ahv's comments

Well, here are two plots from the data earlier today showing some patterns: http://i.imgur.com/q2Qc0.png

Left one for the data ending with "f200000000", right one with "50000000". For these I just assumed the numbers were 64-bit little endian integers.

Or if you know the distro, it is trivial to get the package containing the su executable and locate the address.

Also works on Arch with minor modifications.

Had to change 'exit@plt' to '<exit@plt' where it searches for the relevant function and change the program run from /bin/su to /bin/mount.