Upgrade to Pro — share decks privately, control downloads, hide ads and more …
Sign up for free

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
71
1

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.8k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
830
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
680
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.3k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
340
Fuzzing 101
Avatar for LJP-TW ljptw
1
270
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
360
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
220
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
180

Other Decks in Technology

See All in Technology
Deployment の 先にある AI Agent 基盤 - kagent vNext、Agent Substrate、Hermes から読み解く Agent Runtime の現在地 / k8s-matsuri-2-ai-agent-platform-amsy810
Avatar for Masaya Aoyama (@amsy810) masayaaoyama
4
680
Minecraft JavaのMODをSwiftで作る
Avatar for 1mash0 1mash0
0
190
Slack上でインフラをトラブルシュートする！ Agentic Platform Engineeringの第一歩
Avatar for teru0x1 teru0x1
5
1.8k
おい、エージェントを使って終わらせろ
Avatar for nwiizo nwiizo
2
760
AIを活用するために決めた "やらないこと" - 価値に注目する / Not betting on AI
Avatar for soudai sone soudai
PRO
3
560
安心して変更できるWebフロントエンドの作り方
Avatar for Hiroyuki ANAI pirosikick
5
2.8k
Goodbye ShellScript, Hello File-based App
Avatar for Shunsuke Tsuchiya shunsock
0
410
Genieを崇めよ
Avatar for camay kameitomohiro
0
170
Von-Neumann Machines, Dreams & The Futures of IT
Avatar for Uwe Friedrichsen ufried
0
110
ソフトウェアDNAとクラウドエージェントのススメ
Avatar for Cloud Ace cloudace
0
120
JSONataとAWS Step Functionsで目指すRuntimelessな世界
Avatar for mu7889yoon / Yuta Nakamura mu7889yoon
0
300
事業課題から技術的負債に向き合う
Avatar for SansanTech sansantech
PRO
2
2k

Featured

See All Featured
Navigating Team Friction
Avatar for Lara Hogan lara
192
16k
The Limits of Empathy - UXLibs8
Avatar for Cassini Nazir cassininazir
1
680
Designing for Performance
Avatar for Lara Hogan lara
611
70k
Pawsitive SEO: Lessons from My Dog (and Many Mistakes) on Thriving as a Consultant in the Age of AI
Avatar for David Carrasco davidcarrasco
0
250
10 Git Anti Patterns You Should be Aware of
Avatar for Lemi Orhan Ergin lemiorhan
PRO
659
62k
Fantastic passwords and where to find them - at NoRuKo
Avatar for Phil Nash philnash
52
3.8k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
9
1.6k
End of SEO as We Know It (SMX Advanced Version)
Avatar for Michael King ipullrank
3
4.4k
A Soul's Torment
Avatar for Nat Ma seathinner
8
3.6k
Automating Front-end Workflow
Avatar for Addy Osmani addyosmani
1369
210k
Self-Hosted WebAssembly Runtime for Runtime-Neutral Checkpoint/Restore in Edge–Cloud Continuum
Avatar for Yuki Nakata chikuwait chikuwait
0
810
How GitHub (no longer) Works
Avatar for Zach Holman holman
316
150k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8