公開用.pdf

Transcript

1. IBSJCPUF04ͷྫʹݟΔ
   খ͞ͳ04ͷϒʔτͷྲྀΕ !ZVZBCV
2. ࣗݾ঺հ #MPH
   IUUQZVZVCVIBUFOBCMPHDPN
   5XJUUFS
   IUUQTUXJUUFSDPNZVZBCV
   ˞εϥΠυʹؒҧͬͨ಺༰͕ೖ͍ͬͯΔ͔΋͠Ε·ͤΜ͕ɺ
   ͓ؾ෇͖ͷ఺͕͋Ε͹Ұํ͍ͩ͘͞
   
3. ର৅ ॳ৺ऀ޲͚
   ɾσόοΨʔ (%# Λ஌͍ͬͯΔ͕࢖ͬͨ͜ͱ͕ͳ͍Ϩϕϧͷਓ
   ɹˠ྘৭ͷςΩετ͸ίϐϖ͙ͯ͢͠࢖͑Δ(%#ͷίϚϯυ
   ɾ04ࣗ࡞ຊΛੵΜಡ͍ͯ͠Δਓ
   ɾ͜Ε͔Βࣗ࡞ຊΛಡΉਓ ͪΐͬͱ೉͍͔͠΋
   ্ڃऀͷਓ͸͋·Γ໘ന͘ͳ͍͔΋͠Εͳ͍Ͱ͢
   ˞೔04ࣗ࡞ຊͷωλόϨؚ͕·ΕΔͷͰ
   ݏͳਓ͸ݟͳ͍Ͱ͍ͩ͘͞ɻ
5. ൃදऀͷ؀ڥ ൃදऀͷ؀ڥ͸ҎԼͷΑ͏ʹͳ͍ͬͯ·͢ɻ ϗετOS:macOS High Sierra 10.13.6 όΠφϦΤσΟλ:0xED MakeFileͳͲ:sandaiࢯ࡞੒(https://github.com/sandai/30nichideosjisaku) QEMU emulator version 2.11.0 haribote OS͸࠷ऴ೔(30೔໨)ͷharibote27fΛ࢖͍ͬͯ·͢ ΋͔ͨ͠͠ΒΈͳ͞Μͷ؀ڥͰ͸ಈ͔ͳ͔ͬͨΓɺ ൃදதͷΞυϨεͳͲ͕ҧ͍ͬͯΔ͔΋͠Ε·ͤΜɻ
6. RFNV
   NPOJUPS
   
   (%#ઃఆ 04ࣗ࡞ຊͷ؀ڥʹ؆୯ʹઃఆՄೳ 1.z_tools/qemu/Makefileʹগ͠ॻ͖଍͢ 2&.6@"3(4
   
   -
   
   N
   
   MPDBMUJNF
   WHB
   TUE
   GEB
   GEJNBHFCJO
   NPOJUPS
   TUEJP
   T
   4
   2.Make runޙɺଞͷίϯιʔϧ͔ΒҎԼͷίϚϯυͰgdbʹ઀ଓ gdb -ex 'target remote localhost:1234'
7. ιʔεΛͪΐͬͱ͚ͩ આ໌
8. 04ͷ̏૚ bootpack.hrb OSͷຊମͬΆ͍ίʔυɻϝϞϦ؅ཧΩʔϘʔυϚϧνλεΫ౳ ιʔε:bootpack.c fifo.c int.c mouse.c tek.c console.c file.c keyboard.c mtask.c timer.c dsctbl.c graphic.c memory.c sheet.c window.c naskfunc.nas IPL(ϒʔτηΫλ) ໾ׂ2ηΫλҎ߱ͷϑϩοϐʔಡΈࠐΈ ιʔεɿipl09.nas asmhead.bin ໾ׂ:ը໘αΠζઃఆ,16bit/32bit੾Γସ͑ ιʔε:asmhead.nas IBSJCPUFTZT IBSJCPUFJNH Y"" ηΫλ్தd Y ηΫλd Y ηΫλd ʙY.#
9. 04͕ϝϞϦ্ʹ
   ϩʔυ͞ΕΔ༷ࢠ
10. 04͕ϩʔυ͞ΕΔ·Ͱ #*04͕ϑϩοϐʔͷϒʔτηΫλ ઌ಄#
    ΛϝϞϦͷY$ʹಡΈࠐΈ·͢
    *1-͕࢒Γͷ෦෼ΛYʹಡΈࠐΈɺ
    BTNIFBEOBTͷ෦෼Λݺͼग़͢
    *1- ϒʔτηΫλ
    ipl09.nas Y$ Y Y
11. 04͕ϩʔυ͞ΕΔ·Ͱ BTNIFBEOBTதͰ
    04ຊମ CPPUQBDLISC Λ
    Y൪஍ʹίϐʔͯ͠
    ίϐʔઌͷCPPUQBDLISCΛݺͼग़͠·͢ bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
12. bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT bootpack.hrb bootpack.c౳ Y$ Y Y 04͕ϩʔυ͞ΕΔ·Ͱ Y൪஍ʹϩʔυ͞Εͨ04ຊମΛ࣮ߦ͢Δ
13. ϩʔυҎ֎ʹ΍ͬͯΔ͜ͱ asmhead.nas ը໘αΠζઃఆ,16bit/32bit(CPU)੾Γସ͑ ipl09.nas ϑϩοϐʔಡΈࠐΈҎ֎͸ಛʹͳ͠ bootpack.c ϚϧνλεΫͷઃఆ ηάϝϯτͷઃఆ ը໘ඳը ΩʔϘʔυɾϚ΢εͷઃఆ ϝϞϦ؅ཧ etc… *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT bootpack.hrb bootpack.c౳ Y$ Y Y
14. ϑϩοϐʔಡΈࠐΈ͔Β
    ຊମ࣮ߦ·ͰΛৄࡉʹઆ໌
15. ϑϩοϐʔͷಡΈࠐΈ *1- ϒʔτηΫλ
    ipl09.nas Y$ Y Y 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠
16. ϑϩοϐʔͷಡΈࠐΈ INT(0x13); σΟεΫؔ܎ ◦ AH = 0x02; ʢಡΈࠐΈ࣌ʣ ◦ AH = 0x0c; ʢγʔΫ࣌ʣ ◦ AL = ॲཧ͢ΔηΫλ਺; ◦ CH = γϦϯμ൪߸ & 0xff; ◦ CL = ηΫλ൪߸(bit0-5) ◦ DH = ϔου൪߸; ◦ DL = υϥΠϒ൪߸; ◦ ES:BX = όοϑΝΞυϨε; Ҿ༻ݩɿIUUQPTXJLJPTBTLKQ "5 #*04 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ *1- ϒʔτηΫλ
    ipl09.nas Y$ Y Y
17. ϑϩοϐʔͷಡΈࠐΈ 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ *1- ϒʔτηΫλ
    ipl09.nas Y$ Y Y INT(0x13); σΟεΫؔ܎ ◦ AH = 0x02; ʢಡΈࠐΈ࣌ʣ ◦ AH = 0x0c; ʢγʔΫ࣌ʣ ◦ AL = ॲཧ͢ΔηΫλ਺; ◦ CH = γϦϯμ൪߸ & 0xff; ◦ CL = ηΫλ൪߸(bit0-5) ◦ DH = ϔου൪߸; ◦ DL = υϥΠϒ൪߸; ◦ ES:BX = όοϑΝΞυϨε; b *0x7CD2 continue info register eax 0x211 ecx 0x2 edx 0x0 ebx 0x0 eip 0x7cd2 es 0x820 2080
18. ϑϩοϐʔͷಡΈࠐΈ INT(0x13); σΟεΫؔ܎ ◦ AH = 0x02; ʢಡΈࠐΈ࣌ʣ ◦ AH = 0x0c; ʢγʔΫ࣌ʣ ◦ AL = 0x11 ॲཧ͢ΔηΫλ਺; ◦ CH = 0x00 γϦϯμ൪߸ & 0xff; ◦ CL = 0x2 ηΫλ൪߸(bit0-5) ◦ DH = 0x0 ϔου൪߸; ◦ DL = 0x0 υϥΠϒ൪߸; ◦ ES:BX = 0x820 όοϑΝΞυϨε; 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ b *0x7CD2 continue info register eax 0x211 ecx 0x2 edx 0x0 ebx 0x0 eip 0x7cd2 es 0x820 2080 *1- ϒʔτηΫλ
    ipl09.nas Y$ Y Y
19. b *0x7CD2 continue info register eax 0x211 ecx 0x2 edx 0x0 ebx 0x0 eip 0x7cd2 es 0x820 2080 ϑϩοϐʔͷಡΈࠐΈ INT(0x13); σΟεΫؔ܎ ◦ AH = 0x02; ʢಡΈࠐΈ࣌ʣ ◦ AH = 0x0c; ʢγʔΫ࣌ʣ ◦ AL = 0x11 ॲཧ͢ΔηΫλ਺; ◦ CH = 0x00 γϦϯμ൪߸ & 0xff; ◦ CL = 0x2 ηΫλ൪߸(bit0-5) ◦ DH = 0x0 ϔου൪߸; ◦ DL = 0x0 υϥΠϒ൪߸; ◦ ES:BX = 0x820 όοϑΝΞυϨε; 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ *1- ϒʔτηΫλ
    ipl09.nas Y$ Y Y ཁ͸YͷҐஔʹdηΫλΛಡΈࠐΉʂ
20. ϑϩοϐʔͷಡΈࠐΈ 76 00007C9E readfast: ; ALΛ࢖ͬͯͰ͖Δ͚ͩ·ͱΊͯಡΈग़͢ ...(ུ)... 112 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ 113 00007CD4 73 14 JNC next ; Τϥʔ͕͓͖ͳ͚Ε͹next΁ ※0x8200 + 0x1400 -0x200 = 0x9400 b *0x7CD2 b *0x7CD4 display/8b 0x8200 1: x/8xb 0x8200 0x8200: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00
21. ϑϩοϐʔͷಡΈࠐΈ 76 00007C9E readfast: ; ALΛ࢖ͬͯͰ͖Δ͚ͩ·ͱΊͯಡΈग़͢ ...(ུ)... 112 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ 113 00007CD4 73 14 JNC next ; Τϥʔ͕͓͖ͳ͚Ε͹next΁ ※0x8200 + 0x1400 -0x200 = 0x9400 b *0x7CD2 b *0x7CD4 display/8b 0x8200 1: x/8xb 0x8200 0x8200: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 continue Continuing. Breakpoint 1, 0x00007cd4 in ?? ()
22. ϑϩοϐʔͷಡΈࠐΈ 76 00007C9E readfast: ; ALΛ࢖ͬͯͰ͖Δ͚ͩ·ͱΊͯಡΈग़͢ ...(ུ)... 112 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ 113 00007CD4 73 14 JNC next ; Τϥʔ͕͓͖ͳ͚Ε͹next΁ ※0x8200 + 0x1400 -0x200 = 0x9400 b *0x7CD2 b *0x7CD4 display/8b 0x8200 1: x/8xb 0x8200 0x8200: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 continue Continuing. Breakpoint 1, 0x00007cd4 in ?? () 1: x/8xb 0x8200 0x8200: 0xf0 0xff 0xff 0x03 0x40 0x00 0x05 0x60
23. ϑϩοϐʔͷಡΈࠐΈ 76 00007C9E readfast: ; ALΛ࢖ͬͯͰ͖Δ͚ͩ·ͱΊͯಡΈग़͢ ...(ུ)... 112 00007CD2 CD 13 INT 0x13 ; σΟεΫBIOSݺͼग़͠ 113 00007CD4 73 14 JNC next ; Τϥʔ͕͓͖ͳ͚Ε͹next΁ ※0x8200 + 0x1400 -0x200 = 0x9400 b *0x7CD2 b *0x7CD4 display/8b 0x8200 1: x/8xb 0x8200 0x8200: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 continue Continuing. Breakpoint 1, 0x00007cd4 in ?? () 1: x/8xb 0x8200 0x8200: 0xf0 0xff 0xff 0x03 0x40 0x00 0x05 0x60
24. ϑϩοϐʔͷಡΈࠐΈ BM ηΫλ਺ DI γϦϯμ൪߸ DM ηΫλ൪߸ EI ϔου൪߸ EM υϥΠϒ൪߸ FT ಡΈࠐΈઌ CY ಡΈࠐΈઌ Y Y Y Y Y Y Y Y Y Y Y Y YB Y Y Y Y Y Y YD Y YB Y Y Y Y YFD Y Y Y YC Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y YD Y Y Y Y Y Y YB Y Y Y Y Y Y YD Y YD Y Y Y Y YF Y Y Y YE Y Y Y Y Y Y Y Y Y YD Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y Y YD Y Y Y Y Y Y YD Y YF Y Y Y Y YF Y Y Y YG Y Y Y Y
25. ϑϩοϐʔͷಡΈࠐΈ C
    Y$%
    EJTQMBZY
    BM
    EJTQMBZY
    DI
    EJTQMBZY
    DM
    EJTQMBZY
    EI
    EJTQMBZY
    EM
    EJTQMBZY
    FT
    EJTQMBZY
    CY
    DPOUJOVF
    ҎޙɹFOUFS࿈ଧ
26. ૚໨ʹҠಈ bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y 00007C6B ; ಡΈऴΘͬͨͷͰharibote.sysΛ࣮ߦͩʂ ɾɾɾ(ུ) 00007C70 E9 458D JMP 0xc200
27. ը໘Ϟʔυͷ੾Γସ͑ 7#& 7&4"
    #*04
    &YUFOTJPO ͷը໘੾Γସ͑ INT 0x10 "9
    
    YG
    #9
    
    ը໘Ϟʔυ൪߸
    ը໘Ϟʔυ൪߸
    Y
    ɿ
    Y
    
    
    CJU
    Y
    ɿ
    Y
    
    
    CJU
    Y
    ɿ
    Y
    
    
    CJU
    Y
    ɿ
    Y
    
    CJU
    ˞ͨͩ͠CYʹ͸Y଍ͨ͠஋Λࢦఆ͠ͳ͍ͱ
    ͏·͍͔͘ͳ͍Β͍͠ຊॻQΑΓ
    bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
28. ը໘Ϟʔυͷ੾Γସ͑ ղ૾౓ઃఆͷ໋ྩ͸Y$&dY$ʹϩʔυ͞Ε͍ͯΔ asmhead.lstΑΓൈਮ 64 0000C23E BB 4105 MOV BX,VBEMODE+0x4000 65 0000C241 B8 4F02 MOV AX,0x4f02 66 0000C244 CD 10 INT 0x10 67 0000C246 C6 06 0FF2 08 MOV BYTE [VMODE],8 bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
29. asmhead.lstΑΓൈਮ 64 0000C23E BB 4105 MOV BX,VBEMODE+0x4000 65 0000C241 B8 4F02 MOV AX,0x4f02 66 0000C244 CD 10 INT 0x10 67 0000C246 C6 06 0FF2 08 MOV BYTE [VMODE],8 ը໘Ϟʔυͷ੾Γସ͑ b *0xc244 b *0xc246 continue bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
30. $16ಈ࡞Ϟʔυ੾Γସ͑ ϦΞϧϞʔυ
    
    ϓϩςΫτϞʔυ bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
31. $16ಈ࡞Ϟʔυ੾Γସ͑ ϦΞϧϞʔυ
    
    ϓϩςΫτϞʔυ CJU
    CJU
    bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
32. $16ಈ࡞Ϟʔυ੾Γସ͑ ϦΞϧϞʔυ
    
    ϓϩςΫτϞʔυ CJU
    ηάϝϯτͳ͠
    CJU
    ηάϝϯτΛ࢖͏
    bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
33. $16ಈ࡞Ϟʔυ੾Γସ͑ ϦΞϧϞʔυ
    
    ϓϩςΫτϞʔυ CJU
    ηάϝϯτͳ͠
    อޢػೳͳ͠
    CJU
    ηάϝϯτΛ࢖͏
    อޢ ϓϩςΫτ ػೳ͋Γ
    bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
34. $16ಈ࡞Ϟʔυ੾Γସ͑ ϦΞϧϞʔυ
    
    ϓϩςΫτϞʔυ CJU
    ηάϝϯτͳ͠
    อޢػೳͳ͠
    ϦΞϧΞυϨογϯά
    CJU
    ηάϝϯτΛ࢖͏
    อޢ ϓϩςΫτ ػೳ͋Γ
    όʔνϟϧΞυϨογϯά bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
35. $16ಈ࡞Ϟʔυ੾Γସ͑ bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y ࢑ఆͷGDT *OEFY MJNJU CBTF ҙຯ  ໿(# Y σʔλ  ໿,# Y ίʔυ
36. $16ಈ࡞Ϟʔυ੾Γସ͑ 0000C2A4 ; ϓϩςΫτϞʔυҠߦ 0000C2A4 0000C2A4 LGDT [GDTR0]; ࢑ఆGDTΛઃఆ 0000C2A9 MOV EAX,CR0 0000C2AC AND EAX,0x7fffffff 0000C2B2 OR EAX,0x00000001 0000C2B6 MOV CR0,EAX 0000C2B9 JMP pipelineflush 0000C2BB pipelineflush: 0000C2BB MOV AX,1*8 0000C2BE MOV DS,AX 0000C2C0 MOV ES,AX 0000C2C2 MOV FS,AX 0000C2C4 MOV GS,AX 0000C2C6 MOV SS,AX 0000C2C8 0000C2C8 ; bootpackͷసૹ 0000C2C8 0000C2C8 MOV ESI,bootpack ; సૹݩ bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y
37. $16ಈ࡞Ϟʔυ੾Γସ͑ 0000C2A4 ; ϓϩςΫτϞʔυҠߦ 0000C2A4 0000C2A4 LGDT [GDTR0]; ࢑ఆGDTΛઃఆ 0000C2A9 MOV EAX,CR0 0000C2AC AND EAX,0x7fffffff 0000C2B2 OR EAX,0x00000001 0000C2B6 MOV CR0,EAX 0000C2B9 JMP pipelineflush 0000C2BB pipelineflush: 0000C2BB MOV AX,1*8 0000C2BE MOV DS,AX 0000C2C0 MOV ES,AX 0000C2C2 MOV FS,AX 0000C2C4 MOV GS,AX 0000C2C6 MOV SS,AX 0000C2C8 0000C2C8 ; bootpackͷసૹ 0000C2C8 0000C2C8 MOV ESI,bootpack ; సૹݩ bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y C
    Y$"
    C
    Y$$
    DPOUJOVF
38. $16ಈ࡞Ϟʔυ੾Γସ͑ bootpack.hrb bootpack.c౳ *1- ϒʔτηΫλ
    ipl09.nas asmhead.nas IBSJCPUFTZT Y$ Y Y ࣮ߦલ EIP=0000c2a4 ES =9000 CS =0000 SS =0000 DS =0000 FS =0000 GS =0000 GDT=00000000 CR0=00000010 C
    Y$"
    C
    Y$$
    DPOUJOVF ࣮ߦޙ EIP=0000c2c8 ES =0008 CS =0000 SS =0008 DS =0008 FS =0008 GS =0008 GDT=0000c370 CR0=00000011 (qemu) info registers
39. 04ຊମίϐʔ ུ *1- ϒʔτϩʔμʔ
    ipl09.nas asmhead.nas IBSJCPUFTZT bootpack.hrb bootpack.c౳ Y$ Y Y
40. 04ຊମ࣮ߦ *1- ϒʔτϩʔμʔ
    ipl09.nas asmhead.nas IBSJCPUFTZT bootpack.hrb bootpack.c౳ Y$ Y Y 0000C319 ; bootpackͷىಈ ...OSຊମίϐʔͷ໋ྩͳͷͰུ 0000C33E skip: 0000C33E MOV ESP,[EBX+12] ; ελοΫॳظ஋ 0000C343 JMP DWORD 2*8:0x0000001b
41. EIP=0000c343 CS =0000 ※උߟ:ଞͷηάϝϯτϨδελ͸શͯ0x008 ES =0008 SS =0008 DS =0008 FS =0008 GS =0008 04ຊମ࣮ߦ GBS
    KVNQ ֤Ϩδελ࣮ߦલ RFNV
    NPOJUPS *1- ϒʔτϩʔμʔ
    ipl09.nas asmhead.nas IBSJCPUFTZT bootpack.hrb bootpack.c౳ Y$ Y Y JMP DWORD 2*8:0x0000001b
42. 04ຊମ࣮ߦ GBS
    KVNQ *1- ϒʔτϩʔμʔ
    ipl09.nas asmhead.nas IBSJCPUFTZT bootpack.hrb bootpack.c౳ Y$ Y Y EIP=0000001b CS =0010 ※උߟ:ଞͷηάϝϯτϨδελ͸શͯ0x008 ES =0008 SS =0008 DS =0008 FS =0008 GS =0008 ֤Ϩδελ࣮ߦޙ RFNV
    NPOJUPS JMP DWORD 2*8:0x0000001b
43. 04ຊମ࣮ߦ OFBS
    KVNQ ※ϝϞϦμϯϓ 0x28001b: 0xe9075a ̍C൪஍ bootpack.hrb bootpack.c౳ Y
44. 04ຊମ࣮ߦ OFBS
    KVNQ 0x28001b: 0xe9075a ̍C൪஍ʹISCϔομͷͲਅΜத
45. 04ຊମ࣮ߦ OFBS
    KVNQ 0x28001b: 0xe9075a 1b= ඞͣ0xe9 = JMP໋ྩ 1c=mainؔ਺ͷΞυϨε(32bit) - 0x20 ̍C൪஍ʹISCϔομͷͲਅΜத
46. 04ຊମ࣮ߦ OFBS
    KVNQ 0x28001b: 0xe9075a0000 ͳͥ 0x28001b: 0xe9075a 0000 0x280020←͔͜͜ΒͷΦϑηοτͰδϟϯϓ͢Δ͔Β
47. 04ຊମ࣮ߦ OFBS
    KVNQ 0x28001b: 0xe9075a0000 = JMP 0x00005a07 ※0x5a07 = ϓϩάϥϜͷ࣮ߦ൪஍͔Β-20ͨ͠൪஍
48. 04ຊମ࣮ߦ OFBS
    KVNQ GDBʹΑΔٯΞηϯϒϧ 0x28001b: jmp 0x285a27 0x28001b: 0xe9075a0000 = JMP 0x00005a07 ※0x5a07 = ϓϩάϥϜͷ࣮ߦ൪஍͔Β-20ͨ͠൪஍
49. 04ຊମ࣮ߦ OFBS
    KVNQ ࣌ؒͷ౎߹্ௐ΂੾Ε͍ͯ·ͤΜ͕ɺ OSຊମͷϝΠϯؔ਺ʹඈͿલʹ΋͏Ұ౓near jumpͯ͠·͢ 0x28001b: jmp 0x285a27 ɾɾɾ 0x285a27: push ebp 0x285a28: mov ebp,esp 0x285a2a: pop ebp 0x285a2b: jmp 0x280024 ɾɾɾ 0x280024: push ebp ←mainؔ਺
50. ΍ͬͱ.BJOؔ਺ʹ͖·ͨ͠ Dιʔε
    WPJE
    )BSJ.BJO WPJE .lstϑΝΠϧ 31 [SECTION .text] 318 0000000 GLOBAL _HariMain 319 0000000 _HariMain: 320 00000000 5 PUSH EBP 321 00000001 89 E MOV EBP,ESP GBDͷϝϞϦμϯϓ&ٯΞηϯϒϧ (gdb) x/10i 0x280024 0x280024: push ebp 0x280025: mov ebp,esp 0x280027: push edi 0x28001b -> 0x285a27 -> 0x280024
51. ը໘͕มΘΔͱ͜Ζ͚ͩͰ΋ C
    YEF
    C
    YF
    C
    YGD
    0x2802d9: call 0x2823b1 0x2802de: push 0x1 0x2802e0: push edi 0x2802e1: call 0x2823b1 0x2802e6: push 0x2 0x2802e8: push DWORD PTR [ebp-0x434] 0x2802ee: call 0x2823b1 0x2802f3: add esp,0x24
    TIFFU@VQEPXO TIU@CBDL
    
     
    
    TIFFU@VQEPXO LFZ@XJO
    
    
     
    
    TIFFU@VQEPXO TIU@NPVTF
     
56. ͝੩ௌ
    ͋Γ͕ͱ͏͍͟͝·ͨ͠