Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
68
1

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.8k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
820
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
670
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.3k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
340
Fuzzing 101
Avatar for LJP-TW ljptw
1
260
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
350
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
210
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
170

Other Decks in Technology

See All in Technology
いかに伝えるか　〜新卒エンジニアの教育のための、ライトノベル活用の一例
Avatar for Akira Ikeda（池田 暁） ikedon
1
170
[RSJ26] AnoleVLA: Lightweight Vision-Language-Action Model with Deep State Space Models for Mobile Manipulation
Avatar for Semantic Machine Intelligence Lab., Keio Univ. keio_smilab
PRO
0
120
2026-09-04 SRE Tech Talk #15 怠惰なTerraform / Lazy Terraform
Avatar for SUZUKI Masashi masasuzu
0
130
DINO-EdgeQuery:Edge-First Polygon Decoding for Building Footprint Extraction from Satellite Imagery
Avatar for Yuji Kobayashi lehupa
0
130
bet_ai_day_2026_session02
Avatar for 株式会社AgenticSec agenticsec
1
790
#jawssonic2026 あの時代が悪かった ~動かなかったSageMakerと共に迎えたイベント当日~
Avatar for Kana Kitagawa ktkn1129
0
120
プロダクト思考 × 基盤思考を AIで実現する Compound Engineering
Avatar for Watanabe Takeshi(Buzz) tkc66buzz
1
210
Bet AI Day 2026丨Agentは、「金融」という巨大産業の何を変えられるのか
Avatar for LayerX layerx
PRO
0
630
【試作】IoT x AIエージェント
Avatar for コロッケそば happysamurai294
0
110
Introduction to Sansan for Engineers / エンジニア向け会社紹介
Avatar for Sansan, Inc. sansan33
PRO
6
77k
最新技術に積極チャレンジ！EKS共通基盤のこれまでとこれから
Avatar for 高棹大樹 daitak
0
300
AIエージェントの開発・提供におけるセキュリティリスクの論点と対策
Avatar for GMO Flatt Security flatt_security
1
480

Featured

See All Featured
Un-Boring Meetings
Avatar for Sebastian Deterding codingconduct
0
410
Templates, Plugins, & Blocks: Oh My! Creating the theme that thinks of everything
Avatar for Michelle Schulp Hunt marktimemedia
31
2.9k
SERP Conf. Vienna - Web Accessibility: Optimizing for Inclusivity and SEO
Avatar for Sara Fernández Carmona sarafernandez
2
1.6k
How to make the Groovebox
Avatar for あそなす asonas
2
2.4k
How to Grow Your eCommerce with AI & Automation
Avatar for Katarina Dahlin katarinadahlin
PRO
1
260
Building Applications with DynamoDB
Avatar for Matt Wood mza
96
7.2k
Primal Persuasion: How to Engage the Brain for Learning That Lasts
Avatar for Mike Taylor tmiket
0
440
Producing Creativity
Avatar for Steve Smith orderedlist
PRO
348
41k
Java REST API Framework Comparison - PWX 2021
Avatar for Matt Raible mraible
34
9.7k
New Earth Scene 8
Avatar for Sydney Stone popppiees
3
2.5k
The Illustrated Children's Guide to Kubernetes
Avatar for Chris Short chrisshort
51
53k
Code Reviewing Like a Champion
Avatar for maltzj maltzj
528
40k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8