20135306 2.3 Program Hack Practice

Source: Internet
Author: User

the Linux "Practice --2.3 program Hack

20135306 Huang

First, Master NOP , JNE , JE , JMP , CMP Machine code for assembly instructions

    • The NOP:NOP instruction is the "null instruction". When executing to the NOP instruction, the CPU does nothing, just as an instruction to execute the past and continue executing a command behind NOP. (Machine code: 90)
    • JNE: Conditional transfer directives, if not equal, jumps. (Machine code: 75)
    • JE: Conditional transfer instruction, if equal, jumps. (Machine code: 74)
    • JMP: Unconditional transfer instructions. Direct transfer within the section of JMP Short (machine code: EB) directly within the section of JMP near (machine code: E9) Section indirectly transfer JMP Word (Machine code: FF) between segments Direct (FAR) Transfer JMP remote (machine code: EA)
    • CMP: Compare instruction, function equivalent to subtraction instruction, just compare operation between operands, do not save result. After the CMP directive executes, it affects the flag register. Other relevant instructions are identified by identifying these affected flag register bits to get a comparison result.

Second, mastering the Disassembly and hex programmer

    • Instruction "Objdump-d Login" To view the disassembly code
    • · Change 750e to 7500
      (It can be changed to 74E0, but the correct password input will be wrong)
      Note: In order to skip the password check, that is, regardless of the results of the comparison, the normal landing.
      Jne is the conditional jump, if the condition satisfies, then jumps;
      Jne the next two lines is the output content;
      JMP is a jump statement (no conditions, then jump directly)
      The next two lines of JMP are also output.
      Jne that jumps when comparisons are not equal. That is, when the input and the saved password is not equal, jump to the next line of MOV in JMP, if the comparison results are equal, then execute jne next two lines of MOV, call line, description, the execution MOV, call line output is "right".
      It is now clear that the red line needs to be modified so that it jumps to the next line when the comparison results are not equal.
      So, change the 0e to 00.
    • VI Open Login, enter ":%!" Xxd
    • Input:/750e find that location, compare to four weeks, determine the location and change it to 7500
    • Enter ":%! Xxd-r "Save
    • Enter ": Wq" to save
    • • Run the login test results

Thinking:
1. Do not log in normally, that is, the need to jump unconditionally to the wrong place, unconditionally jump to jmp, then the same need to change the 750e to eb0e. (EB for an unconditional jump within the paragraph, unconditionally jump to the wrong place);
2. In the same way if the opposite effect is required, that is, enter the correct password can not log in, enter the wrong password to login. You need to change it to 740e (74 of the judging conditions and 75 are the opposite).

20135306 2.3 Program Hack Practice

Contact Us

The content source of this page is from Internet, which doesn't represent Alibaba Cloud's opinion; products and services mentioned on that page don't have any relationship with Alibaba Cloud. If the content of the page makes you feel confusing, please write us an email, we will handle the problem within 5 days after receiving your email.

If you find any instances of plagiarism from the community, please send an email to: info-contact@alibabacloud.com and provide relevant evidence. A staff member will contact you within 5 working days.

A Free Trial That Lets You Build Big!

Start building with 50+ products and up to 12 months usage for Elastic Compute Service

  • Sales Support

    1 on 1 presale consultation

  • After-Sales Support

    24/7 Technical Support 6 Free Tickets per Quarter Faster Response

  • Alibaba Cloud offers highly flexible support services tailored to meet your exact needs.