pwnable从入门到放弃第八题。
Download : http://pwnable.kr/bin/leg.c
Download : http://pwnable.kr/bin/leg.asm
ssh [email protected] -p2222 (pw:guest)
先下载这两个文件：leg.c
#include <stdio.h>
#include <fcntl.h>
int key1(){
asm("mov r3, pc\n");
}
int key2(){
asm(
"push {r6}\n"
"add r6, pc, $1\n"
"bx r6\n"
".code 16\n"
"mov r3, pc\n"
"add r3, $0x4\n"
"push {r3}\n"
"pop {pc}\n"
".code 32\n"
"pop {r6}\n"
);
}
int key3(){
asm("mov r3, lr\n");
}
int main(){
int key=;
printf("Daddy has very strong arm! : ");
scanf("%d", &key);
if( (key1()+key2()+key3()) == key ){
printf("Congratz!\n");
int fd = open("flag", O_RDONLY);
char buf[];
int r = read(fd, buf, );
write(, buf, r);
}
else{
printf("I have strong leg :P\n");
}
return ;
}
代码貌似逻辑很直接，就是输入key，当key=key1+key2+key3时就可以了。
但是3个函数居然都是汇编= =、、、 而且还是arm的。。 让不让人活了。。
leg.asm 还不如直接看全汇编
(gdb) disass main
Dump of assembler code for function main:
0x00008d3c <+>: push {r4, r11, lr}
0x00008d40 <+>: add r11, sp, #
0x00008d44 <+>: sub sp, sp, #
0x00008d48 <+>: mov r3, #
0x00008d4c <+>: str r3, [r11, #-]
0x00008d50 <+>: ldr r0, [pc, #] ; 0x8dc0 <main+>
0x00008d54 <+>: bl 0xfb6c <printf>
0x00008d58 <+>: sub r3, r11, #
0x00008d5c <+>: ldr r0, [pc, #] ; 0x8dc4 <main+>
0x00008d60 <+>: mov r1, r3
0x00008d64 <+>: bl 0xfbd8 <__isoc99_scanf>
0x00008d68 <+>: bl 0x8cd4 <key1>
0x00008d6c <+>: mov r4, r0
0x00008d70 <+>: bl 0x8cf0 <key2>
0x00008d74 <+>: mov r3, r0
0x00008d78 <+>: add r4, r4, r3
0x00008d7c <+>: bl 0x8d20 <key3>
0x00008d80 <+>: mov r3, r0
0x00008d84 <+>: add r2, r4, r3
0x00008d88 <+>: ldr r3, [r11, #-]
0x00008d8c <+>: cmp r2, r3
0x00008d90 <+>: bne 0x8da8 <main+>
0x00008d94 <+>: ldr r0, [pc, #] ; 0x8dc8 <main+>
0x00008d98 <+>: bl 0x1050c <puts>
0x00008d9c <+>: ldr r0, [pc, #] ; 0x8dcc <main+>
0x00008da0 <+>: bl 0xf89c <system>
0x00008da4 <+>: b 0x8db0 <main+>
0x00008da8 <+>: ldr r0, [pc, #] ; 0x8dd0 <main+>
0x00008dac <+>: bl 0x1050c <puts>
0x00008db0 <+>: mov r3, #
0x00008db4 <+>: mov r0, r3
0x00008db8 <+>: sub sp, r11, #
0x00008dbc <+>: pop {r4, r11, pc}
0x00008dc0 <+>: andeq r10, r6, r12, lsl #
0x00008dc4 <+>: andeq r10, r6, r12, lsr #
0x00008dc8 <+>: ; <UNDEFINED> instruction: 0x0006a4b0
0x00008dcc <+>: ; <UNDEFINED> instruction: 0x0006a4bc
0x00008dd0 <+>: andeq r10, r6, r4, asr #
End of assembler dump.
(gdb) disass key1
Dump of assembler code for function key1:
0x00008cd4 <+>: push {r11} ; (str r11, [sp, #-]!)
0x00008cd8 <+>: add r11, sp, #
0x00008cdc <+>: mov r3, pc
0x00008ce0 <+>: mov r0, r3
0x00008ce4 <+>: sub sp, r11, #
0x00008ce8 <+>: pop {r11} ; (ldr r11, [sp], #)
0x00008cec <+>: bx lr
End of assembler dump.
(gdb) disass key2
Dump of assembler code for function key2:
0x00008cf0 <+>: push {r11} ; (str r11, [sp, #-]!)
0x00008cf4 <+>: add r11, sp, #
0x00008cf8 <+>: push {r6} ; (str r6, [sp, #-]!)
0x00008cfc <+>: add r6, pc, #
0x00008d00 <+>: bx r6
0x00008d04 <+>: mov r3, pc
0x00008d06 <+>: adds r3, #
0x00008d08 <+>: push {r3}
0x00008d0a <+>: pop {pc}
0x00008d0c <+>: pop {r6} ; (ldr r6, [sp], #)
0x00008d10 <+>: mov r0, r3
0x00008d14 <+>: sub sp, r11, #
0x00008d18 <+>: pop {r11} ; (ldr r11, [sp], #)
0x00008d1c <+>: bx lr
End of assembler dump.
(gdb) disass key3
Dump of assembler code for function key3:
0x00008d20 <+>: push {r11} ; (str r11, [sp, #-]!)
0x00008d24 <+>: add r11, sp, #
0x00008d28 <+>: mov r3, lr
0x00008d2c <+>: mov r0, r3
0x00008d30 <+>: sub sp, r11, #
0x00008d34 <+>: pop {r11} ; (ldr r11, [sp], #)
0x00008d38 <+>: bx lr
End of assembler dump.
(gdb)
逐步跟踪分析一下各函数的返回值：
key1()
0x00008cdc <+8>: mov r3, pc
0x00008ce0 <+12>: mov r0, r3 r0是函数的返回值，这个函数来源于pc，而pc指向的是执行语句行+8也就是0x00008cdc+0x8
key2()
0x00008cfc <+12>: add r6, pc, #1
0x00008d00 <+16>: bx r6
0x00008d04 <+20>: mov r3, pc
0x00008d06 <+22>: adds r3, #4
0x00008d10 <+32>: mov r0, r3
从第一行起，add r6,pc,#1 r6=0x00008d04+0x1 = 0x00008d05
从而bx r6就跳转thumb模式下，该模式下pc= 执行语句地址+0x4
而后adds r3,#4 又对r3+0x4
因此 返回值 0x00008d04+0x4+0x4
a = 0x00008d80
b = 0x00008cdc +0x8
c = 0x00008d04 +0x4+0x4
print (a+b+c)
key3()
0x00008d28 <+8>: mov r3, lr
0x00008d2c <+12>: mov r0, r3
返回值r0=lr，lr寄存器存储的是函数的返回地址，指向main函数中的
0x00008d80 <+68>: mov r3, r0
一行，因此可算出key = key1()+key2()+key3()