title: Curious thing when finding environment variable address in gdb
body: <p>Recently I'm doing some Return-to-libc attack experiment base on the paper <a href="http://www.google.com.hk/url?sa=t&amp;rct=j&amp;q=Bypassing+non-executable-stack+during+exploitation+using+return-to-libc+&amp;source=web&amp;cd=1&amp;ved=0CFQQFjAA&amp;url=http%3A%2F%2Fwww.infosecwriters.com%2Ftext_resources%2Fpdf%2Freturn-to-libc.pdf&amp;ei=0XAHUJKpIPGjiAepsLmFBA&amp;usg=AFQjCNHaszd69G_M9szFbIAwR5VWrTT0OQ" rel="nofollow noreferrer"><em>Bypassing non-executable-stack during exploitation using return-to-libc</em></a> with my Ubuntu11.10.<br></p>
  
  <p>Before my experiment I closed the ALSR.<br></p>
  
  <p>According to the paper, I can find address of the environment variable SHELL="/bin/bash" in gdb(use gdb to debug the program I want to attack): <br></p>
  
  <p><img src="https://i.stack.imgur.com/hJWzr.png" alt="enter image description here"><br>
  <img src="https://i.stack.imgur.com/mEhnS.png" alt="enter image description here"><br></p>
  
  <p>But I found that this address is <strong>wrong</strong> when I try to use it to Return-to-libc experiment.<br><br>
  And then I write a simple program to get the environment variable address:<br><br>
  <img src="https://i.stack.imgur.com/yAB6Z.png" alt="enter image description here"></p>
  
  <p>When I run this program in the Terminal, I get the <strong>right</strong> address:<br><br>
  <img src="https://i.stack.imgur.com/EXcQD.png" alt="enter image description here">
  <br><br>
  <strong>With this address I can do the attack.</strong><br><br>
  I also find the related <a href="https://stackoverflow.com/questions/1102712/why-is-there-a-difference-in-memory-address-of-environment-variable-when-running">question</a> about this. But the answers doesn't really make sense(the second one may be better).<br></p>
  
  <p>Just tell me some details about this, please.</p>