৽஛ਓ࠷Ѫٯ޲ ޻ఔ terrynini38514 terrynini

WHO AM I ?

附上⼈權指數 ID : Terrynini38514 ▸ ᪑զ༗ᴍख़ɿ 
 ٯٯ ▸ ᪑զຑ٢ຑɿ 
 ᅳཱަ௨େላ  -"# 
 ࢿిҫ٬ᢛ҆શ੽࢜ላҐላఔ௠ఊӉ ▸ ᜗ඍೳ፤ိਧత౦੢ɿ 
 ೥ۚ६ᘋף܉ 
 'JSF&ZF'MBSF0O$IBMMFOHFഁ୆ ▸ $5'5FBNɿ 
 %PVCMF4JHNBʢቮ጗ૺ#BMTOซ吞Խ࡞ଖ݂೑ʣ 
 #BMTO  3 ᔒরยՄ༻ٹ໋

C 4XJUDI MFTTUIBODBTF  4

C 4XJUDI NPSFUIBODBTF PSEFSFE OPQJF  5

C 4XJUDI NPSFUIBODBTF PSEFSFE QJF  6

C 4XJUDI NPSFUIBODBTF PSEFSFE QJF  7 ▸ 補⼀張 jump table 在這裡

DEMO?

C 4XJUDI NPSFUIBODBTF SBOEPN  9

DEMO?

C EPXIJMFMPPQ  11

C XIJMFMPPQ  12

C GPSMPPQ  13

PRACTICE-02

MEMORY

MEMORY &OEJBO  16 low memory address high memory address 0x12345678 高位 低位 1 byte 1 byte 1 byte 1 byte 1 byte . . .

MEMORY &OEJBO  17 low memory address high memory address 0x12 0x34 0x56 0x78 0x12345678 高位 低位

MEMORY -JUUMF&OEJBO  18 low memory address high memory address 0x12 0x34 0x56 0x78 0x12345678 高位 低位 低位 高位

MEMORY -JUUMF&OEJBO  19 low memory address high memory address 0x12 0x34 0x56 0x78 低位 高位 rax -> byte ptr [rax] word ptr [rax] 0x78 0x5678 0x12345678 dword ptr [rax] qword ptr [rax] oword ptr [rax]

STACK FRAME

BABY STEP 4UBDL'SBNF "CTUSBDUJPO  21 main's stack frame high memory address bossA's stack frame bossB's stack frame grows up toward 0 low memory address

BABY STEP 4UBDL'SBNF "CTUSBDUJPO  22 main's stack frame high memory address bossA's stack frame bossB's stack frame grows up toward 0 low memory address

BABY STEP 4UBDL'SBNF  23 low memory address high memory address highlight means RIP points to here ʢ၊ઃզ၇త༌ೖੋYʣ

BABY STEP 4UBDL'SBNF  24 low memory address high memory address highlight means RIP points to here 0x40 0x1000 esp -> ʢ၊ઃզ၇త༌ೖੋYʣ

BABY STEP 4UBDL'SBNF  25 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address 0xffc esp -> 0x1000

BABY STEP 4UBDL'SBNF  26 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address esp -> 0xffc 0x1000

BABY STEP 4UBDL'SBNF  27 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp 0xff8 esp -> 0xffc 0x1000

BABY STEP 4UBDL'SBNF  28 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> 0xff8 0xffc 0x1000

BABY STEP 4UBDL'SBNF  29 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> buffer for bossA's local variables 0xfe0 0xff8 0xffc 0x1000

BABY STEP 4UBDL'SBNF  30 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> buffer for bossA's local variables 0xff8 0xffc 0x1000 eax: 0x40 0xfe0

BABY STEP 4UBDL'SBNF  31 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> buffer for bossA's local variables 0xff8 0xffc 0x1000 eax: 0x40 SKIP SOME OPERATIONS ! //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// ///////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 0xfe0

BABY STEP 4UBDL'SBNF  32 low memory address high memory address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> buffer for bossA's local variables 0xff8 0xffc 0x1000 eax: 0x20 0xfe0