@maycon said:
I bypassed the canary and got the base address of the s****, the binary, and I am able to leak a lot of address of lc (w****, r*, c****, n***** etc), but I’m unable to find the exactly version of the lc. I’m thinking to just call d2, d**2 and s****m to get a shell, but maybe it’s the wrong path. Some hints?
I sent you a PM.