title: gdb libc function offsets don't match objdump
body: <p>I am writing some ROP shellcode on 64 bit linux. I have found my gadgets using both 'objdump -d /lib64/libc.so.6' and 'ROPgadget /lib64/libc.so.6'</p>
  
  <p>This simply means that I have chosen offsets from the base of libc that contain assembly instructions that I wish to execute.</p>
  
  <p>Using the values from objdump as an offset from the base address of libc as found in /proc/$pid/maps [1], I crafted my payload. However, some of the gadgets found with both objdump and ROPgadget do not appear when single stepping my code using gdb.</p>
  
  <p>Why does it appear that some libc code is simply missing? Am I using the wrong base address?</p>
  
  <p>[1]</p>
  
  <pre><code>7ffff7818000-7ffff79b5000 r-xp 00000000 08:03 5317651                    /lib64/libc-2.19.so
  7ffff79b5000-7ffff7bb4000 ---p 0019d000 08:03 5317651                    /lib64/libc-2.19.so
  7ffff7bb4000-7ffff7bb8000 r--p 0019c000 08:03 5317651                    /lib64/libc-2.19.so
  7ffff7bb8000-7ffff7bba000 rw-p 001a0000 08:03 5317651                    /lib64/libc-2.19.so
  </code></pre>
  
  <p>p.s.</p>
  
  <pre><code>lrwxrwxrwx 1 root root 12 Dec 11 15:42 /lib64/libc.so.6 -&gt; libc-2.19.so
  </code></pre>
  
  <p>and ASLR is disabled</p>
  
  <p>The missing gadgets:</p>
  
  <pre><code>$ objdump -M intel -D /lib64/libc-2.19.so | grep -B1 ret | grep rsp | grep pop
  63fd:   5c                      pop    rsp
  6a98:   5c                      pop    rsp
  </code></pre>
  
  <p>and just to prove that i can do maths:
  0x7ffff7818000+6a98 = 0x7ffff781ea98</p>
  
  <pre><code>(gdb) disas 0x7ffff781ea98
  No function contains specified address.
  </code></pre>