2020 交大程式安全：逆向工程上課講義－第一週(第一段)

৽஛ਓ࠷Ѫٯ޲ ޻ఔ terrynini38514 terrynini

WHO AM I ?

附上⼈權指數 ID : Terrynini38514 ▸ ᪑զ༗ᴍख़ɿ   ٯٯ ▸ ᪑զຑ٢ຑɿ
  ᅳཱަ௨େላ -"#   ࢿిҫ٬ᢛ҆શ੽࢜ላҐላఔ௠ఊӉ ▸ ᜗ඍೳ፤ိਧత౦੢ɿ   ೥ۚ६ᘋף܉   'JSF&ZF'MBSF0O$IBMMFOHFഁ୆ ▸ $5'5FBNɿ   %PVCMF4JHNBʢቮ጗ૺ#BMTOซ吞Խ࡞ଖ݂೑ʣ   #BMTO 3 ᔒরยՄ༻ٹ໋

INTRODUCTION & REVIEW

INSTRODUCTION & REVIEW ೈᱪ ٯ޲޻ఔੋॄኄʁ ▸ ࡏ᠍গݪ࢝ᛰత৘گԼ෼ੳఔࣜతઃܭ ዱҙఔࣜ෼ੳFH8BOOB$SZ ೈᱪߦҝ෼ੳFH[PPN ։ᚙೈᱪपᬑጯ༻FHOPVWFBV
4BNCB 4LZQFQSPUPDPM 挖۷ೈᱪ࿙ಎFH8JOEPXT J1IPOF ඇ๏ߦҝFHᓘ൛ೈᱪ ,FZHFO ೺खػ༡ፍཫతషᅷ৲ग़ိ์ਐUFMFHSBN 5

▸ ⃧Ճٯ޲޻ఔత੒ຊ Ճີ ᧋ࢮ ޡಋ ఔࣜᛰࠞᔿ ࢖ࣥߦ檔೉Ҏऔಘ ៃৗੑߋ৽ INSTRODUCTION &
REVIEW ఍ڔٯ޲޻ఔ 6

INSTRODUCTION & REVIEW ओཁ෼ੳํ๏ ▸ ᯩଶ෼ੳ ෆࣥߦ໨ඪఔࣜɼ௚઀෼ੳఔࣜతࣥߦ檔 ෼ੳQSPHSBN ▸ ಈଶ෼ੳ
׬੔҃෦෼ࣥߦ໨ඪఔࣜɼ௚઀҃ؒ઀᧺࡯ଖߦҝ ෼ੳQSPDFTT 7

INSTRODUCTION & REVIEW ओཁ෼ੳ޻۩ ᯩଶ෼ੳ *%"QSP   و ை ڧେ
(IJESB ݐٞ՝ಊத࢖༻   /4"։ݯ޻۩ +BWB SBEBSF   ։ݯ޻۩ $-* 8 ಈଶ෼ੳ 8JOECHQSFWJFX   ڧେ YECH ݐٞ՝ಊத࢖༻   (6* ։ݯ޻۩ Ꮇॆޭೳ HEC ݐٞ՝ಊத࢖༻   $-* ڧେ FEC   (6* ෆश׳$-*ՄҎઌࢼࢼ

▸ Accumulator register ▸ Base register ▸ Counter register ▸
Data register ▸ Source Index ▸ Destination Index ▸ Stack Pointer ▸ Stack Base Pointer ▸ Instruction Pointer INSTRODUCTION & REVIEW Y *" SFHJTUFS 9 ") "- #) #- $) $- %) %- 4* %* 41 #1 "9 #9 $9 %9 &"9 CJUT CJUT CJUT &#9 &$9 &%9 &4* &%* &41 &#1 &*1

INSTRODUCTION & REVIEW Y ".% SFHJTUFS 10 ▸ additional
r8~r15 &"9 ") "- &#9 #) #- &$9 $) $- &%9 %) %- &4* TJM &%* EJM &41 TQM &#1 CQM 3E 3C "9 #9 $9 %9 3"9 CJUT CJUT CJUT 3#9 3$9 3%9 34* 3%* 341 3#1 3 3*1 CJUT 38 #1 41 %* 4*

INSTRODUCTION & REVIEW 4FHNFOU3FHJTUFST ▸ CS, DS, SS, ES, FS,
GS ▸ cs:0x1000 (= 0x31000) ▸ OS use flat memory model nowadays ▸ Segment Register no longer represent the base of a segment, but the index in Descriptor Table 11

INSTRODUCTION & REVIEW *OTUSVDUJPO 12

INSTRODUCTION & REVIEW '-"(4SFHJTUFS &'-"(4 3'-"(4 ▸ Zero Flag set
if result is 0 e.g. 100-100=0 ▸ Carry Flag set if carry of borrow a bit beyond the size of register e.g. 0 - 1 = 4294967295 e.g. 4294967295 + 1 = 0 14

INSTRODUCTION & REVIEW '-"(4SFHJTUFS &'-"(4 3'-"(4 ▸ Overflow Flag set
if singed result overflow e.g. 2147483647 + 1 = - 2147483648 ▸ Sign Flag set if operation result is negative (sign bit is 1) e.g. 0 - 1 = -1 15

INSTRODUCTION & REVIEW '-"(4SFHJTUFS &'-"(4 3'-"(4 16 ;' $'
୅ද݁Ռ '"-4& 536& FBYFCY '"-4& '"-4& FBYFCY 536& '"-4& FBYFCY &'-"( ୅ද݁Ռ TJHOGMBHʺPWFSGMPXGMBH FBYFCY TJHOGMBHPWFSGMPXGMBH FBYFCY ;'5SVF FBYFCY cmp eax, ebx 無號整數有號整數 compare 時並不管有號還無號、flag 全部會設好，Jcc 指令決定看什麼

INSTRODUCTION & REVIEW +DD 17 無號整數有號整數 JA Jump
if above JNBE Jump if not below or not equal ( Jump if above) JAE Jump if above or equal JNB Jump if not below (=JAE) JB Jump if below JNAE Jump if not above or not equal(=JB) JBE Jump if below or equal JNA Jump if not above(=JBE) JG Jump if greater JNLE Jump if not less or not equal(=JG) JGE Jump if greater or equal JNL Jump if not less (=JGE) JL Jump if less JNGE Jump if not greater or not equal(=JL) JLE Jump if less or equal JNG Jump if not greater (=JLE) JE Jump if equal JNE Jump if not equal JMP 不管，跳普通其他 JC Jump if carry flag set JS Jump if sign flag set 各種...

INSTRODUCTION & REVIEW *OTUSVDUJPO 20 Intel syntax ebx =
100 的概念 AT&T syntax 100 -> ebx 的概念

ABEX'S CRACKME #1

HELLO 1SPHSBN &OUSZ1PJOU 4UVC$PEF .BJOඇ.BJO 23

HELLO ፙ౸᮫ݤDPEFతํ๏ ▸ ௚઀׈ىိ ▸ ਘፙჩᏐ TUSJOHPSNBHJDOVNCFS ▸ #SFBLPO"1*
▸ #SFBLJO"1* SVOUJNFQBDLFS QSPUFDUPS 24

BABY STEP

▸ Ұݸઅᴍ୅දҰݸ## #BTJD#MPDL ▸ ##୞༗ҰݸೖޱᴍҎٴग़ޱᴍ ▸ ##बੋJOTUSVDUJPOతTFRVFODF ▸ ##தҰݸJOTUSVDUJPOతࣥߦ҉ࣔྃಉ
  ##தతଖଞJOTUSVDUJPOቮៃ҃ଈሡඃࣥߦ   ʢෆߟྀFYDFQUJPOʣ BABY STEP $POUSPMGMPXHSBQI 26

▸ 這是⼀個平淡無奇的 BB (Basic Block) BABY STEP $POUSPMGMPXHSBQI 27
mov edi, offset s ;"Do the right thing" call _puts jmp short loc_4008AB

▸ 這是⼀個不知道要往哪的 BB BABY STEP $POUSPMGMPXHSBQI 28 mov eax,
[rbp+var_7C] movsxd rbx, eax lea rax, [rbp+ptr] mov rdi, rax call _strlen cmp rbx, rax jb short loc_400838 true branch false branch

BABY STEP $POUSPMGMPXHSBQI 29 cmp rbx, rax jb short
loc_400838 true branch false branch add rbx, 1 ▸ 這是⼀個走回頭路的 BB

C DPNQJMFXBMLUISPVHIU 31 HelloWorld.c HelloWorld.i HelloWorld.s ߶ላ။$తզ HelloWorld.o Library
*.obj HelloWorld 1SFQSPDFTTPSલ႔ཧث $PNQJMFSฤᩄث "TTFNCMFS૊ᩄث -JOLFS࿈݁ث 1SFQSPDFTT $PNQJMF "TTFNCMF -JOL

C JG 32

C JGFMTF 33

PRACTICE

2020 交大程式安全：逆向工程上課講義－第一週(第一段)

2020 交大程式安全：逆向工程上課講義－第一週(第一段)

More Decks by terrynini

Other Decks in Technology

Featured

Transcript