VEX的提取(对.c文件的测试)主要还是利用linux下gcc和valgrind的两条命令,即
gcc test.c -g -o test
valgrind --trace-flags=10000000 ./test > test.txt 2>&1
在此时生成无VEX的superblock文档
之后的步骤有两种
一个是结合windows下ollydbg或者linux下gdb/edb对比main函数操作的寄存器序号(伍周桐学长的方法),因为汇编还是不太懂且windows和linux寄存器命名不太一样最终没得到成果。
另一个是结合可以查到的资料,对superblock的命名进行筛选,首先找到程序入口
之后筛选main+偏移量的superblock比如
记下块的编号范围然后用命令输出(本次筛选结果在1247~1279)
valgrind --trace-flags=10000000 --trace-notbelow=1246 --trace-notabove=1279 ./test > test.txt 2>&1
输出整理本程序的main函数的VEX如下(TEST1),删去多余无意义语句即得最终VEX
==== SB 1247 (evchecks 6369) [tid 1] 0x400554 main /root/Desktop/hello+0x400554
------------------------ Front end ------------------------
0x400554: pushq %rbp
------ IMark(0x400554, 1, 0) ------
t0 = GET:I64(56)
t1 = Sub64(GET:I64(48),0x8:I64)
PUT(48) = t1
STle(t1) = t0
PUT(184) = 0x400555:I64
0x400555: movq %rsp,%rbp
------ IMark(0x400555, 3, 0) ------
PUT(56) = GET:I64(48)
PUT(184) = 0x400558:I64
0x400558: subq $32, %rsp
------ IMark(0x400558, 4, 0) ------
t4 = GET:I64(48)
t3 = 0x20:I64
t2 = Sub64(t4,t3)
PUT(144) = 0x8:I64
PUT(152) = t4
PUT(160) = t3
PUT(48) = t2
PUT(184) = 0x40055C:I64
0x40055C: movl $4,%edi
------ IMark(0x40055C, 5, 0) ------
PUT(72) = 32Uto64(0x4:I32)
PUT(184) = 0x400561:I64
0x400561: call 0x400428
------ IMark(0x400561, 5, 0) ------
t5 = Sub64(GET:I64(48),0x8:I64)
PUT(48) = t5
STle(t5) = 0x400566:I64
t6 = 0x400428:I64
====== AbiHint(Sub64(t5,0x80:I64), 128, t6) ======
PUT(184) = 0x400428:I64
0x400428: jmp* 2098458(%rip)
------ IMark(0x400428, 6, 0) ------
t8 = Add64(0x40042E:I64,0x20051A:I64)
t9 = LDle:I64(t8)
PUT(184) = t9
PUT(184) = GET:I64(184); exit-Boring
==== SB 1255 (evchecks 6429) [tid 1] 0x400566 main+18 /root/Desktop/hello+0x400566
------------------------ Front end ------------------------
0x400566: movq %rax,-16(%rbp)
------ IMark(0x400566, 4, 0) ------
t0 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFF0:I64)
STle(t0) = GET:I64(16)
PUT(184) = 0x40056A:I64
0x40056A: movl $4,%edi
------ IMark(0x40056A, 5, 0) ------
PUT(72) = 32Uto64(0x4:I32)
PUT(184) = 0x40056F:I64
0x40056F: call 0x400428
------ IMark(0x40056F, 5, 0) ------
t1 = Sub64(GET:I64(48),0x8:I64)
PUT(48) = t1
STle(t1) = 0x400574:I64
t2 = 0x400428:I64
====== AbiHint(Sub64(t1,0x80:I64), 128, t2) ======
PUT(184) = 0x400428:I64
0x400428: jmp* 2098458(%rip)
------ IMark(0x400428, 6, 0) ------
t4 = Add64(0x40042E:I64,0x20051A:I64)
t5 = LDle:I64(t4)
PUT(184) = t5
PUT(184) = GET:I64(184); exit-Boring
==== SB 1256 (evchecks 6432) [tid 1] 0x400574 main+32 /root/Desktop/hello+0x400574
------------------------ Front end ------------------------
0x400574: movq %rax,-8(%rbp)
------ IMark(0x400574, 4, 0) ------
t0 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFF8:I64)
STle(t0) = GET:I64(16)
PUT(184) = 0x400578:I64
0x400578: cmpl $0, -20(%rbp)
------ IMark(0x400578, 4, 0) ------
t4 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFEC:I64)
t3 = LDle:I32(t4)
t2 = 0x0:I32
t1 = Sub32(t3,t2)
PUT(144) = 0x7:I64
PUT(152) = 32Uto64(t3)
PUT(160) = 32Uto64(t2)
PUT(184) = 0x40057C:I64
0x40057C: jne-8 0x400583
------ IMark(0x40057C, 2, 0) ------
if (64to1(amd64g_calculate_condition[mcx=0x13]{0x5812c8c0}(0x4:I64,GET:I64(144),GET:I64(152),GET:I64(160),GET:I64(168)):I64)) { PUT(184) = 0x40057E:I64; exit-Boring }
PUT(184) = 0x400583:I64
PUT(184) = GET:I64(184); exit-Boring
==== SB 1257 (evchecks 6433) [tid 1] 0x40057e main+42 /root/Desktop/hello+0x40057e
------------------------ Front end ------------------------
0x40057E: movl -32(%rbp),%eax
------ IMark(0x40057E, 3, 0) ------
t0 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFE0:I64)
PUT(16) = 32Uto64(LDle:I32(t0))
PUT(184) = 0x400581:I64
0x400581: jmp-8 0x400586
------ IMark(0x400581, 2, 0) ------
PUT(184) = 0x400586:I64
0x400586: movl %eax,-20(%rbp)
------ IMark(0x400586, 3, 0) ------
t1 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFEC:I64)
STle(t1) = 64to32(GET:I64(16))
PUT(184) = 0x400589:I64
0x400589: movq -16(%rbp),%rax
------ IMark(0x400589, 4, 0) ------
t2 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFF0:I64)
PUT(16) = LDle:I64(t2)
PUT(184) = 0x40058D:I64
0x40058D: leaq 1(%rax), %rcx
------ IMark(0x40058D, 4, 0) ------
t3 = Add64(GET:I64(16),0x1:I64)
PUT(24) = t3
PUT(184) = 0x400591:I64
0x400591: movq -16(%rbp),%rax
------ IMark(0x400591, 4, 0) ------
t4 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFF0:I64)
PUT(16) = LDle:I64(t4)
PUT(184) = 0x400595:I64
0x400595: movl $2,%edx
------ IMark(0x400595, 5, 0) ------
PUT(32) = 32Uto64(0x2:I32)
PUT(184) = 0x40059A:I64
0x40059A: movq %rcx,%rsi
------ IMark(0x40059A, 3, 0) ------
PUT(64) = GET:I64(24)
PUT(184) = 0x40059D:I64
0x40059D: movq %rax,%rdi
------ IMark(0x40059D, 3, 0) ------
PUT(72) = GET:I64(16)
PUT(184) = 0x4005A0:I64
0x4005A0: call 0x400458
------ IMark(0x4005A0, 5, 0) ------
t5 = Sub64(GET:I64(48),0x8:I64)
PUT(48) = t5
STle(t5) = 0x4005A5:I64
t6 = 0x400458:I64
====== AbiHint(Sub64(t5,0x80:I64), 128, t6) ======
PUT(184) = 0x400458:I64
0x400458: jmp* 2098434(%rip)
------ IMark(0x400458, 6, 0) ------
t8 = Add64(0x40045E:I64,0x200502:I64)
t9 = LDle:I64(t8)
PUT(184) = t9
PUT(184) = GET:I64(184); exit-Boring
==== SB 1277 (evchecks 6554) [tid 1] 0x4005bc main+104 /root/Desktop/hello+0x4005bc
------------------------ Front end ------------------------
0x4005BC: movq -8(%rbp),%rax
------ IMark(0x4005BC, 4, 0) ------
t0 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFF8:I64)
PUT(16) = LDle:I64(t0)
PUT(184) = 0x4005C0:I64
0x4005C0: movq %rax,%rdi
------ IMark(0x4005C0, 3, 0) ------
PUT(72) = GET:I64(16)
PUT(184) = 0x4005C3:I64
0x4005C3: call 0x400448
------ IMark(0x4005C3, 5, 0) ------
t1 = Sub64(GET:I64(48),0x8:I64)
PUT(48) = t1
STle(t1) = 0x4005C8:I64
t2 = 0x400448:I64
====== AbiHint(Sub64(t1,0x80:I64), 128, t2) ======
PUT(184) = 0x400448:I64
0x400448: jmp* 2098442(%rip)
------ IMark(0x400448, 6, 0) ------
t4 = Add64(0x40044E:I64,0x20050A:I64)
t5 = LDle:I64(t4)
PUT(184) = t5
PUT(184) = GET:I64(184); exit-Boring
示例程序如下:
在之后尝试将主程序作为函数再去调用
发现VEX有如下不同(调用之后执行t的顺序改变,在初始程序中后序superblock中执行的语句提前执行)
0x400625: movl $0,%eax
------ IMark(0x400625, 5, 0) ------
PUT(16) = 32Uto64(0x0:I32)
PUT(184) = 0x40062A:I64
0x40062A: call 0x400594
------ IMark(0x40062A, 5, 0) ------
t2 = Sub64(GET:I64(48),0x8:I64)
PUT(48) = t2
STle(t2) = 0x40062F:I64
t3 = 0x400594:I64
====== AbiHint(Sub64(t2,0x80:I64), 128, t3) ======
PUT(184) = 0x400594:I64
0x400594: pushq %rbp
------ IMark(0x400594, 1, 0) ------
t4 = GET:I64(56)
t5 = Sub64(GET:I64(48),0x8:I64)
PUT(48) = t5
STle(t5) = t4
PUT(184) = 0x400595:I64
0x400595: movq %rsp,%rbp
------ IMark(0x400595, 3, 0) ------
PUT(56) = GET:I64(48)
PUT(184) = 0x400598:I64
0x400598: subq $32, %rsp
------ IMark(0x400598, 4, 0) ------
t8 = GET:I64(48)
t7 = 0x20:I64
t6 = Sub64(t8,t7)
PUT(144) = 0x8:I64
PUT(152) = t8
PUT(160) = t7
PUT(48) = t6
PUT(184) = 0x40059C:I64
0x40059C: movl $4,%edi
------ IMark(0x40059C, 5, 0) ------
PUT(72) = 32Uto64(0x4:I32)
PUT(184) = 0x4005A1:I64
示例程序三在程序开头增加了一行代码观察改变
VEX多了如下代码其他部分未改变
0x40059C: movl $1, -24(%rbp)
------ IMark(0x40059C, 7, 0) ------
t5 = Add64(GET:I64(56),0xFFFFFFFFFFFFFFE8:I64)
STle(t5) = 0x1:I32
PUT(184) = 0x4005A3:I64