Upgrade to PRO for Only $50/Year—Limited-Time Offer! 🔥

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
1
45

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021
Tweet

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.6k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
720
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
570
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.2k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
290
Fuzzing 101
Avatar for LJP-TW ljptw
1
180
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
280
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
150
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
110

Other Decks in Technology

See All in Technology
A Compass of Thought: Guiding the Future of Test Automation ( #jassttokai25 , #jassttokai )
Avatar for teyamagu teyamagu
PRO
1
190
こがヘンだよ！Snowflake?サービス名称へのこだわり
Avatar for タロウ tarotaro0129
0
110
名刺メーカーDevグループ 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
0
980
21st ACRi Webinar - AMD Presentation Slide (Nao Sumikawa)
Avatar for Nao Sumikawa nao_sumikawa
0
200
Introduction to Sansan for Engineers / エンジニア向け会社紹介
Avatar for Sansan, Inc. sansan33
PRO
5
48k
Digitization部 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
6.1k
Active Directory 勉強会 第 6 回目 Active Directory セキュリティについて学ぶ回
Avatar for Eureka eurekaberry
16
5.9k
小さな判断で育つ、大きな意思決定力 / 20251204 Takahiro Kinjo
Avatar for SHIFT EVOLVE shift_evolve
PRO
1
300
HIG学習用スライド
Avatar for 野瀬田　裕樹 yuukiw00w
0
110
プラットフォームエンジニアリングとは何であり、なぜプラットフォームエンジニアリングなのか
Avatar for doublemarket doublemarket
1
550
ML PM Talk #1 - ML PMの分類に関する考察
Avatar for LINEヤフーTech (LY Corporation Tech) lycorptech_jp
PRO
1
490
オープンデータの内製化から分かったGISデータを巡る行政の課題
Avatar for 室木直樹 naokim84
2
1.3k

Featured

See All Featured
Save Time (by Creating Custom Rails Generators)
Avatar for Garrett Dimon garrettdimon
PRO
32
1.8k
Refactoring Trust on Your Teams (GOTO; Chicago 2020)
Avatar for Rebecca Miller-Webster rmw
35
3.3k
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.3k
VelocityConf: Rendering Performance Case Studies
Avatar for Addy Osmani addyosmani
333
24k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
12k
We Have a Design System, Now What?
Avatar for Morgane Peng morganepeng
54
7.9k
Reflections from 52 weeks, 52 projects
Avatar for Jefferson Lam jeffersonlam
355
21k
Evolution of real-time – Irina Nazarova, EuRuKo, 2024
Avatar for Irina Nazarova irinanazarova
9
1.1k
The Hidden Cost of Media on the Web [PixelPalooza 2025]
Avatar for Tammy Everts tammyeverts
1
78
Exploring the Power of Turbo Streams & Action Cable | RailsConf2023
Avatar for Kevin Liebholz kevinliebholz
36
6.2k
Agile that works and the tools we love
Avatar for Rasmus Luckow-Nielsen rasmusluckow
331
21k
Why You Should Never Use an ORM
Avatar for John Nunemaker jnunemaker
PRO
60
9.6k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8