Leaking an Address to Defeat ASLR

• ASLR randomizes the base address of libc, but the internal layout of libc is fixed for a given build.
• If you know the runtime address of any one libc symbol, you know the base, and therefore the address of every libc symbol: libc_base = leaked_addr - offset_of_symbol
• How to get a leak: abuse an output function you can influence:
• puts(got_entry) — prints bytes until a NUL.
• write(1, got_entry, 8) — prints raw bytes.
• A format-string bug: printf with %p / %s.
• Classic trick: use a ROP chain to call puts(GOT[puts]), leaking the real address of puts itself.