当前位置:网站首页>GDB locates the main address of the program after strip
GDB locates the main address of the program after strip
2022-07-25 21:08:00 【xiaozhiwise】
The program after removing the symbol , How to find it in reverse main, as follows :
/*
* intel(64) main address
*/
1.readelf -h find Entry point address Address
(gdb) x/20i 0x555555555080
0x555555555080: endbr64
0x555555555084: xor %ebp,%ebp
0x555555555086: mov %rdx,%r9
0x555555555089: pop %rsi
0x55555555508a: mov %rsp,%rdx
0x55555555508d: and $0xfffffffffffffff0,%rsp
0x555555555091: push %rax
0x555555555092: push %rsp
0x555555555093: lea 0x9e6(%rip),%r8 # 0x555555555a80
0x55555555509a: lea 0x96f(%rip),%rcx # 0x555555555a10
=> 0x5555555550a1: lea 0x910(%rip),%rdi # 0x5555555559b8
0x5555555550a8: callq *0x2f32(%rip) # 0x555555557fe0
0x5555555550ae: hlt
0x5555555550af: nop
0x5555555550b0: lea 0x2f59(%rip),%rdi # 0x555555558010
0x5555555550b7: lea 0x2f52(%rip),%rax # 0x555555558010
0x5555555550be: cmp %rdi,%rax
0x5555555550c1: je 0x5555555550d8
0x5555555550c3: mov 0x2f0e(%rip),%rax # 0x555555557fd8
0x5555555550ca: test %rax,%rax
2.rip Take down the address of an instruction , Add the constant of the breakpoint instruction
0x5555555550a8 + 0x910 = 0x5555555559b8 // main address
/*
* intel(32) main address
*/
1.readelf -h find Entry point address Address
(gdb) x/20i 0x80483c0
80483c0: 31 ed xor %ebp,%ebp
80483c2: 5e pop %esi
80483c3: 89 e1 mov %esp,%ecx
80483c5: 83 e4 f0 and $0xfffffff0,%esp
80483c8: 50 push %eax
80483c9: 54 push %esp
80483ca: 52 push %edx
80483cb: 68 20 8b 04 08 push $0x8048b20
80483d0: 68 b0 8a 04 08 push $0x8048ab0
80483d5: 51 push %ecx
80483d6: 56 push %esi
80483d7: 68 77 8a 04 08 push $0x8048a77
80483dc: e8 cf ff ff ff call 80483b0 <[email protected]>
80483e1: f4 hlt
80483e2: 66 90 xchg %ax,%ax
80483e4: 66 90 xchg %ax,%ax
80483e6: 66 90 xchg %ax,%ax
80483e8: 66 90 xchg %ax,%ax
80483ea: 66 90 xchg %ax,%ax
80483ec: 66 90 xchg %ax,%ax
80483ee: 66 90 xchg %ax,%ax
2. Find the last one push That's ok
80483d7: 68 77 8a 04 08 push $0x8048a77 // main address
/*
* arm(64) main address
*/
1.readelf -h find Entry point address Address
(gdb) x/20i 0x400500
400500: d280001d mov x29, #0x0 // #0
400504: d280001e mov x30, #0x0 // #0
400508: aa0003e5 mov x5, x0
40050c: f94003e1 ldr x1, [sp]
400510: 910023e2 add x2, sp, #0x8
400514: 910003e6 mov x6, sp
400518: 580000c0 ldr x0, 400530 <[email protected]+0x40>
40051c: 580000e3 ldr x3, 400538 <[email protected]+0x48>
400520: 58000104 ldr x4, 400540 <[email protected]+0x50>
400524: 97ffffe7 bl 4004c0 <[email protected]>
400528: 97ffffee bl 4004e0 <[email protected]>
40052c: 00000000 .inst 0x00000000 ; undefined
400530: 00400c48 .inst 0x00400c48 ; undefined
400534: 00000000 .inst 0x00000000 ; undefined
400538: 00400c80 .inst 0x00400c80 ; undefined
40053c: 00000000 .inst 0x00000000 ; undefined
400540: 00400d00 .inst 0x00400d00 ; undefined
400544: 00000000 .inst 0x00000000 ; undefined
2. Find the second variable definition line
400530: 00400c48 .word 0x00400c48 // main address
/*
* arm(32) main address
*/
arm 32bit The program strip Post assembly instructions are completely different , Although the address is not strip It can be matched before , But the instructions have all flown . It seems that when such a program needs to be reversed , Looking for a main It is difficult to .
边栏推荐
- leetcode-79:单词搜索
- Leetcode skimming -- guess the size of numbers II 375 medium
- Leetcode-6131: the shortest dice sequence impossible to get
- 牛客-TOP101-BM38
- leetcode-6130:设计数字容器系统
- Niuke-top101-bm38
- leetcode-6131:不可能得到的最短骰子序列
- Using the OAP aspect causes the controller to be called repeatedly
- Please give an example of how to optimize MySQL index (sqlserver index optimization)
- CTS test steps (Casio cts200 test)
猜你喜欢

Leetcode-6129: number of all 0 subarrays
![[depth] the new LAAS agreement elephant: the key to revitalizing the development of the defi track](/img/ef/33f93225171e2c3e14b7d090c68196.png)
[depth] the new LAAS agreement elephant: the key to revitalizing the development of the defi track

DDD的Go实战

IEC61131 address representation

程序的编译和运行

preprocessor directives

Leetcode-79: word search

Has baozi ever played in the multi merchant system?

Leetcode-919: complete binary tree inserter

ROS_ Rqt toolbox
随机推荐
Pychart automatically enters the test mode when running the program
DDD go practice
图片怎么存储到数据库里「建议收藏」
matlab----EEGLab查看脑电信号
3阶有向完全图的所有非同构的子图(不同钩子图个数)
[advanced drawing of single cell] 07. Display of KEGG enrichment results
An interview question combining defer and function in golang
As a test, how to understand thread synchronization and asynchrony
cv图像翻转,EmguCV图像旋转「建议收藏」
NPM module removal_ [solved] after NPM uninstalls the module, the module is not removed from package.json [easy to understand]
leetcode-6130:设计数字容器系统
cts测试步骤(卡西欧cts200测试)
leetcode-146:LRU 缓存
Programmer's Guide to health quenching 5: introduction to sports Basics
基于腾讯地图实现精准定位,实现微信小程序考勤打卡功能
Cesium polygon gradient texture (canvas)
Remote - basic principle introduction
Interface testing tool restlet client
Hello, I'd like to ask questions about C and database operation.
Using the OAP aspect causes the controller to be called repeatedly