Upgrade to Pro — share decks privately, control downloads, hide ads and more …

逆向工程基礎

7f110257501127300df3f923119ba043?s=47 Inndy
December 01, 2016
Technology
4
1.3k

 逆向工程基礎

7f110257501127300df3f923119ba043?s=128

Inndy

December 01, 2016
Tweet

More Decks by Inndy

See All by Inndy
7f110257501127300df3f923119ba043?s=48 inndy
0
10
7f110257501127300df3f923119ba043?s=48 inndy
3
2k
7f110257501127300df3f923119ba043?s=48 inndy
2
550
7f110257501127300df3f923119ba043?s=48 inndy
0
250
7f110257501127300df3f923119ba043?s=48 inndy
7
3k
7f110257501127300df3f923119ba043?s=48 inndy
0
1.1k
7f110257501127300df3f923119ba043?s=48 inndy
33
6.3k
7f110257501127300df3f923119ba043?s=48 inndy
1
580
7f110257501127300df3f923119ba043?s=48 inndy
4
3.2k

Other Decks in Technology

See All in Technology
71c9ebde850996d2533c5df4df2c93c6?s=48 opdavies
0
1.6k
24606216ae4bbee28494552cb71cc220?s=48 yosshi_
3
290
2ee165e506f59e3fe6f463bf7f150ccb?s=48 minamizaki
0
630
33d6320b53f63f6627508095633cf5ce?s=48 yosuke_matsuura
PRO
0
3.4k
567600e04dbcb14d6bd8f120e6625a27?s=48 tsuyo
0
190
A5fed8c15d016c2a42d7d9f830326045?s=48 takuros
2
340
Cd891a89dfec6ca7bd278b5f5bd87c90?s=48 tzkoba
0
390
9e7a653ed313b3da4b263a772bfc5026?s=48 clustervr
0
100
510ec964f5d26c2724c883fd7b671e3d?s=48 cygames
1
370
9e7a653ed313b3da4b263a772bfc5026?s=48 clustervr
0
190
F082484f19b518225501fafa28d05b93?s=48 greymd
0
620
A4d5b3aae2e67f31b513c88c726514c2?s=48 smzksts
0
240

Featured

See All Featured
Ae14cc4491ac334f9cd23f9f93b4305e?s=48 orderedlist
PRO
329
35k
5f83ef806155b403c3393160ce51f955?s=48 jlugia
216
16k
C44e1f7e22c3f23cff7bc130871047ef?s=48 eileencodes
113
25k
4262b9cfacfb6b2c77f23e1d0310cd3e?s=48 myddelton
109
11k
812e1705ff0f8bc1bcf18587bde687d5?s=48 62gerente
587
200k
E43f8dfd01057f8304f5f8fb9a294d7d?s=48 jeffersonlam
328
15k
79acae287842acf29084005533a7fb3b?s=48 hursman
106
9.2k
027d1ebf66cc039a0bd3b55eeadbe75d?s=48 sachag
446
36k
A16eb159db895e3b01d3dc95767ad595?s=48 jonyablonski
14
1.1k
F57e2136eb9895eb95ff5dc8a1c02677?s=48 zakiwarfel
88
3.3k
C1daf20e5c49ff910745198ef9869ac2?s=48 hatefulcrawdad
257
17k
C9b18d9dff88a9dd2393364c2b3b21bd?s=48 colly
186
14k

Transcript

  1. /5645须㸞灇瑖爢 *OOEZJOOEZUX!HNBJMDPN 3FWFSTF&OHJOFFSJOH

  2. 㖈Ꟛ㨥⛓⵹ ˙ 䧮⧺鏤⡹䊺竤剚 ˙ ✳鹎⡙⼧鹎⡙⼧Ⱉ鹎⡙⛓꟦✽湱鱲䳖 ˙ 㻨玑䒭濼麥JG MPPQ GVODUJPO SFDVSTJPO

    WBSJBCMF BSSBZ ˙ $铃鎊㛇劥1PJOUFS乽⡲ ˙ 㥶卓剤聃♶㣖僈涯涸㖒倰〳⟃莊䩛涮㉏ ˙ 㥶卓⟃♳剤馄麕♧⼱⟃♳溏♶䥢䧴♶濼麥⡹〳腋饥ꐫ來㹔✫

  3. 0VUMJOF ˙ ⾲㨥焺管陼㐼莅㛂遤墂 ˙ 鎹䥊넓垸㘗 ˙ 玑䒭⼦媯 ˙ 鎹䥊넓⼦媯莅⡑㽷 ˙

    ⴲ䱳穉ざ铃鎊 ˙ $16冾㶸㐼 ˙ 4UBDL

  4. 鷠ぢ䊨玑➝稲 ˙ ⡹尝剤玑䒭涸⾲㨥焺 ˙ ⡹䟝銴濼麥鸏⦐玑䒭僽䙦랃㻜⡲涸 ˙ ⡹䟝銴㻨麉䨡㢫䱦 ˙ ⡹䟝銴灶鍑⸆腋뀿阮 ˙

    ⡹䟝銴㻨鮿넓鏽ⱁ堥 ˙ ⡹䟝銴䪪怪峯 ˙ ⡹꨾銴鷠ぢ䊨玑

  5. ♶ず涸管陼㛂遤倰䒭 ˙ 管陼䧭⾲欰堥㐼焺/BUJWF ˙ $ $ 0CK$ 4XJGU HPMBOH IBTLFMM

    "OESPJE "35  ˙ 管陼䧭⚥꟦焺*OUFSNFEJBUF-BOHVBHF *- PSCZUFDPEF ˙ /&5 $ 7# '  +BWB 1ZUIPO QSFDPNQJMFEUPQZD  ˙ 湬陼*OUFSQSFUJOH ˙ 1ZUIPO 3VCZ +BWB4DSJQU 7#4DSJQU -*41

  6. ⾲㨥焺管陼㐼莅〳㛂遤墂 ⾲㨥焺 㛂遤墂 管陼㐼

  7. ⾲㨥焺管陼㐼莅〳㛂遤墂 ⾲㨥焺 㛂遤墂 鷠ぢ ♶剚㸤♧垺⡎駈⟃管陼ⴀ♧垺⸆腋涸玑䒭䧴僽澗鍑玑䒭遤捀

  8. 管陼㐼珏겳 ˙ "05 "IFBEPGUJNF  ˙ 㽠僽⡹濼麥涸$ $ 管陼㐼䖰⾲㨥焺管陼䧭〳㛂遤墂呪 ˙

    +*5 +VTUJOUJNF  ˙ $ISPNF涸7+BWB4DSJQUFOHJOF㿂倴鸏珏駵饱⢵涸儘⦬管陼䧭堥㐼焺 ˙ 5SBOTDPNQJMBUJPO ˙ 䖰♧珏邍麨倰䒭管陼䧭〥㢫♧珏TPVSDFDPEFUPTPVSDFDPEF $ZUIPO  CZUFDPEFUPOBUJWF "OESPJE3VO5JNF "35

  9. 䧮⦛鎣锸涸眕㕠 ˙ 〫剤"05$PNQJMFS管陼ⴀ⢵涸/BUJWF$PEF ˙ YBOEY@Ⰽ珏卺圓 ˙ Ⱖ➮涸ヤ ˙ 䊨Ⱘ鿪窍⡹✫荈䊹㷸ゅ9% ˙

    +BWB+%(6* KBEY DGS ˙ "OESPJE +BWB KBEY EFYKBS +%(6* ˙ /&5*-4QZ /&53FFDUPS EPU1FFL +VTU%FDPNQJMF ˙ 1ZUIPO QZD VODPNQZMF

  10. 鎹䥊넓垸㘗 ˙ 㣐㹻㼩⟃♴そ鑂剤㢵澗鍑 ˙ CJUCZUF ˙ 隶侸 ˙ 鎹䥊넓䭸垦1PJOUFS ˙

    ꤏ⴪ ˙ 穡圓넓4USVDUVSF ˙ 6OJPO

  11. 鎹䥊넓垸㘗 ˙ 嫦⦐呔㶩僽CZUF ˙ 嫦⦐呔㶩剤荈䊹涸管贫鎹䥊넓㖒㖧.FNPSZBEESFTT⣜䎸黃㟞 ˙ ♧⦐隶侸〳腋剚欽㥪䎙⦐CZUF ˙ 隶侸涸NFNPSZBEESFTT僽痧♧⦐CZUF涸BEESFTT

  12. 鎹䥊넓垸㘗 int a = 0xabcd1234; assert(&a == (int*)0x0034); assert(sizeof(int) ==

    4);

  13. 鎹䥊넓垸㘗 34 12 CD AB     

      

  14. 鎹䥊넓垸㘗 int arr[3] = { 0xabababab, 0xcccccccc, 0xffffffff }; assert(arr

    == (int*)0x0034); assert(sizeof(int) == 4);

  15. 鎹䥊넓垸㘗 AB AB AB AB CC CC CC CC FF

    FF FF FF        

  16. ˙ Ⰽ珏倰䒭CJHFOEJBO MJUUMFFOEJBO ˙ Y⢪欽MJUUMFFOEJBO ˙ JOUBY̔Y Y Y Y

    JONFNPSZ  ˙ MPOHMPOHCYBCDEFG ˙ ̔YFG YDE YBC Y Y Y Y Y JONFNPSZ  ˙ CJHFOEJBO ˙ JOUBY̔Y Y Y Y JONFNPSZ 侮侸⮭㶸倰䒭

  17. 玑䒭⼦媯 $SBDLNFFYF 1&)FBEFS 4FDUJPO5BCMF $PEF4FDUJPO %BUB4FDUJPO *NQPSU&YQPSU5BCMF 4FDUJPOT

  18. 鎹䥊넓⼦媯莅⡑㽷 $SBDLNFFYF $PEF4FDUJPO 3FBEPOMZ%BUB )FBEFS 8SJUBCMF%BUB 1SPDFTT%BUB 1&.PEVMF  ''''''''

    4UBDL )FBQ LFSOFMEMM 1&.PEVMF

  19. ⴲ䱳穉ざ铃鎊 00000000: 56 53 83 ec 04 8b 5c 24

    10 83 fb 02 7e 24 31 f6 VS....\$....~$1. 00000010: 8d 43 ff 83 ec 0c 83 eb 02 50 e8 e1 ff ff ff 83 .C.......P...... 00000020: c4 10 01 c6 83 fb 02 7f e7 8d 46 01 83 c4 04 5b ..........F....[ 00000030: 5e c3 鸏❉须俲僽➊랃

  20. 00000000 56 00000001 53 00000002 83EC04 00000005 8B5C2410 00000009 83FB02

    0000000C 7E24 0000000E 31F6 00000010 8D43FF 00000013 83EC0C 00000016 83EB02 00000019 50 0000001A E8E1FFFFFF 0000001F 83C410 00000022 01C6 00000024 83FB02 00000027 7FE7 00000029 8D4601 0000002C 83C404 0000002F 5B 00000030 5E 00000031 C3 ⴲ䱳穉ざ铃鎊 ⿾穉陼⛓䖕 push esi push ebx sub esp,byte +0x4 mov ebx,[esp+0x10] cmp ebx,byte +0x2 jng 0x32 xor esi,esi lea eax,[ebx-0x1] sub esp,byte +0xc sub ebx,byte +0x2 push eax call dword 0x0 add esp,byte +0x10 add esi,eax cmp ebx,byte +0x2 jg 0x10 lea eax,[esi+0x1] add esp,byte +0x4 pop ebx pop esi ret address opcode assembly code

  21. ⴲ䱳穉ざ铃鎊 ⾲㨥焺Ꟁ鸏垺 int fib(int n) { if(n <= 2) {

    return 1; } else { return fib(n - 1) + fib(n - 2); } }

  22. ⴲ䱳穉ざ铃鎊圓䧭 ˙ 歋䖎㢵䭸⟂穉䧭玑䒭 ˙ ⸈岁⛨岁9PS/PU嫲鯱騥鱲 ˙ 0QFSBUJPO<<<"SH> "SH> "SH> ˙

    BEEFBY FCYFBY FCY ˙ 冾㶸㐼 ˙ $16Ⰹ㔿㹁涸䎙⦐隶侸

  23. EAX = 0x12345678 AX = 0x5678 AL = 0x78 AH

    = 0x56 ⴲ䱳穉ざ铃鎊 酢⯏4* 4) 4-  խխխ%* %) %- &*1䭸ぢ玑䒭植㖈㛂遤 涸䭸⟂

  24. ˙ Y@㢵✫CJUTSFHJTUFSㄤ겙㢫涸Ⱄ⦐冾㶸㐼 ˙ &"9 CJUT ̔3"9 CJUT  ˙ 3

    3 3 3 3 3 3 3 ˙ 3 CJUT 3% CJUT 38 CJUT 3# CJUT  ˙ 麌皿佪桧刿㥪 ˙ ⟃⵹CJUT冾㶸㐼銴⨞Ⰽ妄⸈岁䩞腋㸤䧭MPOHMPOH CJUTJOUFHFS 湱 ⸈植㖈〫銴♧妄 ˙ $BMMJOHDPOWFOUJPO♶ず⿮侸剚⯓佞冾㶸㐼 ⴲ䱳穉ざ铃鎊CJUT䊴殯

  25. ⴲ䱳穉ざ铃鎊 ˙ 须俲珏겳 ˙ 冾㶸㐼SFH ˙ &"9 &#9 &$9 &%9

    &%* &4* &41 ˙ 侸⧩JNN ˙    YD Y ˙ 鎹䥊넓⿮罌NFN ˙ CZUFQUS<Y> ˙ EXPSEQUS<FCY FBY  >

  26. ⴲ䱳穉ざ铃鎊 • add dst, src • dst += src •

    dst：mem, reg • src：mem, reg, imm • dst, src 不可同時為 mem • add eax, 7 // eax += 7 • add dword ptr [0x123456+eax*4], ebx // arr[eax] += ebx • add eax, ebx // eax += ebx

  27. ⴲ䱳穉ざ铃鎊 • mov dst, src - dst = src •

    add dst, src - dst += src • sub dst, src - dst -= src • and dst, src - dst &= src • or dst, src - dst |= src • xor dst, src - dst ^= src • not dst - dst = ~dst • inc dst - dst++

  28. ⴲ䱳穉ざ铃鎊 // 算數練習 mov eax, 8 mov ebx, 7 xor

    ecx, ecx inc ecx add eax, ebx add ebx, ebx sub eax, ebx sub ecx, eax

  29. ⴲ䱳穉ざ铃鎊 • push val • val: imm, reg, mem •

    把數值 push 進堆疊 • pop target • target: reg, mem • 把數值從堆疊 pop 到指定的地⽅方

  30. ⴲ䱳穉ざ铃鎊 • jmp target • target: reg, imm, mem •

    無條件跳轉到 target 的指令繼續執⾏行行 • call target • 函式呼叫，跟 jmp 有點像，但是把返回位址 push 進堆疊 • ret • 從 function 跳回返回位址，等於 pop eip

  31. ⴲ䱳穉ざ铃鎊 • cmp a, b • a: reg, mem •

    b: imm, reg • 比較完之後 CPU 會把比較結果記錄在 EFLAGS 裡⾯面 • je addr, jz addr - 如果比較相等就跳轉 / jne addr - 不相等跳轉 • jg addr - 如果 a > b 就跳轉 • jl addr - 如果 a < b 就跳轉 • jge addr - 如果 a >= b 就跳轉 • jle addr - 如果 a <= b 就跳轉

  32. ⴲ䱳穉ざ铃鎊&'-"(4 ˙ 0'ˋ0WFSPX ˙ 4'ˋ4JHOFE ˙ ;'ˋ;FSP'MBH ˙ $'ˋ$BSSZ'MBH ˙

    3FGFSFODFIUUQTDPVSTFTFOHSJMMJOPJTFEVFDFCPPLTMBCNBOVBMBTTFNCMZIUNM 0' 4' ;' $' … 11 … 7 6 … 0

  33. ⴲ䱳穉ざ铃鎊箻绢 試著把以下組合語⾔言轉成 C 語⾔言 R: inc eax cmp eax, 10

    jl R