title: Get the environment variable address
body: <p>I have ASLR disabled. Well, I want obtain the address of the environment variable "SHELL", so I use the C function getenv().</p>
  
  <pre><code>#include &lt;stdio.h&gt;
  #include &lt;stdlib.h&gt;
  
  int main(int argc, char *argv[])
  {
      char* ptr = getenv("SHELL");
      printf("%p\n", ptr);
  }
  </code></pre>
  
  <p>The address obtained with getenv()</p>
  
  <pre><code>$ ./getenv
  0xbffff752
  </code></pre>
  
  <p>The address obtained with gdb:</p>
  
  <pre><code>gdb&gt; x/4000s $esp
  ...
  (gdb) x/s 0xbffff710
  0xbffff710:     "SHELL=/bin/bash"
  (gdb) x/s 0xbffff716
  0xbffff716:     "/bin/bash"
  </code></pre>
  
  <p>Why are the addresses different? As noted, I must say the correct address in the obtained with GDB.</p>