Reverve
babyRE
首先用file观察一下文件类型,得到如下结果
babyRE: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, for GNU/Linux 2.6.32, BuildID[sha1]=b6bce514f549db35e9fd8c008199820644059859, not stripped
用ida64打开,观察伪代码
int __cdecl main(int argc, const char **argv, const char **envp)
{
char s; // [rsp+0h] [rbp-20h]
int v5; // [rsp+18h] [rbp-8h]
int i; // [rsp+1Ch] [rbp-4h]
for ( i = 0; i <= 181; ++i )
{
envp = (const char **)(*((unsigned __int8 *)judge + i) ^ 0xCu);
*((_BYTE *)judge + i) ^= 0xCu;
}
printf("Please input flag:", argv, envp);
__isoc99_scanf("%20s", &s);
v5 = strlen(&s);
if ( v5 == 14 && (unsigned int)judge(&s) )
puts("Right!");
else
puts("Wrong!");
return 0;
}
从这里可以得到,len(flag) = 14,jugde函数在ida64中不能访问,所以就要用gdb进行调试
gdb babyRE #启动调试
首先,看看main函数里面的所以东西,并确定各个东西的位置
disass main #查看main函数汇编代码
Dump of assembler code for function main:
0x0000000000400606 <+0>: push rbp
0x0000000000400607 <+1>: mov rbp,rsp
0x000000000040060a <+4>: sub rsp,0x20
0x000000000040060e <+8>: mov DWORD PTR [rbp-0x4],0x0
0x0000000000400615 <+15>: jmp 0x400637 <main+49>
0x0000000000400617 <+17>: mov eax,DWORD PTR [rbp-0x4]
0x000000000040061a <+20>: cdqe
0x000000000040061c <+22>: movzx eax,BYTE PTR [rax+0x600b00] #调用judge
0x0000000000400623 <+29>: xor eax,0xc #12
0x0000000000400626 <+32>: mov edx,eax
0x0000000000400628 <+34>: mov eax,DWORD PTR [rbp-0x4]
0x000000000040062b <+37>: cdqe
0x000000000040062d <+39>: mov BYTE PTR [rax+0x600b00],dl
0x0000000000400633 <+45>: add DWORD PTR [rbp-0x4],0x1
0x0000000000400637 <+49>: cmp DWORD PTR [rbp-0x4],0xb5
0x000000000040063e <+56>: jle 0x400617 <main+17>
0x0000000000400640 <+58>: mov edi,0x400734
0x0000000000400645 <+63>: mov eax,0x0
0x000000000040064a <+68>: call 0x4004d0 <printf@plt>
0x000000000040064f <+73>: lea rax,[rbp-0x20]
0x0000000000400653 <+77>: mov rsi,rax
0x0000000000400656 <+80>: mov edi,0x400747
0x000000000040065b <+85>: mov eax,0x0
0x0000000000400660 <+90>: call 0x400500 <__isoc99_scanf@plt> #输入(要输14位满,足right 条件)
0x0000000000400665 <+95>: lea rax,[rbp-0x20]
0x0000000000400669 <+99>: mov rdi,rax
0x000000000040066c <+102>: call 0x4004c0 <strlen@plt> #长度
0x0000000000400671 <+107>: mov DWORD PTR [rbp-0x8],eax
0x0000000000400674 <+110>: cmp DWORD PTR [rbp-0x8],0xe #14
0x0000000000400678 <