t**)&__endptr,

__loc); //target call

return 0;

}

[+] wcstold_l ( wchar_t const* __nptr, wchar_t** __endptr, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __nptr = L'A';

wchar_t* __endptr = 0;

__locale_t __loc = duplocale(0);

wcstold_l(&__nptr, (wchar_t**)&__endptr, __loc); //target call

return 0;

}

[+] wcstoll_l ( wchar_t const* __nptr, wchar_t** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __nptr = L'A';

wchar_t* __endptr = 0;

__locale_t __loc = duplocale(0);

wcstoll_l(

&__nptr,

(wchar_t**)&__endptr,

__loc); //target call

return 0;

}

[+] wcstoul_l ( wchar_t const* __nptr, wchar_t** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __nptr = L'A';

wchar_t* __endptr = 0;

__locale_t __loc = duplocale(0);

wcstoul_l(

&__nptr,

(wchar_t**)&__endptr,

__loc); //target call

return 0;

}

[+] wcstoull_l ( wchar_t const* __nptr, wchar_t** __endptr, int __base, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __nptr = L'A';

wchar_t* __endptr = 0;

__locale_t __loc = duplocale(0);

wcstoull_l(

&__nptr,

(wchar_t**)&__endptr,

__loc); //target call

return 0;

}

[+] wcsxfrm_l ( wchar_t* __s1, wchar_t const* __s2, size_t __n, __locale_t __loc )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include <locale.h>

#include <wchar.h>

int main(int argc, char *argv[])

{

wchar_t __s1 [] = {

L'A',

L'B',

L'C',

L'D',

L'\0'};

__locale_t __loc = duplocale(0);

wcsxfrm_l(

__s1,

L"__s2",

__loc); //target call

return 0;

}

wctype.h, libc-2.16.so
[+] iswalnum_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswalnum_l(1, __locale); //target call

return 0;

}

[+] iswalpha_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswalpha_l(1, __locale); //target call

return 0;

}

[+] iswblank_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswblank_l(1, __locale); //target call

return 0;

}

[+] iswcntrl_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswcntrl_l(1, __locale); //target call

return 0;

}

[+] iswctype_l ( wint_t __wc, wctype_t __desc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

wctype_t __desc = wctype_l("__property", __locale);

iswctype_l(1, __desc, __locale); //target call

return 0;

}

[+] iswdigit_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswdigit_l(1, __locale); //target call

return 0;

}

[+] iswgraph_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswgraph_l(1, __locale); //target call

return 0;

}

[+] iswlower_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswlower_l(1, __locale); //target call

return 0;

}

[+] iswprint_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswprint_l(1, __locale); //target call

return 0;

}

[+] iswpunct_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswpunct_l(1, __locale); //target call

return 0;

}

[+] iswspace_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswspace_l(1, __locale); //target call

return 0;

}

[+] iswupper_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswupper_l(1, __locale); //target call

return 0;

}

[+] iswxdigit_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

iswxdigit_l(1, __locale); //target call

return 0;

}

[+] towctrans_l ( wint_t __wc, wctrans_t __desc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

wctrans_t __desc = wctrans_l("__property", __locale);

towctrans_l(1, __desc, __locale); //target call

return 0;

}

[+] towlower_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

towlower_l(1, __locale); //target call

return 0;

}

[+] towupper_l ( wint_t __wc, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

towupper_l(1, __locale); //target call

return 0;

}

[+] wctrans_l ( char const* __property, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

wctrans_l("__property", __locale); //target call

return 0;

}

[+] wctype_l ( char const* __property, __locale_t __locale )

received signal SEGV

1
2
3
4
5
6
7
8

#include <locale.h>

#include <wctype.h>

int main(int argc, char *argv[])

{

__locale_t __locale = duplocale(0);

wctype_l("__property", __locale); //target call

return 0;

}

crypt.h, libcrypt-2.16.so
[+] encrypt_r ( char* __block, int __edflag, struct crypt_data* __data )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55

#include <crypt.h>

int main(int argc, char *argv[])

{

char __block [] = {

'A',

'B',

'C',

'D',

'\0'};

struct crypt_data __data = {

.keysched = {

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B'},

.crypt_3_buf = {

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P'},

.current_salt = {'Q', 'R'},

.current_saltbits = 1L,

.direction = 2,

.initialized = 0};

encrypt_r(__block, 0, &__data); //target call

return 0;

}

unistd.h, libcrypt-2.16.so
[+] encrypt ( char* __block, int __edflag )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <unistd.h>

int main(int argc, char *argv[])

{

char __block [] = {

'A',

'B',

'C',

'D',

'\0'};

encrypt(__block, 0); //target call

return 0;

}

dlfcn.h, libdl-2.16.so
[+] dlsym ( void* __handle, char const* __name )

received signal SEGV

1
2
3
4
5
6
7
8

#include <stdlib.h>

#include <dlfcn.h>

int main(int argc, char *argv[])

{

void* __handle = malloc(256);

dlsym(__handle, "__name"); //target call

return 0;

}

[+] dlvsym ( void* __handle, char const* __name, char const* __version )

received signal SEGV

1
2
3
4
5
6
7
8

#include <stdlib.h>

#include <dlfcn.h>

int main(int argc, char *argv[])

{

void* __handle = malloc(256);

dlvsym(__handle, "__name", "1.0"); //target call

return 0;

}

semaphore.h, libpthread-2.16.so
[+] sem_getvalue ( sem_t* __sem, int* __sval )

received signal SEGV

1
2
3
4
5
6
7
8
9

#include <stdlib.h>

#include <semaphore.h>

int main(int argc, char *argv[])

{

sem_t* __sem = sem_open("__name", 0, 0);

int* __sval = (int*) malloc(sizeof(int)*256);

sem_getvalue(__sem, __sval); //target call

return 0;

}

[+] sem_init ( sem_t* __sem, int __pshared, unsigned int __value )

received signal SEGV

#include <semaphore.h>

int main(int argc, char *argv[])

{

sem_t* __sem = sem_open("__name", 0, 0);

sem_init(__sem, 0, 1); //target call

return 0;

}

[+] sem_post ( sem_t* __sem )

received signal SEGV

#include <semaphore.h>

int main(int argc, char *argv[])

{

sem_t* __sem = sem_open("__name", 0, 0);

sem_post(__sem); //target call

return 0;

}

[+] sem_timedwait ( sem_t* __sem, struct timespec const* __abstime )

received signal SEGV

1
2
3
4
5
6
7
8
9
10

#include <semaphore.h>

int main(int argc, char *argv[])

{

sem_t* __sem = sem_open("__name", 0, 0);

struct timespec __abstime;

clock_getres(1, &__abstime);

sem_timedwait(__sem, &__abstime); //target call

return 0;

}

[+] sem_trywait ( sem_t* __sem )

received signal SEGV

#include <semaphore.h>

int main(int argc, char *argv[])

{

sem_t* __sem = sem_open("__name", 0, 0);

sem_trywait(__sem); //target call

return 0;

}

[+] sem_wait ( sem_t* __sem )

received signal SEGV

#include <semaphore.h>

int main(int argc, char *argv[])

{

sem_t* __sem = sem_open("__name", 0, 0);

sem_wait(__sem); //target call

return 0;

}

nameser.h, libresolv-2.16.so
[+] ns_initparse ( u_char const* p1, int p2, ns_msg* p3 )

received signal SEGV

#include <arpa/nameser.h>

int main(int argc, char *argv[])

{

ns_msg* msg = 0; //can't initialize

ns_initparse((u_char const*) "str", 1, msg); //target call

return 0;

}

[+] ns_parserr ( ns_msg* p1, ns_sect p2, int p3, ns_rr* p4 )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17

#include <arpa/nameser.h>

int main(int argc, char *argv[])

{

ns_msg* msg = 0; //can't initialize

ns_rr rr = {

.type = 0,

.rr_class = 2,

.ttl = 3,

.rdlength = 4,

.rdata = (u_char const*) "rdata"};

ns_parserr(

msg,

ns_s_qd,

&rr); //target call

return 0;

}

[+] ns_sprintrr ( ns_msg const* p1, ns_rr const* p2, char const* p3, char const* p4, char* p5, size_t p6 )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25

#include <arpa/nameser.h>

int main(int argc, char *argv[])

{

ns_msg* msg = 0; //can't initialize

ns_rr rr = {

.type = 0,

.rr_class = 1,

.ttl = 2,

.rdlength = 4,

.rdata = (u_char const*) "rdata"};

char p5 [] = {

'A',

'B',

'C',

'D',

'\0'};

ns_sprintrr(

msg,

&rr,

"str",

"str2",

p5,

4); //target call

return 0;

}

resolv.h, libresolv-2.16.so
[+] __loc_ntoa ( u_char const* __binary, char* __ascii )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12

#include <resolv.h>

int main(int argc, char *argv[])

{

char __ascii [] = {

'A',

'B',

'C',

'D',

'\0'};

__loc_ntoa((u_char const*) "__binary", __ascii); //target call

return 0;

}

aio.h, librt-2.16.so
[+] lio_listio ( int __mode, struct aiocb*const* __list, int __nent, struct sigevent* __sig )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142

#include <wchar.h>

#include <stdio.h>

#include <stdlib.h>

#include <aio.h>

int main(int argc, char *argv[])

{

void* aio_buf = malloc(256);

struct sigevent aio_sigevent;

timer_create(4, &aio_sigevent, (timer_t*)&aio_buf);

FILE* __stream = fopen("testdata/sample.txt", "r+");

__off_t aio_offset = ftello(__stream);

struct aiocb __list_elem [] = {

(struct aiocb) {

.aio_fildes = 1,

.aio_lio_opcode = 2,

.aio_reqprio = 3,

.aio_buf = aio_buf,

.aio_nbytes = 4,

.aio_sigevent = aio_sigevent,

.__next_prio = 0,

.__abs_prio = 5,

.__policy = 6,

.__error_code = 7,

.__return_value = 4,

.aio_offset = aio_offset,

.__pad = {

'A',

'B',

'C',

'D'},

.__unused = {

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J'}},

(struct aiocb) {

.aio_fildes = 8,

.aio_lio_opcode = 9,

.aio_reqprio = 10,

.aio_buf = aio_buf,

.aio_nbytes = 4,

.aio_sigevent = aio_sigevent,

.__next_prio = 0,

.__abs_prio = 1,

.__policy = 2,

.__error_code = 3,

.__return_value = 4,

.aio_offset = aio_offset,

.__pad = {

'K',

'L',

'M',

'N'},

.__unused = {

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D',

'E', 'F', 'G', 'H',

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T'}},

(struct aiocb) {

.aio_fildes = 4,

.aio_lio_opcode = 5,

.aio_reqprio = 6,

.aio_buf = aio_buf,

.aio_nbytes = 4,

.aio_sigevent = aio_sigevent,

.__next_prio = 0,

.__abs_prio = 7,

.__policy = 8,

.__error_code = 9,

.__return_value = 4,

.aio_offset = aio_offset,

.__pad = {

'U',

'V',

'W',

'X'},

.__unused = {

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N',

'O', 'P', 'Q', 'R',

'S', 'T', 'U', 'V',

'W', 'X', 'Y', 'Z',

'A', 'B', 'C', 'D'}},

(struct aiocb) {

.aio_fildes = 10,

.aio_lio_opcode = 1,

.aio_reqprio = 2,

.aio_buf = aio_buf,

.aio_nbytes = 4,

.aio_sigevent = aio_sigevent,

.__next_prio = 0,

.__abs_prio = 3,

.__policy = 4,

.__error_code = 5,

.__return_value = 4,

.aio_offset = aio_offset,

.__pad = {

'E',

'F',

'G',

'H'},

.__unused = {

'I', 'J', 'K', 'L',

'M', 'N', 'O', 'P',

'Q', 'R', 'S', 'T',

'U', 'V', 'W', 'X',

'Y', 'Z', 'A', 'B',

'C', 'D', 'E', 'F',

'G', 'H', 'I', 'J',

'K', 'L', 'M', 'N'}},

(struct aiocb) {0}};

struct aiocb* __list [] = {

__list_elem,

0};

struct sigevent __sig;

timer_create(7, &__sig, (timer_t*)&aio_buf);

lio_listio(

(struct aiocb*const*)__list,

&__sig); //target call

//finalization

fclose(__stream);

return 0;

}

pty.h, libutil-2.16.so
[+] forkpty ( int* __amaster, char* __name, struct termios const* __termp, struct winsize const* __winp )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include <stdlib.h>

#include <pty.h>

int main(int argc, char *argv[])

{

int* __amaster = (int*) malloc(sizeof(int)*256);

struct termios* __termp = 0; //can't initialize

struct winsize __winp = {

.ws_row = 0,

.ws_col = 1,

.ws_xpixel = 2,

.ws_ypixel = 3};

forkpty(

__amaster,

"__name",

__termp,

&__winp); //target call

return 0;

}

[+] openpty ( int* __amaster, int* __aslave, char* __name, struct termios const* __termp, struct winsize const* __winp )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20

#include <stdlib.h>

#include <pty.h>

int main(int argc, char *argv[])

{

int* __amaster = (int*) malloc(sizeof(int)*256);

int* __aslave = (int*) malloc(sizeof(int)*256);

struct termios* __termp = 0; //can't initialize

struct winsize __winp = {

.ws_row = 0,

.ws_col = 1,

.ws_xpixel = 2,

.ws_ypixel = 3};

openpty(

__amaster,

__aslave,

"__name",

__termp,

&__winp); //target call

return 0;

}

link.h, sotruss-lib.so
[+] la_i86_gnu_pltenter ( Elf32_Sym* __sym, unsigned int __ndx, uintptr_t* __refcook, uintptr_t* __defcook, La_i86_regs* __regs, unsigned int* __flags, char const* __symname, long* __framesizep )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63

#include <stdlib.h>

#include <link.h>

int main(int argc, char *argv[])

{

Elf32_Sym __sym = {

.st_name = 1,

.st_value = 2,

.st_size = 4,

.st_info = 'A',

.st_other = 'B',

.st_shndx = 3};

uintptr_t* __refcook = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

uintptr_t* __defcook = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

unsigned int __flags [] = {

3};

uintptr_t __refcook_1 = la_symbind32(

&__sym,

__refcook,

__defcook,

__flags,

"__symname");

La_i86_regs __regs [] = {

(La_i86_regs) {

.lr_edx = 6,

.lr_ecx = 7,

.lr_eax = 8,

.lr_ebp = 9,

.lr_esp = 10},

(La_i86_regs) {

.lr_edx = 1,

.lr_ecx = 2,

.lr_eax = 3,

.lr_ebp = 4,

.lr_esp = 5},

(La_i86_regs) {

.lr_edx = 6,

.lr_ecx = 7,

.lr_eax = 8,

.lr_ebp = 9,

.lr_esp = 10},

(La_i86_regs) {

.lr_edx = 1,

.lr_ecx = 2,

.lr_eax = 3,

.lr_ebp = 4,

.lr_esp = 5},

(La_i86_regs) {0}};

long __framesizep = 0;

la_i86_gnu_pltenter(

&__sym,

&__refcook_1,

__defcook,

__regs,

__flags,

"__symname",

&__framesizep); //target call

return 0;

}

[+] la_i86_gnu_pltexit ( Elf32_Sym* __sym, unsigned int __ndx, uintptr_t* __refcook, uintptr_t* __defcook, La_i86_regs const* __inregs, La_i86_retval* __outregs, char const* symname )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102

#include <stdlib.h>

#include <link.h>

int main(int argc, char *argv[])

{

uintptr_t* __refcook = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

uintptr_t* __defcook = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

unsigned int __flags [] = {

3};

uintptr_t __refcook_1 = la_symbind32(

__refcook,

__defcook,

__flags,

"__symname");

La_i86_regs __regs [] = {

(La_i86_regs) {

.lr_edx = 4,

.lr_ecx = 5,

.lr_eax = 6,

.lr_ebp = 7,

.lr_esp = 8},

(La_i86_regs) {

.lr_edx = 9,

.lr_ecx = 10,

.lr_eax = 1,

.lr_ebp = 2,

.lr_esp = 3},

(La_i86_regs) {

.lr_edx = 4,

.lr_ecx = 5,

.lr_eax = 6,

.lr_ebp = 7,

.lr_esp = 8},

(La_i86_regs) {

.lr_edx = 9,

.lr_ecx = 10,

.lr_eax = 1,

.lr_ebp = 2,

.lr_esp = 3},

(La_i86_regs) {0}};

long __framesizep = 0;

Elf32_Addr st_value = la_i86_gnu_pltenter(

&__refcook_1,

__defcook,

__regs,

__flags,

"__symname",

&__framesizep);

Elf32_Sym __sym = {

.st_name = 1,

.st_value = st_value,

.st_size = 4,

.st_info = 'A',

.st_other = 'B',

.st_shndx = 4};

La_i86_regs __inregs [] = {

(La_i86_regs) {

.lr_edx = 6,

.lr_ecx = 7,

.lr_eax = 8,

.lr_ebp = 9,

.lr_esp = 10},

(La_i86_regs) {

.lr_edx = 1,

.lr_ecx = 2,

.lr_eax = 3,

.lr_ebp = 4,

.lr_esp = 5},

(La_i86_regs) {

.lr_edx = 6,

.lr_ecx = 7,

.lr_eax = 8,

.lr_ebp = 9,

.lr_esp = 10},

(La_i86_regs) {

.lr_edx = 1,

.lr_ecx = 2,

.lr_eax = 3,

.lr_ebp = 4,

.lr_esp = 5},

(La_i86_regs) {0}};

La_i86_retval __outregs = {

.lrv_eax = 6,

.lrv_edx = 7,

.lrv_st0 = 1.5L,

.lrv_st1 = 2.5L};

la_i86_gnu_pltexit(

&__sym,

__refcook,

__defcook,

__inregs,

&__outregs,

"symname"); //target call

return 0;

}

[+] la_objopen ( struct link_map* __map, Lmid_t __lmid, uintptr_t* __cookie )

received signal SEGV

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67

#include <stdlib.h>

#include <link.h>

int main(int argc, char *argv[])

{

struct link_map __map;

uintptr_t* __refcook = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

uintptr_t* __defcook = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

La_i86_regs __regs [] = {

(La_i86_regs) {

.lr_edx = 4,

.lr_ecx = 5,

.lr_eax = 6,

.lr_ebp = 7,

.lr_esp = 8},

(La_i86_regs) {

.lr_edx = 9,

.lr_ecx = 10,

.lr_eax = 1,

.lr_ebp = 2,

.lr_esp = 3},

(La_i86_regs) {

.lr_edx = 4,

.lr_ecx = 5,

.lr_eax = 6,

.lr_ebp = 7,

.lr_esp = 8},

(La_i86_regs) {

.lr_edx = 9,

.lr_ecx = 10,

.lr_eax = 1,

.lr_ebp = 2,

.lr_esp = 3},

(La_i86_regs) {0}};

unsigned int __flags [] = {

3};

long __framesizep = 0;

Elf32_Addr st_value = la_i86_gnu_pltenter(

__refcook,

__defcook,

__regs,

__flags,

"__symname",

&__framesizep);

Elf32_Sym __sym = {

.st_name = 2,

.st_value = st_value,

.st_size = 4,

.st_info = 'A',

.st_other = 'B',

.st_shndx = 4};

uintptr_t* __refcook_1 = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

uintptr_t* __defcook_1 = (uintptr_t*) malloc(sizeof(uintptr_t)*256);

uintptr_t __cookie = la_symbind32(

&__sym,

__refcook_1,

__defcook_1,

__flags,

"__symname");

la_objopen(&__map, 1L, &__cookie); //target call

return 0;

}

to the top

[+] Hanged execution (1 problem)

pthread.h, libpthread-2.16.so
[+] pthread_spin_lock ( int volatile* __lock )

hanged execution (more than 7 seconds)

1
2
3
4
5
6
7
8

#include <stdlib.h>

#include <pthread.h>

int main(int argc, char *argv[])

{

int* __lock = (int volatile*) malloc(sizeof(int volatile)*256);

pthread_spin_lock(__lock); //target call

return 0;

}

to the top

Warnings (45)

[+] Received signal ABRT (9 warnings)

obstack.h, libc-2.16.so
[+] obstack_free ( struct obstack* __obstack, void* __block )

received signal ABRT

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64

#include <stdlib.h>

#include <obstack.h>

//auxiliary function

struct _obstack_chunk*

chunkfun(void* p1, long p2){

char limit [] = {

'I',

'J',

'K',

'L',

'\0'};

struct _obstack_chunk retval = {

.limit = limit,

.prev = 0,

.contents = {

'M',

'N',

'O',

'P'}};

return &retval;

}

//auxiliary function

void

freefun(void* p1, struct _obstack_chunk* p2){

free(p1);

}

int main(int argc, char *argv[])

{

char limit [] = {

'A',

'B',

'C',

'D',

'\0'};

struct _obstack_chunk chunk = {

.limit = limit,

.prev = 0,

.contents = {

'E',

'F',

'G',

'H'}};

void* extra_arg = malloc(256);

struct obstack __obstack = {

.chunk_size = 4,

.chunk = &chunk,

.object_base = limit,

.next_free = limit,

.chunk_limit = limit,

.temp = {.tempint = 1},

.alignment_mask = 0,

.chunkfun = &chunkfun,

.freefun = &freefun,

.extra_arg = extra_arg,

.use_extra_arg = 2,

.maybe_empty_object = 3,

.alloc_failed = 0};

void* __block = malloc(256);

obstack_free(&__obstack, __block); //target call

return 0;

}

stdlib.h, libc-2.16.so
[+] abort ( )

received signal ABRT

#include <stdlib.h>

int main(int argc, char *argv[])

{

abort(); //target call

return 0;

}

[+] cfree ( void* __ptr )

received signal ABRT

*** glibc detected *** ./test: free(): invalid pointer: 0xb7595c08 ***

#include <stdlib.h>

int main(int argc, char *argv[])

{

void* __ptr = malloc(256);

cfree(__ptr); //target call

return 0;

}

uchar.h, libc-2.16.so
[+] c16rtomb ( char* __s, char16_t __c16, mbstate_t* __ps )

received signal ABRT

test: ../iconv/loop.c:448: internal_ascii_loop_single: Assertion `inptr - bytebuf > (state->__count & 7)' failed.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <wchar.h>

#include <uchar.h>

int main(int argc, char *argv[])

{

char __s [] = {

'A',

'B',

'C',

'D',

'\0'};

mbstate_t __ps = {.__count = 4, .__value = {.__wch = 2}};

c16rtomb(__s, 1, &__ps); //target call

return 0;

}

[+] c32rtomb ( char* __s, char32_t __c32, mbstate_t* __ps )

received signal ABRT

test: ../iconv/loop.c:448: internal_ascii_loop_single: Assertion `inptr - bytebuf > (state->__count & 7)' failed.

1
2
3
4
5
6
7
8
9
10
11
12
13
14

#include <wchar.h>

#include <uchar.h>

int main(int argc, char *argv[])

{

char __s [] = {

'A',

'B',

'C',

'D',

'\0'};

mbstate_t __ps = {.__count = 4, .__value = {.__wch = 2}};

c32rtomb(__s, 1, &__ps); //target call

return 0;

}

wchar.h, libc-2.16.so
[+] wcrtomb ( char* __s, wchar_t __wc, mbstate_t* __ps )

received signal ABRT

test: ../iconv/loop.c:448: internal_ascii_loop_single: Assertion `inptr - bytebuf > (state->__count & 7)' failed.

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <wchar.h>

int main(int argc, char *argv[])

{

char __s [] = {

'A',

'B',

'C',

'D',

'\0'};

mbstate_t __ps = {.__count = 4, .__value = {.__wch = 1}};

wcrtomb(__s, L'E', &__ps); //target call

return 0;

}

[+] wcsnrtombs ( char* __dst, wchar_t const** __src, size_t __nwc, size_t __len, mbstate_t* __ps )

received signal ABRT

test: ../iconv/loop.c:448: internal_ascii_loop_single: Assertion `inptr - bytebuf > (state->__count & 7)' failed.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24

#include <wchar.h>

int main(int argc, char *argv[])

{

char __dst [] = {

'A',

'B',

'C',

'D',

'\0'};

wchar_t* __src [] = {

"testdata/sample.txt",

0};

mbstate_t __ps = {.__count = 4, .__value = {.__wch = 1}};

wcsnrtombs(

__dst,

(wchar_t const**)__src,

&__ps); //target call

return 0;

}

[+] wcsrtombs ( char* __dst, wchar_t const** __src, size_t __len, mbstate_t* __ps )

received signal ABRT

test: ../iconv/loop.c:448: internal_ascii_loop_single: Assertion `inptr - bytebuf > (state->__count & 7)' failed.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23

#include <wchar.h>

int main(int argc, char *argv[])

{

char __dst [] = {

'A',

'B',

'C',

'D',

'\0'};

wchar_t* __src [] = {

"testdata/sample.txt",

0};

mbstate_t __ps = {.__count = 4, .__value = {.__wch = 1}};

wcsrtombs(

__dst,

(wchar_t const**)__src,

&__ps); //target call

return 0;

}

pthread.h, libpthread-2.16.so
[+] pthread_cancel ( pthread_t __th )

received signal ABRT

libgcc_s.so.1 must be installed for pthread_cancel to work

#include <pthread.h>

int main(int argc, char *argv[])

{

pthread_t __th = pthread_self();

pthread_cancel(__th); //target call

return 0;

}

to the top

[+] Received signal ALRM (1 warning)

unistd.h, libc-2.16.so
[+] usleep ( __useconds_t __useconds )

received signal ALRM

#include <unistd.h>

int main(int argc, char *argv[])

{

__useconds_t __useconds = ualarm(1, 1);

usleep(__useconds); //target call

return 0;

}

to the top

[+] Received signal HUP (4 warnings)

signal.h, libc-2.16.so
[+] gsignal ( int __sig )

received signal HUP

#include <signal.h>

int main(int argc, char *argv[])

{

gsignal(1); //target call

return 0;

}

[+] raise ( int __sig )

received signal HUP

#include <signal.h>

int main(int argc, char *argv[])

{

raise(1); //target call

return 0;

}

sigthread.h, libpthread-2.16.so
[+] pthread_kill ( pthread_t __threadid, int __signo )

received signal HUP

1
2
3
4
5
6
7
8

#include <pthread.h>

#include <signal.h>

int main(int argc, char *argv[])

{

pthread_t __threadid = pthread_self();

pthread_kill(__threadid, 1); //target call

return 0;

}

[+] pthread_sigqueue ( pthread_t __threadid, int __signo, union sigval const __value )

received signal HUP

1
2
3
4
5
6
7
8
9

#include <signal.h>

#include <pthread.h>

int main(int argc, char *argv[])

{

pthread_t __threadid = pthread_self();

union sigval __value = {.sival_int = 1};

pthread_sigqueue(__threadid, 1, __value); //target call

return 0;

}

to the top

[+] Exited with value "1" (7 warnings)

err.h, libc-2.16.so
[+] err ( int __status, char const* __format, ... )

exited with value 1

test: 1: Success

1
2
3
4
5
6
7
8
9
10

#include <err.h>

int main(int argc, char *argv[])

{

err(

"%d",

(char*)0); //target call

return 0;

}

[+] errx ( int __status, char const* __format, ... )

exited with value 1

test: 1

1
2
3
4
5
6
7
8
9
10

#include <err.h>

int main(int argc, char *argv[])

{

errx(

"%d",

(char*)0); //target call

return 0;

}

[+] verr ( int __status, char const* __format, __gnuc_va_list p3 )

exited with value 1

test: __format: Success

1
2
3
4
5
6
7
8
9
10
11
12

#include <err.h>

int main(int argc, char *argv[])

{

char p3 [] = {

'A',

'B',

'C',

'D',

'\0'};

verr(1, "__format", p3); //target call

return 0;

}

[+] verrx ( int __status, char const* p2, __gnuc_va_list p3 )

exited with value 1

test: str

1
2
3
4
5
6
7
8
9
10
11
12

#include <err.h>

int main(int argc, char *argv[])

{

char p3 [] = {

'A',

'B',

'C',

'D',

'\0'};

verrx(1, "str", p3); //target call

return 0;

}

error.h, libc-2.16.so
[+] error ( int __status, int __errnum, char const* __format, ... )

exited with value 1

./test: 1: Exec format error

1
2
3
4
5
6
7
8
9
10
11

#include <error.h>

int main(int argc, char *argv[])

{

error(

"%d",

(char*)0); //target call

return 0;

}

[+] error_at_line ( int __status, int __errnum, char const* __fname, unsigned int __line, char const* __format, ... )

exited with value 1

./test:__fname:0: 1: Argument list too long

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <error.h>

int main(int argc, char *argv[])

{

error_at_line(

"__fname",

"%d",

(char*)0); //target call

return 0;

}

pthread.h, libpthread-2.16.so
[+] pthread_once ( pthread_once_t* __once_control, __init_routine_type __init_routine )

exited with value 1

memory exhausted

1
2
3
4
5
6
7
8
9
10
11
12
13

#include <obstack.h>

#include <stdlib.h>

#include <pthread.h>

typedef void (*__init_routine_type) ();

int main(int argc, char *argv[])

{

pthread_once_t* __once_control = (pthread_once_t*) malloc(sizeof(pthread_once_t)*256);

__init_routine_type __init_routine = obstack_alloc_failed_handler;

pthread_once(__once_control, __init_routine); //target call

return 0;

}

to the top

[+] Exited with value "127" (3 warnings)

syslog.h, libc-2.16.so
[+] syslog ( int __pri, char const* __fmt, ... )

exited with value 127

Inconsistency detected by ld.so: dl-minimal.c: 136: realloc: Assertion `ptr == alloc_last_block' failed!

1
2
3
4
5
6
7
8
9
10

#include <syslog.h>

int main(int argc, char *argv[])

{

syslog(

"%d",

(char*)0); //target call

return 0;

}

[+] vsyslog ( int __pri, char const* __fmt, __gnuc_va_list __ap )

exited with value 127

Inconsistency detected by ld.so: dl-minimal.c: 136: realloc: Assertion `ptr == alloc_last_block' failed!

1
2
3
4
5
6
7
8
9
10
11
12

#include <syslog.h>

int main(int argc, char *argv[])

{

char __ap [] = {

'A',

'B',

'C',

'D',

'\0'};

vsyslog(1, "__fmt", __ap); //target call

return 0;

}

wordexp.h, libc-2.16.so
[+] wordexp ( char const* __words, wordexp_t* __pwordexp, int __flags )

exited with value 127

Inconsistency detected by ld.so: dl-minimal.c: 136: realloc: Assertion `ptr == alloc_last_block' failed!

1
2
3
4
5
6
7
8
9
10
11

#include <wordexp.h>

int main(int argc, char *argv[])

{

char we_wordv = 'A';

char *we_wordv_p = (char *)&we_wordv;

char **we_wordv_pp = &we_wordv_p;

wordexp_t __pwordexp = {.we_wordc = 4, .we_wordv = (char**)we_wordv_pp, .we_offs = 4};

wordexp("__words", &__pwordexp, 0); //target call

return 0;

}

to the top

[+] Exited with value "64" (2 warnings)

argp.h, libc-2.16.so
[+] argp_error ( struct argp_state const* __state, char const* __fmt, ... )

exited with value 64

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153

#include <ucontext.h>

#include <wchar.h>

#include <stdio.h>

#include <stdlib.h>

#include <argp.h>

//auxiliary function

error_t

parser(int p1, char* p2, struct argp_state* p3){

return 1;

}

//auxiliary function

char*

help_filter(int p1, char const* p2, void* p3){

return (char*)p2;

}

int main(int argc, char *argv[])

{

struct argp_option options [] = {

(struct argp_option) {

.name = "name",

.key = 1,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 2},

(struct argp_option) {

.name = "name",

.key = 3,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 4},

(struct argp_option) {

.name = "name",

.key = 5,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 6},

(struct argp_option) {

.name = "name",

.key = 7,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 8},

(struct argp_option) {0}};

struct argp_child children = {

.argp = 0,

.flags = 0,

.header = "header",

.group = 9};

struct argp root_argp = {

.options = options,

.parser = &parser,

.args_doc = "args_doc",

.doc = "doc",

.children = &children,

.help_filter = &help_filter,

.argp_domain = "argp_domain"};

void* input = malloc(256);

void* hook = malloc(256);

struct _libc_fpstate pstate = {

.cw = 2,

.sw = 3,

.tag = 4,

.ipoff = 5,

.cssel = 6,

.dataoff = 7,

.datasel = 8,

._st = {

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 9},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 10},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 1},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 2},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 3},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 4},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 5},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 6}},

.status = 7};

struct argp_state __state = {

.root_argp = &root_argp,

.argc = argc,

.argv = argv,

.next = 10,

.flags = 0,

.arg_num = 1,

.quoted = 0,

.input = input,

.child_inputs = (void**)&input,

.hook = hook,

.name = "name",

.err_stream = fopen("testdata/sample.txt", "r+"),

.out_stream = fopen("testdata/sample.txt", "r+"),

.pstate = (void*)&pstate};

argp_error(

&__state,

"%d",

(char*)0); //target call

return 0;

}

[+] argp_usage ( struct argp_state const* __state )

exited with value 64

Usage: name [OPTION...] args_doc
Try `name --help' or `name --usage' for more information.

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149

#include <ucontext.h>

#include <wchar.h>

#include <stdio.h>

#include <stdlib.h>

#include <argp.h>

//auxiliary function

error_t

parser(int p1, char* p2, struct argp_state* p3){

return 1;

}

//auxiliary function

char*

help_filter(int p1, char const* p2, void* p3){

return (char*)p2;

}

int main(int argc, char *argv[])

{

struct argp_option options [] = {

(struct argp_option) {

.name = "name",

.key = 1,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 2},

(struct argp_option) {

.name = "name",

.key = 3,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 4},

(struct argp_option) {

.name = "name",

.key = 5,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 6},

(struct argp_option) {

.name = "name",

.key = 7,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 8},

(struct argp_option) {0}};

struct argp_child children = {

.argp = 0,

.flags = 0,

.header = "header",

.group = 9};

struct argp root_argp = {

.options = options,

.parser = &parser,

.args_doc = "args_doc",

.doc = "doc",

.children = &children,

.help_filter = &help_filter,

.argp_domain = "argp_domain"};

void* input = malloc(256);

void* hook = malloc(256);

struct _libc_fpstate pstate = {

.cw = 2,

.sw = 3,

.tag = 4,

.ipoff = 5,

.cssel = 6,

.dataoff = 7,

.datasel = 8,

._st = {

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 9},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 10},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 1},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 2},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 3},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 4},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 5},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 6}},

.status = 7};

struct argp_state __state = {

.root_argp = &root_argp,

.argc = argc,

.argv = argv,

.next = 10,

.flags = 0,

.arg_num = 1,

.quoted = 0,

.input = input,

.child_inputs = (void**)&input,

.hook = hook,

.name = "name",

.err_stream = fopen("testdata/sample.txt", "r+"),

.out_stream = fopen("testdata/sample.txt", "r+"),

.pstate = (void*)&pstate};

argp_usage(&__state); //target call

return 0;

}

to the top

[+] Exited with value "8" (1 warning)

argp.h, libc-2.16.so
[+] argp_failure ( struct argp_state const* __state, int __status, int __errnum, char const* __fmt, ... )

exited with value 8

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155

#include <ucontext.h>

#include <wchar.h>

#include <stdio.h>

#include <stdlib.h>

#include <argp.h>

//auxiliary function

error_t

parser(int p1, char* p2, struct argp_state* p3){

return 1;

}

//auxiliary function

char*

help_filter(int p1, char const* p2, void* p3){

return (char*)p2;

}

int main(int argc, char *argv[])

{

struct argp_option options [] = {

(struct argp_option) {

.name = "name",

.key = 1,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 2},

(struct argp_option) {

.name = "name",

.key = 3,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 4},

(struct argp_option) {

.name = "name",

.key = 5,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 6},

(struct argp_option) {

.name = "name",

.key = 7,

.arg = "arg",

.flags = 0,

.doc = "doc",

.group = 8},

(struct argp_option) {0}};

struct argp_child children = {

.argp = 0,

.flags = 0,

.header = "header",

.group = 9};

struct argp root_argp = {

.options = options,

.parser = &parser,

.args_doc = "args_doc",

.doc = "doc",

.children = &children,

.help_filter = &help_filter,

.argp_domain = "argp_domain"};

void* input = malloc(256);

void* hook = malloc(256);

struct _libc_fpstate pstate = {

.cw = 2,

.sw = 3,

.tag = 4,

.ipoff = 5,

.cssel = 6,

.dataoff = 7,

.datasel = 8,

._st = {

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 9},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 10},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 1},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 2},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 3},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 4},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 5},

(struct _libc_fpreg) {

.significand = {

3},

.exponent = 6}},

.status = 7};

struct argp_state __state = {

.root_argp = &root_argp,

.argc = argc,

.argv = argv,

.next = 10,

.flags = 0,

.arg_num = 1,

.quoted = 0,

.input = input,

.child_inputs = (void**)&input,

.hook = hook,

.name = "name",

.err_stream = fopen("testdata/sample.txt", "r+"),

.out_stream = fopen("testdata/sample.txt", "r+"),

.pstate = (void*)&pstate};

argp_failure(

&__state,

"%d",

(char*)0); //target call

return 0;

}

to the top

[+] Hanged execution (6 warnings)

pthread.h, libc-2.16.so
[+] pthread_cond_wait ( pthread_cond_t* __cond, pthread_mutex_t* __mutex )

hanged execution (more than 7 seconds)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18

#include <pthread.h>

int main(int argc, char *argv[])

{

pthread_condattr_t __cond_attr;

pthread_condattr_init(&__cond_attr);

pthread_cond_t __cond;

pthread_cond_init(&__cond, &__cond_attr);

pthread_mutexattr_t __mutexattr;

pthread_mutexattr_init(&__mutexattr);

pthread_mutex_t __mutex;

pthread_mutex_init(&__mutex, &__mutexattr);

pthread_cond_wait(&__cond, &__mutex); //target call

return 0;

}

signal.h, libc-2.16.so
[+] sigsuspend ( sigset_t const* __set )

hanged execution (more than 7 seconds)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48

#include <signal.h>
int main(int argc, char *argv[])
{
sigset_t __set [] = {
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {0}};
sigsuspend(__set); //target call
return 0;
}

[+] sigwait ( sigset_t const* __set, int* __sig )

hanged execution (more than 7 seconds)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50

#include <stdlib.h>
#include <signal.h>
int main(int argc, char *argv[])
{
sigset_t __set [] = {
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {0}};
int* __sig = (int) malloc(sizeof(int)256);
sigwait(__set, __sig); //target call
return 0;
}

[+] sigwaitinfo ( sigset_t const* __set, siginfo_t* __info )

hanged execution (more than 7 seconds)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61

#include <signal.h>
int main(int argc, char *argv[])
{
sigset_t __set [] = {
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {
.__val = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28, 29, 30, 31}},
(sigset_t) {0}};
siginfo_t __info = {
.si_signo = 1,
.si_errno = 1,
.si_code = 2,
._sifields = {._pad = {
0, 1, 2, 3,
4, 5, 6, 7,
8, 9, 10, 11,
12, 13, 14, 15,
16, 17, 18, 19,
20, 21, 22, 23,
24, 25, 26, 27,
28}}};
sigwaitinfo(__set, &__info); //target call
return 0;
}

unistd.h, libc-2.16.so
[+] pause ( )

hanged execution (more than 7 seconds)

#include <unistd.h>

int main(int argc, char *argv[])

{

pause(); //target call

return 0;

}

pthread.h, libpthread-2.16.so
[+] pthread_barrier_wait ( pthread_barrier_t* __barrier )

hanged execution (more than 7 seconds)

1
2
3
4
5
6
7
8
9
10
11
12

#include <pthread.h>

int main(int argc, char *argv[])

{

pthread_barrierattr_t __attr;

pthread_barrierattr_init(&__attr);

pthread_barrier_t __barrier;

pthread_barrier_init(&__barrier, &__attr, 4);

pthread_barrier_wait(&__barrier); //target call

return 0;

}

to the top

[+] Unexpected Output (12 warnings)

malloc.h, libc-2.16.so
[+] malloc_stats ( )

Arena 0:
system bytes     =          0
in use bytes     =          0
Total (incl. mmap):
system bytes     =          0
in use bytes     =          0
max mmap regions =          0
max mmap bytes   =          0

#include <malloc.h>

int main(int argc, char *argv[])

{

malloc_stats(); //target call

return 0;

}

netdb.h, libc-2.16.so
[+] rcmd ( char** __ahost, unsigned short __rport, char const* __locuser, char const* __remuser, char const* __cmd, int* __fd2p )

rcmd: getaddrinfo: Bad value for ai_flags

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15

#include <stdlib.h>

#include <netdb.h>

int main(int argc, char *argv[])

{

char* __ahost = 0;

int* __fd2p = (int*) malloc(sizeof(int)*256);

rcmd(

(char**)&__ahost,

"__locuser",

"__remuser",

"__cmd",

__fd2p); //target call

return 0;

}

[+] rcmd_af ( char** __ahost, unsigned short __rport, char const* __locuser, char const* __remuser, char const* __cmd, int* __fd2p, sa_family_t __af )

rcmd: getaddrinfo: Bad value for ai_flags

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16

#include <stdlib.h>

#include <netdb.h>

int main(int argc, char *argv[])

{

char* __ahost = 0;

int* __fd2p = (int*) malloc(sizeof(int)*256);

rcmd_af(

(char**)&__ahost,

"__locuser",

"__remuser",

"__cmd",

__fd2p,

2); //target call

return 0;

}

signal.h, libc-2.16.so
[+] psiginfo ( siginfo_t const* __pinfo, char const* __s )

__s: Hangup (2 0 1)

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19

#include <signal.h>

int main(int argc, char *argv[])

{

siginfo_t __pinfo = {

.si_signo = 1,

.si_errno = 1,

.si_code = 2,

._sifields = {._pad = {

0, 1, 2, 3,

4, 5, 6, 7,

8, 9, 10, 11,

12, 13, 14, 15,

16, 17, 18, 19,

20, 21, 22, 23,

24, 25, 26, 27,

28}}};

psiginfo(&__pinfo, "__s"); //target call

return 0;

}

[+] psignal ( int __sig, char const* __s )

__s: Hangup

#include <signal.h>

int main(int argc, char *argv[])

{

psignal(1, "__s"); //target call

return 0;

}

stdio.h, libc-2.16.so
[+] putchar ( int __c )

#include <wchar.h>

#include <stdio.h>

int main(int argc, char *argv[])

{

putchar(1); //target call

return 0;

}

[+] putchar_unlocked ( int __c )

#include <wchar.h>

#include <stdio.h>

int main(int argc, char *argv[])

{

putchar_unlocked(1); //target call

return 0;

}

[+] puts ( char const* __s )

__s

#include <wchar.h>

#include <stdio.h>

int main(int argc, char *argv[])

{

puts("__s"); //target call

return 0;

}

unistd.h, libc-2.16.so
[+] getpass ( char const* __prompt )

__prompt

#include <unistd.h>

int main(int argc, char *argv[])

{

getpass("__prompt"); //target call

return 0;

}

wchar.h, libc-2.16.so
[+] putwchar ( wchar_t __wc )

#include <wchar.h>

int main(int argc, char *argv[])

{

putwchar(L'A'); //target call

return 0;

}

[+] putwchar_unlocked ( wchar_t __wc )

#include <wchar.h>

int main(int argc, char *argv[])

{

putwchar_unlocked(L'A'); //target call

return 0;

}

resolv.h, libresolv-2.16.so
[+] __p_query ( u_char const* p1 )

;; ns_initparse: Message too long

#include <resolv.h>

int main(int argc, char *argv[])

{

__p_query((u_char const*) "str"); //target call

return 0;

}

to the top