GCC<\/h2>\n
GCC \u7f16\u8bd1\u5de5\u5177\u94fe\u5728\u7f16\u8bd1\u4e00\u4e2aC\u6e90\u6587\u4ef6\u65f6\u9700\u8981\u7ecf\u8fc7\u4ee5\u4e0b 4 \u6b65\uff1a<\/p>\n
- \n
- \u9884\u5904\u7406\uff1a\u4e3a\u628a\u5934\u6587\u4ef6\u7684\u4ee3\u7801\u3001\u5b8f\u4e4b\u7c7b\u7684\u5185\u5bb9\u8f6c\u6362\u6210\u751f\u6210\u7684.i\u6587\u4ef6\uff0c\u8fd8\u662fC\u4ee3\u7801\u3002<\/li>\n
- \u7f16\u8bd1\uff1a\u628a\u9884\u5904\u7406\u540e\u7684.i\u6587\u4ef6\u901a\u8fc7\u7f16\u8bd1\u6210.s\u6587\u4ef6\uff0c\u6c47\u7f16\u8bed\u8a00\u3002<\/li>\n
- \u6c47\u7f16\uff1a\u5c06\u6c47\u7f16\u8bed\u8a00\u6587\u4ef6\u751f\u6210\u76ee\u6807\u6587\u4ef6.o\u6587\u4ef6\uff0c\u673a\u5668\u7801\u3002<\/li>\n
- \u94fe\u63a5\uff1a\u5c06\u6bcf\u4e2a\u6e90\u6587\u4ef6\u5bf9\u5e94\u7684.o\u6587\u4ef6\u94fe\u63a5\u8d77\u6765\uff0c\u5c31\u751f\u6210\u4e00\u4e2a\u53ef\u6267\u884c\u7a0b\u5e8f\u6587\u4ef6\u3002\n
- \n
- \u52a8\u6001\u94fe\u63a5\uff1aGCC\u7f16\u8bd1\u65f6\u7684\u9ed8\u8ba4\u9009\u9879\u3002\u52a8\u6001\u662f\u6307\u5728\u5e94\u7528\u7a0b\u5e8f\u8fd0\u884c\u65f6\u624d\u53bb\u52a0\u8f7d\u5916\u90e8\u7684\u4ee3\u7801\u5e93\uff0c\u4e0d\u540c\u7684\u7a0b\u5e8f\u53ef\u4ee5\u5171\u7528\u4ee3\u7801\u5e93\u3002 \u6240\u4ee5\u52a8\u6001\u94fe\u63a5\u751f\u6210\u7684\u7a0b\u5e8f\u6bd4\u8f83\u5c0f\uff0c\u5360\u7528\u8f83\u5c11\u7684\u5185\u5b58\u3002<\/li>\n
- \u9759\u6001\u94fe\u63a5\uff1a\u94fe\u63a5\u65f6\u4f7f\u7528\u9009\u9879 \u201c--static\u201d\uff0c\u5b83\u5728\u7f16\u8bd1\u9636\u6bb5\u5c31\u4f1a\u628a\u6240\u6709\u7528\u5230\u7684\u5e93\u6253\u5305\u5230\u81ea\u5df1\u7684\u53ef\u6267\u884c\u7a0b\u5e8f\u4e2d\u3002 \u6240\u4ee5\u9759\u6001\u94fe\u63a5\u7684\u4f18\u70b9\u662f\u5177\u6709\u8f83\u597d\u7684\u517c\u5bb9\u6027\uff0c\u4e0d\u4f9d\u8d56\u5916\u90e8\u73af\u5883\uff0c\u4f46\u662f\u751f\u6210\u7684\u7a0b\u5e8f\u6bd4\u8f83\u5927\u3002<\/li>\n<\/ul>\n<\/li>\n<\/ul>\n
#\u9884\u5904\u7406\u8fc7\u7a0b\u4e2d\uff0c\u5bf9\u6e90\u4ee3\u7801\u6587\u4ef6\u4e2d\u7684\u6587\u4ef6\u5305\u542b (include)\u3001 \u9884\u7f16\u8bd1\u8bed\u53e5 (\u5982\u5b8f\u5b9a\u4e49define\u7b49)\u8fdb\u884c\u5c55\u5f00\uff0c\u751f\u6210 .i \u6587\u4ef6\u3002\ngcc \u2013E hello.c \u2013o hello.i\n#\u7f16\u8bd1\u9636\u6bb5\u628a\u9884\u5904\u7406\u540e\u7684.i\u6587\u4ef6\u901a\u8fc7\u7f16\u8bd1\u6210\u4e3a\u6c47\u7f16\u8bed\u8a00\uff0c\u751f\u6210.s\u6587\u4ef6\uff0c\u5373\u628a\u4ee3\u7801\u4eceC\u8bed\u8a00\u8f6c\u6362\u6210\u6c47\u7f16\u8bed\u8a00\uff0c\u8fd9\u662fGCC\u7f16\u8bd1\u5668\u5b8c\u6210\u7684\u5de5\u4f5c\u3002\ngcc \u2013S hello.i \u2013o hello.s\n#\u6c47\u7f16\u9636\u6bb5\u5c06\u6c47\u7f16\u8bed\u8a00\u6587\u4ef6\u7ecf\u8fc7\u6c47\u7f16\uff0c\u751f\u6210\u76ee\u6807\u6587\u4ef6.o\u6587\u4ef6\uff0c\u6bcf\u4e00\u4e2a\u6e90\u6587\u4ef6\u90fd\u5bf9\u5e94\u4e00\u4e2a\u76ee\u6807\u6587\u4ef6\u3002\u5373\u628a\u6c47\u7f16\u8bed\u8a00\u7684\u4ee3\u7801\u8f6c\u6362\u6210\u673a\u5668\u7801\uff0c\u8fd9\u662fas\u6c47\u7f16\u5668\u5b8c\u6210\u7684\u5de5\u4f5c\u3002\ngcc \u2013c hello.s \u2013o hello.o\n#\u94fe\u63a5\u9636\u6bb5\u5c06\u6bcf\u4e2a\u6e90\u6587\u4ef6\u5bf9\u5e94\u7684\u76ee\u6807.o\u6587\u4ef6\u94fe\u63a5\u8d77\u6765\uff0c\u5c31\u751f\u6210\u4e00\u4e2a\u53ef\u6267\u884c\u7a0b\u5e8f\u6587\u4ef6\uff0c\u8fd9\u662f\u94fe\u63a5\u5668ld\u5b8c\u6210\u7684\u5de5\u4f5c\u3002\ngcc hello.o \u2013o hello\nNX\uff1a-z execstack \/ -z noexecstack (\u5173\u95ed \/ \u5f00\u542f) #\u4e0d\u8ba9\u6267\u884c\u6808\u4e0a\u7684\u6570\u636e\uff0c\u4e8e\u662fJMP ESP\u5c31\u4e0d\u80fd\u7528\u4e86\nCanary\uff1a-fno-stack-protector \/-fstack-protector \/ -fstack-protector-all #(\u5173\u95ed \/ \u5f00\u542f \/ \u5168\u5f00\u542f) \u6808\u91cc\u63d2\u5165cookie\u4fe1\u606f\nPIE\uff1a-no-pie \/ -pie #(\u5173\u95ed \/ \u5f00\u542f) \u5730\u5740\u968f\u673a\u5316\uff0c\u53e6\u5916\u6253\u5f00\u540e\u4f1a\u6709get_pc_thunk\nRELRO\uff1a-z norelro \/ -z lazy \/ -z now #(\u5173\u95ed \/ \u90e8\u5206\u5f00\u542f \/ \u5b8c\u5168\u5f00\u542f) \u5bf9GOT\u8868\u5177\u6709\u5199\u6743\u9650<\/code><\/pre>\nfile<\/h2>\n
\u7528\u4e8e\u8fa8\u8bc6\u6587\u4ef6\u7c7b\u578b\uff1a<\/p>\n
file [-bcLvz][-f <\u540d\u79f0\u6587\u4ef6>][-m <\u9b54\u6cd5\u6570\u5b57\u6587\u4ef6>...][\u6587\u4ef6\u6216\u76ee\u5f55...]\n-b \u3000\u5217\u51fa\u8fa8\u8bc6\u7ed3\u679c\u65f6\uff0c\u4e0d\u663e\u793a\u6587\u4ef6\u540d\u79f0\u3002\n-c \u3000\u8be6\u7ec6\u663e\u793a\u6307\u4ee4\u6267\u884c\u8fc7\u7a0b\uff0c\u4fbf\u4e8e\u6392\u9519\u6216\u5206\u6790\u7a0b\u5e8f\u6267\u884c\u7684\u60c5\u5f62\u3002\n-f <\u540d\u79f0\u6587\u4ef6> \u3000\u6307\u5b9a\u540d\u79f0\u6587\u4ef6\uff0c\u5176\u5185\u5bb9\u6709\u4e00\u4e2a\u6216\u591a\u4e2a\u6587\u4ef6\u540d\u79f0\u65f6\uff0c\u8ba9file\u4f9d\u5e8f\u8fa8\u8bc6\u8fd9\u4e9b\u6587\u4ef6\uff0c\u683c\u5f0f\u4e3a\u6bcf\u5217\u4e00\u4e2a\u6587\u4ef6\u540d\u79f0\u3002\n-L \u3000\u76f4\u63a5\u663e\u793a\u7b26\u53f7\u8fde\u63a5\u6240\u6307\u5411\u7684\u6587\u4ef6\u7684\u7c7b\u522b\u3002\n-m <\u9b54\u6cd5\u6570\u5b57\u6587\u4ef6> \u3000\u6307\u5b9a\u9b54\u6cd5\u6570\u5b57\u6587\u4ef6\u3002\n-v \u3000\u663e\u793a\u7248\u672c\u4fe1\u606f\u3002\n-z \u3000\u5c1d\u8bd5\u53bb\u89e3\u8bfb\u538b\u7f29\u6587\u4ef6\u7684\u5185\u5bb9\u3002\n[\u6587\u4ef6\u6216\u76ee\u5f55...] \u8981\u786e\u5b9a\u7c7b\u578b\u7684\u6587\u4ef6\u5217\u8868\uff0c\u591a\u4e2a\u6587\u4ef6\u4e4b\u95f4\u4f7f\u7528\u7a7a\u683c\u5206\u5f00\uff0c\u53ef\u4ee5\u4f7f\u7528shell\u901a\u914d\u7b26\u5339\u914d\u591a\u4e2a\u6587\u4ef6\u3002<\/code><\/pre>\nldd<\/h2>\n
\u5728linux\u4e2d\uff0c ldd\u662flist, dynamic, dependencies\u7684\u7f29\u5199\uff0c \u610f\u601d\u662f\uff0c \u5217\u51fa\u52a8\u6001\u5e93\u4f9d\u8d56\u5173\u7cfb\u3002<\/p>\n
ldd(\u9009\u9879)(\u53c2\u6570)\n--version \u6253\u5370\u6307\u4ee4\u7248\u672c\u53f7\uff1b\n-v \u8be6\u7ec6\u4fe1\u606f\u6a21\u5f0f\uff0c\u6253\u5370\u6240\u6709\u76f8\u5173\u4fe1\u606f\uff1b\n-u \u6253\u5370\u672a\u4f7f\u7528\u7684\u76f4\u63a5\u4f9d\u8d56\uff1b\n-d \u6267\u884c\u91cd\u5b9a\u4f4d\u548c\u62a5\u544a\u4efb\u4f55\u4e22\u5931\u7684\u5bf9\u8c61\uff1b\n-r \u6267\u884c\u6570\u636e\u5bf9\u8c61\u548c\u51fd\u6570\u7684\u91cd\u5b9a\u4f4d\uff0c\u5e76\u4e14\u62a5\u544a\u4efb\u4f55\u4e22\u5931\u7684\u5bf9\u8c61\u548c\u51fd\u6570\uff1b\n--help \u663e\u793a\u5e2e\u52a9\u4fe1\u606f\u3002<\/code><\/pre>\n\u539f\u7406\uff1a<\/p>\n
ldd\u4e0d\u662f\u4e00\u4e2a\u53ef\u6267\u884c\u7a0b\u5e8f\uff0c\u800c\u53ea\u662f\u4e00\u4e2ashell\u811a\u672c\u3002<\/p>\n
ldd\u80fd\u591f\u663e\u793a\u53ef\u6267\u884c\u6a21\u5757\u7684dependency\uff0c\u5176\u539f\u7406\u662f\u901a\u8fc7\u8bbe\u7f6e\u4e00\u7cfb\u5217\u7684\u73af\u5883\u53d8\u91cf\u3002<\/p>\n
ldd\u663e\u793a\u53ef\u6267\u884c\u6a21\u5757\u7684dependency\u7684\u5de5\u4f5c\u539f\u7406\uff0c\u5176\u5b9e\u8d28\u662f\u901a\u8fc7ld-linux.so\uff08elf\u52a8\u6001\u5e93\u7684\u88c5\u8f7d\u5668\uff09\u6765\u5b9e\u73b0\u7684\u3002\u6211\u4eec\u77e5\u9053\uff0cld- linux.so\u6a21\u5757\u4f1a\u5148\u4e8eexecutable\u6a21\u5757\u7a0b\u5e8f\u5de5\u4f5c\uff0c\u5e76\u83b7\u5f97\u63a7\u5236\u6743\uff0c\u56e0\u6b64\u5f53\u4e0a\u8ff0\u7684\u90a3\u4e9b\u73af\u5883\u53d8\u91cf\u88ab\u8bbe\u7f6e\u65f6\uff0cld-linux.so\u9009\u62e9\u4e86\u663e\u793a\u53ef\u6267\u884c\u6a21\u5757\u7684dependency\u3002<\/p>\n
\u5b9e\u9645\u4e0a\u53ef\u4ee5\u76f4\u63a5\u6267\u884cld-linux.so\u6a21\u5757\uff0c\u5982\uff1a\/lib\/ld-linux.so.2 --list program\uff08\u8fd9\u76f8\u5f53\u4e8eldd program\uff09<\/p>\n
nm<\/h2>\n
nm\u547d\u4ee4\u662flinux\u4e0b\u81ea\u5e26\u7684\u7279\u5b9a\u6587\u4ef6\u5206\u6790\u5de5\u5177<\/strong>\uff0c\u4e00\u822c\u7528\u6765\u68c0\u67e5\u5206\u6790\u4e8c\u8fdb\u5236\u6587\u4ef6\u3001\u5e93\u6587\u4ef6\u3001\u53ef\u6267\u884c\u6587\u4ef6\u4e2d\u7684\u7b26\u53f7\u8868\uff0c\u8fd4\u56de\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e2d\u5404\u6bb5\u7684\u4fe1\u606f\u3002<\/p>\n
nm [-option]\n-A \u6bcf\u4e2a\u7b26\u53f7\u524d\u663e\u793a\u6587\u4ef6\u540d\n-D \u663e\u793a\u52a8\u6001\u7b26\u53f7\n-g \u4ec5\u663e\u793a\u5916\u90e8\u7b26\u53f7\n-r \u53cd\u5e8f\u663e\u793a\u7b26\u53f7\u8868<\/code><\/pre>\nhexdump<\/h2>\n
hexdump\u662fLinux\u4e0b\u7684\u4e00\u4e2a\u4e8c\u8fdb\u5236\u6587\u4ef6\u67e5\u770b\u5de5\u5177\uff0c\u5b83\u53ef\u4ee5\u5c06\u4e8c\u8fdb\u5236\u6587\u4ef6\u8f6c\u6362\u4e3aASCII\u3001\u516b\u8fdb\u5236\u3001\u5341\u8fdb\u5236\u3001\u5341\u516d\u8fdb\u5236\u683c\u5f0f\u8fdb\u884c\u67e5\u770b\u3002<\/p>\n
hexdump: [-bcCdovx] [-e fmt] [-f fmt_file] [-n length] [-s skip] [file ...]\n-n length \u53ea\u683c\u5f0f\u5316\u8f93\u5165\u6587\u4ef6\u7684\u524dlength\u4e2a\u5b57\u8282\u3002\n-C \u8f93\u51fa\u89c4\u8303\u7684\u5341\u516d\u8fdb\u5236\u548cASCII\u7801\u3002\n-b \u5355\u5b57\u8282\u516b\u8fdb\u5236\u663e\u793a\u3002\n-c \u5355\u5b57\u8282\u5b57\u7b26\u663e\u793a\u3002\n-d \u53cc\u5b57\u8282\u5341\u8fdb\u5236\u663e\u793a\u3002\n-o \u53cc\u5b57\u8282\u516b\u8fdb\u5236\u663e\u793a\u3002\n-x \u53cc\u5b57\u8282\u5341\u516d\u8fdb\u5236\u663e\u793a\u3002\n-s \u4ece\u504f\u79fb\u91cf\u5f00\u59cb\u8f93\u51fa\u3002<\/code><\/pre>\nobjdump<\/h2>\n
objdump\u547d\u4ee4\u662fLinux\u4e0b\u7684\u53cd\u6c47\u7f16\u76ee\u6807\u6587\u4ef6\u6216\u8005\u53ef\u6267\u884c\u6587\u4ef6\u7684\u547d\u4ee4<\/p>\n
objdump [option] [file]\n-f \u663e\u793a\u6587\u4ef6\u5934\u4fe1\u606f\n-d \u5c06\u4ee3\u7801\u6bb5\u53cd\u6c47\u7f16\n-S \u5c06\u4ee3\u7801\u6bb5\u53cd\u6c47\u7f16\u7684\u540c\u65f6\uff0c\u5c06\u53cd\u6c47\u7f16\u4ee3\u7801\u4e0e\u6e90\u4ee3\u7801\u4ea4\u66ff\u663e\u793a\uff0c\u7f16\u8bd1\u65f6\u9700\u8981\u4f7f\u7528-g\u53c2\u6570\uff0c\u5373\u9700\u8981\u8c03\u8bd5\u4fe1\u606f\uff1b\n-C \u5c06C++\u7b26\u53f7\u540d\u9006\u5411\u89e3\u6790\n-l \u53cd\u6c47\u7f16\u4ee3\u7801\u4e2d\u63d2\u5165\u6587\u4ef6\u540d\u548c\u884c\u53f7\n-j section \u4ec5\u53cd\u6c47\u7f16\u6307\u5b9a\u7684section\n-M intel \u4ee5intel\u7684\u6c47\u7f16\u5f62\u5f0f\u5448\u73b0\uff0c\u9ed8\u8ba4\u662fAT&T<\/code><\/pre>\nreadelf<\/h2>\n
readelf\u547d\u4ee4\uff0c\u4e00\u822c\u7528\u4e8e\u67e5\u770bELF\u683c\u5f0f\u7684\u6587\u4ef6\u4fe1\u606f\uff0c\u5e38\u89c1\u7684\u6587\u4ef6\u5982\u5728Linux\u4e0a\u7684\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u52a8\u6001\u5e93(*.so)\u6216\u8005\u9759\u6001\u5e93(*.a) \u7b49\u5305\u542bELF\u683c\u5f0f\u7684\u6587\u4ef6\u3002<\/p>\n
readelf (option)(file)\n-a all \u663e\u793a\u5168\u90e8\u4fe1\u606f\n-h (elf header)\uff0c\u663e\u793aelf\u6587\u4ef6\u5f00\u59cb\u7684\u6587\u4ef6\u5934\u4fe1\u606f\u3002\n-l (program headers),segments \u663e\u793a\u7a0b\u5e8f\u5934\uff08\u6bb5\u5934\uff09\u4fe1\u606f(\u5982\u679c\u6709\u6570\u636e\u7684\u8bdd)\u3002\n-S (section headers),sections \u663e\u793a\u8282\u5934\u4fe1\u606f(\u5982\u679c\u6709\u6570\u636e\u7684\u8bdd)\u3002\n-g (section groups),\u663e\u793a\u8282\u7ec4\u4fe1\u606f(\u5982\u679c\u6709\u6570\u636e\u7684\u8bdd)\u3002\n-s (symbols) \u663e\u793a\u7b26\u53f7\u8868\u6bb5\u4e2d\u7684\u9879\uff08\u5982\u679c\u6709\u6570\u636e\u7684\u8bdd\uff09\u3002\n-e headers \u663e\u793a\u5168\u90e8\u5934\u4fe1\u606f\uff0c\u7b49\u4ef7\u4e8e: -h -l -S \u3002\n-r relocs \u663e\u793a\u53ef\u91cd\u5b9a\u4f4d\u6bb5\u7684\u4fe1\u606f\u3002\n-d dynamic \u663e\u793a\u52a8\u6001\u6bb5\u7684\u4fe1\u606f\u3002\n-V version-info \u663e\u793a\u7248\u672c\u6bb5\u7684\u4fe1\u606f\u3002<\/code><\/pre>\nROPgadget<\/h2>\n
\u67e5\u627e\u6587\u4ef6\u4e2d\u4e00\u4e9b\u9700\u8981\u7684
\u6307\u4ee4<\/code>\u548c\u5b57\u7b26\u4e32<\/code>\u7b49\u3002<\/p>\nROPgadget --binary \u6587\u4ef6\u540d --only "pop|ret" | grep rdi\nROPgadget --binary \u6587\u4ef6\u540d --only "pop|ret" | grep rsi\nROPgadget --binary \u6587\u4ef6\u540d --only "pop|ret"\nROPgadget --binary \u6587\u4ef6\u540d --sting '\/bin\/sh'\nROPgadget --binary \u6587\u4ef6\u540d --sting 'cat flag.txt'\nROPgadget --binary \u6587\u4ef6\u540d --sting 'cat flag'\nROPgadget --binary \u6587\u4ef6\u540d --sting 'sh'\nROPgadget --binary \u6587\u4ef6\u540d --sting '\/sh'<\/code><\/pre>\ngdb\u8c03\u8bd5<\/h1>\n
GDB \u5168\u79f0\u201cGNU symbolic debugger\u201d\u662f Linux \u4e0b\u5e38\u7528\u7684\u7a0b\u5e8f\u8c03\u8bd5\u5668\u3002\u53d1\u5c55\u81f3\u4eca\uff0cGDB \u5df2\u7ecf\u8fed\u4ee3\u4e86\u8bf8\u591a\u4e2a\u7248\u672c\uff0c\u5f53\u4e0b\u7684 GDB \u652f\u6301\u8c03\u8bd5\u591a\u79cd\u7f16\u7a0b\u8bed\u8a00\u7f16\u5199\u7684\u7a0b\u5e8f\uff0c\u5305\u62ec C\u3001C++\u3001Go\u3001Objective-C\u3001OpenCL\u3001Ada \u7b49\u3002\u5b9e\u9645\u573a\u666f\u4e2d\uff0cGDB \u66f4\u5e38\u7528\u6765\u8c03\u8bd5 C \u548c C++ \u7a0b\u5e8f\u3002<\/p>\n
\u5e38\u7528\u547d\u4ee4<\/h2>\n
\n\n
\n \n\u547d\u4ee4\u540d\u79f0<\/th>\n \u547d\u4ee4\u7f29\u5199<\/th>\n \u547d\u4ee4\u8bf4\u660e<\/th>\n<\/tr>\n<\/thead>\n \n run<\/td>\n r<\/td>\n \u8fd0\u884c\u4e00\u4e2a\u5f85\u8c03\u8bd5\u7684\u7a0b\u5e8f<\/td>\n<\/tr>\n \n continue<\/td>\n c<\/td>\n \u8ba9\u6682\u505c\u7684\u7a0b\u5e8f\u7ee7\u7eed\u8fd0\u884c<\/td>\n<\/tr>\n \n next<\/td>\n n<\/td>\n \u8fd0\u884c\u5230\u4e0b\u4e00\u884c<\/td>\n<\/tr>\n \n step<\/td>\n s<\/td>\n \u5355\u6b65\u6267\u884c\uff0c\u9047\u5230\u51fd\u6570\u4f1a\u8fdb\u5165<\/td>\n<\/tr>\n \n until<\/td>\n u<\/td>\n \u8fd0\u884c\u5230\u6307\u5b9a\u884c\u505c\u4e0b\u6765<\/td>\n<\/tr>\n \n finish<\/td>\n fi<\/td>\n \u7ed3\u675f\u5f53\u524d\u8c03\u7528\u51fd\u6570\uff0c\u56de\u5230\u4e0a\u4e00\u5c42\u8c03\u7528\u51fd\u6570\u5904<\/td>\n<\/tr>\n \n return<\/td>\n return<\/td>\n \u7ed3\u675f\u5f53\u524d\u8c03\u7528\u51fd\u6570\u5e76\u8fd4\u56de\u6307\u5b9a\u503c\uff0c\u5230\u4e0a\u4e00\u5c42\u51fd\u6570\u8c03\u7528\u5904<\/td>\n<\/tr>\n \n jump<\/td>\n j<\/td>\n \u5c06\u5f53\u524d\u7a0b\u5e8f\u6267\u884c\u6d41\u8df3\u8f6c\u5230\u6307\u5b9a\u884c\u6216\u5730\u5740<\/td>\n<\/tr>\n \n print<\/td>\n p<\/td>\n \u6253\u5370\u53d8\u91cf\u6216\u5bc4\u5b58\u5668\u503c<\/td>\n<\/tr>\n \n backtrace<\/td>\n bt<\/td>\n \u67e5\u770b\u5f53\u524d\u7ebf\u7a0b\u7684\u8c03\u7528\u5806\u6808<\/td>\n<\/tr>\n \n frame<\/td>\n f<\/td>\n \u5207\u6362\u5230\u5f53\u524d\u8c03\u7528\u7ebf\u7a0b\u7684\u6307\u5b9a\u5806\u6808<\/td>\n<\/tr>\n \n thread<\/td>\n thread<\/td>\n \u5207\u6362\u5230\u6307\u5b9a\u7ebf\u7a0b<\/td>\n<\/tr>\n \n break<\/td>\n b<\/td>\n \u6dfb\u52a0\u65ad\u70b9<\/td>\n<\/tr>\n \n tbreak<\/td>\n tb<\/td>\n \u6dfb\u52a0\u4e34\u65f6\u65ad\u70b9<\/td>\n<\/tr>\n \n delete<\/td>\n d<\/td>\n \u5220\u9664\u65ad\u70b9<\/td>\n<\/tr>\n \n enable<\/td>\n enable<\/td>\n \u542f\u7528\u67d0\u4e2a\u65ad\u70b9<\/td>\n<\/tr>\n \n disable<\/td>\n disable<\/td>\n \u7981\u7528\u67d0\u4e2a\u65ad\u70b9<\/td>\n<\/tr>\n \n watch<\/td>\n watch<\/td>\n \u76d1\u89c6\u67d0\u4e00\u4e2a\u53d8\u91cf\u6216\u5185\u5b58\u5730\u5740\u7684\u503c\u662f\u5426\u53d1\u751f\u53d8\u5316<\/td>\n<\/tr>\n \n list<\/td>\n l<\/td>\n \u663e\u793a\u6e90\u7801<\/td>\n<\/tr>\n \n info<\/td>\n i<\/td>\n \u67e5\u770b\u65ad\u70b9 \/ \u7ebf\u7a0b\u7b49\u4fe1\u606f<\/td>\n<\/tr>\n \n ptype<\/td>\n ptype<\/td>\n \u67e5\u770b\u53d8\u91cf\u7c7b\u578b<\/td>\n<\/tr>\n \n disassemble<\/td>\n dis<\/td>\n \u67e5\u770b\u6c47\u7f16\u4ee3\u7801<\/td>\n<\/tr>\n \n set args<\/td>\n set args<\/td>\n \u8bbe\u7f6e\u7a0b\u5e8f\u542f\u52a8\u547d\u4ee4\u884c\u53c2\u6570<\/td>\n<\/tr>\n \n show args<\/td>\n show args<\/td>\n \u67e5\u770b\u8bbe\u7f6e\u7684\u547d\u4ee4\u884c\u53c2\u6570<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n gdb .\/<\/h2>\n
gdb .\/[\u7a0b\u5e8f\u540d] \ngdb .\/a\nGNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1\nCopyright (C) 2018 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law. Type "show copying"\nand "show warranty" for details.\nThis GDB was configured as "x86_64-linux-gnu".\nType "show configuration" for configuration details.\nFor bug reporting instructions, please see:\n<http:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\nFind the GDB manual and other documentation resources online at:\n<http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\nFor help, type "help".\nType "apropos word" to search for commands related to "word"...\nReading symbols from .\/a...(no debugging symbols found)...done.<\/code><\/pre>\n\n
\u6ca1\u8f93\u5165\u72b6\u6001\u4e0b Tab \u53ef\u4ee5\u67e5\u770b\u6240\u6709\u547d\u4ee4<\/p>\n<\/blockquote>\n
run<\/h2>\n
(gdb) run\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a\ninput:\nabc\nabc[Inferior 1 (process 39) exited normally]<\/code><\/pre>\nstart<\/h2>\n
(gdb) start\nTemporary breakpoint 1 at 0x555555400912\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a\nTemporary breakpoint 1, 0x0000555555400912 in main ()<\/code><\/pre>\ni r<\/h2>\n
![\"image-20220611152539032\"](\"data:image\/svg+xml;base64,PCEtLUFyZ29uTG9hZGluZy0tPgo8c3ZnIHdpZHRoPSIxIiBoZWlnaHQ9IjEiIHhtbG5zPSJodHRwOi8vd3d3LnczLm9yZy8yMDAwL3N2ZyIgc3Ryb2tlPSIjZmZmZmZmMDAiPjxnPjwvZz4KPC9zdmc+\")
<\/div><\/p>\n(gdb) i r\nrax 0x55555540090e 93824990841102\nrbx 0x0 0\nrcx 0x5555554009a0 93824990841248\nrdx 0x7fffffffdcd8 140737488346328\nrsi 0x7fffffffdcc8 140737488346312\nrdi 0x1 1\nrbp 0x7fffffffdbe0 0x7fffffffdbe0\nrsp 0x7fffffffdbe0 0x7fffffffdbe0\nr8 0x7ffff7dced80 140737351839104\nr9 0x7ffff7dced80 140737351839104\nr10 0x2 2\nr11 0xf 15\nr12 0x555555400780 93824990840704\nr13 0x7fffffffdcc0 140737488346304\nr14 0x0 0\nr15 0x0 0\nrip 0x555555400912 0x555555400912 <main+4>\neflags 0x246 [ PF ZF IF ]\ncs 0x33 51\nss 0x2b 43\nds 0x0 0\nes 0x0 0\nfs 0x0 0\ngs 0x0 0<\/code><\/pre>\n<\/div><\/p>\ndisassemble $rip<\/h2>\n
(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push %rbp\n 0x000055555540090f <+1>: mov %rsp,%rbp\n=> 0x0000555555400912 <+4>: sub $0x20,%rsp\n 0x0000555555400916 <+8>: mov %fs:0x28,%rax\n 0x000055555540091f <+17>: mov %rax,-0x8(%rbp)\n 0x0000555555400923 <+21>: xor %eax,%eax\n 0x0000555555400925 <+23>: movq $0x0,-0x18(%rbp)\n 0x000055555540092d <+31>: movq $0x0,-0x10(%rbp)\n 0x0000555555400935 <+39>: lea 0xe8(%rip),%rdi # 0x555555400a24\n 0x000055555540093c <+46>: callq 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea -0x18(%rbp),%rax\n 0x0000555555400945 <+55>: mov %rax,%rdi\n 0x0000555555400948 <+58>: mov $0x0,%eax\n 0x000055555540094d <+63>: callq 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea -0x18(%rbp),%rax\n 0x0000555555400956 <+72>: mov %rax,%rdi\n 0x0000555555400959 <+75>: mov $0x0,%eax\n 0x000055555540095e <+80>: callq 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzbl -0x10(%rbp),%eax\n 0x0000555555400967 <+89>: cmp $0x61,%al\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea 0x20069e(%rip),%rdi # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: callq 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov $0x0,%eax\n 0x000055555540097c <+110>: mov -0x8(%rbp),%rdx\n 0x0000555555400980 <+114>: xor %fs:0x28,%rdx\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: callq 0x555555400720 <__stack_chk_fail@plt>\n---Type <return> to continue, or q <return> to quit---\u3001\n#\u8f6c\u6362\u6210intel\u6c47\u7f16\u683c\u5f0f\uff1a\n(gdb) set disassembly-flavor intel\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n=> 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt><\/code><\/pre>\nb *\uff0ci b\uff0cr\uff0cd<\/h2>\n
(gdb) b *0x0000555555400916\nBreakpoint 3 at 0x555555400916\n(gdb) i b\nNum Type Disp Enb Address What\n3 breakpoint keep y 0x0000555555400916 <main+8>\n(gdb) r\nThe program being debugged has been started already.\nStart it from the beginning? (y or n) y\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a\n\nBreakpoint 3, 0x0000555555400916 in main ()\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n 0x0000555555400912 <+4>: sub rsp,0x20\n=> 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n(gdb) d 3\n(gdb) i b\nNo breakpoints or watchpoints.<\/code><\/pre>\ndisable enable<\/h2>\n
(gdb) b *0x0000555555400916\nBreakpoint 2 at 0x555555400916\n(gdb) i b\nNum Type Disp Enb Address What\n2 breakpoint keep y 0x0000555555400916 <main+8>\n(gdb) disable b 2\n(gdb) i b\nNum Type Disp Enb Address What\n2 breakpoint keep n 0x0000555555400916 <main+8>\n(gdb) enable b 2\n(gdb) i b\nNum Type Disp Enb Address What\n2 breakpoint keep y 0x0000555555400916 <main+8><\/code><\/pre>\nni si finish<\/h2>\n
hack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gdb .\/a\nGNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1\nCopyright (C) 2018 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law. Type "show copying"\nand "show warranty" for details.\nThis GDB was configured as "x86_64-linux-gnu".\nType "show configuration" for configuration details.\nFor bug reporting instructions, please see:\n<http:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\nFind the GDB manual and other documentation resources online at:\n<http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\nFor help, type "help".\nType "apropos word" to search for commands related to "word"...\nReading symbols from .\/a...(no debugging symbols found)...done.\n(gdb) start\nTemporary breakpoint 1 at 0x912\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a\n\nTemporary breakpoint 1, 0x0000555555400912 in main ()\n(gdb) disassble $rip\nUndefined command: "disassble". Try "help".\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n=> 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n---Type <return> to continue, or q <return> to quit---\n 0x0000555555400990 <+130>: leave\n 0x0000555555400991 <+131>: ret\nEnd of assembler dump.\n(gdb) b *0x000055555540093c\nBreakpoint 2 at 0x55555540093c\n(gdb) start\nThe program being debugged has been started already.\nStart it from the beginning? (y or n) y\nTemporary breakpoint 3 at 0x555555400912\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a\n\nTemporary breakpoint 3, 0x0000555555400912 in main ()\n(gdb) c\nContinuing.\n\nBreakpoint 2, 0x000055555540093c in main ()\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n=> 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n---Type <return> to continue, or q <return> to quit---q\nQuit\n(gdb) ni\ninput:\n0x0000555555400941 in main ()\n(gdb) start\nThe program being debugged has been started already.\nStart it from the beginning? (y or n) y\nTemporary breakpoint 4 at 0x555555400912\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a\n\nTemporary breakpoint 4, 0x0000555555400912 in main ()\n(gdb) c\nContinuing.\n\nBreakpoint 2, 0x000055555540093c in main ()\n(gdb) si\n0x0000555555400710 in puts@plt ()\n(gdb) disassemble $rip\nDump of assembler code for function puts@plt:\n=> 0x0000555555400710 <+0>: jmp QWORD PTR [rip+0x200892] # 0x555555600fa8\n 0x0000555555400716 <+6>: push 0x0\n 0x000055555540071b <+11>: jmp 0x555555400700\nEnd of assembler dump.\n(gdb) finish\nRun till exit from #0 0x0000555555400710 in puts@plt ()\ninput:\n0x0000555555400941 in main ()\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n=> 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n---Type <return> to continue, or q <return> to quit---\n 0x0000555555400990 <+130>: leave\n 0x0000555555400991 <+131>: ret\nEnd of assembler dump.<\/code><\/pre>\n\u5c0f\u77e5\u8bc6\u70b9<\/h1>\n
BYTE WORD DWORD QWORD<\/h2>\n
\n
BYTE 8<\/p>\n
WORD 16<\/p>\n
DWORD 32<\/p>\n
QWORD 64<\/p>\n<\/blockquote>\n
print x\/ set<\/h2>\n
hack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gdb .\/a\nGNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1\nCopyright (C) 2018 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law. Type "show copying"\nand "show warranty" for details.\nThis GDB was configured as "x86_64-linux-gnu".\nType "show configuration" for configuration details.\nFor bug reporting instructions, please see:\n<http:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\nFind the GDB manual and other documentation resources online at:\n<http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\nFor help, type "help".\nType "apropos word" to search for commands related to "word"...\nReading symbols from .\/a...(no debugging symbols found)...done.\n(gdb) start\nTemporary breakpoint 1 at 0x912\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a\n\nTemporary breakpoint 1, 0x0000555555400912 in main ()\n(gdb) i r\nrax 0x55555540090e 93824990841102\nrbx 0x0 0\nrcx 0x5555554009a0 93824990841248\nrdx 0x7fffffffdcd8 140737488346328\nrsi 0x7fffffffdcc8 140737488346312\nrdi 0x1 1\nrbp 0x7fffffffdbe0 0x7fffffffdbe0\nrsp 0x7fffffffdbe0 0x7fffffffdbe0\nr8 0x7ffff7dced80 140737351839104\nr9 0x7ffff7dced80 140737351839104\nr10 0x2 2\nr11 0xf 15\nr12 0x555555400780 93824990840704\nr13 0x7fffffffdcc0 140737488346304\nr14 0x0 0\nr15 0x0 0\nrip 0x555555400912 0x555555400912 <main+4>\neflags 0x246 [ PF ZF IF ]\ncs 0x33 51\nss 0x2b 43\nds 0x0 0\nes 0x0 0\nfs 0x0 0\ngs 0x0 0\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n=> 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n 0x0000555555400990 <+130>: leave\n 0x0000555555400991 <+131>: ret\nEnd of assembler dump.\n(gdb) b *0x0000555555400963\nBreakpoint 2 at 0x555555400963\n(gdb) c\nContinuing.\ninput:\naaaaa\n\nBreakpoint 2, 0x0000555555400963 in main ()\n(gdb) x\/20i $rip\n=> 0x555555400963 <main+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x555555400967 <main+89>: cmp al,0x61\n 0x555555400969 <main+91>: jne 0x555555400977 <main+105>\n 0x55555540096b <main+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x555555400972 <main+100>: call 0x5555554008ef <func>\n 0x555555400977 <main+105>: mov eax,0x0\n 0x55555540097c <main+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x555555400980 <main+114>: xor rdx,QWORD PTR fs:0x28\n 0x555555400989 <main+123>: je 0x555555400990 <main+130>\n 0x55555540098b <main+125>: call 0x555555400720 <__stack_chk_fail@plt>\n 0x555555400990 <main+130>: leave\n 0x555555400991 <main+131>: ret\n 0x555555400992: nop WORD PTR cs:[rax+rax*1+0x0]\n 0x55555540099c: nop DWORD PTR [rax+0x0]\n 0x5555554009a0 <__libc_csu_init>: push r15\n 0x5555554009a2 <__libc_csu_init+2>: push r14\n 0x5555554009a4 <__libc_csu_init+4>: mov r15,rdx\n 0x5555554009a7 <__libc_csu_init+7>: push r13\n 0x5555554009a9 <__libc_csu_init+9>: push r12\n 0x5555554009ab <__libc_csu_init+11>: lea r12,[rip+0x2003de] # 0x555555600d90\n(gdb) x\/20b $rbp-0x10\n0x7fffffffdbd0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0x7fffffffdbd8: 0x00 0xcb 0x22 0xba 0x58 0x60 0xea 0x40\n0x7fffffffdbe0: 0xa0 0x09 0x40 0x55\n(gdb) set *0x7fffffffdbd0=0x61\n(gdb) i r\nrax 0x5 5\nrbx 0x0 0\nrcx 0x0 0\nrdx 0x0 0\nrsi 0x61616161 1633771873\nrdi 0x555555602260 93824992944736\nrbp 0x7fffffffdbe0 0x7fffffffdbe0\nrsp 0x7fffffffdbc0 0x7fffffffdbc0\nr8 0x7ffff7fe94c0 140737354044608\nr9 0x7ffff7fe94c0 140737354044608\nr10 0x555555602010 93824992944144\nr11 0x246 582\nr12 0x555555400780 93824990840704\nr13 0x7fffffffdcc0 140737488346304\nr14 0x0 0\nr15 0x0 0\nrip 0x555555400963 0x555555400963 <main+85>\neflags 0x206 [ PF IF ]\ncs 0x33 51\nss 0x2b 43\nds 0x0 0\nes 0x0 0\nfs 0x0 0\ngs 0x0 0\n(gdb) x\/20b $rbp-0x10\n0x7fffffffdbd0: 0x61 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0x7fffffffdbd8: 0x00 0xcb 0x22 0xba 0x58 0x60 0xea 0x40\n0x7fffffffdbe0: 0xa0 0x09 0x40 0x55\n(gdb) ni\n0x0000555555400967 in main ()\n(gdb) i r\nrax 0x61 97\nrbx 0x0 0\nrcx 0x0 0\nrdx 0x0 0\nrsi 0x61616161 1633771873\nrdi 0x555555602260 93824992944736\nrbp 0x7fffffffdbe0 0x7fffffffdbe0\nrsp 0x7fffffffdbc0 0x7fffffffdbc0\nr8 0x7ffff7fe94c0 140737354044608\nr9 0x7ffff7fe94c0 140737354044608\nr10 0x555555602010 93824992944144\nr11 0x246 582\nr12 0x555555400780 93824990840704\nr13 0x7fffffffdcc0 140737488346304\nr14 0x0 0\nr15 0x0 0\nrip 0x555555400967 0x555555400967 <main+89>\neflags 0x206 [ PF IF ]\ncs 0x33 51\nss 0x2b 43\nds 0x0 0\nes 0x0 0\nfs 0x0 0\ngs 0x0 0\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n=> 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n 0x0000555555400990 <+130>: leave\n 0x0000555555400991 <+131>: ret\nEnd of assembler dump.\n(gdb) ni\n0x0000555555400969 in main ()\n(gdb) ni\n0x000055555540096b in main ()\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n=> 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n 0x0000555555400990 <+130>: leave\n 0x0000555555400991 <+131>: ret\nEnd of assembler dump.\n(gdb) ni\n0x0000555555400972 in main ()\n(gdb) si\n0x00005555554008ef in func ()\n(gdb) disassemble $rip\nDump of assembler code for function func:\n=> 0x00005555554008ef <+0>: push rbp\n 0x00005555554008f0 <+1>: mov rbp,rsp\n 0x00005555554008f3 <+4>: sub rsp,0x10\n 0x00005555554008f7 <+8>: mov QWORD PTR [rbp-0x8],rdi\n 0x00005555554008fb <+12>: mov rax,QWORD PTR [rbp-0x8]\n 0x00005555554008ff <+16>: mov rdi,rax\n 0x0000555555400902 <+19>: call 0x555555400730 <system@plt>\n 0x0000555555400907 <+24>: mov eax,0x0\n 0x000055555540090c <+29>: leave\n 0x000055555540090d <+30>: ret\nEnd of assembler dump.\n(gdb) c\nContinuing.\n$ whoami\nhack\n$ exit\naaaaa[Inferior 1 (process 50) exited normally]<\/code><\/pre>\n\u7f16\u8bd1\u621032\u4f4d\u7a0b\u5e8f\u518dpwn<\/h1>\n
\u5148\u5b89\u88c5\u9002\u914d\u5e93<\/h2>\n
sudo apt-get install gcc-multilib g++-multilib module-assistant<\/code><\/pre>\n\u7f16\u8bd1<\/h2>\n
gcc -m32<\/code><\/pre>\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ ls\na question_1.c question_1.s question_1_x64\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gcc -m32 question_1.c\nquestion_1.c: In function \u2018main\u2019:\nquestion_1.c:22:2: warning: implicit declaration of function \u2018gets\u2019; did you mean \u2018fgets\u2019? [-Wimplicit-function-declaration]\n gets(a);\n ^~~~\n fgets\nquestion_1.c:23:9: warning: format not a string literal and no format arguments [-Wformat-security]\n printf(a);\n ^\n\/tmp\/cc7EtBTh.o: In function `main':\nquestion_1.c:(.text+0xea): warning: the `gets' function is dangerous and should not be used.\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ ls\na a.out question_1.c question_1.s question_1_x64\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gdb .\/a.out\nGNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1\nCopyright (C) 2018 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law. Type "show copying"\nand "show warranty" for details.\nThis GDB was configured as "x86_64-linux-gnu".\nType "show configuration" for configuration details.\nFor bug reporting instructions, please see:\n<http:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\nFind the GDB manual and other documentation resources online at:\n<http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\nFor help, type "help".\nType "apropos word" to search for commands related to "word"...\nReading symbols from .\/a.out...(no debugging symbols found)...done.\n(gdb) start\nTemporary breakpoint 1 at 0x738\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/a.out\n\nTemporary breakpoint 1, 0x56555738 in main ()\n(gdb) disassemble $eip\nDump of assembler code for function main:\n 0x56555729 <+0>: lea ecx,[esp+0x4]\n 0x5655572d <+4>: and esp,0xfffffff0\n 0x56555730 <+7>: push DWORD PTR [ecx-0x4]\n 0x56555733 <+10>: push ebp\n 0x56555734 <+11>: mov ebp,esp\n 0x56555736 <+13>: push ebx\n 0x56555737 <+14>: push ecx\n=> 0x56555738 <+15>: sub esp,0x20\n 0x5655573b <+18>: call 0x565555a0 <__x86.get_pc_thunk.bx>\n 0x56555740 <+23>: add ebx,0x1878\n 0x56555746 <+29>: mov eax,gs:0x14\n 0x5655574c <+35>: mov DWORD PTR [ebp-0xc],eax\n 0x5655574f <+38>: xor eax,eax\n 0x56555751 <+40>: mov DWORD PTR [ebp-0x1c],0x0\n 0x56555758 <+47>: mov DWORD PTR [ebp-0x18],0x0\n 0x5655575f <+54>: mov DWORD PTR [ebp-0x14],0x0\n 0x56555766 <+61>: mov DWORD PTR [ebp-0x10],0x0\n 0x5655576d <+68>: sub esp,0xc\n 0x56555770 <+71>: lea eax,[ebx-0x1738]\n 0x56555776 <+77>: push eax\n 0x56555777 <+78>: call 0x56555510 <puts@plt>\n 0x5655577c <+83>: add esp,0x10\n 0x5655577f <+86>: sub esp,0xc\n 0x56555782 <+89>: lea eax,[ebp-0x1c]\n 0x56555785 <+92>: push eax\n 0x56555786 <+93>: call 0x565554f0 <gets@plt>\n 0x5655578b <+98>: add esp,0x10\n 0x5655578e <+101>: sub esp,0xc\n 0x56555791 <+104>: lea eax,[ebp-0x1c]\n 0x56555794 <+107>: push eax\n 0x56555795 <+108>: call 0x565554e0 <printf@plt>\n 0x5655579a <+113>: add esp,0x10\n 0x5655579d <+116>: movzx eax,BYTE PTR [ebp-0x14]\n 0x565557a1 <+120>: cmp al,0x61\n 0x565557a3 <+122>: jne 0x565557b7 <main+142>\n 0x565557a5 <+124>: sub esp,0xc\n 0x565557a8 <+127>: lea eax,[ebx+0x50]\n 0x565557ae <+133>: push eax\n---Type <return> to continue, or q <return> to quit---q\nQuit\n(gdb) b *0x5655579d\nBreakpoint 2 at 0x5655579d\n(gdb) c\nContinuing.\ninput:\naaaaaaa\n\nBreakpoint 2, 0x5655579d in main ()\n(gdb) x\/20i $eip\n=> 0x5655579d <main+116>: movzx eax,BYTE PTR [ebp-0x14]\n 0x565557a1 <main+120>: cmp al,0x61\n 0x565557a3 <main+122>: jne 0x565557b7 <main+142>\n 0x565557a5 <main+124>: sub esp,0xc\n 0x565557a8 <main+127>: lea eax,[ebx+0x50]\n 0x565557ae <main+133>: push eax\n 0x565557af <main+134>: call 0x565556fe <func>\n 0x565557b4 <main+139>: add esp,0x10\n 0x565557b7 <main+142>: mov eax,0x0\n 0x565557bc <main+147>: mov edx,DWORD PTR [ebp-0xc]\n 0x565557bf <main+150>: xor edx,DWORD PTR gs:0x14\n 0x565557c6 <main+157>: je 0x565557cd <main+164>\n 0x565557c8 <main+159>: call 0x56555850 <__stack_chk_fail_local>\n 0x565557cd <main+164>: lea esp,[ebp-0x8]\n 0x565557d0 <main+167>: pop ecx\n 0x565557d1 <main+168>: pop ebx\n 0x565557d2 <main+169>: pop ebp\n 0x565557d3 <main+170>: lea esp,[ecx-0x4]\n 0x565557d6 <main+173>: ret\n 0x565557d7 <__x86.get_pc_thunk.ax>: mov eax,DWORD PTR [esp]\n(gdb) x\/20b $ebp-0x14\n0xffffcd04: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0xffffcd0c: 0x00 0xb0 0xb5 0xbd 0x30 0xcd 0xff 0xff\n0xffffcd14: 0x00 0x00 0x00 0x00\n(gdb) p $ebp-0x14\n$1 = (void *) 0xffffcd04\n(gdb) set *0xffffcd04=0x61\n(gdb) ni\n0x565557a1 in main ()\n(gdb) ni\n0x565557a3 in main ()\n(gdb) x\/20i $eip\n=> 0x565557a3 <main+122>: jne 0x565557b7 <main+142>\n 0x565557a5 <main+124>: sub esp,0xc\n 0x565557a8 <main+127>: lea eax,[ebx+0x50]\n 0x565557ae <main+133>: push eax\n 0x565557af <main+134>: call 0x565556fe <func>\n 0x565557b4 <main+139>: add esp,0x10\n 0x565557b7 <main+142>: mov eax,0x0\n 0x565557bc <main+147>: mov edx,DWORD PTR [ebp-0xc]\n 0x565557bf <main+150>: xor edx,DWORD PTR gs:0x14\n 0x565557c6 <main+157>: je 0x565557cd <main+164>\n 0x565557c8 <main+159>: call 0x56555850 <__stack_chk_fail_local>\n 0x565557cd <main+164>: lea esp,[ebp-0x8]\n 0x565557d0 <main+167>: pop ecx\n 0x565557d1 <main+168>: pop ebx\n 0x565557d2 <main+169>: pop ebp\n 0x565557d3 <main+170>: lea esp,[ecx-0x4]\n 0x565557d6 <main+173>: ret\n 0x565557d7 <__x86.get_pc_thunk.ax>: mov eax,DWORD PTR [esp]\n 0x565557da <__x86.get_pc_thunk.ax+3>: ret\n 0x565557db <__x86.get_pc_thunk.ax+4>: xchg ax,ax\n(gdb) c\nContinuing.\n$ whoami\nhack<\/code><\/pre>\n\u4f5c\u4e1a<\/h1>\n
gcc -m32 question_1.c -fno-omit-frame-pointer -o question_1_x86_esp\ngcc question_1.c -fno-omit-frame-pointer -o question_1_x64_esp<\/code><\/pre>\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gcc -m32 question_1.c -fno-omit-frame-pointer -o question_1_x86_esp\nquestion_1.c: In function \u2018main\u2019:\nquestion_1.c:22:2: warning: implicit declaration of function \u2018gets\u2019; did you mean \u2018fgets\u2019? [-Wimplicit-function-declaration]\n gets(a);\n ^~~~\n fgets\nquestion_1.c:23:9: warning: format not a string literal and no format arguments [-Wformat-security]\n printf(a);\n ^\n\/tmp\/ccfZI7oo.o: In function `main':\nquestion_1.c:(.text+0xea): warning: the `gets' function is dangerous and should not be used.\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ ls\na a.out question_1.c question_1.s question_1_x64 question_1_x86_esp\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gdb .\/question_1_x86_esp\nGNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1\nCopyright (C) 2018 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law. Type "show copying"\nand "show warranty" for details.\nThis GDB was configured as "x86_64-linux-gnu".\nType "show configuration" for configuration details.\nFor bug reporting instructions, please see:\n<http:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\nFind the GDB manual and other documentation resources online at:\n<http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\nFor help, type "help".\nType "apropos word" to search for commands related to "word"...\nReading symbols from .\/question_1_x86_esp...(no debugging symbols found)...done.\n(gdb) start\nTemporary breakpoint 1 at 0x738\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/question_1_x86_esp\n\nTemporary breakpoint 1, 0x56555738 in main ()\n(gdb) disassemble $eip\nDump of assembler code for function main:\n 0x56555729 <+0>: lea ecx,[esp+0x4]\n 0x5655572d <+4>: and esp,0xfffffff0\n 0x56555730 <+7>: push DWORD PTR [ecx-0x4]\n 0x56555733 <+10>: push ebp\n 0x56555734 <+11>: mov ebp,esp\n 0x56555736 <+13>: push ebx\n 0x56555737 <+14>: push ecx\n=> 0x56555738 <+15>: sub esp,0x20\n 0x5655573b <+18>: call 0x565555a0 <__x86.get_pc_thunk.bx>\n 0x56555740 <+23>: add ebx,0x1878\n 0x56555746 <+29>: mov eax,gs:0x14\n 0x5655574c <+35>: mov DWORD PTR [ebp-0xc],eax\n 0x5655574f <+38>: xor eax,eax\n 0x56555751 <+40>: mov DWORD PTR [ebp-0x1c],0x0\n 0x56555758 <+47>: mov DWORD PTR [ebp-0x18],0x0\n 0x5655575f <+54>: mov DWORD PTR [ebp-0x14],0x0\n 0x56555766 <+61>: mov DWORD PTR [ebp-0x10],0x0\n 0x5655576d <+68>: sub esp,0xc\n 0x56555770 <+71>: lea eax,[ebx-0x1738]\n 0x56555776 <+77>: push eax\n 0x56555777 <+78>: call 0x56555510 <puts@plt>\n 0x5655577c <+83>: add esp,0x10\n 0x5655577f <+86>: sub esp,0xc\n 0x56555782 <+89>: lea eax,[ebp-0x1c]\n 0x56555785 <+92>: push eax\n 0x56555786 <+93>: call 0x565554f0 <gets@plt>\n 0x5655578b <+98>: add esp,0x10\n 0x5655578e <+101>: sub esp,0xc\n 0x56555791 <+104>: lea eax,[ebp-0x1c]\n 0x56555794 <+107>: push eax\n 0x56555795 <+108>: call 0x565554e0 <printf@plt>\n 0x5655579a <+113>: add esp,0x10\n 0x5655579d <+116>: movzx eax,BYTE PTR [ebp-0x14]\n 0x565557a1 <+120>: cmp al,0x61\n 0x565557a3 <+122>: jne 0x565557b7 <main+142>\n 0x565557a5 <+124>: sub esp,0xc\n 0x565557a8 <+127>: lea eax,[ebx+0x50]\n 0x565557ae <+133>: push eax\n---Type <return> to continue, or q <return> to quit---q\nQuit\n(gdb) b *0x5655579d\nBreakpoint 2 at 0x5655579d\n(gdb) c\nContinuing.\ninput:\naaaaa\n\nBreakpoint 2, 0x5655579d in main ()\n(gdb) x\/20i $eip\n=> 0x5655579d <main+116>: movzx eax,BYTE PTR [ebp-0x14]\n 0x565557a1 <main+120>: cmp al,0x61\n 0x565557a3 <main+122>: jne 0x565557b7 <main+142>\n 0x565557a5 <main+124>: sub esp,0xc\n 0x565557a8 <main+127>: lea eax,[ebx+0x50]\n 0x565557ae <main+133>: push eax\n 0x565557af <main+134>: call 0x565556fe <func>\n 0x565557b4 <main+139>: add esp,0x10\n 0x565557b7 <main+142>: mov eax,0x0\n 0x565557bc <main+147>: mov edx,DWORD PTR [ebp-0xc]\n 0x565557bf <main+150>: xor edx,DWORD PTR gs:0x14\n 0x565557c6 <main+157>: je 0x565557cd <main+164>\n 0x565557c8 <main+159>: call 0x56555850 <__stack_chk_fail_local>\n 0x565557cd <main+164>: lea esp,[ebp-0x8]\n 0x565557d0 <main+167>: pop ecx\n 0x565557d1 <main+168>: pop ebx\n 0x565557d2 <main+169>: pop ebp\n 0x565557d3 <main+170>: lea esp,[ecx-0x4]\n 0x565557d6 <main+173>: ret\n 0x565557d7 <__x86.get_pc_thunk.ax>: mov eax,DWORD PTR [esp]\n(gdb) x\/20b $ebp-0x14\n0xffffccf4: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0xffffccfc: 0x00 0x2a 0x9f 0xbf 0x20 0xcd 0xff 0xff\n0xffffcd04: 0x00 0x00 0x00 0x00\n(gdb) set *0xffffccf4=0x61\n(gdb) c\nContinuing.\n$ whoami\nhack\n$ exit\naaaaa[Inferior 1 (process 126) exited normally]\n(gdb) q\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gcc question_1.c -fno-omit-frame-pointer -o question_1_x64_esp\nquestion_1.c: In function \u2018main\u2019:\nquestion_1.c:22:2: warning: implicit declaration of function \u2018gets\u2019; did you mean \u2018fgets\u2019? [-Wimplicit-function-declaration]\n gets(a);\n ^~~~\n fgets\nquestion_1.c:23:9: warning: format not a string literal and no format arguments [-Wformat-security]\n printf(a);\n ^\n\/tmp\/cc5FEGz8.o: In function `main':\nquestion_1.c:(.text+0xc4): warning: the `gets' function is dangerous and should not be used.\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ ls\na a.out question_1.c question_1.s question_1_x64 question_1_x64_esp question_1_x86_esp\nhack@QC-20210627LTVJ:\/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1$ gdb .\/question_1_x64_esp\nGNU gdb (Ubuntu 8.1.1-0ubuntu1) 8.1.1\nCopyright (C) 2018 Free Software Foundation, Inc.\nLicense GPLv3+: GNU GPL version 3 or later <http:\/\/gnu.org\/licenses\/gpl.html>\nThis is free software: you are free to change and redistribute it.\nThere is NO WARRANTY, to the extent permitted by law. Type "show copying"\nand "show warranty" for details.\nThis GDB was configured as "x86_64-linux-gnu".\nType "show configuration" for configuration details.\nFor bug reporting instructions, please see:\n<http:\/\/www.gnu.org\/software\/gdb\/bugs\/>.\nFind the GDB manual and other documentation resources online at:\n<http:\/\/www.gnu.org\/software\/gdb\/documentation\/>.\nFor help, type "help".\nType "apropos word" to search for commands related to "word"...\nReading symbols from .\/question_1_x64_esp...(no debugging symbols found)...done.\n(gdb) start\nTemporary breakpoint 1 at 0x912\nStarting program: \/mnt\/e\/qqdownload\/pwn\/chapter_1\/test_1\/question_1_x64_esp\n\nTemporary breakpoint 1, 0x0000555555400912 in main ()\n(gdb) disassemble $rip\nDump of assembler code for function main:\n 0x000055555540090e <+0>: push rbp\n 0x000055555540090f <+1>: mov rbp,rsp\n=> 0x0000555555400912 <+4>: sub rsp,0x20\n 0x0000555555400916 <+8>: mov rax,QWORD PTR fs:0x28\n 0x000055555540091f <+17>: mov QWORD PTR [rbp-0x8],rax\n 0x0000555555400923 <+21>: xor eax,eax\n 0x0000555555400925 <+23>: mov QWORD PTR [rbp-0x18],0x0\n 0x000055555540092d <+31>: mov QWORD PTR [rbp-0x10],0x0\n 0x0000555555400935 <+39>: lea rdi,[rip+0xe8] # 0x555555400a24\n 0x000055555540093c <+46>: call 0x555555400710 <puts@plt>\n 0x0000555555400941 <+51>: lea rax,[rbp-0x18]\n 0x0000555555400945 <+55>: mov rdi,rax\n 0x0000555555400948 <+58>: mov eax,0x0\n 0x000055555540094d <+63>: call 0x555555400750 <gets@plt>\n 0x0000555555400952 <+68>: lea rax,[rbp-0x18]\n 0x0000555555400956 <+72>: mov rdi,rax\n 0x0000555555400959 <+75>: mov eax,0x0\n 0x000055555540095e <+80>: call 0x555555400740 <printf@plt>\n 0x0000555555400963 <+85>: movzx eax,BYTE PTR [rbp-0x10]\n 0x0000555555400967 <+89>: cmp al,0x61\n 0x0000555555400969 <+91>: jne 0x555555400977 <main+105>\n 0x000055555540096b <+93>: lea rdi,[rip+0x20069e] # 0x555555601010 <sh>\n 0x0000555555400972 <+100>: call 0x5555554008ef <func>\n 0x0000555555400977 <+105>: mov eax,0x0\n 0x000055555540097c <+110>: mov rdx,QWORD PTR [rbp-0x8]\n 0x0000555555400980 <+114>: xor rdx,QWORD PTR fs:0x28\n 0x0000555555400989 <+123>: je 0x555555400990 <main+130>\n 0x000055555540098b <+125>: call 0x555555400720 <__stack_chk_fail@plt>\n 0x0000555555400990 <+130>: leave\n 0x0000555555400991 <+131>: ret\nEnd of assembler dump.\n(gdb) b *0x0000555555400963\nBreakpoint 2 at 0x555555400963\n(gdb) c\nContinuing.\ninput:\naaaaa\n\nBreakpoint 2, 0x0000555555400963 in main ()\n(gdb) x\/20b $rbp-0x10\n0x7fffffffdbb0: 0 0 0 0 0 0 0 0\n0x7fffffffdbb8: 0 -63 -87 121 26 14 97 -2\n0x7fffffffdbc0: -96 9 64 85\n(gdb) x\/20x $rbp-0x10\n0x7fffffffdbb0: 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00\n0x7fffffffdbb8: 0x00 0xc1 0xa9 0x79 0x1a 0x0e 0x61 0xfe\n0x7fffffffdbc0: 0xa0 0x09 0x40 0x55\n(gdb) set *0x7fffffffdbb0=0x61\n(gdb) c\nContinuing.\n$ whoami\nhack\n$ exit\naaaaa[Inferior 1 (process 142) exited normally]\n(gdb) q<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"\u57fa\u7840\u547d\u4ee4 \u8ddf\u7740b\u7ad9\u4f60\u60f3\u6709\u591aPWN(\u5f00\u59cb\u66f4\u65b0)\u505a\u7684\u4e00\u70b9\u7b14\u8bb0\u3002 GCC GCC \u7f16\u8bd1\u5de5\u5177\u94fe\u5728\u7f16\u8bd1\u4e00\u4e2aC\u6e90\u6587\u4ef6\u65f6\u9700\u8981 […]<\/p>\n","protected":false},"author":1,"featured_media":175,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[11,19],"tags":[],"class_list":["post-174","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ctf-and-protest","category-pwn"],"_links":{"self":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/174","targetHints":{"allow":["GET"]}}],"collection":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/comments?post=174"}],"version-history":[{"count":3,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/174\/revisions"}],"predecessor-version":[{"id":178,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/posts\/174\/revisions\/178"}],"wp:featuredmedia":[{"embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media\/175"}],"wp:attachment":[{"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/media?parent=174"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/categories?post=174"},{"taxonomy":"post_tag","embeddable":true,"href":"http:\/\/162.14.82.114\/index.php\/wp-json\/wp\/v2\/tags?post=174"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
![\"image-20220611152539032\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202206121658279.png\")
<\/div><\/p>\n![\"image-20220610195551065\"](\"https:\/\/pic-for-be.oss-cn-hangzhou.aliyuncs.com\/img\/202206121658281.png\")
<\/div><\/p>\n