逆向工程小窥

来源：互联网发布：发布订阅模式 java 编辑：程序博客网时间：2024/06/06 08:29

目标：通过直接修改二进制让下面的代码输出 jail break success

$cat main.c#include <stdio.h>int test() {  return 0xf3f3;}int main(int argc, const char *argv[]){  if (0 == test()) {    printf("jail break success\n");  } else {    printf("jail break fail\n");  }  return 0;}

工具：otool、二进制编辑器、gdb

首先看二进制文件的text段基本信息，例如文件中的偏移，内存的载入地址。
根据这些信息，结合反汇编信息，就能推导出返回值0xf3f3的地址，然后直接用二进制编辑器修改之即可。

$otool -l a.out....Section  sectname __text   segname __TEXT      addr 0x0000000100000f00      size 0x0000000000000064    offset 3840     align 2^4 (16)    reloff 0    nreloc 0     flags 0x80000400 reserved1 0 reserved2 0Section

二进制text段：

$otool -t a.outa.out:(__TEXT,__text) section0000000100000f00 55 48 89 e5 b8 f3 f3 00 00 5d c3 0f 1f 44 00 000000000100000f10 55 48 89 e5 48 83 ec 20 c7 45 fc 00 00 00 00 890000000100000f20 7d f8 48 89 75 f0 e8 d5 ff ff ff 31 ff 39 c7 0f0000000100000f30 85 16 00 00 00 48 8d 3d 4a 00 00 00 b0 00 e8 210000000100000f40 00 00 00 89 45 ec e9 11 00 00 00 48 8d 3d 48 000000000100000f50 00 00 b0 00 e8 0b 00 00 00 89 45 e8 31 c0 48 830000000100000f60 c4 20 5d c3

反汇编：

$otool -tV a.outa.out:(__TEXT,__text) section_test:0000000100000f00  pushq %rbp0000000100000f01  movq  %rsp, %rbp0000000100000f04  movl  $0xf3f3, %eax           ## imm = 0xF3F30000000100000f09  popq  %rbp0000000100000f0a  retq0000000100000f0b  nopl  (%rax,%rax)_main:0000000100000f10  pushq %rbp0000000100000f11  movq  %rsp, %rbp0000000100000f14  subq  $0x20, %rsp0000000100000f18  movl  $0x0, -0x4(%rbp)0000000100000f1f  movl  %edi, -0x8(%rbp)0000000100000f22  movq  %rsi, -0x10(%rbp)0000000100000f26  callq _test0000000100000f2b  xorl  %edi, %edi0000000100000f2d  cmpl  %eax, %edi0000000100000f2f  jne 0x100000f4b0000000100000f35  leaq  0x4a(%rip), %rdi        ## literal pool for: "jail break success\n"0000000100000f3c  movb  $0x0, %al0000000100000f3e  callq 0x100000f64             ## symbol stub for: _printf0000000100000f43  movl  %eax, -0x14(%rbp)0000000100000f46  jmp 0x100000f5c0000000100000f4b  leaq  0x48(%rip), %rdi        ## literal pool for: "jail break fail\n"0000000100000f52  movb  $0x0, %al0000000100000f54  callq 0x100000f64             ## symbol stub for: _printf0000000100000f59  movl  %eax, -0x18(%rbp)0000000100000f5c  xorl  %eax, %eax0000000100000f5e  addq  $0x20, %rsp0000000100000f62  popq  %rbp0000000100000f63  retq

计算出文件偏移后，用二进制编辑器直接修改之。保存，再运行。成功~

http://stevenygard.com/projects/class-dump/
http://pandara.xyz/2016/08/13/fake_wechat_location/
http://bbs.iosre.com/

Hopper Disassembler 见网盘-》我的软件

0 0