Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic 補充篇

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
63
1

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.8k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
800
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
650
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.3k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
330
Fuzzing 101
Avatar for LJP-TW ljptw
1
250
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
330
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
200
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
160

Other Decks in Technology

See All in Technology
StepFunctionsとGraphRAGを活用した暗黙知活用のためのRAG基盤
Avatar for やくも yakumo
0
150
第67回コンピュータビジョン勉強会CVPR2026読会前編
Avatar for TSUKAMOTO Kenji tsukamotokenji
0
170
そのドキュメント、自動化しませんか？
Avatar for yuk yuksew
1
420
Playwright × AI Agent でE2Eテストはどう変わるか AI駆動テストの可能性と実用検証の結果
Avatar for Taiga Oyu taiga7543
2
820
2年前に削除したPHPクラスが、 ある日突然決済をエラーにした
Avatar for ykagano ykagano
1
800
[Droidcon Orlando '26] The Android Lens: Applying Mobile Forensics to AI Performance
Avatar for mvndy_hd amanda_hinchman
1
110
”AIを使う” から ”AIに任せる” へ ─ 開発プロセスを再設計してAIを組織標準にするまで
Avatar for CyberAgent cyberagentdevelopers
PRO
2
140
SRENEXT_2026_Chairs__Talks_in_Tamachi.sre.pdf
Avatar for srenext srenext
1
150
Webの技術とガジェットで子どもも大人も楽しめるワクワク体験を提供する / Qiita Tech Festa Day 2026
Avatar for you（@youtoy） you
PRO
1
230
Devsumi 2026 Summer 人もAIも使える共通基盤を事業の加速装置にする～デザインシステム運用に学ぶ組織レバレッジ～ 渡辺 凌央
Avatar for LegalOn Technologies, Inc legalontechnologies
PRO
1
290
Aurora MySQL 8.4リリース！ Rubyistが備えること / what-rubyist-should-prepare-for-aurora-mysql-8-4
Avatar for Yuki Fukuma fkmy
0
930
2026年のソフトウェア開発を考える（2026/07版） / Agentic Software Engineering 2026-07 Findy Edition
Avatar for Takuto Wada twada
PRO
26
11k

Featured

See All Featured
Lessons Learnt from Crawling 1000+ Websites
Avatar for Charles Meaden charlesmeaden
PRO
1
1.4k
Intergalactic Javascript Robots from Outer Space
Avatar for Vicent Martí tanoku
273
27k
Self-Hosted WebAssembly Runtime for Runtime-Neutral Checkpoint/Restore in Edge–Cloud Continuum
Avatar for Yuki Nakata chikuwait chikuwait
0
660
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
72
12k
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
7k
Everyday Curiosity
Avatar for Cassini Nazir cassininazir
0
260
What does AI have to do with Human Rights?
Avatar for Per Axbom axbom
PRO
1
2.3k
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
46
8.2k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
96
14k
Impact Scores and Hybrid Strategies: The future of link building
Avatar for Tamara Novitovic tamaranovitovic
0
340
The agentic SEO stack - context over prompts
Avatar for schlessera schlessera
0
850
How to Ace a Technical Interview
Avatar for Jacob Kaplan-Moss jacobian
281
24k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8