2017/10/14 at TDOHConf 2017
5%0)$POG*OOEZJOOEZUX!HNBJMDPN鷠ぢ䊨玑䖰Ⰵⵌ佞唳
View Slide
㖈㨥⛓˙ 䧮⧺鏤⡹䊺竤剚˙ ✳鹎⡙⼧鹎⡙⼧Ⱉ鹎⡙⛓✽湱鱲䳖˙ 㻨玑䒭濼麥JG MPPQ GVODUJPO WBSJBCMF BSSBZ˙ ♧럊$铃鎊˙ 㥶卓⟃♳剤♧⼱♶濼麥〳⟃佞唳〥㢫♧⦐陾玑
鷠ぢ䊨玑腋く㌨˙ ⡹尝剤玑䒭涸⾲㨥焺˙ ⡹䟝銴濼麥鸏⦐玑䒭僽䙦랃㻜⡲涸˙ ⡹䟝銴㻨麉䨡㢫䱦˙ ⡹䟝銴灶鍑鮿넓뀿阮˙ ⡹䟝銴㻨鮿넓鏽ⱁ堥˙ ⡹䟝銴䪪怪峯˙ ⡹銴鷠ぢ䊨玑
♶ず涸管陼㛂遤倰䒭˙ 管䧭⾲欰堥㐼焺/BUJWF˙ $ $ 0CK$ 4XJGU HPMBOH˙ 管䧭⚥焺*OUFSNFEJBUF-BOHVBHFCZUFDPEF˙ /&5 $ 7# +BWB 1ZUIPO QZD ˙ 湬陼*OUFSQSFUJOH˙ 1ZUIPO 3VCZ +BWB4DSJQU 7#4DSJQU -*41
㛂遤墂管陼㐼⾲㨥焺⾲㨥焺管陼㐼莅〳㛂遤墂
㛂遤墂鷠ぢ⾲㨥焺⾲㨥焺管陼㐼莅〳㛂遤墂♶剚㸤♧垺⡎駈⟃管陼ⴀ♧垺⸆腋涸玑䒭䧴僽澗鍑玑䒭遤捀
䧮⦛鎣锸涸眕㕠˙ ⚺銴僽"05$PNQJMFS管陼ⴀ⢵涸/BUJWF$PEF˙ YBOE*"Ⰽ珏卺圓˙ Ⱖ➮涸ヤ˙ 䊨Ⱘ鿪窍⡹✫荈䊹㷸ゅ9%˙ +BWB+%(6* KBEY DGS˙ "OESPJE +BWBKBEY EFYKBS+%(6*˙ /&5*-4QZ /&53FFDUPS EPU1FFL +VTU%FDPNQJMF˙ 1ZUIPO QZDVODPNQZMF
鎹䥊넓垸㘗˙ 㣐㹻㼩⟃♴そ鑂剤㢵澗鍑˙ CJUCZUF˙ 隶侸˙ 鎹䥊넓䭸垦QPJOUFS˙ ꤏ˙ 穡圓넓TUSVDUVSF˙ 6OJPO
鎹䥊넓垸㘗˙ 嫦⦐呔㶩㣐㼭僽CZUF CJUT˙ 嫦⦐呔㶩剤荈䊹涸管贫⣜䎸黃㟞˙ 〭⨞鎹䥊넓㖒㖧 NFNPSZBEESFTT˙ ♧⦐隶侸〳腋剚欽㥪䎙⦐CZUFT˙ 隶侸涸BEESFTT僽痧♧⦐CZUF涸BEESFTT
侮侸⮭㶸倰䒭˙ Ⰽ珏倰䒭CJHFOEJBO MJUUMFFOEJBO˙ Yㄤ㣐鿈ⴕ涸"3.⢪欽MJUUMFFOEJBO˙ JOUBY̔˙ MPOHMPOHCYBCDEFG˙ ̔&'$%"#˙ CJHFOEJBO˙ JOUBY̔
侮侸⮭㶸倰䒭˙ 昸➊랃銴欽MJUUMFFOEJBO˙ ̔鱲㘗倰⤑˙ JOUBY˙ TIPSUC TIPSUBY̔˙ DIBSD DIBSBY̔˙ "EESFTT㸤♶隶⾲㖒隶魨
隶侸㶸佞倰䒭int a = 0xabcd1234;assert(&a == (int*)0x0034);assert(sizeof(int) == 4);
隶侸㶸佞倰䒭34 12 CD AB
隶侸㶸佞倰䒭int arr[3] = {0xabababab,0xcccccccc,0xffffffff};assert(arr == (int*)0x0034);assert(sizeof(int) == 4);
隶侸㶸佞倰䒭AB AB AB AB CC CC CC CC FF FF FF FF
玑䒭⼦媯$ISPNFFYF1&)FBEFS4FDUJPO5BCMF$PEF4FDUJPO%BUB4FDUJPO*NQPSU&YQPSU5BCMF4FDUJPOT
鎹䥊넓⼦媯莅⡑㽷$SBDLNFFYF$PEF4FDUJPO3FBEPOMZ)FBEFS8SJUBCMF1SPDFTT%BUB1&.PEVMF''''''''4UBDL)FBQLFSOFMEMM1&.PEVMF
ⴲ䱳穉ざ铃鎊00000000: 56 53 83 ec 04 8b 5c 24 10 83 fb 02 7e 24 31 f6 VS....\$....~$1.00000010: 8d 43 ff 83 ec 0c 83 eb 02 50 e8 e1 ff ff ff 83 .C.......P......00000020: c4 10 01 c6 83 fb 02 7f e7 8d 46 01 83 c4 04 5b ..........F....[00000030: 5e c3鸏❉须俲僽➊랃
00000000 5600000001 5300000002 83EC0400000005 8B5C241000000009 83FB020000000C 7E240000000E 31F600000010 8D43FF00000013 83EC0C00000016 83EB0200000019 500000001A E8E1FFFFFF0000001F 83C41000000022 01C600000024 83FB0200000027 7FE700000029 8D46010000002C 83C4040000002F 5B00000030 5E00000031 C3ⴲ䱳穉ざ铃鎊⿾穉陼⛓䖕push esipush ebxsub esp,byte +0x4mov ebx,[esp+0x10]cmp ebx,byte +0x2jng 0x32xor esi,esilea eax,[ebx-0x1]sub esp,byte +0xcsub ebx,byte +0x2push eaxcall dword 0x0add esp,byte +0x10add esi,eaxcmp ebx,byte +0x2jg 0x10lea eax,[esi+0x1]add esp,byte +0x4pop ebxpop esiretaddress opcode assembly code
ⴲ䱳穉ざ铃鎊⾲㨥焺Ꟁ鸏垺 int fib(int n){if(n <= 2) {return 1;} else {return fib(n - 1) + fib(n - 2);}}
ⴲ䱳穉ざ铃鎊˙ 穉ざ铃鎊ㄤ堥㐼焺㛇劥♳僽♧垺涸匌銯˙ 堥㐼焺僽窍堥㐼 $16隡涸˙ 穉ざ铃鎊僽窍➃겳隡涸˙ 〳⟃✽湱鱲䳖˙ 穉陼㐼 "TTFNCMFS˙ ⿾穉陼㐼 %JTBTTFNCMFS
ⴲ䱳穉ざ铃鎊˙ 歋䖎㢵䭸⟂穉䧭玑䒭˙ ⸈岁⛨岁嫲鯱騥鱲˙ 0QFSBUJPO<<> "SH> "SH>˙ BEEFBY FCYFBYFCY˙ 冾㶸㐼˙ $16Ⰹ㔿㹁涸䎙⦐隶侸
EAX = 0x12345678AX = 0x5678AL = 0x78AH = 0x56&*1䭸ぢ玑䒭植㖈 㛂遤涸䭸⟂ⴲ䱳穉ざ铃鎊
ⴲ䱳穉ざ铃鎊˙ [email protected]㢵✫CJUTSFHJTUFSㄤ겙㢫涸Ⱄ⦐冾㶸㐼˙ &"9 CJUT̔3"9 CJUT˙ 3 3 3 3 3 3 3 3˙ 3 CJUT 3% CJUT 38 CJUT 3# CJUT˙ 麌皿佪桧刿㥪˙ CJUT冾㶸㐼銴Ⰽ妄⸈岁䩞㸤䧭CJUTJOU湱⸈ 植㖈〫銴♧妄˙ $BMMJOHDPOWFOUJPO♶ず侸剚⯓佞冾㶸㐼
ⴲ䱳穉ざ铃鎊˙ 须俲珏겳˙ 冾㶸㐼SFH˙ &"9 &$9 &%9 &%* &4* &41˙ 侸⧩JNN˙ YD Y˙ 鎹䥊넓罌NFN˙ CZUFQUSY>˙ EXPSEQUS
ⴲ䱳穉ざ铃鎊• add dst, src• dst += src• dst：mem, reg• src：mem, reg, imm• dst, src 不可同時為 mem• add eax, 7 // eax += 7• add dword ptr [0x1234+eax*4], ebx // int arr[LEN]; arr[eax] += ebx• add eax, ebx // eax += ebx
ⴲ䱳穉ざ铃鎊• mov dst, src - dst = src• add dst, src - dst += src• sub dst, src - dst -= src• and dst, src - dst &= src• or dst, src - dst |= src• xor dst, src - dst ^= src• not dst - dst = ~dst• inc dst - dst++
ⴲ䱳穉ざ铃鎊• push val• val: imm, reg, mem• 把數值 push 進堆疊• pop target• target: reg, mem• 把數值從堆疊 pop 到指定的地⽅方
ⴲ䱳穉ざ铃鎊• jmp target• target: reg, imm, mem• 無條件跳轉到 target 的指令繼續執⾏行行• call target• 函式呼叫，跟 jmp 有點像，跳過去執⾏行行並且把返回位址 push 進堆疊• ret• 跳回返回位址，等於 pop eip/rip
ⴲ䱳穉ざ铃鎊• cmp a, b• a: reg, mem• b: imm, reg• 比較完之後 CPU 會把比較結果記錄在 EFLAGS 裡⾯面• je addr, jz addr - 如果比較相等就跳轉• jne addr - 不相等跳轉• jg addr - 如果 a > b 就跳轉• jl addr - 如果 a < b 就跳轉
ⴲ䱳穉ざ铃鎊&'-"(4˙ &'-"(4僽♧⦐CJUT冾㶸㐼⟃CJUNBTL涸倰䒭⮭㶸ぐ珏朜䢀˙ 0'ˋ0WFSPX˙ 殹皿侸涮欰形⡙涸儘⦬˙ ;'ˋ;FSP'MBH˙ 麌皿穡卓昸˙ $'ˋ$BSSZ'MBH˙ 殹皿侸涮欰鹎⡙涸儘⦬
玑䒭遤昸ⴕ區˙ ꬆ䢀ⴕ區˙ 湬䱺⢪欽EJTBTTFNCMFSEFDPNQJMFS溏玑䒭焺˙ 溏ⵌ涸匌銯嫲鯱侮넓˙ ⹛䢀ⴕ區˙ ⢪欽EFCVHHFS⢵錚㻌ⴕ區玑䒭遤昸˙ ♴倬럊〳⟃錚㻌玑䒭㛂遤麕玑⚥涸须俲ㄤ朜䢀˙ 幋ざ⢪欽剚剤♶ꐫ涸佪卓
玑䒭遤昸ⴕ區˙ 䙦랃䪪ⵌ䧮⦛䠮莇馱涸匌銯˙ 䖰侸⧩㶶⚮㢫鿈"1*♴䩛˙ 矦㋲⢵铞⯓䪪ⵌ剤湱ꡠ涸匌銯˙ 鎹䥊넓䵃㼦$IFBU&OHJOF馄㥪欽˙ 㼩㶶⚮⢪欽鎹䥊넓倬럊EBUBCSFBLQPJOU˙ 䵃㼦䭸ぢ㶶⚮涸1PJOUFS˙ 㼩"1*♴倬럊˙ 䱺衽䖃玑䒭㛂遤崩玑䖕䪪㽠腋㣁䪪ⵌ⡹銴涸匌銯
玑䒭遤昸ⴕ區˙ 莊⦐⢿㶩˙ 䧮䟝銴䪪ⵌ麉䨡錬蒀余乹涸贖椚ⴅ䒭˙ ⯓欽鎹䥊넓䵃㼦䪪ⵌ.1涸⡙㖧˙ ⱄ欽鎹䥊넓倬럊䪪ⵌ䩾.1涸㖒倰˙ ⢪欽ꬆ䢀ⴕ區䖃䖕䪪㽠剤余乹湱ꡠ涸GVODUJPO
玑䒭遤昸ⴕ區˙ ⱄ莊⦐⢿㶩˙ 䧮䟝銴灶鍑厥4晦俒㶶管鱀㐼涸뀿阮˙ ⯓䖰鎹䥊넓䪪㶶⚮䪪ⵌ3FHJTUFSFE5P˙ ⱄ䪪ⵌ剤⢪欽ⵌ鸏⦐㶶⚮涸㖒倰˙ 䖃♳䪪㽠剤ⴼ倬僽や鏽ⱁ涸嫲㼩騥鱲˙ 䪪ⵌSFHJTUFSFEBH涸⡙㖧˙ 欽鎹䥊넓倬럊䪪ⵌ痧♧⦐㻨Ⰵ涸㖒倰搭䖕佖䱈
䊨Ⱘ⛳䖎ꅾ銴8JOEPXT眝˙ 0MMZ%CH罉晦涸EFCVHHFS剤㣐ꆀ涸QMVHJO⿻來㷸♶麕〫佅䴂CJUT玑䒭˙ YECH湡➠搭崞鬪涮涸EFCVHHFSず儘佅䴂CJUT莅CJUT玑䒭PQFOTPVSDF˙ XJOECH䗏鮿㸽倰ⴀ涸俒㶶歲EFCVHHFS䟝銴溏LFSOFM♶腋尝剤㸐
䊨Ⱘ⛳䖎ꅾ銴-JOVY眝˙ HEC欽饱⢵䖎⫹㖈欽WJN涸EFCVHHFS銴蔅럊儘㷸绢欽饱⢵䖎汥蕲㥪欽⸆腋˙ ꂂ♳1&%"鸏⦐QMVHJO㽠〳⟃倰⤑涸贖椚搂TPVSDFDPEF涸墂呪˙ FEC FWBOTEFCVHHFS欽饱⢵䖎⫹0MMZ%CH˙ RJSB5JNFMFTTEFCVHHFS鎹ꏗ♴侮⦐玑䒭涸㛂遤崩玑鼩剤䨾剤涸鎹䥊넓冾㶸㐼隶⻋
䊨Ⱘ⛳䖎ꅾ銴⼵鍑眝˙ 䨾剤䎂荩˙ *%" 1SP♧㤛顜ⵌ旙挾㖒邍剓䓽涸ꬆ䢀ⴕ區䊨Ⱘ噠歲垦彋ꂂ⪔佅䴂馄㢵䭸⟂꧌⟃⿻墂呪呔䒭˙ SBEBSF♧㤛PQFOTPVSDF俒㶶歲涸ꬆ䢀ⴕ區EFCVHHFS䊨Ⱘ欽饱⢵⛳剤럊⫹㖈欽7*.
齡剤鸏랃㥪䐁涸✲䞕˙ 麉䨡ꦑ⤑⡹佖余乹⸂˙ ㉂噠鮿넓♲ⴕꗻ灶鍑˙ ⯝顥鮿넓䎸贫欴欰㐼˙ 鮿넓噠鿪♶欽崞✫㌨2"2
鮿넓⥃隌䪮遯˙ ⿶〭⨞⸈媽˙ "41BDL 619 5IFNJEB 7.1SPUFDU 䖎㢵˙ 幋差侮⦐CJOBSZ雊➮湡ꬌ˙ 䌢欽涸䪮䊫˙ ⸈Ⰵ搂佪卓涸㘏㖣䭸⟂˙ 䪾♧⦐䭸⟂佖㻨䧭㢵⦐䭸⟂⟃♳Ⰽ䬸〭蔅䭸⟂˙ ⸈Ⰵ䖎㢵涸騥鬪雊鷆髠⿻ꠗ隡㔮ꨈ˙ 7.⻋䭸⟂
⿾鮿넓⥃隌䪮遯˙ 鄄⸈媽涸鮿넓尝鳵岁湬䱺欽ꬆ䢀ⴕ區鮿넓溏˙ 膨媽䪪0&1 0SJHJOBM&OUSZ1PJOU˙ 䧴僽湬䱺溏NFNPSZEVNQⴀ⢵涸匌銯˙ ⸈媽鮿넓剚㠺簮⚛⚂⸈㺙侮⦐玑䒭焺⼦媯˙ ⡎僽㛂遤涸儘⦬籏僽銴鼩⾲˙ 䧮⦛〳⟃㖈鮿넓駵饱⢵涸儘⦬䪾鎹䥊넓酭涸DPEFꅾ倞㼓酤䧭♧⦐CJOBSZ˙ ꅾ䒊JNQPSUUBCMF
⿾⿾鮿넓⥃隌䪮遯˙ く䱈0&1㼩0&1⢪欽蔅䭸⟂䪮遯˙ ⩔"1*涸䎙⦐CZUFⱄꂂざ蔅䭸⟂˙ 鸏垺⡹㽠䪪♶ⵌ"1*涸QPJOUFS㖈ㆭ酭˙ 欽㣼䚓涸倰岁⩏庠ⵌEFCVHHFS涸儘⦬㽠駵㣼䚓涸㛂遤崩玑雊⡹䖎ꨈ鷆髠˙ 䪾MJCSBSZ鿪⺫鹎㛂遤墂酭JNQPSUUBCMF㼱✫㥪㢵DPEF隶㥪㢵
inndy
kubukoz
kenmatsu4
oracle4engineer
nenonaninu
bun913
hirokiigeta
k1low
tatematsu_san
odasho
lmi
aiji42
line_developers
sugarenia
iamctodd
dougneiner
jmmastey
sferik
bkeepers
roundedbygravity
mojombo
jakevdp
marcduiker
stephaniewalter
zakiyama