Upgrade to Pro — share decks privately, control downloads, hide ads and more …

逆向工程:從入門到放棄

Inndy
October 14, 2017

 逆向工程:從入門到放棄

2017/10/14 at TDOHConf 2017

Inndy

October 14, 2017
Tweet

More Decks by Inndy

Other Decks in Technology

Transcript

  1. 5%0)$POG
    *OOEZJOOEZUX!HNBJMDPN
    鷠ぢ䊨玑䖰ⰅꟌⵌ佞唳

    View full-size slide

  2. 㖈Ꟛ㨥⛓⵹
    ˙ 䧮⧺鏤⡹䊺竤剚
    ˙ ✳鹎⡙⼧鹎⡙⼧Ⱉ鹎⡙⛓꟦✽湱鱲䳖
    ˙ 㻨玑䒭濼麥JG MPPQ GVODUJPO WBSJBCMF BSSBZ
    ˙ ♧럊$铃鎊
    ˙ 㥶卓⟃♳剤♧⼱♶濼麥〳⟃佞唳⿡〥㢫♧⦐陾玑

    View full-size slide

  3. 鷠ぢ䊨玑腋く㌨
    ˙ ⡹尝剤玑䒭涸⾲㨥焺
    ˙ ⡹䟝銴濼麥鸏⦐玑䒭僽䙦랃㻜⡲涸
    ˙ ⡹䟝銴㻨麉䨡㢫䱦
    ˙ ⡹䟝銴灶鍑鮿넓뀿阮
    ˙ ⡹䟝銴㻨鮿넓鏽ⱁ堥
    ˙ ⡹䟝銴䪪怪峯
    ˙ ⡹꨾銴鷠ぢ䊨玑

    View full-size slide

  4. ♶ず涸管陼㛂遤倰䒭
    ˙ 管䧭⾲欰堥㐼焺/BUJWF
    ˙ $ $ 0CK$ 4XJGU HPMBOH
    ˙ 管䧭⚥꟦焺*OUFSNFEJBUF-BOHVBHFCZUFDPEF
    ˙ /&5 $ 7#
    +BWB 1ZUIPO QZD

    ˙ 湬陼*OUFSQSFUJOH
    ˙ 1ZUIPO 3VCZ +BWB4DSJQU 7#4DSJQU -*41

    View full-size slide

  5. 㛂遤墂
    管陼㐼
    ⾲㨥焺
    ⾲㨥焺管陼㐼莅〳㛂遤墂

    View full-size slide

  6. 㛂遤墂
    鷠ぢ
    ⾲㨥焺
    ⾲㨥焺管陼㐼莅〳㛂遤墂
    ♶剚㸤♧垺⡎駈⟃管陼ⴀ♧垺⸆腋涸玑䒭䧴僽澗鍑玑䒭遤捀

    View full-size slide

  7. 䧮⦛鎣锸涸眕㕠
    ˙ ⚺銴僽"05$PNQJMFS管陼ⴀ⢵涸/BUJWF$PEF
    ˙ YBOE*"Ⰽ珏卺圓
    ˙ Ⱖ➮涸ヤ
    ˙ 䊨Ⱘ鿪窍⡹✫荈䊹㷸ゅ9%
    ˙ +BWB+%(6* KBEY DGS
    ˙ "OESPJE +BWB
    KBEY EFYKBS+%(6*
    ˙ /&5*-4QZ /&53FFDUPS EPU1FFL +VTU%FDPNQJMF
    ˙ 1ZUIPO QZD
    VODPNQZMF

    View full-size slide

  8. 鎹䥊넓垸㘗
    ˙ 㣐㹻㼩⟃♴そ鑂剤㢵澗鍑
    ˙ CJUCZUF
    ˙ 隶侸
    ˙ 鎹䥊넓䭸垦QPJOUFS
    ˙ ꤏ⴪
    ˙ 穡圓넓TUSVDUVSF
    ˙ 6OJPO

    View full-size slide

  9. 鎹䥊넓垸㘗
    ˙ 嫦⦐呔㶩㣐㼭僽CZUF CJUT

    ˙ 嫦⦐呔㶩剤荈䊹涸管贫⣜䎸黃㟞
    ˙ 〭⨞鎹䥊넓㖒㖧 NFNPSZBEESFTT

    ˙ ♧⦐隶侸〳腋剚欽㥪䎙⦐CZUFT
    ˙ 隶侸涸BEESFTT僽痧♧⦐CZUF涸BEESFTT

    View full-size slide

  10. 侮侸⮭㶸倰䒭
    ˙ Ⰽ珏倰䒭CJHFOEJBO MJUUMFFOEJBO
    ˙ Yㄤ㣐鿈ⴕ涸"3.⢪欽MJUUMFFOEJBO
    ˙ JOUBY̔
    ˙ MPOHMPOHCYBCDEFG
    ˙ ̔&'$%"#
    ˙ CJHFOEJBO
    ˙ JOUBY̔

    View full-size slide

  11. 侮侸⮭㶸倰䒭
    ˙ 昸➊랃銴欽MJUUMFFOEJBO
    ˙ ̔鱲㘗倰⤑
    ˙ JOUBY
    ˙ TIPSUC TIPSU
    BY̔
    ˙ DIBSD DIBS
    BY̔
    ˙ "EESFTT㸤♶隶⾲㖒隶魨

    View full-size slide

  12. 隶侸㶸佞倰䒭
    int a = 0xabcd1234;
    assert(&a == (int*)0x0034);
    assert(sizeof(int) == 4);

    View full-size slide

  13. 隶侸㶸佞倰䒭
    34 12 CD AB








    View full-size slide

  14. 隶侸㶸佞倰䒭
    int arr[3] = {
    0xabababab,
    0xcccccccc,
    0xffffffff
    };
    assert(arr == (int*)0x0034);
    assert(sizeof(int) == 4);

    View full-size slide

  15. 隶侸㶸佞倰䒭
    AB AB AB AB CC CC CC CC FF FF FF FF








    View full-size slide

  16. 玑䒭⼦媯
    $ISPNFFYF
    1&)FBEFS
    4FDUJPO5BCMF
    $PEF4FDUJPO
    %BUB4FDUJPO
    *NQPSU&YQPSU5BCMF
    4FDUJPOT

    View full-size slide

  17. 鎹䥊넓⼦媯莅⡑㽷
    $SBDLNFFYF
    $PEF4FDUJPO
    3FBEPOMZ
    )FBEFS
    8SJUBCMF
    1SPDFTT%BUB
    1&.PEVMF

    ''''''''
    4UBDL
    )FBQ
    LFSOFMEMM
    1&.PEVMF

    View full-size slide

  18. ⴲ䱳穉ざ铃鎊
    00000000: 56 53 83 ec 04 8b 5c 24 10 83 fb 02 7e 24 31 f6 VS....\$....~$1.
    00000010: 8d 43 ff 83 ec 0c 83 eb 02 50 e8 e1 ff ff ff 83 .C.......P......
    00000020: c4 10 01 c6 83 fb 02 7f e7 8d 46 01 83 c4 04 5b ..........F....[
    00000030: 5e c3
    鸏❉须俲僽➊랃

    View full-size slide

  19. 00000000 56
    00000001 53
    00000002 83EC04
    00000005 8B5C2410
    00000009 83FB02
    0000000C 7E24
    0000000E 31F6
    00000010 8D43FF
    00000013 83EC0C
    00000016 83EB02
    00000019 50
    0000001A E8E1FFFFFF
    0000001F 83C410
    00000022 01C6
    00000024 83FB02
    00000027 7FE7
    00000029 8D4601
    0000002C 83C404
    0000002F 5B
    00000030 5E
    00000031 C3
    ⴲ䱳穉ざ铃鎊
    ⿾穉陼⛓䖕
    push esi
    push ebx
    sub esp,byte +0x4
    mov ebx,[esp+0x10]
    cmp ebx,byte +0x2
    jng 0x32
    xor esi,esi
    lea eax,[ebx-0x1]
    sub esp,byte +0xc
    sub ebx,byte +0x2
    push eax
    call dword 0x0
    add esp,byte +0x10
    add esi,eax
    cmp ebx,byte +0x2
    jg 0x10
    lea eax,[esi+0x1]
    add esp,byte +0x4
    pop ebx
    pop esi
    ret
    address opcode assembly code

    View full-size slide

  20. ⴲ䱳穉ざ铃鎊
    ⾲㨥焺Ꟁ鸏垺 int fib(int n)
    {
    if(n <= 2) {
    return 1;
    } else {
    return fib(n - 1) + fib(n - 2);
    }
    }

    View full-size slide

  21. ⴲ䱳穉ざ铃鎊
    ˙ 穉ざ铃鎊ㄤ堥㐼焺㛇劥♳僽♧垺涸匌銯
    ˙ 堥㐼焺僽窍堥㐼 $16
    隡涸
    ˙ 穉ざ铃鎊僽窍➃겳隡涸
    ˙ 〳⟃✽湱鱲䳖
    ˙ 穉陼㐼 "TTFNCMFS

    ˙ ⿾穉陼㐼 %JTBTTFNCMFS

    View full-size slide

  22. ⴲ䱳穉ざ铃鎊
    ˙ 歋䖎㢵䭸⟂穉䧭玑䒭
    ˙ ⸈岁⛨岁嫲鯱騥鱲
    ˙ 0QFSBUJPO<<<"SH> "SH> "SH>
    ˙ BEEFBY FCYFBYFCY
    ˙ 冾㶸㐼
    ˙ $16Ⰹ㔿㹁涸䎙⦐隶侸

    View full-size slide

  23. EAX = 0x12345678
    AX = 0x5678
    AL = 0x78
    AH = 0x56
    &*1䭸ぢ玑䒭植㖈

    㛂遤涸䭸⟂
    ⴲ䱳穉ざ铃鎊

    View full-size slide

  24. ⴲ䱳穉ざ铃鎊
    ˙ Y@㢵✫CJUTSFHJTUFSㄤ겙㢫涸Ⱄ⦐冾㶸㐼
    ˙ &"9 CJUT

    ̔3"9 CJUT


    ˙ 3 3 3 3 3 3 3 3
    ˙ 3 CJUT

    3% CJUT

    38 CJUT

    3# CJUT


    ˙ 麌皿佪桧刿㥪
    ˙ CJUT冾㶸㐼銴Ⰽ妄⸈岁䩞㸤䧭CJUTJOU湱⸈

    植㖈〫銴♧妄
    ˙ $BMMJOHDPOWFOUJPO♶ず⿮侸剚⯓佞冾㶸㐼

    View full-size slide

  25. ⴲ䱳穉ざ铃鎊
    ˙ 须俲珏겳
    ˙ 冾㶸㐼SFH
    ˙ &"9 &$9 &%9 &%* &4* &41
    ˙ 侸⧩JNN
    ˙ YD Y
    ˙ 鎹䥊넓⿮罌NFN
    ˙ CZUFQUS<Y>
    ˙ EXPSEQUS

    View full-size slide

  26. ⴲ䱳穉ざ铃鎊
    • add dst, src
    • dst += src
    • dst:mem, reg
    • src:mem, reg, imm
    • dst, src 不可同時為 mem
    • add eax, 7 // eax += 7
    • add dword ptr [0x1234+eax*4], ebx

    // int arr[LEN]; arr[eax] += ebx
    • add eax, ebx // eax += ebx

    View full-size slide

  27. ⴲ䱳穉ざ铃鎊
    • mov dst, src - dst = src
    • add dst, src - dst += src
    • sub dst, src - dst -= src
    • and dst, src - dst &= src
    • or dst, src - dst |= src
    • xor dst, src - dst ^= src
    • not dst - dst = ~dst
    • inc dst - dst++

    View full-size slide

  28. ⴲ䱳穉ざ铃鎊
    • push val
    • val: imm, reg, mem
    • 把數值 push 進堆疊
    • pop target
    • target: reg, mem
    • 把數值從堆疊 pop 到指定的地⽅方

    View full-size slide

  29. ⴲ䱳穉ざ铃鎊
    • jmp target
    • target: reg, imm, mem
    • 無條件跳轉到 target 的指令繼續執⾏行行
    • call target
    • 函式呼叫,跟 jmp 有點像,跳過去執⾏行行並且把返
    回位址 push 進堆疊
    • ret
    • 跳回返回位址,等於 pop eip/rip

    View full-size slide

  30. ⴲ䱳穉ざ铃鎊
    • cmp a, b
    • a: reg, mem
    • b: imm, reg
    • 比較完之後 CPU 會把比較結果記錄在 EFLAGS 裡⾯面
    • je addr, jz addr - 如果比較相等就跳轉
    • jne addr - 不相等跳轉
    • jg addr - 如果 a > b 就跳轉
    • jl addr - 如果 a < b 就跳轉

    View full-size slide

  31. ⴲ䱳穉ざ铃鎊&'-"(4
    ˙ &'-"(4僽♧⦐CJUT冾㶸㐼⟃CJUNBTL涸倰䒭⮭
    㶸ぐ珏朜䢀
    ˙ 0'ˋ0WFSPX
    ˙ 殹皿侸涮欰形⡙涸儘⦬
    ˙ ;'ˋ;FSP'MBH
    ˙ 麌皿穡卓昸
    ˙ $'ˋ$BSSZ'MBH
    ˙ 殹皿侸涮欰鹎⡙涸儘⦬

    View full-size slide

  32. 玑䒭遤昸ⴕ區
    ˙ ꬆ䢀ⴕ區
    ˙ 湬䱺⢪欽EJTBTTFNCMFSEFDPNQJMFS溏玑䒭焺
    ˙ 溏ⵌ涸匌銯嫲鯱侮넓꬗
    ˙ ⹛䢀ⴕ區
    ˙ ⢪欽EFCVHHFS⢵錚㻌ⴕ區玑䒭遤昸
    ˙ ♴倬럊〳⟃錚㻌玑䒭㛂遤麕玑⚥涸须俲ㄤ朜䢀
    ˙ 幋ざ⢪欽剚剤♶ꐫ涸佪卓

    View full-size slide

  33. 玑䒭遤昸ⴕ區
    ˙ 䙦랃䪪ⵌ䧮⦛䠮莇馱涸匌銯
    ˙ 䖰侸⧩㶶⚮㢫鿈"1*♴䩛
    ˙ 矦㋲⢵铞⯓䪪ⵌ剤湱ꡠ涸匌銯
    ˙ 鎹䥊넓䵃㼦$IFBU&OHJOF馄㥪欽
    ˙ 㼩㶶⚮⢪欽鎹䥊넓倬럊EBUBCSFBLQPJOU
    ˙ 䵃㼦䭸ぢ㶶⚮涸1PJOUFS
    ˙ 㼩"1*♴倬럊
    ˙ 䱺衽䖃玑䒭㛂遤崩玑⵹䖕䪪㽠腋㣁䪪ⵌ⡹銴涸匌銯

    View full-size slide

  34. 玑䒭遤昸ⴕ區
    ˙ 莊⦐⢿㶩
    ˙ 䧮䟝銴䪪ⵌ麉䨡錬蒀余乹涸贖椚ⴅ䒭
    ˙ ⯓欽鎹䥊넓䵃㼦䪪ⵌ.1涸⡙㖧
    ˙ ⱄ欽鎹䥊넓倬럊䪪ⵌ䩾.1涸㖒倰
    ˙ ⢪欽ꬆ䢀ⴕ區䖃⵹䖕䪪㽠剤余乹湱ꡠ涸GVODUJPO

    View full-size slide

  35. 玑䒭遤昸ⴕ區
    ˙ ⱄ莊⦐⢿㶩
    ˙ 䧮䟝銴灶鍑厥4晦俒㶶管鱀㐼涸뀿阮
    ˙ ⯓䖰鎹䥊넓䪪㶶⚮䪪ⵌ3FHJTUFSFE5P
    ˙ ⱄ䪪ⵌ剤⢪欽ⵌ鸏⦐㶶⚮涸㖒倰
    ˙ 䖃♳꬗䪪㽠剤ⴼ倬僽や鏽ⱁ涸嫲㼩騥鱲
    ˙ 䪪ⵌSFHJTUFSFEBH涸⡙㖧
    ˙ 欽鎹䥊넓倬럊䪪ⵌ痧♧⦐㻨Ⰵ涸㖒倰搭䖕佖䱈

    View full-size slide

  36. 䊨Ⱘ⛳䖎ꅾ銴8JOEPXT眝
    ˙ 0MMZ%CH罉晦涸EFCVHHFS剤㣐ꆀ涸QMVHJO⿻來
    㷸♶麕〫佅䴂CJUT玑䒭
    ˙ YECH湡⵹➠搭崞鬪Ꟛ涮涸EFCVHHFSず儘佅䴂
    CJUT莅CJUT玑䒭PQFOTPVSDF
    ˙ XJOECH䗏鮿㸽倰ⴀ涸俒㶶歲꬗EFCVHHFS䟝銴溏
    LFSOFM♶腋尝剤㸐

    View full-size slide

  37. 䊨Ⱘ⛳䖎ꅾ銴-JOVY眝
    ˙ HEC欽饱⢵䖎⫹㖈欽WJN涸EFCVHHFS꨾銴蔅럊儘
    ꟦㷸绢欽饱⢵䖎汥蕲㥪欽⸆腋꬗
    ˙ ꂂ♳1&%"鸏⦐QMVHJO㽠〳⟃倰⤑涸贖椚搂TPVSDF
    DPEF涸墂呪
    ˙ FEC FWBOTEFCVHHFS
    欽饱⢵䖎⫹0MMZ%CH
    ˙ RJSB5JNFMFTTEFCVHHFS鎹ꏗ♴侮⦐玑䒭涸㛂
    遤崩玑鼩剤䨾剤涸鎹䥊넓冾㶸㐼隶⻋

    View full-size slide

  38. 䊨Ⱘ⛳䖎ꅾ銴⼵鍑眝
    ˙ 䨾剤䎂荩
    ˙ *%" 1SP
    ♧㤛顜ⵌ旙挾㖒邍剓䓽涸ꬆ䢀ⴕ區䊨
    Ⱘ噠歲垦彋ꂂ⪔佅䴂馄㢵䭸⟂꧌⟃⿻墂呪呔䒭
    ˙ SBEBSF♧㤛PQFOTPVSDF俒㶶歲꬗涸ꬆ䢀ⴕ
    區EFCVHHFS䊨Ⱘ欽饱⢵⛳剤럊⫹㖈欽7*.

    View full-size slide

  39. 齡剤鸏랃㥪䐁涸✲䞕
    ˙ 麉䨡ꦑ⤑⡹佖余乹⸂
    ˙ ㉂噠鮿넓♲ⴕꗻ灶鍑
    ˙ ⯝顥鮿넓䎸贫欴欰㐼
    ˙ 鮿넓噠鿪♶欽崞✫㌨2"2

    View full-size slide

  40. 鮿넓⥃隌䪮遯
    ˙ ⿶〭⨞⸈媽
    ˙ "41BDL 619 5IFNJEB 7.1SPUFDU 䖎㢵
    ˙ 幋差侮⦐CJOBSZ雊➮꬗湡ꬌ
    ˙ 䌢欽涸䪮䊫
    ˙ ⸈Ⰵ搂佪卓涸㘏㖣䭸⟂
    ˙ 䪾♧⦐䭸⟂佖㻨䧭㢵⦐䭸⟂⟃♳Ⰽ䬸〭蔅䭸⟂
    ˙ ⸈Ⰵ䖎㢵涸騥鬪雊鷆髠⿻ꠗ隡㔮ꨈ
    ˙ 7.⻋䭸⟂

    View full-size slide

  41. ⿾鮿넓⥃隌䪮遯
    ˙ 鄄⸈媽涸鮿넓尝鳵岁湬䱺欽ꬆ䢀ⴕ區鮿넓溏
    ˙ 膨媽䪪0&1 0SJHJOBM&OUSZ1PJOU

    ˙ 䧴僽湬䱺溏NFNPSZEVNQⴀ⢵涸匌銯
    ˙ ⸈媽鮿넓剚㠺簮⚛⚂⸈㺙侮⦐玑䒭焺⼦媯
    ˙ ⡎僽㛂遤涸儘⦬籏僽銴鼩⾲
    ˙ 䧮⦛〳⟃㖈鮿넓駵饱⢵涸儘⦬䪾鎹䥊넓酭꬗涸DPEFꅾ
    倞㼓酤䧭♧⦐CJOBSZ
    ˙ ꅾ䒊JNQPSUUBCMF

    View full-size slide

  42. ⿾⿾鮿넓⥃隌䪮遯
    ˙ く䱈0&1㼩0&1⢪欽蔅䭸⟂䪮遯
    ˙ ⩔"1*涸⵹꬗䎙⦐CZUFⱄꂂざ蔅䭸⟂
    ˙ 鸏垺⡹㽠䪪♶ⵌ"1*涸QPJOUFS㖈ㆭ酭
    ˙ 欽㣼䚓涸倰岁⩏庠ⵌEFCVHHFS涸儘⦬㽠駵㣼䚓涸
    㛂遤崩玑雊⡹䖎ꨈ鷆髠
    ˙ 䪾MJCSBSZ鿪⺫鹎㛂遤墂酭꬗JNQPSUUBCMF㼱✫㥪
    㢵DPEF隶㥪㢵

    View full-size slide