Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
1
44

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021
Tweet

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.6k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
710
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
560
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.1k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
280
Fuzzing 101
Avatar for LJP-TW ljptw
1
170
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
280
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
150
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
110

Other Decks in Technology

See All in Technology
Digitization部 紹介資料
Avatar for Sansan, Inc. sansan33
PRO
1
5.6k
Copilot Studio ハンズオン - 生成オーケストレーションモード
Avatar for tomoyasasaki tomoyasasakimskk
0
200
Azureコストと向き合った、4年半のリアル / Four and a half years of dealing with Azure costs
Avatar for AEON aeonpeople
1
250
「改善」ってこれでいいんだっけ？
Avatar for うきぐも / すずき ukigmo_hiro
0
400
Linux カーネルが支えるコンテナの仕組み / LF Japan Community Days 2025 Osaka
Avatar for tenforward tenforward
1
110
Zephyr(RTOS)にEdge AIを組み込んでみた話
Avatar for misoji engineer iotengineer22
1
260
「魔法少女まどか☆マギカ Magia Exedra」の多様なバトルの開発を柔軟かつ効率的に実現するためのPure C#とUnityの分離について
Avatar for gree_tech gree_tech
PRO
0
240
アウトプットから始めるOSSコントリビューション 〜eslint-plugin-vueの場合〜 #vuefes
Avatar for 弁護士ドットコム bengo4com
3
270
Claude Code Subagents 再入門 ~cc-sddの実装で学んだこと~
Avatar for Gota gotalab555
10
17k
AI AgentをLangflowでサクッと作って、1日働かせてみた！
Avatar for Yano-13 yano13
1
120
組織改革から開発効率向上まで！ - 成功事例から見えたAI活用のポイント - / 20251016 Tetsuharu Kokaki
Avatar for SHIFT EVOLVE shift_evolve
PRO
2
230
混合雲環境整合異質工作流程工具運行關鍵業務 Job 的經驗分享
Avatar for Yao-Siang Su (蘇曜祥) yaosiang
0
140

Featured

See All Featured
How to train your dragon (web standard)
Avatar for Monica Dinculescu notwaldorf
97
6.3k
Art, The Web, and Tiny UX
Avatar for Lynn Fisher lynnandtonic
303
21k
Documentation Writing (for coders)
Avatar for Carmen Chung carmenintech
75
5.1k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
95
14k
Java REST API Framework Comparison - PWX 2021
Avatar for Matt Raible mraible
34
8.9k
CoffeeScript is Beautiful & I Never Want to Write Plain JavaScript Again
Avatar for Sam Stephenson sstephenson
162
15k
Rebuilding a faster, lazier Slack
Avatar for samanthasiow samanthasiow
84
9.2k
Build your cross-platform service in a week with App Engine
Avatar for Jose L jlugia
232
18k
The Cost Of JavaScript in 2023
Avatar for Addy Osmani addyosmani
55
9.1k
We Have a Design System, Now What?
Avatar for Morgane Peng morganepeng
53
7.8k
Embracing the Ebb and Flow
Avatar for Simon Collison colly
88
4.9k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
12k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8