pwn 进阶（3）

0x01 Stack migration

leave;ret;

leave
mov esp,ebp
pop ebp
ret
pop eip

if we deploy stack

stack		bss
fake_ebp1	esp–>	fake ebp1 mem is here/ fake_ebp2
read		fake_fun
leave_ret	ebp–>	fake_ebp2 mem is here

control eip return to read fake_eb2 as fake ebp1

if a func call another func , when it return ,it execute leave;ret;

mov esp,ebp  --> esp <=> ebp
pop ebp  --> ebp <=> fake epb1
pop eip --> return read --> write fake_ebp2 to fake ebp1
then leave_ret
mov esp,ebp  --> esp <=> ebp
pop ebp  --> ebp <=> fake epb2
pop eip --> return fake_fun

now we finish Stack migration.

sometimes we need migrate stack to bss segment.

0x02 ida keypatch

g 0042AA98

keypatch --> patcher --> assemble 
edit --> patch program --> ...input file

0x03 Encryption & Deencryption

Why ？

Because i don‘t want to learn windows pwn ，yeah f**k b++c that pwn ，so I want to learn something about reverse. therefore,i start to learn Encryption & Deencryption.Who know it ,hahahahfahahfafa i don’t like study anymore.

Chapter I basic knowledge

1.Two byte storage sequences

Little-endian：high high ,low low

Big-endian:low high,high low

2.Windows OS

win32 API

	windows application
	win32 API
	OS
	device

The core of windows is dynamic link. Windows provides a wealth of application programs to use function calls, which are implemented by dynamic link library (DLL). The main parts of early windows only need to be implemented in three dynamic link libraries, which respectively represent the three main subsystems of windows, namely kernel, user and GDI

kernel, user and GDI:

kernel:implemented by kernel32.DLL, core function services of os.

user:handle user interface, including keyboard and mouse input, window and menu management, etc

GDI:a graphical device interface that allows programs to display text and graphics on screens and printers.

Windows also provides other DLLs to support more functions

The 64 bit system files of windows are placed in a folder called system32, which contains the native 64 bit image files. In order to be compatible with 32-bit operating system, the folder \ windows \ sysWOW64 is added, in which 32-bit system files are stored

Windows message mechanism

Windows is a message driven system. Windows messages provide a means of communication between applications and windows systems. There are two kinds of message queues in Windows system: one is system message queue, the other is application message queue

SendMessage function: call the window function of a window to send a message to that window. The function does not return until the message has been processed.

WM COMMAND: when a user selects a command or control from a menu or button, the message is sent to its parent window, or when a shortcut key is released. Return value: non-zero for processing

WM Destroy: when a window is destroyed, the message is sent, and the hexadecimal number of the message is 02h. Return value: non-zero if processed

WM gettext: copies the text of a corresponding window to a buffer provided by the caller. Return value: number of characters copied

WM qui