CTF From Zero To One

2016 / TDOH Conf

Transcript

1. 5%0)$POG
   *OOEZJOOEZUX!HNBJMDPN
   $5''SPN;FSP5P0OF
   

   View Slide

2. XIPBNJ
   ˙ *OOEZBLB加啄
   ˙ 〵猰须䊨㣐♲
   ˙ 噠긅4FDVSJUZ3FTFBSDIFS
   ˙ 噠긅䊨玑䌌BU4IBSFMJLF
   ˙ 噠긅㷸欰
   ˙ $5'꥙⟿GPSY꥙Ꟁ
   ˙ ꆄ湽ⱟ鮪
   

   View Slide

3. 85'JT$5'
   

   View Slide

4. ˊ笞㛇涰猰
   չ䵻唿麉䨡歋Ⰽ꥙➃꼛✽湱⵹䖃㼩倰涸㛇㖒㤾偫

   խխ䪾侰倰涸偫䖰侰倰涸㛇㖒䌟㔐荈䊹꥙⟿涸㛇㖒պ
   

   View Slide

5. 꽺㹐涸䵻唿麉䨡
   

   View Slide

6. 捀➊랃䩧$5'
   ˙ 㖈㢫꬗✥䩧㣖⽭ꦖ➛㣔䭭SPPU僈㣔叆宐ꐹ
   ˙ ㄤⰦ➮➃ⴗ煔❜崩
   ˙ 诔歋$5'㷸须㸞
   

   View Slide

7. ➛㣔䧮銴铞涸佦✲僽

   䖰➊랃鿪♶剚ⵌ䌟㕰䭭♴痧♧そ涸麕玑
   

   View Slide

8. ➛㣔䧮銴铞涸佦✲僽

   䖰➊랃鿪♶剚ⵌ♧⦐➃䩧$5'涸麕玑
   

   View Slide

9. 'SPN;FSP
   ˙ 䟝銴㻨荈䊹涸麉䨡㢫䱦
   ˙ 搭䖕㽠㷸剚✫㻨玑䒭ㄤ鷠ぢ䊨玑
   ˙ 荛㼱⯓澗鍑♧⦐걆㚖ꄷ屘㄂䩞♶剚㣖ꅾ#JOBSZ 8FC $SZQUP
   

   View Slide

10. 'PSN;FSP
    ˙ 騈㖈)BDL4UV涸㣐㣐⦛倾鼹䩧ꄷ屘鑑衽鍑)*5$0/8BSHBNF鷠ぢ겗
    ˙ 穅倴濼麥➊랃僽*%"1SPՂ䊺濼欽抡
    ˙ 㖈鸏⛓⵹鿪僽欽$IFBU&OHJOF/PUFQBE⨞鷠ぢ
    ˙ )*5$0/8BSHBNF鱲㘗䧭)*5$0/$5'Ꟛ㨥隶䧭㕜ꥹ飓✲
    

    View Slide

11. 5P0OF
    ˙ 鸏媯儘꟦Ꟛ㨥㷸鷠ぢ⛓㢫涸匌銯8FC $SZQUP #JOBSZ&YQMPJUBUJPO
    ˙ 魨鼹尝剤➃♧饱䩧$5'〫㥪♧⦐➃梖
    ˙ ♧➃䨞꥙僽汥蕲涸尝剤꥙⿼〫㥪荈䊹㷸ぐ⦐걆㚖涸濼陏
    ˙ ⡎僽ꨈ⟃꧌⚥礶牟溏ꨈ겗剤❉겗湡♶ꨈ⡎僽蔅儘꟦
    

    View Slide

12. 5IFO 5P0OF
    ˙ ⿡䎃⛰剢儘穉✫GPSY䌟䎙⦐ず㷸♧饱梖⡎僽䨞⸂㻜㖈♶㣁9%
    ˙ 䎃䏁涸儘⦬㣐㣐䌟䧮⦛♧饱䩧9$5'耢飓
    ˙ 3$5''JOBMOE
    QMBDF
    ˙ 44$5''JOBMTU
    QMBDF
    ˙ 9$5''JOBMUI
    QMBDF
    ˙ ꆄ湽栁TU
    QMBDF
    

    View Slide

13. ♶ず涸$5'飓ⵖ
    ˙ +FPQBSEZ瘸겗䮋䨞
    ˙ "UUBDL%FGFOTF余꣈畹飓
    ˙ %"31"$($堥㐼➃余꣈
    ˙ ,JOHPGUIF)JMM⡥걆걆㖒
    

    View Slide

14. +FPQBSEZ
    겗湡
    鎙ⴕ匢
    

    View Slide

15. +FPQBSEZ
    ˙ 鍑겗䭭BH䳖ⴕ侸
    ˙ STUCMPPE剤儘⦬剤CPOVT
    ˙ ♶ず겳㘗涸겗湡剤ぐ珏ꨈ䏞
    ˙ ⿮莅Ꟍ壋⡜剤ꨶ舡剤笪騟⽰〳
    

    View Slide

16. +FPQBSEZ8FC
    ˙ 剚♳笪㽠〳⟃Ꟛ㨥䩧㣁矦㋲✫ゅ
    ˙ 须鎝峾ꪫ
    ˙ SPCPUTUYUHJUTWOFSSPSNFTTBHFTIBSFEIPTU
    ˙ 岤Ⰵ余乹
    ˙ 42-*OKFDUJPO
    ˙ PS
    ˙ 6/*0/4&-&$5
    ˙ #MJOE*OKFDUJPO
    

    View Slide

17. +FPQBSEZ8FC
    ˙ 岤Ⰵ余乹糵
    ˙ $PNNBOE*OKFDUJPO
    ˙ ⡹騈-JOVYDPNNBOE剤㢵擿
    ˙ 鸒䌢剚銴粕麕厥❉랱そ㋲瑠涯䒸贫ⴕ贫
    ˙ DBUBH
    ˙ BDBUBH
    ˙ \HSFQ S ^
    ˙ TIQSPDTFMGFOW)551IFBEFS BQBDIF
    
    

    View Slide

18. +FPQBSEZ8FC
    ˙ 岤Ⰵ余乹糵
    ˙ $SPTT4JUF4DSJQUJOH 944
    
    ˙ 剓鵜♶㼱8FC鿪銴⯓944ⱄ䖃䖕䩧
    ˙ 9.-&OUJUZ*OKFDUJPO 99&
    
    ˙ ⟃+FPQBSEZ⢵铞♶㢵鋅㔔捀〳⟃%P4 #JMMJPOMBVHIT
    
    ˙ 梖忶鷴涸铞Ⰵ涸儘⦬䖎㻜欽
    

    View Slide

19. +FPQBSEZ8FC
    ˙ 3BDF$POEJUJPO
    ˙ 须俲䏨䧴Ⱖ➮乽⡲尝剤欽5SBOTBDUJPO-PDL鸤䧭涸朜䢀♶♧荞
    欴欰꟦ꥵ〳⟃ⵄ欽
    ˙ &Y鱲颹齅鱀
    ˙ 隡《긅겙4&-&$5䩾妵JO1)1佖隶긅겙61%"5&
    ˙ 㥶卓⠿剪㐼MPBEJOH鯱ꅾ4&-&$5莅61%"5&乽⡲剚剤儘꟦䊴〳⟃
    ꅾ醳鱲ⴀ
    ˙ 㖈155涮欰麕䖎㢵鵜劍涸%JSUZ$08怪峯⛳僽3BDF$POEJUJPO
    

    View Slide

20. 3BDF$POEJUJPOPO155
    

    View Slide

21. +FPQBSEZ8FC
    ˙ 铃鎊暶䚍#VH1)1
    ˙ 㖒邍剓㢵➃欽涸铃鎊8FC剓䢔涸DPEFCBTF
    ˙ VOTFSJBMJ[FNFNPSZDPSSVQUJPO VTFBGUFSGSFF
    ˙ QBSTF@VSMQBSTFS齅鱀ꐫ铐
    ˙ TUSDNQ @(&5<TFDSFU> QE.I3772D.XK:3Z,6T4
    
    ˙ BQIQ TFDSFU<>TFDSFU<>
    ˙ NE
    NE 2/,$%;0
    
    

    View Slide

22. +FPQBSEZ8FC
    ˙ 铃鎊暶䚍#VH3VCZ
    ˙ 3VCZ欽$㻨JOUFQSFUFS罜⚂䎙⛖尝剤MJCSBSZEFQFOEFODZ[MJC
    PQFOTTM MJCVOXJOE
    ˙ 鸏➿邍䖎㢵匌銯鿪荈䎍♶⣜飅㢫鿈玑䒭䏨⟃玑䒭㸞涸錬䏞⢵溏
    ˙ 嵥럊侸贖椚儘剤0WFSPX
    ˙ #JH%FDJNBM &
    UP@T '
    
    UP@G
    ˙ :".-QBSTFS㼬荞3$&$7&
    ˙ 湱㼩⢵铞3VCZ爢纈岤ꅾ㸞䖤㢵
    

    View Slide

23. +FPQBSEZ8FC
    ˙ $SZQUP'BJM
    ˙ ⡹剚꨾銴增叆须俲剤尝剤鄄佖麕⡹剚
    ˙ 欽NE
    ˙ NE TFDSFUEBUB
    
    ˙ -FOHUI&YUFOTJPO"UUBDL
    ˙ ⡹剚꨾銴⸈㺙须俲⛳鏪僽4FTTJPO
    ˙ "&4$#$
    ˙ 1BEEJOH0SBDMF"UUBDL
    

    View Slide

24. +FPQBSEZ8FC
    ˙ 8FC䩧饱⢵⫹僽㖈枤閱
    ˙ 锞ꡠ岤须㸞倞耂剓鵜涸ⰗꟚ怪峯
    ˙ TUSVDUT
    ˙ 8FCⴀ겗剚剤崩遤馸⹴
    ˙ ⵹ꤏ㶩剤4FSWFS4JEF5FNQMBUF*OKFDUJPO 1BEEJOH0SBDMF 幋ざ944
    ˙ ꡠ岤ⴀ겗㕰꥙涸8FC㼠㹻剓鵜㖈灇瑖➊랃
    ˙ ⴀ겗䌢䌢⚥
    

    View Slide

25. +FPQBSEZ#JOBSZ3FWFSTF
    ˙ 窍⡹♧⦐#JOBSZ䟝鳵岁䵆䥢➮㖈⨞➊랃
    ˙ Ⱙ㘗涸3FWFSTJOH겗湡剚僽OBUJWFDPEF鸒䌢欽$铃鎊㻨
    ˙ ꨾銴隡穉ざ铃鎊涸腋⸂
    ˙ 겗湡㣐嚌剤䎙珏Ꟁ湱
    ˙ 鱒ⰅBH겗湡剚デ鏰⡹僽♶僽㼩涸
    ˙ 鱒Ⰵ㺙焺鍑㺙BH䖕⽫ⴀ⢵
    ˙ 窍⡹⸈㺙涸BHㄤ⸈㺙玑䒭剤儘⦬剚剤♧穉䊺濼僈俒涸㺙俒
    ˙ 鏽ⱁ堥䍲䭸㹁涸6TFS皿ⴀ➮涸䎸贫
    

    View Slide

26. +FPQBSEZ#JOBSZ3FWFSTF
    ˙ Ⱙ㘗涸겗湡⫹僽鸏垺
    

    View Slide

27. +FPQBSEZ#JOBSZ3FWFSTF
    ˙ 鹎ꥣ♧럊涸겗湡
    ˙ ⸈媽幋差麕涸玑䒭ⴕ區⵹銴⯓膨媽%FPCGVTDBUF
    ˙ 䩛䊨穉ざ涸㛂遤墂䩛㻨BTTFNCMZ♶僽넞ꥣ铃鎊管陼ⴀ⢵涸
    ˙ $㛂遤墂⸈管陼剓⢕⻋
    ˙ TUSJOH涸贖椚㽠㣁ꨈ溏✫PQUJNJ[FꟚ♴⿡刿䟝娦
    ˙ 㣼䚓涸铃鎊管陼ⴀ⢵涸CJOBSZ㥶HPMBOH TXJGU IBTLFMM
    ˙ 7JSUVBM.BDIJOF⫹僽(#"&NVMBUPS齡겳涸匌銯
    ˙ TUBUJDDPNQJMFEBOETUSJQFECJOBSZ85'
    

    View Slide

28. +FPQBSEZ#JOBSZ3FWFSTF
    ˙ ⨋Ꟍ♧럊涸겗湡
    ˙ 厥❉管陼䧭CJOBSZDPEF⡎♶僽OBUJWFDPEF涸CJOBSZ鸒䌢尝剤
    EFDPNQJMFS〳⟃欽㽠皿剤⛳剚䟝鳵岁䵆㡏EFDPNQJMFS
    ˙ 7#1$PEF 4&$$0/SFUSPTQFDUJWF
    
    ˙ 4RVJSSFMMBOH #$5'TJG
    
    ˙ ⯕僽䪪ⴀ➮僽➊랃铃鎊㽠蔅✫䧮㥪⛉涸儘꟦22
    ˙ 1ZUIPOCZUFDPEF QZD
    +BWBDMBTT PCGVTDBUFE/&5
    ˙ 䩛㻨♧❉㣼䚓涸CZUFDPEFQBUUFSO剚䵆㡏EFDPNQJMFS
    

    View Slide

29. +FPQBSEZ#JOBSZ3FWFSTF
    ˙ ⨋Ꟍ♧럊涸겗湡糵
    ˙ ⲈꟌ䎂〵涸OBUJWFCJOBSZ
    ˙ "3. .*14鿪皿㼭✲✫欽2&.6㽠〳⟃駵
    ˙ 尝剤EFDPNQJMFS〳⟃欽22
    ˙ 㻨♧㣐㛜DPEF搭䖕ꟚDPNQJMFSPQUJNJ[F⿶僽$㻨涸
    ˙ 峤峤漗嫲鯱䘰鿪䚓植➿$5'涮㾝㣖〳䙲22
    ˙ ꬌ䌢䏁㾵涸CJOBSZ
    ˙ #*0430. %SJWFS %04CJOBSZ
    

    View Slide

30. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝
    ˙ 㷸绢䊨Ⱘ僽䖎ꅾ銴涸䩞腋麕殹♧⦐珖耷涸䊨Ⱘ➃
    ˙ 㥪涸䊨Ⱘ䌟⡹♳㣔㛔㡏涸䊨Ⱘ雊⡹䄶惓22
    ˙ ⹛䢀ⴕ區䊨Ⱘ%FCVHHFS
    ˙ 0MMZ%CH YECH HEC FWBOTEFCVHHFS (6*EFCVHHFSGPS-JOVY
    
    ˙ 剤❉겗湡鏤㹁㥪CSFBLQPJOU㺙焺꼛♳㽠ⴀ植㖈⡹꬗⵹✫
    ˙ 剤❉겗湡〳⟃CZUFCZCZUF涸凐⸂灶鍑
    ˙ 㷸绢䙦랃㻨EFCVHHFSTDSJQU
    ˙ TUSBDF MUSBDF錚㻌玑䒭涸TZTUFNDBMM MJCSBSZDBMM遤捀
    

    View Slide

31. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝
    ˙ ꬆ䢀ⴕ區䊨Ⱘ
    ˙ PCKEVNQ〳⟃溏穉ざ铃鎊
    ˙ *%"1SPXJUI)FYSBZEFDPNQJMFS
    ˙ 馄馄馄馄馄秹顜顜顜顜娦➃⺫わEFDPNQJMFS涸䱇奚銴䱺鵜⼧蠝荩䍤
    ˙ 馄秹䓽㣐䎙⛖僽垦彋ꂂ⪔
    ˙ SBEBSF
    ˙ 䖎䓽㣐涸䊨Ⱘ*%"1SP⛓倴SBEBSF㽠⫹僽7JTVBM4UVEJP⛓倴WJN
    ˙ 㷸绢刼箁䖎〳䙲剤❉㣼䚓涸CVH22
    

    View Slide

32. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝
    ˙ ꬆ䢀ⴕ區䊨Ⱘ
    ˙ CJOBSZOJOKB
    ˙ )PQ%JTBTTFNCMFS
    ˙ 暶Ꟁ僽0CKFDUJWF$
    ˙ 3FUBSHFUBCMFEFDPNQJMFS
    ˙ 箁♳⿾管陼剪⹡♶麕⯝顥涸剤ꣳⵖ
    

    View Slide

33. *%"1SP
    

    View Slide

34. SBEBSF
    

    View Slide

35. +FPQBSEZ#JOBSZ3FWFSTF䊨Ⱘ眝
    ˙ ⹛䢀ⴕ區䊨Ⱘ鹎ꥣ
    ˙ #JOBSZJOTUSVNFOUBUJPO*OUFMQJOUPPMT
    ˙ 㻨玑䒭⹛䢀涸錚㻌)PPL〥♧⦐玑䒭
    ˙ 〳⟃欽⢵⨞TJEFDIBOOFMBUUBDL UJNJOHBUUBDL
    
    ˙ 箁䚍嫲㼩㶶⚮涸儘⦬鎙皿䭸⟂侸ꆀ㽠〳⟃濼麥枤㼩✫䎙⦐㶶
    ˙ 4.5TPMWFS;CZ.JDSPTPGU
    ˙ 9 99
    9
    ˙ 牟㣼涸荈⹛凐⸂灶鍑
    

    View Slide

36. +FPQBSEZ#JOBSZ3FWFSTF䊱遯眝
    ˙ 4ZNCPMJD&YFDVUJPO
    ˙ BOHS
    ˙ 㼩CJOBSZ⨞TZNCPMJDFYFDVUJPO荈⹛䌟Ⰵ4.5TPMWFSBOHS欽
    ;䪪ⴀ䨾剤哭⟝騥鱲涸哭⟝僽➊랃
    ˙ 䖰齡酭Ꟛ㨥饥ⵌ齡酭鼚Ꟛ齡酭
    ˙ 㥪⡹デ鏰䧮銴怏駈涸哭⟝僽➊랃
    ˙ 䢩く鎹䥊넓罜⚂剤❉朜屣♶鋅䖤腋鍑
    

    View Slide

37. +FPQBSEZ#JOBSZ3FWFSTF䊱遯眝
    ˙ 4ZNCPMJD&YFDVUJPO
    ˙ LMFF
    ˙ 㛇倴MMWN卺圓♴⾲㨥焺㾵秹涸TZNCPMJDFYFDVUJPO
    ˙ $$PUIFSMBOHVBHF̔DPNQJMFEUPMMWN*3̔LMFF
    ˙ 㻨♧⦐$玑䒭〭LMFFデ鏰⡹銴怏駈➊랃哭⟝䩞腋鍸涮BTTFSU
    ˙ 〳⟃䭭IFYSBZEFDPNQJMFSⴀ⢵涸DPEF鹎⿡駵9%
    ˙ -B[Z,-&&CZ-BZTIUUQTHJUIVCDPN-ZT-B[Z,-&&
    

    View Slide

38. 1XOBCMF
    ˙ ⡹㻨麕$铃鎊㌨
    

    View Slide

39. 1XOBCMF
    ˙ ⡹㻨麕$铃鎊㌨
    

    View Slide

40. 1XOBCMF (low address)
    AAAAAAAA <--- esp
    00000000
    00000000 <--- buffer
    00000000
    00000000
    00000000
    00000000
    0083af3c <--- stack canary
    ffeeddcc <--- ebp, saved ebp
    00401234 <--- return address
    abcdabcd
    (high address)
    int main() {
    ...
    printf("your name:");
    scanf("%s", name);
    ...
    return 0;
    }
    

    View Slide

41. 1XOBCMF (low address)
    AAAAAAAA <--- esp
    00000000
    41414141 <--- buffer
    41414141
    41414141
    41414141
    41414141
    41414141 <--- stack canary
    41414141 <--- ebp, saved ebp
    41414141 <--- return address
    41414141
    (high address)
    int main() {
    ...
    printf("your name:");
    scanf("%s", name);
    ...
    return 0;
    }
    

    View Slide

42. 1XOBCMF (low address)
    AAAAAAAA <--- esp
    00000000
    41414141 <--- buffer
    41414141
    41414141
    41414141
    41414141
    41414141 <--- stack canary
    41414141 <--- ebp, saved ebp
    41414141 <--- return address
    41414141
    (high address)
    int main() {
    ...
    printf("your name:");
    scanf("%s", name);
    ...
    return 0;
    }
    *** stack smashing detected ***
    

    View Slide

43. 1XOBCMF
    ˙ TUBDLDBOBSZ僽植➿管陼㐼涸⥃隌堥ⵖ꣈姺TUBDLPWFSPX怪峯鄄ⵄ欽
    ˙ 鹎ⰅGVODUJPO儘㻨Ⰵ04ꦑ堥欴欰涸TUBDLDBOBSZ
    ˙ ꨆꟚGVODUJPO僽增叆TUBDLDBOBSZ僽や鄄睕佖
    ˙ 鸮糵㻨Ⰵ銼覈FCQ SFUSVOBEESFTT⛓⵹♧㹁剚⯓覈ⵌTUBDLDBOBSZ
    ˙ #PPPPPPPPPPPN
    ˙ 䧮⦛⢵溏♧⦐尝剤⥃隌涸⢿㶩
    

    View Slide

44. 1XOBCMF
    ˙ OBNF㖈㛜毕♳
    ˙ EBUB㖈ꬆ䢀涸⡙㖧
    ˙ TDBOG T OBNF
    
    ˙ 鸤䧭CVFSPWFSPX
    ˙ 濼麥TUBDL僽䙦랃麌⡲涸䖎ꅾ銴
    

    View Slide

45. 1XOBCMF
    ˙ TDBOG T OBNF
    
    ˙ """""""""""""""""""""""""
    """""""""""""""""""""""""
    """""""""""""""""""""""""
    """""""""""""""""""""""""
    """""""""""""""""""""""""
    """""""""""""""""""""""""
    """""""""""""""""""""""""
    ababcdcd <- esp
    00000000
    41414141 <- &name
    41414141
    41414141
    41414141
    41414141
    41414141 <- ebp
    41414141 <- ret addr
    41414141
    41414141
    

    View Slide

46. 1XOBCMF
    ˙ SFU
    ˙ &*1Y
    ˙ $SBTI
    ˙ &*1〳⟃䱾ⵖ
    ˙ 齡䧮⦛〳♶〳⟃〭CBTIⴀ⢵
    ˙ %FNP
    ababcdcd <- esp
    00000000
    41414141 <- &name
    41414141
    41414141
    41414141
    41414141
    41414141 <- ebp
    41414141 <- ret addr
    41414141
    41414141
    

    View Slide

47. 1XOBCMF鎹䥊넓䨞昰涸余꣈娜〷
    ˙ #VFSPWFSPX SFUVSOUPTUBDL
    ˙ %BUB&YFDVUJPO1SFWFOUJPO雊须俲♶〳㛂遤
    ˙ 3FUVSO0SJFOUFE1SPHSBNNJOH301鰋논锓CZ-BZT
    ˙ 4UBDLDBOBSZ增叆剤尝剤PWFSPX
    ˙ "4-3雊⡹枤♶⚥
    ˙ 4IBEPX4UBDL欽〥㢫♧⦐TUBDL㶸SFUVSOBEESFTT
    ˙ 301JTEFBE
    ˙ 䒂⠽ꠗ隡+VNQ0SJFOUFE1SPHSBNNJOH
    

    View Slide

48. 1XOBCMF$5'䌢欽余乹䩛岁
    ˙ 3FUVSOUP4UBDL
    ˙ 䪾TIFMMDPEF㻨㖈TUBDL♳䟝鳵岁SFUVSOⵌTUBDL♳㛂遤
    ˙ 䪪ⵌKNQFTQ
    ˙ 3FUVSOUPMJCD
    ˙ 欽301㛂遤MJCD酭꬗涸GVODUJPO
    ˙ 3FUVSOUPEMSFTPMWF
    ˙ ⵄ欽%ZOBNJD-JOLJOH雊➮湬䱺䌟䧮⦛⿡TZTUFN
    
    

    View Slide

49. 1XOBCMF$5'䌢欽余乹䩛岁
    ˙ GPSNBUTUSJOH怪峯
    ˙ QSJOUG EEE
    
    ˙ ⡹濼麥O Q㌨
    ˙ QSJOUG T EBUB
    
    ˙ QSJOUG EBUB
    
    00401234 <- esp, ret addr
    2016 <- arg1
    1 <- arg2
    1 <- arg3
    aaaaaaaa <- int a
    bbbbbbbb <- int b
    41414141 <- char data[8]
    41414141
    00ae5d25 <- stack canary
    cccccccc <- saved ebp
    00405566 <- ret addr
    

    View Slide

50. 1XOBCMF$5'䌢欽余乹䩛岁
    ˙ GPSNBUTUSJOH怪峯
    ˙ QSJOUG EEE
    
    ˙ ⡹濼麥O Q㌨
    ˙ QSJOUG T EBUB
    
    ˙ QSJOUG EBUB
    
    ˙ QQQQQQQQQQ
    ˙ %FNP
    00401234 <- esp, ret addr
    2016 <- arg1
    1 <- arg2
    1 <- arg3
    aaaaaaaa <- arg4
    bbbbbbbb <- arg5
    41414141 <- arg6
    41414141 <- arg7
    00ae5d25 <- arg8
    cccccccc <- arg9
    00405566 <- arg10
    

    View Slide

51. 1XOBCMF$5'䌢欽余乹䩛岁
    ˙ #JOBSZ&YQMPJUBUJPO涸劥颶僽隡《䧴㻨Ⰵ✫♶鑪雊⡹焥ⵌ涸㖒倰
    ˙ 銼覈涸㖒倰僽
    ˙ SFUVSOBEESFTT
    ˙ EBUBQPJOUFS
    ˙ GVODUJPOQPJOUFS
    ˙ (05FOUSZ
    ˙ NPSF
    

    View Slide

52. $SZQUP
    ˙ 管焺ꦡ询⸈㺙
    ˙ ⸈㺙♧㹁剤♧䪾ꚤ⻑
    ˙ 管焺
    ˙ ⡹♧㹁聃麕)FY CBTF VSMFODPEF
    ˙ 嫲鯱㼱鋅VVFODPEF CBTF CBTF
    ˙ ꦡ询
    ˙ 騈管焺♧垺⡎僽湡涸♶ず
    ˙ SPU
    ˙ /VF,:@.
    

    View Slide

53. $SZQUP
    ˙ 〢Ⱙ㺙焺㷸
    ˙ %#'5#4%+2*'4'0%4;26+10$BFTBS$JQIFS LFZ"
    
    ˙ 7FHFOFSF$JQIFS⳯且⸈㺙鹎ꥣ晝劥
    ˙ ➿䳖⸈㺙4VCTUJUVUJPO$JQIFS
    ˙ 䪾嫦⦐㶶嫢♧㼩♧涸鱲䳖ⵌ〥♧穉㶶嫢
    ˙ 걽桧ⴕ區余乹ꆚ㼩僈俒涸暶䚍⨞ⴕ區
    

    View Slide

54. $SZQUP
    ˙ 植➿㺙焺㷸
    ˙ #MPDL$JQIFS䪾须俲ⴗ䧭♧㝆♧㝆⨞⸈鍑㺙
    ˙ %&4 "&4 #MPXTI
    ˙ 㥶卓须俲䖎Ꟁ
    ˙ #MPDL$JQIFS0QFSBUJPO.PEF
    ˙ 1,$4$#$.PEF剤1BEEJOH0SBDMF"UUBDL
    ˙ 4UFBN$JQIFS
    ˙ 欽13/(✥侸欴欰㐼呏亙,FZ欴欰鸮糵涸4USFBN,FZ⨞9PS
    ˙ 0'#.PEF䖎⫹僽4USFBN$JQIFS
    

    View Slide

55. $SZQUP
    ˙ %JF)FMMNBO,FZ&YDIBOHF
    ˙ 㥶卓鸮箁鄄甦聃銴䙦랃㸞涸鹎遤⸈㺙鸮箁
    ˙ )BTI꧹廔
    ˙ 窍⡹♧❉须俲欴ⴀ㔿㹁Ꟁ䏞涸侸⧩
    ˙ )BTI$PMMJTJPO
    ˙ -FOHUI&YUFOTJPO"UUBDL
    ˙ 㺙焺欽涸)BTI怵皿岁
    ˙ TDSZQU CDSZQU QCLEG BSHPO
    

    View Slide

56. $SZQUP
    ˙ ꬌ㼩珖㺙焺㷸
    ˙ 铭劥♳♧㹁剤涸34"/QR
    ˙ 34"꨾銴㸞涸QBEEJOH0"&1
    ˙ 堬㕩刼箁㺙焺㷸&$$
    ˙ &M(BNBM3BCJO
    ˙ 㛇倴ꨆ侕侸㷸涸⸈㺙禺窡
    ˙ 34"禺窡㛇倴顥꼛㼭㹁椚ㄤ'JOJUF'JFME"SJUINFUJD
    ˙ 澗鍑34"涸麌⡲♶剚阮僈荛㼱〳⟃胝ⴀ欴欰,FZㄤ⸈鍑㺙涸倰䒭
    

    View Slide

57. $SZQUP䊨Ⱘ
    ˙ STBUPPMQZ
    ˙ YPSUPPM
    ˙ IUUQGBDUPSECDPN
    

    View Slide

58. 'PSFOTJD
    ˙ 侸⡙Ꙥ陏䖰♶剚⹛涸.FNPSZ%VNQ%JTL*NBHF䮕须俲
    ˙ .FNPSZ'PSFOTJD
    ˙ 濼麥LFSOFM酭꬗剤❉➊랃穡圓넓銴㥶⡦㹁⡙䪪ⴀ鸏❉穡圓넓
    ˙ ➊랃僽7JSUVBM.FNPSZ5-#
    ˙ 8JOEPXT&130$&44-JOVYUBTL@TUSVDU NN@TUSVDU
    ˙ 䖰1SPDFTT-JTUꟚ㨥
    ˙ %VNQ〳毠涸QSPDFTT鼩⾲ⴀFYFDVUBCMFMF鹎遤ⴕ區
    ˙ 'JMF$BDIF/FUXPSL$POOFDUJPOT
    

    View Slide

59. 'PSFOTJD
    ˙ %JTL'PSFOTJD
    ˙ 3FHJTUSZ)*7&MF 8JOEPXT
    
    ˙ %VNQ-./5-.IBTI8JOEPXT涬Ⰵ㺙焺IBTI
    ˙ 䫌SPPULJU
    ˙ ⸈㺙ꦡ询煂⼦5SVF$SZQU
    ˙ &'*SPPULJU
    

    View Slide

60. 'PSFOTJD5PPM
    ˙ WPMBUJMJUZ
    ˙ ♧⦐馄䓽涸.FNPSZGPSFOTJDGSBNFXPSL
    ˙ ꤑ✫㉂噠鮿넓⛓㢫剓㥪涸'SFFTPGUXBSF鼇乵
    ˙ 〳⟃⸈䱦QMVHJO⢵仍⯏⸆腋
    ˙ QTMJTU EVNQQSPDFTTNFNPSZ EVNQNPEVMFMF EVNQESJWFSMF
    EVNQDBDIFEMF EVNQSFHJTUSZ EVNQQBTTXPSEIBTI NJNJLBU[
    
    EVNQ"&4LFZ
    

    View Slide

61. .JTD4UFHP
    ˙ 窍⡹♧❉㣼䚓涸䮋䨞ꦡ询须鎝㖈须俲⚥
    ˙ 㕬晚-4#
    ˙ 㖈㕬晚䖕꬗꣡⸈♧⦐㠺簮墂
    ˙ CBTFQBEEJOHCJU〳⟃询须俲
    ˙ 㡏䱈涸CJOBSZEBUB
    ˙ ䷒倛ꨶ焺
    ˙ 䊨Ⱘ
    ˙ PQFOTUFHP TUFHPTPMWFS &EJUPS CJOBSZUFNQMBUF
    
    

    View Slide

62. .JTD4UFHP5PPM
    ˙ &EJUPS
    ˙ #JOBSZUFNQMBUF馄㥪欽
    ˙ PQFOTUFHP
    ˙ TUFHPTPMWFS
    ˙ 㕬晚겗〳⟃欽鸏⦐溏-4#
    ˙ TOPX IUUQXXXEBSLTJEFDPNBVTOPX
    
    

    View Slide

63. "UUBDL%FGFOTF
    ˙ 鎙ⴕ匢♳剚剤
    ˙ ぐ⦐剪⹡涸朜䢀
    ˙ "MJWF 1XOFE %PXO
    ˙ 鑪㔐ざ涸ⴕ侸隶⹛ꆀ
    ˙ 籏ⴕ侸
    

    View Slide

64. "UUBDL%FGFOTF
    ˙ 嫦⦐꥙⟿剤荈䊹涸(BNFCPY
    ˙ 剤♧垺涸겗湡♧垺涸怪峯
    ˙ 余乹Ⱖ➮꥙⟿꣈狡荈䊹
    ˙ ⟃1XO捀⚺❏崎⩑晋剤8FC
    ˙ ⚺鳵倰剤4FSWJDF$IFDL
    

    View Slide

65. "UUBDL%FGFOTF
    ˙ 瘼殜䖎ꅾ銴
    ˙ 崩ꆀⴕ區倴ꅾ佞余乹
    ˙ 佞䖕Ꟍ
    ˙ 㥶⡦CJOBSZQBUDI
    ˙ *%"1SP
    ˙ IUFEJUPS
    ˙ DIFBUFOHJOF
    ˙ -%@13&-0"%
    

    View Slide

66. %"31"$($
    ˙ 堥㐼➃䩧"UUBDL%FGFOTF
    ˙ 갸濼鑬䞕锞溏♳⼯涸㜥妄9%
    

    View Slide

67. 2"
    

    View Slide