Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
62
1

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.8k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
790
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
650
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.3k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
330
Fuzzing 101
Avatar for LJP-TW ljptw
1
240
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
330
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
200
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
160

Other Decks in Technology

See All in Technology
世界、断片、モデル。そして理解
Avatar for SAKO Hiroshi ardbeg1958
1
130
全員がリーダーである世界へ キリマンジャロ登頂とシェアド・リーダー
Avatar for Watanabe Jin jinwatanabe
0
110
Multicaで30個のミニプロジェクトをAIエージェント運用して見えてきたこと
Avatar for eiei114 eiei114
0
500
41歳でAWSが好きすぎてITエンジニアになったおっさんの話
Avatar for Yuuki Yamashita yama3133
0
420
Oracle Exadata Database Service on Cloud@Customer X11M (ExaDB-C@C) サービス概要
Avatar for oracle4engineer oracle4engineer
PRO
2
8.4k
Claude Code公式skillで 自分の仕事を少しずつ手放そう！（Claude Code開発ノウハウ大公開スペシャル by クラスメソッド）
Avatar for Kei Masaoka kaym
1
530
仕様駆動開発、導入半年。「本当に速くなってるの?」にデータで答える / AICon2026_hirakawa
Avatar for Rakus_Dev rakus_dev
0
240
Gen3R: 3D Scene Generation Meets Feed-Forward Reconstruction
Avatar for Spatial AI Network spatial_ai_network
0
140
DatabricksにおけるMCPソリューション
Avatar for Takaaki Yayoi taka_aki
1
280
GoでCコンパイラを作った話
Avatar for repunit11 repunit
0
140
データエンジニアリングとドメイン駆動設計
Avatar for 増田 亨 masuda220
PRO
7
1.1k
Vポイント分析基盤におけるデータモデリング20年史
Avatar for タロウ taromatsui_cccmkhd
2
180

Featured

See All Featured
Bootstrapping a Software Product
Avatar for Garrett Dimon garrettdimon
PRO
307
120k
Ethics towards AI in product and experience design
Avatar for Skipper Chong Warson skipperchong
2
330
Ten Tips & Tricks for a 🌱 transition
Avatar for Manu Carrasco Molina stuffmc
0
150
Breaking role norms: Why Content Design is so much more than writing copy - Taylor Woolridge
Avatar for UX Y'all uxyall
0
350
RailsConf 2023
Avatar for Aaron Patterson tenderlove
30
1.5k
Visualizing Your Data: Incorporating Mongo into Loggly Infrastructure
Avatar for mongodb mongodb
49
10k
Lightning Talk: Beautiful Slides for Beginners
Avatar for Ines Montani inesmontani
PRO
2
610
Raft: Consensus for Rubyists
Avatar for Patrick Van Stee vanstee
141
7.6k
Rails Girls Zürich Keynote
Avatar for Gregor Martynus gr2m
96
14k
Abbi's Birthday
Avatar for Violet Bock coloredviolet
3
8.7k
Building an army of robots
Avatar for Kyle Neath kneath
306
46k
How STYLIGHT went responsive
Avatar for nonsquared nonsquared
100
6.2k

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8