본문 바로가기
System_Security

10. 기계어 -> C 복원 연습

by Jnamelight 2017. 8. 3.


0x8048460 <main>:       push   %ebp
0x8048461 <main+1>:     mov    %ebp,%esp

0x8048463 <main+3>:     sub    %esp,0x40c
// 1036바이트의 스택 메모리를 사용

0x8048469 <main+9>:     push   0x80485b0
0x804846e <main+14>:    call   0x8048398 <printf>
0x8048473 <main+19>:    add    %esp,4
// printf("~~~");

0x8048476 <main+22>:    mov    %eax,%ds:0x80496f0
0x804847b <main+27>:    push   %eax
0x804847c <main+28>:    push   0x400
0x8048481 <main+33>:    lea    %eax,[%ebp-1024]
0x8048487 <main+39>:    push   %eax
0x8048488 <main+40>:    call   0x8048368 <fgets>
0x804848d <main+45>:    add    %esp,12
// fgets(char *ad, size, Filediscription)

0x8048490 <main+48>:    lea    %eax,[%ebp-1024]
0x8048496 <main+54>:    push   %eax
0x8048497 <main+55>:    call   0x8048378 <strlen>
0x804849c <main+60>:    add    %esp,4
// strlen(buffer);

0x804849f <main+63>:    mov    DWORD PTR [%ebp-1036],%eax


0x80484a5 <main+69>:    cmp    DWORD PTR [%ebp-1036],0
0x80484ac <main+76>:    jle    0x80484d2 <main+114>
// 다시 cmp로 오는 점프 문이 없기 떄문에 if 로 볼수 있다.
// if
 
0x80484ae <main+78>:    mov    %eax,DWORD PTR [%ebp-1036]

0x80484b4 <main+84>:    dec    %eax
0x80484b5 <main+85>:    lea    %edx,[%ebp-1024]
0x80484bb <main+91>:    cmp    BYTE PTR [%eax+%edx],0xa
0x80484bf <main+95>:    jne    0x80484d2 <main+114>

0x80484c1 <main+97>:    mov    %eax,DWORD PTR [%ebp-1036]
0x80484c7 <main+103>:   dec    %eax
0x80484c8 <main+104>:   lea    %edx,[%ebp-1024]
0x80484ce <main+110>:   mov    BYTE PTR [%eax+%edx],0x0



0x80484d2 <main+114>:   lea    %ecx,[%ebp-1024]
0x80484d8 <main+120>:   mov    DWORD PTR [%ebp-1028],%ecx
0x80484de <main+126>:   mov    DWORD PTR [%ebp-1032],0x8049608

//while<-

0x80484e8 <main+136>:   mov    %eax,DWORD PTR [%ebp-1028]
0x80484ee <main+142>:   cmp    BYTE PTR [%eax],0x0
0x80484f1 <main+145>:   je     0x8048512 <main+178>	// escape


0x80484f3 <main+147>:   mov    %eax,DWORD PTR [%ebp-1032]
0x80484f9 <main+153>:   cmp    BYTE PTR [%eax],0x0
0x80484fc <main+156>:   je     0x8048512 <main+178>	// escape

0x80484fe <main+158>:   mov    %eax,DWORD PTR [%ebp-1028]
0x8048504 <main+164>:   mov    %edx,DWORD PTR [%ebp-1032]
0x804850a <main+170>:   mov    %al,BYTE PTR [%eax]
0x804850c <main+172>:   cmp    %al,BYTE PTR [%edx]
0x804850e <main+174>:   je     0x8048514 <main+180>	//escape

0x8048510 <main+176>:   jmp    0x8048512 <main+178>
0x8048512 <main+178>:   jmp    0x8048522 <main+194>

0x8048514 <main+180>:   inc    DWORD PTR [%ebp-1028]
0x804851a <main+186>:   inc    DWORD PTR [%ebp-1032]
0x8048520 <main+192>:   jmp    0x80484e8 <main+136>

//->

0x8048522 <main+194>:   mov    %eax,DWORD PTR [%ebp-1028]
0x8048528 <main+200>:   cmp    BYTE PTR [%eax],0x0
0x804852b <main+203>:   jne    0x8048547 <main+231>

0x804852d <main+205>:   mov    %eax,DWORD PTR [%ebp-1032]
0x8048533 <main+211>:   cmp    BYTE PTR [%eax],0x0
0x8048536 <main+214>:   jne    0x8048547 <main+231>

0x8048538 <main+216>:   push   0x80485c1
0x804853d <main+221>:   call   0x8048398 <printf>
0x8048542 <main+226>:   add    %esp,4
0x8048545 <main+229>:   jmp    0x8048554 <main+244>

0x8048547 <main+231>:   push   0x80485df
0x804854c <main+236>:   call   0x8048398 <printf>
0x8048551 <main+241>:   add    %esp,4
0x8048554 <main+244>:   xor    %eax,%eax
0x8048556 <main+246>:   jmp    0x8048558 <main+248>
0x8048558 <main+248>:   leave
0x8048559 <main+249>:   ret
0x804855a <main+250>:   nop
0x804855b <main+251>:   nop
0x804855c <main+252>:   nop
0x804855d <main+253>:   nop
0x804855e <main+254>:   nop
0x804855f <main+255>:   nop

------------------------------------------------------------------------


#include <stdio.h>

int main()
{

	char buffer[1024];	// ebp-1024
	char *a;		// ebp-1028
	char *b;		// ebp-1032
	int len;		// ebp-1036

	printf("Input password:");	

	fgets( buffer, 1024, stdin);

	len=strlen( buffer );
	if( len > 0 ){
		if(buffer[len-1] == '\n'){
			buffer[len-1] = 0;
		}
	}qu
	
	a = buffer;
	b = "th3p4ssw0rd";	// string			

	while( *a != '\0' && *b != '\0' && *a == *b ){
		
		a++;
		b++;
	}

	if(*a == '\0' && *b == '\0' ){
		printf("Congratulations! You got it!\n");
		
	}else{
		printf("Oops! wrong password! :-P\n");
	}
	
	

	return 0;
}


'System_Security' 카테고리의 다른 글

12. 후킹  (0) 2017.08.18
11. Buffer Overflow  (0) 2017.08.08
09. 디버거  (0) 2017.08.03
08. 시스템 콜  (0) 2017.08.01
07. 메인 함수  (0) 2017.08.01

댓글