Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
65
1

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.8k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
800
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
660
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.3k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
330
Fuzzing 101
Avatar for LJP-TW ljptw
1
260
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
340
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
210
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
160

Other Decks in Technology

See All in Technology
MulticaとPi Coding Agentで、小規模OSSを30本同時運用した流れ
Avatar for eiei114 eiei114
0
110
【CEDEC2026】『Relink』を拡張せよ - 『GRANBLUE FANTASY: Relink - Endless Ragnarok』の開発速度と品質を守るCI運用
Avatar for Cygames, Inc. cygames
PRO
0
180
MIRU 2026 チュートリアル
Avatar for Keisuke Fujii keisuke198619
0
910
Forza Horizon 6 のテレメトリ機能で 自動運転に使えそうな学習データを集める話
Avatar for henjin0 henjin0
0
180
攻撃と防御で学ぶAI時代のプロダクトセキュリティ演習
Avatar for Recruit recruitengineers
PRO
9
2.8k
Webアクセシビリティ入門 2026
Avatar for Recruit recruitengineers
PRO
3
570
クラウドセキュリティ入門　～安全なクラウド利用のための基礎知識～
Avatar for LHazy lhazy
13
13k
え？フロントエンドエンジニアの ワイがインフラも！？
Avatar for puku0x puku0x
1
580
【CEDEC2026】『ウマ娘 プリティーダービー』 英語版のキャラクターの方言や口調をローカライズするための創造的アプローチ
Avatar for Cygames, Inc. cygames
PRO
2
970
サイバー捜査員研修（前半）
Avatar for Nomizo Nomizo nomizone
1
2k
Service Connect 上のサービスに ECS Service の外側から到達できなかった話
Avatar for Itaru Ota ota1022
1
250
【AG-UI × A2UI × MCP Apps】Generative UIをやさしく解説する
Avatar for NRI Netcom nrinetcom
PRO
1
120

Featured

See All Featured
Why Your Marketing Sucks and What You Can Do About It - Sophie Logan
Avatar for Sophie Logan marketingsoph
0
380
Docker and Python
Avatar for Tania Allard trallard
47
4.1k
Ruling the World: When Life Gets Gamed
Avatar for Sebastian Deterding codingconduct
0
300
brightonSEO & MeasureFest 2025 - Christian Goodrich - Winning strategies for Black Friday CRO & PPC
Avatar for Christian Goodrich cargoodrich
3
770
Designing Experiences People Love
Avatar for Jonathan Moore moore
143
24k
Technical Leadership for Architectural Decision Making
Avatar for Kenny Baas-Schwegler baasie
3
480
Highjacked: Video Game Concept Design
Avatar for Ryan Kendrick rkendrick25
PRO
1
430
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
Avatar for mongodb mongodb
49
10k
So, you think you're a good person
Avatar for Per Axbom axbom
PRO
2
2.1k
Effective software design: The role of men in debugging patriarchy in IT @ Voxxed Days AMS
Avatar for Kenny Baas-Schwegler baasie
0
470
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.5k
Making the Leap to Tech Lead
Avatar for Ryan Cromwell cromwellryan
135
10k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8