Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic 補充篇

Sponsored · Ship Features Fearlessly Turn features on and off without deploys. Used by thousands of Ruby developers. →
Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
1
50

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021
Tweet

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.7k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
730
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
590
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.2k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
290
Fuzzing 101
Avatar for LJP-TW ljptw
1
190
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
290
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
160
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
120

Other Decks in Technology

See All in Technology
三菱UFJ銀行におけるエンタープライズAI駆動開発のリアル / Enterprise AI_Driven Development at MUFG Bank: The Real Story
Avatar for 三菱UFJインフォメーションテクノロジー株式会社 muit
10
20k
フルカイテン株式会社 エンジニア向け採用資料
Avatar for FULL KAITEN fullkaiten
0
10k
[続・営業向け 誰でも話せるOCI セールストーク] AWSよりOCIの優位性が分からない編(2026年2月20日開催)
Avatar for oracle4engineer oracle4engineer
PRO
0
140
Data Hubグループ 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
0
2.8k
「データとの対話」の現在地と未来
Avatar for kobakou kobakou
0
970
Databricksアシスタントが自分で考えて動く時代に! エージェントモード体験もくもく会
Avatar for Takaaki Yayoi taka_aki
0
210
20260222ねこIoTLT　ねこIoTLTをふりかえる
Avatar for フクイ poropinai1966
0
310
バニラVisaギフトカードを棄てるのは結構大変
Avatar for meow meow_noisy
0
160
Agentic Codingの実践とチームで導入するための工夫
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
0
200
【SLO】"多様な期待値" と向き合ってみた
Avatar for kaita z63d
2
260
【2026年版】生成AIによる情報システムへのインパクト
Avatar for Takaaki Yayoi taka_aki
0
190
WBCの解説は生成AIにやらせよう - 生成AIで野球解説者AI Agentを実現する / Baseball Commentator AI Agent for Gemini
Avatar for Shinichi Nakagawa shinyorke
PRO
0
300

Featured

See All Featured
Into the Great Unknown - MozCon
Avatar for Noah Learner thekraken
40
2.3k
Avoiding the “Bad Training, Faster” Trap in the Age of AI
Avatar for Mike Taylor tmiket
0
95
Abbi's Birthday
Avatar for Violet Bock coloredviolet
2
5k
Agile that works and the tools we love
Avatar for Rasmus Luckow-Nielsen rasmusluckow
331
21k
Testing 201, or: Great Expectations
Avatar for Joseph Mastey jmmastey
46
8.1k
Six Lessons from altMBA
Avatar for Skipper Chong Warson skipperchong
29
4.2k
Information Architects: The Missing Link in Design Systems
Avatar for Michelle Chin soysaucechin
0
810
I Don’t Have Time: Getting Over the Fear to Launch Your Podcast
Avatar for Joe Casabona jcasabona
34
2.6k
Claude Code どこまでも/ Claude Code Everywhere
Avatar for nwiizo nwiizo
63
53k
SEO for Brand Visibility & Recognition
Avatar for Aleyda Solis aleyda
0
4.3k
GraphQLとの向き合い方2022年版
Avatar for Yosuke Kurami quramy
50
14k
Java REST API Framework Comparison - PWX 2021
Avatar for Matt Raible mraible
34
9.2k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8