社課-組合語言.pdf

Transcript

1. 快跟我回洞穴 組合語言歷險記 Fox@HackerSir
2. 前測表單 一素 正 ,像 張形 方 含 的有 圖片 樣式 自動產生的描述
3. whoami • Fox • 11 th 學術部 • 研究方向 ◦ 競程 ◦ Reverse ◦ ML
4. Outline • What is Assembly • Why learn Assembly • Assembly Syntax • Stack Frame
5. 程式語言演化 最 接 近 電 腦 核 心 機器語言 0101000101111 0010010100101 0010010101001 0100010100101 0101011111010 10101011110… Machine code 低階語言 push mov sub mov pop ret ebp ebp,esp esp,0x10 esp, ebp ebp Assembly 高階語言 int main(){ // there is c return 0; } C / C++ 最 遠 離 電 腦 核 心
6. 組合語言 • Assembly Language (ASM) • 組語、組合語言 • 只要會看，不用會寫 push mov sub mov mov mov mov mov mov call mov mov call mov leave ret rbp rbp,rsp rsp,0x10 DWORD PTR [rbp-0xc],0x5 DWORD PTR [rbp-0x8],0x3 edx,DWORD PTR [rbp-0x8] eax,DWORD PTR [rbp-0xc] esi,edx edi,eax 1129 <func1> DWORD PTR [rbp-0x4],eax eax,0x0 1149 <func2> eax,DWORD PTR [rbp-0x4]
7. Why learn ASM • Compile 的中間產物 • Reverse Engineering 的基礎 • Disassemble 的產物 • Reverse 無法完全轉回高階語言
8. Compiler 組譯器 Assembler 編譯器 Compiler 原始碼 Source Code File 目的碼 Object File 組合語言 Asm Code File 連結器 Linker 可執行檔 Executable File 外部函式庫 / 檔案 External Library / Object File
9. Reverse 組譯器 Assembler 編譯器 Compiler 原始碼 Source Code File 組合語言 Asm Code File 目的碼 Object File 反組譯器 Reverse Disassembler 連結器 Linker 可執行檔 Executable File 外部函式庫 / 檔案 External Library / Object File
10. Learning ASM • 暫存器 Register • 基本指令 Instructions • 條件判斷 Condition • 呼叫函式 Call Function • 堆疊幀 Stack Frame
11. Compile Explorer • Compile Explorer: godbolt.org • 可以線上將程式碼轉成 ASM
12. ELF • • Executable and Linkable Format 在 Unix 環境下可執行檔 ELF Header Program Header Table .text .data sections .rodata .bss Section Header Table
13. Sections Sections 用途 .bss 存放未初始化全域變數 .data 存放初始化全域變數 .rodata 存放只可讀不可寫的資料 .text 存放編譯過後的程式碼
14. Sections .bss 未初始全域 .data 初始化全域 .rodata 可讀不可寫 .text 程式碼
15. Sections .bss .bss 未初始全域 .data 初始化全域 .rodata 可讀不可寫 .text 程式碼
16. Sections .bss .data .bss 未初始全域 .data 初始化全域 .rodata 可讀不可寫 .text 程式碼
17. Sections .bss .data .rodata .bss 未初始全域 .data 初始化全域 .rodata 可讀不可寫 .text 程式碼
18. Sections .bss .data .rodata .bss 未初始全域 .data 初始化全域 .rodata 可讀不可寫 .text 程式碼 .text
19. Sections $gcc -c helloworld.c //編譯程式到物件檔，不進行連結 $objdump –h helloworld.o //列出所有 sections $objdump -s helloworld.o //顯示 sections 中的內容 $objdump -M intel –d helloworld.o //反組譯程式碼區段
20. Asm Syntax INTEL AT&T 暫存器 eax %eax 立即值 1 $1 指令 mov movb, movw, movl, movq 參數順序 mov eax, 1 movl $1, %eax 記憶體循址 mov eax, [ebp+0x8] movl (%ebp+0x8), %eax
21. Asm Register 暫存器大小 術語 資料型態 64 bits (8 bytes) QWORD (Quad Word) (unsigned) long long, double 32 bits (4 bytes) DWORD (Double Word) (unsigned) int, float 16 bits (2 bytes) WORD (unsigned) short 8 bits (1 byte) BYTE char, bool
22. Register – X64 Register ax, bx, cx, dx, di, si, bp, sp r8~r15 64 bits (8 bytes) 前綴加 r Ex. rax, rdi 不變 Ex. r8 32 bits (4 bytes) 前綴加 e Ex. eax, edi 後綴加 D Ex. r8d 16 bits (2 bytes) 不變 Ex. ax, di 後綴加 W Ex. r8d 8 bits (1 byte) X 取代成 H/L I/P，後綴加 L Ex. ah, al 後綴加 B Ex. r8b
23. Register 64bits 32bits 16bits rax eax ax rax: 0x00112233445566778899AABBCCDDEEFF eax: 0x8899AABBCCDDEEFF ax: 0xCCDDEEFF al: 0xEEFF ah al 8bits
24. Register 種類 名稱 功用 通用暫存器 運算、計數器 區段暫存器 指向記憶體區段 指標暫存器 指向堆疊或陣列 旗標暫存器 紀錄運算狀態
25. 通用暫存器 暫存器 作用 ax 累加器 最常用，用於算術和傳輸 bx 基底暫存器 通常用於存放記憶體位置 cx 記數暫存器 通常用於計數用途，例如迴圈 dx 資料暫存器 通常用於存放資料，特別有關輸入輸出
26. 區段暫存器 暫存器 作用 cs 程式碼區段 儲存程式碼所在區塊，搭配 ip ds 資料區段 儲存資料所在區塊，存放變數或陣列，搭配 si ss 堆疊區段 儲存 Stack 所在區塊，搭配 sp、bp
27. 指標暫存器 暫存器 作用 si 來源索引暫存器 保存資料來源的記憶體位址 di 目的索引暫存器 保存資料目的的記憶體位址 bp 基底指標暫存器 指向 Stack 的底部 sp 堆疊指標暫存器 指向 Stack 的頂部 ip 指令指標暫存器 指向下一條即將執行的指令位置
28. 指標暫存器 bp ip sp Code Segment Data Segment Stack Segment 程式碼區段 資料區段 堆疊區段
29. 旗標暫存器 • 用於檢測算術運算後的結果 • 可以用於條件判斷 暫存器 說明 運算後 CF 進位旗標 Carry Flag 最高位需要進位或借位 1, 否則 0 PF 奇偶旗標 Parity Flag 最低 8 位元數量 奇數個 1, 否則 0 AF 輔助進位旗標 Auxiliary Flag 檢測第 3 位是否產生進位或借位 為 1, 否則 0 ZF 零旗標 Zero Flag 結果為零時 設定 ZF=1, 否則 0
30. 旗標暫存器 暫存器 說明 SF 符號旗標 Sign Flag 運算後為負數為 1, 否則 0 OF 溢位旗標 Overflow Flag 檢測有號數運算後溢位為 1 ， 否則為 0 TF 陷阱旗標 Trap Flag 當 TF = 1 時，進入單步執 行模式，用於 debug DF 方向旗標 Direction Flag DF = 1 時，字串處理地址由 低到高，反之 IF 中斷旗標 Interrupt Flag IF = 1 時，允許硬體中斷
31. Asm instruction 指令 說明 例子 push 將資料推進 stack push rbp pop 將資料從 stack 推出放進 rbp pop rbp mov 將 eax 的資料放到 ebx mov ebx, eax lea 將 var 記憶體位置載入 eax lea eax, [var] nop nothing nop
32. Asm instruction 指令 說明 例子 inc 加1 inc eax dec 減1 dec eax add 相加 add eax, 0x1 sub 相減 sub eax, 0x1 mul 相乘 mul eax, 0x2 div 相除 div eax, 0x2 shl/shr 左移/右移 shl eax, 4
33. Call function • call func • x86: 將變數 push 到 stack • x64: 將變數儲存在 register
34. Calling Convention • 參數會各別放到以下 register 參數傳遞 64 bits register • 回傳值放到 eax 1st rdi • godbolt 2nd rsi 3rd rdx 4th rcx 5th r8 6th r9 7th ~ 推入堆疊中
35. Stack Frame Low • Stack Frame 會從高到低堆 • Stack Frame 中會儲存 Function 資料 ◦ Local Variable • rsp 指向目前 Frame 頂點 • rbp 指向目前 Frame 底端 rsp Stack Frame 3 rbp Stack Frame 2 Stack Frame 1 High
36. Stack Frame • rip 前置 call func Main: ... call Func add rax, 10h #0x001100 ... Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rsp Prev Stack Frame rbp
37. Stack Frame • 前置 call func Main: ... call Func add rax, 10h #0x001100 ... Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rip push next_inst jmp Func next_inst (0x001100) rsp Prev Stack Frame rbp
38. Stack Frame • 前置 call func Main: ... call Func add rax, 10h #0x001100 ... Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rip push next_inst jmp Func next_inst (0x001100) rsp Prev Stack Frame rbp
39. Stack Frame • 進入 Func Main: ... call Func add rax, 10h #0x001100 ... rip Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret Prev rbp rsp next_inst (0x001100) Prev Stack Frame rbp
40. Stack Frame • 進入 Func Main: ... call Func add rax, 10h #0x001100 ... rip Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret Prev rbp next_inst (0x001100) Prev Stack Frame rsp rbp
41. Stack Frame • 進入 Func Main: ... call Func add rax, 10h #0x001100 ... rsp New Space rip Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rbp Prev rbp next_inst (0x001100) Prev Stack Frame
42. Stack Frame • 退出 Func Main: ... call Func add rax, 10h #0x001100 ... rsp New Space rip Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rbp Prev rbp next_inst (0x001100) Prev Stack Frame
43. Stack Frame • 退出 Func Main: ... call Func add rax, 10h #0x001100 ... rip mov rsp, rbp pop Not Assessible Func1: push rbp mov rbp, rsp sub rsp, 10h ... leave ret Prev rbp next_inst (0x001100) Prev Stack Frame rbp rsp
44. Stack Frame • 退出 Func Main: ... call Func add rax, 10h #0x001100 ... Func1: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rip mov rsp, rbp pop Not Assessible rsp next_inst (0x001100) Prev Stack Frame rbp
45. Stack Frame • 退出 Func Main: ... call Func add rax, 10h #0x001100 ... Func1: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rip pop rip Not Assessible rsp next_inst (0x001100) Prev Stack Frame rbp
46. Stack Frame • rip 退出 Func Main: ... call Func add rax, 10h #0x001100 ... Func: push rbp mov rbp, rsp sub rsp, 10h ... leave ret rsp Prev Stack Frame rbp
47. 題目1 • 呼叫 func(1234, 9846, 821091, 8562, 655521, 7985) • 請問他的回傳值，並轉成 hex • Hint: Calling Convention，若答案 = 175， 則 Flag 為 HackerSir{0xAF} • 題目
48. 題目2 • 呼叫 func(100) • 請問他的回傳值，並轉成 hex • Hint: basic instruction • 題目
49. 題目1 • 參數 edi -> esi -> edx -> ecx -> r8d -> r9d • 回傳值 eax RBP-0x18 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: mov DWORD PTR [rbp-0x8],esi 1157: mov DWORD PTR [rbp-0xc],edx 115a: mov DWORD PTR [rbp-0x10],ecx 115d: mov DWORD PTR [rbp-0x14],r8d 1161: mov DWORD PTR [rbp-0x18],r9d 1165: mov eax,DWORD PTR [rbp-0xc] 1168: pop rbp 1169: ret RBP-0x14 RBP-0x10 RBP-0xc RBP-0x8 RBP-0x4 r9d r8d ecx edx esi edi Prev rbp next_inst Prev Stack Frame rbp
50. 題目1 • 參數 edi -> esi -> edx -> ecx -> r8d -> r9d • 回傳值 eax RBP-0x18 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: mov DWORD PTR [rbp-0x8],esi 1157: mov DWORD PTR [rbp-0xc],edx 115a: mov DWORD PTR [rbp-0x10],ecx 115d: mov DWORD PTR [rbp-0x14],r8d 1161: mov DWORD PTR [rbp-0x18],r9d 1165: mov eax,DWORD PTR [rbp-0xc] 1168: pop rbp 1169: ret RBP-0x14 RBP-0x10 RBP-0xc RBP-0x8 RBP-0x4 7985 655521 8562 821091 9846 1234 Prev rbp next_inst Prev Stack Frame rbp
51. 題目2 • [rbp-0x14] = edi = 100 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
52. 題目2 • [rbp-0x14] = 100 • [rbp-0x4] = 0x6 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
53. 題目2 • [rbp-0x14] = 100 • [rbp-0x4] = 0x6 • eax = [rbp-0x4] = 0x6 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
54. 題目2 • [rbp-0x14] = 100 + eax = 106 • [rbp-0x4] = 0x6 • eax = 0x6 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
55. 題目2 • [rbp-0x14] = 106 • [rbp-0x4] = 0x26 • eax = 0x6 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
56. 題目2 • [rbp-0x14] = 106 • [rbp-0x4] = 0x26 • eax = [rbp-0x14] = 106 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
57. 題目2 • [rbp-0x14] = 106 • [rbp-0x4] = 0x26 • eax = 106 - [rbp-0x4] = 68 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
58. 題目2 • [rbp-0x14] = 106 • [rbp-0x4] = eax = 68 • eax = 68 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
59. 題目2 • [rbp-0x14] = 106 • [rbp-0x4] = 68 • eax = [rbp-0x4] = 68 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
60. 題目2 • [rbp-0x14] = 106 – eax = 38 • [rbp-0x4] = 68 • eax = 68 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
61. 題目2 • [rbp-0x14] = 38 • [rbp-0x4] = 68 • eax = [rbp-0x4] = 68 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x14],edi 1154: mov DWORD PTR [rbp-0x4],0x6 115b: mov eax,DWORD PTR [rbp-0x4] 115e: add DWORD PTR [rbp-0x14],eax 1161: mov DWORD PTR [rbp-0x4],0x26 1168: mov eax,DWORD PTR [rbp-0x14] 116b: sub eax,DWORD PTR [rbp-0x4] 116e: mov DWORD PTR [rbp-0x4],eax 1171: mov eax,DWORD PTR [rbp-0x4] 1174: sub DWORD PTR [rbp-0x14],eax 1177: mov eax,DWORD PTR [rbp-0x4] 117a: pop rbp 117b: ret
62. Asm instruction 指令 說明 例子 cmp 相減比較 設定 ZF, CF cmp eax, ebx test 由 & 比較兩數 設定 SF, ZF, PF test eax, ebx jmp 跳轉到指定 address jmp 0x001234
63. JCC • Jump Condition Code • 可以當作條件判斷 • 搭配 cmp 或 test 設定 flag register
64. JCC ZF 相減後 = 0 為 1, 否則 0 SF 運算後為負數為 1, 否則 0 OF 檢測有號數運算後溢位為 1, 否則為 0 符號 指令 說明 條件 == je jump if equal ZF = 1 != jne jump if not equal ZF = 0
65. JCC for signed number 符號 指令 說明 條件 > jg jump if greater ZF = 0 and SF = OF >= jge jump if greater or equal SF = OF < jl jump if less SF != OF <= jle jump if less or equal ZF = 1 or SF != OF ZF 相減後 = 0 為 1, 否則 0 SF 運算後為負數為 1, 否則 0 OF 檢測有號數運算後溢位為 1, 否則為 0
66. 題目3 • 呼叫 func(54) • 請問他的回傳值，並轉成 hex • Hint: jump and jcc • 題目
67. 題目3 • [rbp-0x4] = edi = 54 = 0x36 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
68. 題目3 • [rbp-0x4] = 0x36 • if [rbp-0x4] <= 0x2c jump 117c • else nop <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
69. 題目3 • [rbp-0x4] = 0x36 • if [rbp-0x4] == 0x36 jump 116f <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
70. 題目3 • [rbp-0x4] = 0x36 • if [rbp-0x4] > 0x40 jump 1168 • else nop <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
71. 題目3 • [rbp-0x4] = 0x36 + 0xa = 0x40 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
72. 題目3 • [rbp-0x4] = 0x40 • jump 1182 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
73. 題目3 • [rbp-0x4] = 0x40 • edx = [rbp-0x4] = 0x40 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
74. 題目3 • [rbp-0x4] = 0x40 • edx = 0x40 • eax = edx = 0x40 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
75. 題目3 • [rbp-0x4] = 0x40 • edx = 0x40 • eax = eax + eax = 0x80 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
76. 題目3 • [rbp-0x4] = 0x40 • edx = 0x40 • eax = eax + edx = 0xc0 <func>: 1149: endbr64 114d: push rbp 114e: mov rbp,rsp 1151: mov DWORD PTR [rbp-0x4],edi 1154: cmp DWORD PTR [rbp-0x4],0x2c 1158: jle 117c <func+0x33> 115a: cmp DWORD PTR [rbp-0x4],0x36 115f: je 116f <func+0x26> 1161: add DWORD PTR [rbp-0x4],0xa 1165: jmp 117d <func+0x34> 1168: mov eax,0x7b 116d: jmp 118b <func+0x42> 116f: cmp DWORD PTR [rbp-0x4],0x40 1174: jg 1168 <func+0x1f> 1176: add DWORD PTR [rbp-0x4],0xa 117a: jmp 1182 <func+0x39> 117d: add DWORD PTR [rbp-0x4],0xa 1182: mov edx,DWORD PTR [rbp-0x4] 1185: mov eax,edx 1187: add eax,eax 1189: add eax,edx 118b: pop rbp 118c: ret
77. 後測表單 一字 正 像 ,填 張遊 方 素 含戲 形 有 的 樣圖 式片 自動產生的描述