Reversing x64Elf
本帖最后由 Sound 于 2016-12-29 00:53 编辑描述：ReverseMe
这是一个 64bit elf,运行这个Elf文件 ,当程序进行参数执行的时候,输出以下信息$ ./re
Enter the password: Sound
Incorrect password!
Main function Analysis
.text:00000000004007E8 ; int __cdecl main(int, char **, char **)
.text:00000000004007E8 main proc near ; DATA XREF: start+1Do
.text:00000000004007E8
.text:00000000004007E8 s = byte ptr -110h
.text:00000000004007E8 var_8 = qword ptr -8
.text:00000000004007E8
.text:00000000004007E8 push rbp
.text:00000000004007E9 mov rbp, rsp
.text:00000000004007EC sub rsp, 110h
.text:00000000004007F3 mov rax, fs:28h
.text:00000000004007FC mov , rax
.text:0000000000400800 xor eax, eax
.text:0000000000400802 mov edi, offset format ; "Enter the password: "
.text:0000000000400807 mov eax, 0
.text:000000000040080C call _printf
.text:0000000000400811 mov rdx, cs:stdin ; stream
.text:0000000000400818 lea rax,
.text:000000000040081F mov esi, 0FFh ; n
.text:0000000000400824 mov rdi, rax ; s
.text:0000000000400827 call _fgets
.text:000000000040082C test rax, rax
.text:000000000040082F jz short loc_400866
.text:0000000000400831 lea rax,
.text:0000000000400838 mov rdi, rax
.text:000000000040083B call sub_4006FD
.text:0000000000400840 test eax, eax
.text:0000000000400842 jnz short loc_400855
.text:0000000000400844 mov edi, offset s ; "Nice!"
.text:0000000000400849 call _puts
.text:000000000040084E mov eax, 0
.text:0000000000400853 jmp short loc_40086B
.text:0000000000400855 ; ---------------------------------------------------------------------------
.text:0000000000400855
.text:0000000000400855 loc_400855: ; CODE XREF: main+5Aj
.text:0000000000400855 mov edi, offset aIncorrectPassw ; "Incorrect password!"
.text:000000000040085A call _puts
.text:000000000040085F mov eax, 1
.text:0000000000400864 jmp short loc_40086B
.text:0000000000400866 ; ---------------------------------------------------------------------------
.text:0000000000400866
.text:0000000000400866 loc_400866: ; CODE XREF: main+47j
.text:0000000000400866 mov eax, 0
在0x400827处，开始询问用户输入的密码(调用_fgets)并传递到0x40083B处的sub_4006FD 函数
如果这个函数返回的值非零，则密码无效，程序将输出字符串“Incorrect password！”。 反之，它会显示Nice！
Analysis Sub_4006FD
.text:00000000004006FD Pw_Check proc near ; CODE XREF: main+53p
.text:00000000004006FD
.text:00000000004006FD var_38 = qword ptr -38h
.text:00000000004006FD var_24 = dword ptr -24h
.text:00000000004006FD var_20 = qword ptr -20h
.text:00000000004006FD var_18 = qword ptr -18h
.text:00000000004006FD var_10 = qword ptr -10h
.text:00000000004006FD
.text:00000000004006FD push rbp
.text:00000000004006FE mov rbp, rsp
.text:0000000000400701 mov , rdi
.text:0000000000400705 mov , 0
.text:000000000040070C mov , offset aDufhbmf ; "Dufhbmf"
.text:0000000000400714 mov , offset aPgImos ; "pG`imos"
.text:000000000040071C mov , offset aEwuglpt ; "ewUglpt"
.text:0000000000400724 mov , 0
.text:000000000040072B jmp short loc_40079B
.text:000000000040072D ; ---------------------------------------------------------------------------
.text:000000000040072D
.text:000000000040072D loc_40072D: ; CODE XREF: Pw_Check+A2j
.text:000000000040072D mov ecx,
.text:0000000000400730 mov edx, 55555556h
.text:0000000000400735 mov eax, ecx
.text:0000000000400737 imul edx
.text:0000000000400739 mov eax, ecx
.text:000000000040073B sar eax, 1Fh
.text:000000000040073E sub edx, eax
.text:0000000000400740 mov eax, edx
.text:0000000000400742 add eax, eax
.text:0000000000400744 add eax, edx
.text:0000000000400746 sub ecx, eax
.text:0000000000400748 mov edx, ecx
.text:000000000040074A movsxdrax, edx
.text:000000000040074D mov rsi,
.text:0000000000400752 mov ecx,
.text:0000000000400755 mov edx, 55555556h
.text:000000000040075A mov eax, ecx
.text:000000000040075C imul edx
.text:000000000040075E mov eax, ecx
.text:0000000000400760 sar eax, 1Fh
.text:0000000000400763 sub edx, eax
.text:0000000000400765 mov eax, edx
.text:0000000000400767 add eax, eax
.text:0000000000400769 cdqe
.text:000000000040076B add rax, rsi
.text:000000000040076E movzx eax, byte ptr
.text:0000000000400771 movsx edx, al
.text:0000000000400774 mov eax,
.text:0000000000400777 movsxdrcx, eax
.text:000000000040077A mov rax,
.text:000000000040077E add rax, rcx
.text:0000000000400781 movzx eax, byte ptr
.text:0000000000400784 movsx eax, al
.text:0000000000400787 sub edx, eax
.text:0000000000400789 mov eax, edx
.text:000000000040078B cmp eax, 1
.text:000000000040078E jz short loc_400797
.text:0000000000400790 mov eax, 1
.text:0000000000400795 jmp short loc_4007A6
.text:0000000000400797 ; ---------------------------------------------------------------------------
.text:0000000000400797
.text:0000000000400797 loc_400797: ; CODE XREF: Pw_Check+91j
.text:0000000000400797 add , 1
.text:000000000040079B
.text:000000000040079B loc_40079B: ; CODE XREF: Pw_Check+2Ej
.text:000000000040079B cmp , 0Bh
.text:000000000040079F jle short loc_40072D
.text:00000000004007A1 mov eax, 0
.text:00000000004007A6
.text:00000000004007A6 loc_4007A6: ; CODE XREF: Pw_Check+98j
.text:00000000004007A6 pop rbp
.text:00000000004007A7 retn
.text:00000000004007A7 Pw_Check endp
这个函数操作用户输入的密码，并将其与基于3个字符串 （"Dufhbmf""pG`imos""ewUglpt"） 的计算的结果进行比较. 使用Pseudo-code Plugin (F5)
signed __int64 __fastcall sub_4006FD(__int64 a1)
{
signed int i; // @1
const char *v3; // @1
const char *v4; // @1
const char *v5; // @1
v3 = "Dufhbmf";
v4 = "pG`imos";
v5 = "ewUglpt";
for ( i = 0; i <= 11; ++i )
{
if ( (&v3) - *(_BYTE *)(i + a1) != 1 )
return 1LL;
}
return 0LL;
}
现在可以很直观的了解函数的流程,在3个字符串的字符之间轮流(模数计数器),然后来计算ELF预设的密码字符。
Done:
先对3个字符串进行ASCII hex转换,
Dufhbmf0x44, 0x75, 0x66, 0x68, 0x62, 0x6D, 0x66
pG`imos 0x70, 0x47, 0x60, 0x69, 0x6D, 0x6F, 0x73
ewUglpt 0x65, 0x77, 0x55, 0x67, 0x6C, 0x70, 0x74 code python scr
#!/usr/bin/env python3
s = [,
,
]
flag = []
for i in range(12):
flag.append(s-1)
print(''.join())
输出 Flag:Code_Talkers
$ ./rr
Enter the password: Code_Talkers
Nice!
前排围观。 围观过来凑热闹 Sound 出品，
必属精品！ 我这小白表示看不懂 小白看不懂啊 Tutorial-Reversing x64Elf
http://www.52pojie.cn/thread-568767-1-1.html
(出处: 吾爱破解论坛)
对应的是这个视频教程？ 表示完全看不懂，支持一下
页:
[1]