2020 交大程式安全：逆向工程上課講義－第一週(第三段)

৽஛ਓ࠷Ѫٯ޲ ޻ఔ terrynini38514 terrynini

WHO AM I ?

附上⼈權指數 ID : Terrynini38514 ▸ ᪑զ༗ᴍख़ɿ   ٯٯ ▸ ᪑զຑ٢ຑɿ
  ᅳཱަ௨େላ -"#   ࢿిҫ٬ᢛ҆શ੽࢜ላҐላఔ௠ఊӉ ▸ ᜗ඍೳ፤ိਧత౦੢ɿ   ೥ۚ६ᘋף܉   'JSF&ZF'MBSF0O$IBMMFOHFഁ୆ ▸ $5'5FBNɿ   %PVCMF4JHNBʢቮ጗ૺ#BMTOซ吞Խ࡞ଖ݂೑ʣ   #BMTO 3 ᔒরยՄ༻ٹ໋

BABY STEP 4UBDL'SBNF 4 low memory address high memory
address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> 0xff8 0xffc 0x1000 eax: 0x20 0x20 bossA_want 0xfec 0xfe0

address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> 0xff8 0xffc 0x1000 eax: 0x20 0x20 bossA_want 0xfec SKIP SOME OPERATIONS ! //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// //////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////////// 0xfe0

address highlight means RIP points to here 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> 0xff8 0xffc 0x1000 0x20 bossA_want 0xfec 0xfe0

address highlight means RIP points to here esp -> ebp -> 0xfe0 0xff8 0x20 bossA_want 0xfec

address highlight means RIP points to here esp -> ebp -> 0xfe0 0xff8 0x20 bossA_want 0xfec just for alignment 0xfd4

address highlight means RIP points to here esp -> ebp -> 0xfe0 0xff8 0x20 bossA_want 0xfec just for alignment 0xfd4 0x20 0xfd0

address highlight means RIP points to here esp -> just for alignment 0xfd4 0x20 0xfd0 0x80484ff return address 0xfcc 0xfe0

address just for alignment 0xfd4 0x20 0xfd0 0x80484ff return address 0xfcc 0xfe0 esp ->

address esp -> just for alignment 0xfd4 0x20 0xfd0 0x80484ff return address 0xfcc 0xfe0 0xff8 old ebp 0xfc8

address just for alignment 0xfd4 0x20 0xfd0 0x80484ff return address 0xfcc 0xfe0 0xff8 old ebp 0xfc8 esp -> ebp -> leave = mov esp, ebp   pop ebp

address just for alignment 0xfd4 0x20 0xfd0 0x80484ff return address 0xfcc 0xfe0 leave = mov esp, ebp   pop ebp 0xff8 old ebp 0xfc8 esp -> ebp ->

address just for alignment 0xfd4 0x20 0xfd0 0x80484ff return address 0xfcc 0xfe0 esp -> ret = pop eip

address highlight means RIP points to here esp -> just for alignment 0xfd4 0x20 0xfd0 0xfe0

BABY STEP 4UBDL'SBNF 17 highlight means RIP points to
here low memory address high memory address 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> 0xff8 0xffc 0x1000 0x20 bossA_want 0xfec 0xfe0

here low memory address high memory address 0x40 0x8048536 return address main's ebp old ebp esp -> ebp -> 0xff8 0xffc 0x1000 0x20 bossA_want 0xfec 0xfe0 leave = mov esp, ebp   pop ebp

here low memory address high memory address 0x40 0x8048536 return address main's ebp old ebp esp -> 0xff8 0xffc 0x1000 leave = mov esp, ebp   pop ebp ebp ->

here low memory address high memory address 0x40 0x8048536 return address esp -> 0xff8 0xffc 0x1000

BABY STEP 4UBDL'SBNF 21 prologue epilogue

BABY STEP $BMMJOH$POWFOUJPODEFDM 22 caller pop stack from right
to left low memory address high memory address 1 0x8048536 return address main's ebp old ebp ebp -> 0xff8 0x1000 2 3 ༝DBMMFSਗ਼ۭTUBDLൺֱ༰қመ࡞QSJOUG೭ྨతෆఆ௕ҾᏐവࣜ

BABY STEP $BMMJOH$POWFOUJPOTUEDBMM XJOBQJVTFUIJTDPOWFOUJPO 23 callee pop stack ༝DBMMFFਗ਼ۭTUBDLൺֱઅলۭؒ

BABY STEP $BMMJOH$POWFOUJPOGBTUDBMM 24 put first two args in
regs put rest args on stack callee pop stack

BABY STEP $BMMJOH$POWFOUJPOUIJTDBMM 25 put "this" in ecx

BABY STEP Y@$BMMJOH$POWFOUJPO windows function(rcx, rdx, r8, r9) 26
Linux function(rdi, rsi, rdx, rcx, r8, r9) ೗ՌჩᏐ௒աݸ࣌ɼ௒աతಉYDBMMJOHDPOWFOUJPOɼ௚઀์TUBDL XJOEPXT์తҐஔཁ஫ҙҰԼ

OPTIMIZATION

OPTIMIZATION $POTUBOU'PMEJOH 28 i = 320 * 200 *
32; >> i = 2048000; (example from wiki)

OPTIMIZATION $POTUBOU1SPQBHBUJPO 'PMEJOH 29 >> >> (example from wiki)

OPTIMIZATION 5BJM$BMM 30 >> (example from wiki)

OPTIMIZATION 4PNFNBHJDUSJDL 31

OPTIMIZATION 4PNFNBHJDUSJDL 32 edx:eax = input*0x38e38e39 edx = (input*0x38e38e39)>>33
eax = input >> 31 edx = edx - eax

OPTIMIZATION 4PNFNBHJDUSJDL 33

CLASS & STRUCT

CLASS & STRUCT .FNPGPSEFNP OBNFNBOHMJOH ੒һؒሣᴡऔNJO TJ[FPG NFNCFS QBDL
݁ߏ࠷ޙሣᴡऔNJO NBY.FNCFS4J[F QBDL ቕ౟݁ߏෆҎ੔ᱪ௕౓ိܭࢉɼࣕੋҎ֘݁ߏॴ࢖༻తሣᴡ值ိሣᴡ ҝྃመݱଟଶɼDMBTTతୈҰݸNFNCFS။ࢦ޲WUBCMF 36

BYEBYE Լिओ୊ ▸ Anti-Debug & Anti-Analyze ▸ PE-File format ▸
PE related trick 37

2020 交大程式安全：逆向工程上課講義－第一週(第三段)

2020 交大程式安全：逆向工程上課講義－第一週(第三段)

More Decks by terrynini

Other Decks in Technology

Featured

Transcript