linux下哪些软件能跑pin,Linux下pin的简单使用

文章参考CTF-wiki

一路上踩了不少坑记录一下。

例题 NDH2K13-crackme-500

尝试用IDA打开发现section header 损坏，一路确认进去也没找到主函数，使用pintools对其进行分析。

输入命令

playmaker@playmaker-PC:~$ ~/pin-3.7-97619-g0d0c92f4f-gcc-linux/pin -t ./pin-3.7-97619-g0d0c92f4f-gcc-linux/source/tools/ManualExamples/obj-intel64/inscount0.so -- ./Desktop/crackme <<< "a";cat inscount.out

Jonathan Salwan loves you <3

----------------------------

Password: Bad password

Count 162712

playmaker@playmaker-PC:~$ ~/pin-3.7-97619-g0d0c92f4f-gcc-linux/pin -t ./pin-3.7-97619-g0d0c92f4f-gcc-linux/source/tools/ManualExamples/obj-intel64/inscount0.so -- ./Desktop/crackme <<< "aa";cat inscount.out

Jonathan Salwan loves you <3

----------------------------

Password: Bad password

Count 165508

playmaker@playmaker-PC:~$ ~/pin-3.7-97619-g0d0c92f4f-gcc-linux/pin -t ./pin-3.7-97619-g0d0c92f4f-gcc-linux/source/tools/ManualExamples/obj-intel64/inscount0.so -- ./Desktop/crackme <<< "aaa";cat inscount.out

Jonathan Salwan loves you <3

----------------------------

Password: Bad password

Count 168304

playmaker@playmaker-PC:~$ ~/pin-3.7-97619-g0d0c92f4f-gcc-linux/pin -t ./pin-3.7-97619-g0d0c92f4f-gcc-linux/source/tools/ManualExamples/obj-intel64/inscount0.so -- ./Desktop/crackme <<< "aaaa";cat inscount.out

Jonathan Salwan loves you <3

----------------------------

Password: Bad password

Count 171100

四次长度不同的数据，且执行指令数字逐渐增加，写一个脚本查看逐渐变长的规律

#!/usr/bin/env python

# -*- coding: utf-8 -*-

from subprocess import Popen, PIPE

from sys import argv

import string

import time

pinPath = "/home/playmaker/pin-3.7-97619-g0d0c92f4f-gcc-linux/pin"

pinInit = lambda tool, elf: Popen([pinPath, '-t', tool, '--', elf], stdin = PIPE, stdout = PIPE)

pinWrite = lambda cont: pin.stdin.write(cont)

def pinRead():

f = open('./inscount.out','r')

file = f.read().strip('\n')

f.close()

return file

if __name__ == "__main__":

last = 0

for i in xrange(1, 30):

pin = pinInit("./pin-3.7-97619-g0d0c92f4f-gcc-linux/source/tools/ManualExamples/obj-intel64/inscount0.so", "./Desktop/crackme")

pinWrite("a" * i + '\n')

time.sleep(0.5)

now = int(pinRead().split("Count ")[1])

print "inputLen({:2d}) -> ins({}) -> delta({})".format(i, now, now - last)

last = now

运行结果如下

playmaker@playmaker-PC:~$ python guesslength.py

inputLen( 1) -> ins(159810) -> delta(159810)

inputLen( 2) -> ins(162606) -> delta(2796)

inputLen( 3) -> ins(165402) -> delta(2796)

inputLen( 4) -> ins(168198) -> delta(2796)

inputLen( 5) -> ins(170994) -> delta(2796)

inputLen( 6) -> ins(173790) -> delta(2796)

inputLen( 7) -> ins(176586) -> delta(2796)

inputLen( 8) -> ins(182307) -> delta(5721)

inputLen( 9) -> ins(182179) -> delta(-128)

inputLen(10) -> ins(184975) -> delta(2796)

inputLen(11) -> ins(187771) -> delta(2796)

inputLen(12) -> ins(190567) -> delta(2796)

inputLen(13) -> ins(193363) -> delta(2796)

inputLen(14) -> ins(196159) -> delta(2796)

inputLen(15) -> ins(198955) -> delta(2796)

inputLen(16) -> ins(201751) -> delta(2796)

inputLen(17) -> ins(204547) -> delta(2796)

inputLen(18) -> ins(207343) -> delta(2796)

inputLen(19) -> ins(210139) -> delta(2796)

inputLen(20) -> ins(212935) -> delta(2796)

inputLen(21) -> ins(215731) -> delta(2796)

inputLen(22) -> ins(218527) -> delta(2796)

inputLen(23) -> ins(221323) -> delta(2796)

inputLen(24) -> ins(224119) -> delta(2796)

inputLen(25) -> ins(226915) -> delta(2796)

inputLen(26) -> ins(229711) -> delta(2796)

inputLen(27) -> ins(243691) -> delta(13980)

inputLen(28) -> ins(243691) -> delta(0)

inputLen(29) -> ins(243691) -> delta(0)

长度位8时出现指令出现了激增，即可猜测flag的长度为8，接着可以猜测输入的正确的越多，执行的指令越多，于是写个逐位爆破脚本

#!/usr/bin/env python

# -*- coding: utf-8 -*-

from subprocess import Popen, PIPE

from sys import argv

import string

import pdb

import time

pinPath = "/home/playmaker/pin-3.7-97619-g0d0c92f4f-gcc-linux/pin"

pinInit = lambda tool, elf: Popen([pinPath, '-t', tool, '--', elf], stdin = PIPE, stdout = PIPE)

pinWrite = lambda cont: pin.stdin.write(cont)

def pinRead():

#f = open('./inscount.out','r')

f = open('./inscount.out','r')

file = f.read().strip('\n')

f.close()

return file

if __name__ == "__main__":

last = 0

dic = string.ascii_letters + string.digits + "+_ "

pwd = '?' * 8

dicIdx = 0

pwdIdx = 0

while True:

pwd = pwd[: pwdIdx] + dic[dicIdx] + pwd[pwdIdx + 1: ]

pin = pinInit("./pin-3.7-97619-g0d0c92f4f-gcc-linux/source/tools/ManualExamples/obj-intel64/inscount0.so","./Desktop/crackme")

pinWrite(pwd + '\n')

time.sleep(1)

now = int(pinRead().split("Count ")[1])

print "input({}) -> now({}) -> delta({})".format(pwd, now, now - last)

if now - last > 2000 and dicIdx:

pwdIdx += 1

dicIdx = -1

last = 0

if pwdIdx >= len(pwd):

print "Found pwd: {}".format(pwd)

break

dicIdx += 1

last = now

得到flag

PinCTF

还有一个简便工具,但是上题的题目PinCTF解决不了

下载地址以及使用教程

注：下载解压好运行./install.sh，并且pip安装好相关库即可用