Upgrade to Pro — share decks privately, control downloads, hide ads and more …

Binary Exploitation - Basic 補充篇

Avatar for LJP-TW LJP-TW
May 26, 2021
Technology
1
44

Binary Exploitation - Basic 補充篇

2021/05/26 台科資安社 社課
直播記錄檔: https://www.youtube.com/watch?v=I3X69ADZOnw
- TLS

Avatar for LJP-TW

LJP-TW

May 26, 2021
Tweet

More Decks by LJP-TW

See All by LJP-TW
Reverse Engineering - 1
Avatar for LJP-TW ljptw
0
1.6k
Reverse Engineering - 2
Avatar for LJP-TW ljptw
0
700
Reverse Engineering - 3
Avatar for LJP-TW ljptw
0
560
Re:0 從零開始的逆向工程
Avatar for LJP-TW ljptw
1
1.1k
Linux 極入門篇
Avatar for LJP-TW ljptw
1
280
Fuzzing 101
Avatar for LJP-TW ljptw
1
170
Binary Exploitation - File Structure
Avatar for LJP-TW ljptw
1
270
Binary Exploitation - Heap
Avatar for LJP-TW ljptw
1
140
Binary Exploitation - Basic
Avatar for LJP-TW ljptw
1
110

Other Decks in Technology

See All in Technology
Terraformで構築する セルフサービス型データプラットフォーム / terraform-self-service-data-platform
Avatar for pei0804 pei0804
1
120
なぜSaaSがMCPサーバーをサービス提供するのか？
Avatar for SansanTech sansantech
PRO
8
2.7k
大「個人開発サービス」時代に僕たちはどう生きるか
Avatar for Sotaro Karasawa sotarok
20
9.7k
Skrub: machine-learning with dataframes
Avatar for Gael Varoquaux gaelvaroquaux
0
120
Django's GeneratedField by example - DjangoCon US 2025
Avatar for Paolo Melchiorre pauloxnet
0
110
サンドボックス技術でAI利活用を促進する
Avatar for k-nagase koh_naga
0
200
なぜテストマネージャの視点が 必要なのか？ 〜 一歩先へ進むために 〜
Avatar for Sammy(MoritaMasami) moritamasami
0
210
[ JAWS-UG 東京 CommunityBuilders Night #2 ]SlackとAmazon Q Developerで 運用効率化を模索する
Avatar for sh_fk2 sh_fk2
3
370
La gouvernance territoriale des données grâce à la plateforme Terreze
Avatar for BlueHats bluehats
0
150
DevIO2025_継続的なサービス開発のための技術的意思決定のポイント / how-to-tech-decision-makaing-devio2025
Avatar for Logy nologyance
1
370
2025年になってもまだMySQLが好き
Avatar for yoku0825 yoku0825
8
4.5k
今！ソフトウェアエンジニアがハードウェアに手を出すには
Avatar for mackee mackee
11
4.5k

Featured

See All Featured
The Power of CSS Pseudo Elements
Avatar for Geoffrey Crofte geoffreycrofte
77
6k
Code Reviewing Like a Champion
Avatar for maltzj maltzj
525
40k
Scaling GitHub
Avatar for Zach Holman holman
463
140k
The World Runs on Bad Software
Avatar for Brandon Keepers bkeepers
PRO
70
11k
The Pragmatic Product Professional
Avatar for Laura Van Doore lauravandoore
36
6.9k
The Cult of Friendly URLs
Avatar for Andy Hume andyhume
79
6.6k
What's in a price? How to price your products and services
Avatar for Michael Herold michaelherold
246
12k
Understanding Cognitive Biases in Performance Measurement
Avatar for Philip Tellis bluesmoon
29
1.9k
Typedesign – Prime Four
Avatar for Hannes Fritz hannesfritz
42
2.8k
Fireside Chat
Avatar for paigeccino paigeccino
39
3.6k
Become a Pro
Avatar for Speaker Deck speakerdeck
PRO
29
5.5k
The Web Performance Landscape in 2024 [PerfNow 2024]
Avatar for Tammy Everts tammyeverts
9
810

Transcript

  1. 2021/5/26 NTUSTISC Binary Exploitation aka Pwn Basic 補充篇

  2. # whoami - LJP / LJP-TW - Pwn / Rev

    - NTUST / NCTU / NYCU - 10sec CTF Team 1

  3. Outline - TLS 2

  4. TLS 3

  5. TLS - TLS 全名 Thread-Local Storage - Linux x64 使用

    fs 暫存器記著 TLS 的位置 - Stack Canary 就是存在 TLS 中 4

  6. TLS - fs 為 Segment Register - 計算方式 reg:offset =

    ref + offset - 這時候你用 gdb 想看一下 fs 等於多少卻發現 - 難道 Canary 從 [0+0x28] 拿來的?? 5

  7. TLS - GDB 也是 Process, fs = 0 是指 GDB

    自己的 fs - 所以要怎麼拿到觀測中的 Process 的 fs? - 呼叫 arch_prctl 6 Ref: https://fasterthanli.me/series/making-our-own-executable-packer/part-13

  8. TLS - Pwngdb 有實作取得 TLS 的功能 - 閱讀一下怎麼實作的, 發現其實一樣 -

    https://github.com/scwuaptx/Pwngdb/blob/master/pwndbg/pwngdb.py#L77 7

  9. TLS Demo 8