Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Binary Exploitation - Basic 補充篇

Sponsored · SiteGround - Reliable hosting with speed, security, and support you can count on. →
Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
78
1

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.9k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
860
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
690
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.3k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
350
Fuzzing 101
Avatar for LJP-TW ljptw
1
280
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
390
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
230
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
190

Other Decks in Technology

See All in Technology
大型犬好きによるPugの紹介
Avatar for yamanoku yamanoku
1
150
「Docker Desktop不要の時代」は 来たのか？
Avatar for ueponx ueponx
0
630
Cognition AI Japan - ウェビナー2_テストQA_運用監視
Avatar for Akira Shibata cogakira
0
140
PagerDuty Tech Hub-鳴らすけれど、人は動かない
Avatar for shinji ezaki ezaki
0
130
AI時代に必要な脅威モデリング― 変化の速度に負けない理解とリスク判断
Avatar for masakane55 masakane55
5
1.3k
今さら理解するウェブフォントver.2026
Avatar for takanorip takanorip
3
690
[JAWS-UG彩の国埼玉#12]そろそろ準備する？re:Invent2026をやさしく解説 / reinvent2026-sainokuni
Avatar for sh_fk2 sh_fk2
1
110
メルペイ 会計システム概要と歴史
Avatar for mewuto mewuto
1
220
味覇で作るパスタが美味い - 20261001_yabaubuki.dev
Avatar for Livesense Inc. livesense
PRO
0
130
事業成長とデータ活用を止めないためのマネジメントへ挑戦
Avatar for Noriaki Hiraki hiracky16
0
330
Snapshot Testing in Practice: Predictable and Reliable SwiftUI Views
Avatar for Felipe Espinoza fespinoza
0
210
事業活動を AI Ready にする攻めと守りのデータエンジニアリング / data-engineering-for-ai-ready-business
Avatar for pei0804 pei0804
7
2.7k

Featured

See All Featured
Un-Boring Meetings
Avatar for Sebastian Deterding codingconduct
0
450
A Modern Web Designer's Workflow
Avatar for Chris Coyier chriscoyier
699
190k
Mozcon NYC 2025: Stop Losing SEO Traffic
Avatar for Sam Torres samtorres
1
570
Skip the Path - Find Your Career Trail
Avatar for Mark Kilby mkilby
1
250
Joys of Absence: A Defence of Solitary Play
Avatar for Sebastian Deterding codingconduct
1
550
The Art of Delivering Value - GDevCon NA Keynote
Avatar for David Neal reverentgeek
16
2.2k
Navigating the moral maze — ethical principles for Al-driven product design
Avatar for Skipper Chong Warson skipperchong
2
630
Agile that works and the tools we love
Avatar for Rasmus Luckow-Nielsen rasmusluckow
331
22k
Claude Code のすすめ
Avatar for schroneko schroneko
67
230k
GitHub's CSS Performance
Avatar for Jon Rohan jonrohan
1033
470k
Code Review Best Practice
Avatar for Trisha Gee trishagee
74
20k
"I'm Feeling Lucky" - Building Great Search Experiences for Today's Users (#IAC19)
Avatar for Dan Newman danielanewman
230
23k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8