【pwnable.kr】leg

pwnable从入门到放弃第八题。

Download : http://pwnable.kr/bin/leg.c
Download : http://pwnable.kr/bin/leg.asm

ssh leg@pwnable.kr -p2222 (pw:guest)

先下载这两个文件：leg.c

#include <stdio.h>

#include <fcntl.h>

int key1(){

    asm("mov r3, pc\n");

}

int key2(){

    asm(

    "push    {r6}\n"

    "add    r6, pc, $1\n"

    "bx    r6\n"

    ".code   16\n"

    "mov    r3, pc\n"

    "add    r3, $0x4\n"

    "push    {r3}\n"

    "pop    {pc}\n"

    ".code    32\n"

    "pop    {r6}\n"

    );

}

int key3(){

    asm("mov r3, lr\n");

}

int main(){

    int key=;

    printf("Daddy has very strong arm! : ");

    scanf("%d", &key);

    if( (key1()+key2()+key3()) == key ){

        printf("Congratz!\n");

        int fd = open("flag", O_RDONLY);

        char buf[];

        int r = read(fd, buf, );

        write(, buf, r);

    }

    else{

        printf("I have strong leg :P\n");

    }

    return ;

}

代码貌似逻辑很直接，就是输入key，当key=key1+key2+key3时就可以了。

但是3个函数居然都是汇编= =、、、而且还是arm的。。让不让人活了。。

leg.asm 还不如直接看全汇编

(gdb) disass main

Dump of assembler code for function main:

   0x00008d3c <+>:    push    {r4, r11, lr}

   0x00008d40 <+>:    add    r11, sp, #

   0x00008d44 <+>:    sub    sp, sp, #

   0x00008d48 <+>:    mov    r3, #

   0x00008d4c <+>:    str    r3, [r11, #-]

   0x00008d50 <+>:    ldr    r0, [pc, #]    ; 0x8dc0 <main+>

   0x00008d54 <+>:    bl    0xfb6c <printf>

   0x00008d58 <+>:    sub    r3, r11, #

   0x00008d5c <+>:    ldr    r0, [pc, #]    ; 0x8dc4 <main+>

   0x00008d60 <+>:    mov    r1, r3

   0x00008d64 <+>:    bl    0xfbd8 <__isoc99_scanf>

   0x00008d68 <+>:    bl    0x8cd4 <key1>

   0x00008d6c <+>:    mov    r4, r0

   0x00008d70 <+>:    bl    0x8cf0 <key2>

   0x00008d74 <+>:    mov    r3, r0

   0x00008d78 <+>:    add    r4, r4, r3

   0x00008d7c <+>:    bl    0x8d20 <key3>

   0x00008d80 <+>:    mov    r3, r0

   0x00008d84 <+>:    add    r2, r4, r3

   0x00008d88 <+>:    ldr    r3, [r11, #-]

   0x00008d8c <+>:    cmp    r2, r3

   0x00008d90 <+>:    bne    0x8da8 <main+>

   0x00008d94 <+>:    ldr    r0, [pc, #]    ; 0x8dc8 <main+>

   0x00008d98 <+>:    bl    0x1050c <puts>

   0x00008d9c <+>:    ldr    r0, [pc, #]    ; 0x8dcc <main+>

   0x00008da0 <+>:    bl    0xf89c <system>

   0x00008da4 <+>:    b    0x8db0 <main+>

   0x00008da8 <+>:    ldr    r0, [pc, #]    ; 0x8dd0 <main+>

   0x00008dac <+>:    bl    0x1050c <puts>

   0x00008db0 <+>:    mov    r3, #

   0x00008db4 <+>:    mov    r0, r3

   0x00008db8 <+>:    sub    sp, r11, #

   0x00008dbc <+>:    pop    {r4, r11, pc}

   0x00008dc0 <+>:    andeq    r10, r6, r12, lsl #

   0x00008dc4 <+>:    andeq    r10, r6, r12, lsr #

   0x00008dc8 <+>:            ; <UNDEFINED> instruction: 0x0006a4b0

   0x00008dcc <+>:            ; <UNDEFINED> instruction: 0x0006a4bc

   0x00008dd0 <+>:    andeq    r10, r6, r4, asr #

End of assembler dump.

(gdb) disass key1

Dump of assembler code for function key1:

   0x00008cd4 <+>:    push    {r11}        ; (str r11, [sp, #-]!)

   0x00008cd8 <+>:    add    r11, sp, #

   0x00008cdc <+>:    mov    r3, pc

   0x00008ce0 <+>:    mov    r0, r3

   0x00008ce4 <+>:    sub    sp, r11, #

   0x00008ce8 <+>:    pop    {r11}        ; (ldr r11, [sp], #)

   0x00008cec <+>:    bx    lr

End of assembler dump.

(gdb) disass key2

Dump of assembler code for function key2:

   0x00008cf0 <+>:    push    {r11}        ; (str r11, [sp, #-]!)

   0x00008cf4 <+>:    add    r11, sp, #

   0x00008cf8 <+>:    push    {r6}        ; (str r6, [sp, #-]!)

   0x00008cfc <+>:    add    r6, pc, #

   0x00008d00 <+>:    bx    r6

   0x00008d04 <+>:    mov    r3, pc

   0x00008d06 <+>:    adds    r3, #

   0x00008d08 <+>:    push    {r3}

   0x00008d0a <+>:    pop    {pc}

   0x00008d0c <+>:    pop    {r6}        ; (ldr r6, [sp], #)

   0x00008d10 <+>:    mov    r0, r3

   0x00008d14 <+>:    sub    sp, r11, #

   0x00008d18 <+>:    pop    {r11}        ; (ldr r11, [sp], #)

   0x00008d1c <+>:    bx    lr

End of assembler dump.

(gdb) disass key3

Dump of assembler code for function key3:

   0x00008d20 <+>:    push    {r11}        ; (str r11, [sp, #-]!)

   0x00008d24 <+>:    add    r11, sp, #

   0x00008d28 <+>:    mov    r3, lr

   0x00008d2c <+>:    mov    r0, r3

   0x00008d30 <+>:    sub    sp, r11, #

   0x00008d34 <+>:    pop    {r11}        ; (ldr r11, [sp], #)

   0x00008d38 <+>:    bx    lr

End of assembler dump.

(gdb)

逐步跟踪分析一下各函数的返回值：

key1()

   0x00008cdc <+8>:    mov    r3, pc

   0x00008ce0 <+12>:    mov    r0, r3

r0是函数的返回值，这个函数来源于pc，而pc指向的是执行语句行+8也就是0x00008cdc+0x8

key2()

   0x00008cfc <+12>:    add    r6, pc, #1

   0x00008d00 <+16>:    bx    r6

   0x00008d04 <+20>:    mov    r3, pc

   0x00008d06 <+22>:    adds    r3, #4

   0x00008d10 <+32>:    mov    r0, r3

从第一行起，add r6,pc,#1 r6=0x00008d04+0x1 = 0x00008d05

从而bx r6就跳转thumb模式下，该模式下pc= 执行语句地址+0x4

而后adds r3,#4 又对r3+0x4

因此返回值 0x00008d04+0x4+0x4

a = 0x00008d80

b = 0x00008cdc +0x8

c = 0x00008d04 +0x4+0x4

print (a+b+c)

key3()

   0x00008d28 <+8>:    mov    r3, lr

   0x00008d2c <+12>:    mov    r0, r3

返回值r0=lr，lr寄存器存储的是函数的返回地址，指向main函数中的

   0x00008d80 <+68>:    mov    r3, r0

一行，因此可算出key = key1()+key2()+key3()

巴特西

【pwnable.kr】leg

最新文章

热门文章