Core Idea: objdump-d find the key assembly code, then use ghex2 to open the executable program, modify and assemble the corresponding machine code, of course, the premise is to understand the assembly. The following is a simple example of linux: 1. Create a simple program first,
#include <iostream> using namespace std; bool abc(){ return false; } int main(int argc, char *argv[]) { if(abc()){ cout << "hacked" << endl; }else{ cout << "not hacked" << endl; } return 0; }
2. use g ++ main. cpp compiled into executable program. out, 3. run. /. out output: not hacked 4. call objdump-d. out> simple.txt 5. search for abc in simple.txt and find the following code:
080486f4 <_Z3abcv>: 80486f4: 55 push %ebp 80486f5: 89 e5 mov %esp,%ebp 80486f7: b8 00 00 00 00 mov $0x0,%eax 80486fc: 5d pop %ebp 80486fd: c3 ret
6. then open. out, search 55 89 e5 b8 00 00 00, find the location of the machine code corresponding to this Assembly, 7. finally, the key step is to change the machine code above to 55 89 e5 b8 01 00 00 00. In fact, only one word is changed, meaning that the return value of false is changed to true. 8. Run./a. out again and output: hacked. Success