728x90
๋ฌธ์
end๋ก ์ ํํ๋ฉด ํ๋ก๊ทธ๋จ์ด ์ข ๋ฃ๋๋ค๊ณ ๊ฐ์ ํ์. ํ๋ก๊ทธ๋จ์ด ์ข ๋ฃ๋์ ๋, 0x400000 ๋ถํฐ 0x400019๊น์ง์ ๋ฐ์ดํฐ๋ฅผ ๋์๋๋ ์์คํค ๋ฌธ์๋ก ๋ณํํ๋ฉด ์ด๋ ๋ฌธ์์ด์ด ๋์ค๋๊ฐ?
[Register]
rcx = 0
rdx = 0
rsi = 0x400000
=======================
[Memory]
0x400000 | 0x67 0x55 0x5c 0x53 0x5f 0x5d 0x55 0x10
0x400008 | 0x44 0x5f 0x10 0x51 0x43 0x43 0x55 0x5d
0x400010 | 0x52 0x5c 0x49 0x10 0x47 0x5f 0x42 0x5c
0x400018 | 0x54 0x11 0x00 0x00 0x00 0x00 0x00 0x00
=======================
[code]
1: mov dl, BYTE PTR[rsi+rcx]
2: xor dl, 0x30
3: mov BYTE PTR[rsi+rcx], dl
4: inc rcx
5: cmp rcx, 0x19
6: jg end
7: jmp 1
์ฝ๋
#include <stdio.h>
int main()
{
int arr[4][8] = {
{0x67, 0x55, 0x5c, 0x53, 0x5f, 0x5d, 0x55, 0x10},
{0x44, 0x5f, 0x10, 0x51, 0x43, 0x43, 0x55, 0x5d},
{0x52, 0x5c, 0x49, 0x10, 0x47, 0x5f, 0x42, 0x5c},
{0x54, 0x11, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00},
};
int i = 0;
for(i=0; i<=0x19; i++)
{
printf("%c", *(*arr+i)^0x30 );
}
return 0;
}
๊ฒฐ๊ณผ:
Welcome to assembly world!
728x90
'๐ดCTF > DreamHack' ์นดํ ๊ณ ๋ฆฌ์ ๋ค๋ฅธ ๊ธ
DreamHack - Mitigation: Stack Canary ์ค์ต ๋ฌธ์ (์นด๋๋ฆฌ ๊ฐ ๊ตฌํ๊ธฐ) (0) | 2023.05.01 |
---|---|
DreamHack - Return to Shellcode ํ์ด (0) | 2023.05.01 |
DreamHack - Return Address Overwrite (0) | 2023.04.30 |
DreamHack - basic_exploitation_000 ํ์ด (0) | 2023.04.26 |
DreamHack - basic_exploitation_001 ํ์ด (0) | 2023.04.25 |