the Linux "Practice --2.3 program Hack
20135306 Huang
First, Master NOP , JNE , JE , JMP , CMP Machine code for assembly instructions
- The NOP:NOP instruction is the "null instruction". When executing to the NOP instruction, the CPU does nothing, just as an instruction to execute the past and continue executing a command behind NOP. (Machine code: 90)
- JNE: Conditional transfer directives, if not equal, jumps. (Machine code: 75)
- JE: Conditional transfer instruction, if equal, jumps. (Machine code: 74)
- JMP: Unconditional transfer instructions. Direct transfer within the section of JMP Short (machine code: EB) directly within the section of JMP near (machine code: E9) Section indirectly transfer JMP Word (Machine code: FF) between segments Direct (FAR) Transfer JMP remote (machine code: EA)
- CMP: Compare instruction, function equivalent to subtraction instruction, just compare operation between operands, do not save result. After the CMP directive executes, it affects the flag register. Other relevant instructions are identified by identifying these affected flag register bits to get a comparison result.
Second, mastering the Disassembly and hex programmer
- Instruction "Objdump-d Login" To view the disassembly code
- · Change 750e to 7500
(It can be changed to 74E0, but the correct password input will be wrong)
Note: In order to skip the password check, that is, regardless of the results of the comparison, the normal landing.
Jne is the conditional jump, if the condition satisfies, then jumps;
Jne the next two lines is the output content;
JMP is a jump statement (no conditions, then jump directly)
The next two lines of JMP are also output.
Jne that jumps when comparisons are not equal. That is, when the input and the saved password is not equal, jump to the next line of MOV in JMP, if the comparison results are equal, then execute jne next two lines of MOV, call line, description, the execution MOV, call line output is "right".
It is now clear that the red line needs to be modified so that it jumps to the next line when the comparison results are not equal.
So, change the 0e to 00.
- VI Open Login, enter ":%!" Xxd
- Input:/750e find that location, compare to four weeks, determine the location and change it to 7500
- Enter ":%! Xxd-r "Save
- Enter ": Wq" to save
- • Run the login test results
Thinking:
1. Do not log in normally, that is, the need to jump unconditionally to the wrong place, unconditionally jump to jmp, then the same need to change the 750e to eb0e. (EB for an unconditional jump within the paragraph, unconditionally jump to the wrong place);
2. In the same way if the opposite effect is required, that is, enter the correct password can not log in, enter the wrong password to login. You need to change it to 740e (74 of the judging conditions and 75 are the opposite).
20135306 2.3 Program Hack Practice
