当前位置:网站首页>GDB locates the main address of the program after strip
GDB locates the main address of the program after strip
2022-07-25 21:08:00 【xiaozhiwise】
The program after removing the symbol , How to find it in reverse main, as follows :
/*
* intel(64) main address
*/
1.readelf -h find Entry point address Address
(gdb) x/20i 0x555555555080
0x555555555080: endbr64
0x555555555084: xor %ebp,%ebp
0x555555555086: mov %rdx,%r9
0x555555555089: pop %rsi
0x55555555508a: mov %rsp,%rdx
0x55555555508d: and $0xfffffffffffffff0,%rsp
0x555555555091: push %rax
0x555555555092: push %rsp
0x555555555093: lea 0x9e6(%rip),%r8 # 0x555555555a80
0x55555555509a: lea 0x96f(%rip),%rcx # 0x555555555a10
=> 0x5555555550a1: lea 0x910(%rip),%rdi # 0x5555555559b8
0x5555555550a8: callq *0x2f32(%rip) # 0x555555557fe0
0x5555555550ae: hlt
0x5555555550af: nop
0x5555555550b0: lea 0x2f59(%rip),%rdi # 0x555555558010
0x5555555550b7: lea 0x2f52(%rip),%rax # 0x555555558010
0x5555555550be: cmp %rdi,%rax
0x5555555550c1: je 0x5555555550d8
0x5555555550c3: mov 0x2f0e(%rip),%rax # 0x555555557fd8
0x5555555550ca: test %rax,%rax
2.rip Take down the address of an instruction , Add the constant of the breakpoint instruction
0x5555555550a8 + 0x910 = 0x5555555559b8 // main address
/*
* intel(32) main address
*/
1.readelf -h find Entry point address Address
(gdb) x/20i 0x80483c0
80483c0: 31 ed xor %ebp,%ebp
80483c2: 5e pop %esi
80483c3: 89 e1 mov %esp,%ecx
80483c5: 83 e4 f0 and $0xfffffff0,%esp
80483c8: 50 push %eax
80483c9: 54 push %esp
80483ca: 52 push %edx
80483cb: 68 20 8b 04 08 push $0x8048b20
80483d0: 68 b0 8a 04 08 push $0x8048ab0
80483d5: 51 push %ecx
80483d6: 56 push %esi
80483d7: 68 77 8a 04 08 push $0x8048a77
80483dc: e8 cf ff ff ff call 80483b0 <[email protected]>
80483e1: f4 hlt
80483e2: 66 90 xchg %ax,%ax
80483e4: 66 90 xchg %ax,%ax
80483e6: 66 90 xchg %ax,%ax
80483e8: 66 90 xchg %ax,%ax
80483ea: 66 90 xchg %ax,%ax
80483ec: 66 90 xchg %ax,%ax
80483ee: 66 90 xchg %ax,%ax
2. Find the last one push That's ok
80483d7: 68 77 8a 04 08 push $0x8048a77 // main address
/*
* arm(64) main address
*/
1.readelf -h find Entry point address Address
(gdb) x/20i 0x400500
400500: d280001d mov x29, #0x0 // #0
400504: d280001e mov x30, #0x0 // #0
400508: aa0003e5 mov x5, x0
40050c: f94003e1 ldr x1, [sp]
400510: 910023e2 add x2, sp, #0x8
400514: 910003e6 mov x6, sp
400518: 580000c0 ldr x0, 400530 <[email protected]+0x40>
40051c: 580000e3 ldr x3, 400538 <[email protected]+0x48>
400520: 58000104 ldr x4, 400540 <[email protected]+0x50>
400524: 97ffffe7 bl 4004c0 <[email protected]>
400528: 97ffffee bl 4004e0 <[email protected]>
40052c: 00000000 .inst 0x00000000 ; undefined
400530: 00400c48 .inst 0x00400c48 ; undefined
400534: 00000000 .inst 0x00000000 ; undefined
400538: 00400c80 .inst 0x00400c80 ; undefined
40053c: 00000000 .inst 0x00000000 ; undefined
400540: 00400d00 .inst 0x00400d00 ; undefined
400544: 00000000 .inst 0x00000000 ; undefined
2. Find the second variable definition line
400530: 00400c48 .word 0x00400c48 // main address
/*
* arm(32) main address
*/
arm 32bit The program strip Post assembly instructions are completely different , Although the address is not strip It can be matched before , But the instructions have all flown . It seems that when such a program needs to be reversed , Looking for a main It is difficult to .
边栏推荐
- "Shallow in and shallow out" MySQL and InnoDB [it is recommended to collect and share]
- 程序的编译和运行
- Basic knowledge of Marine Geology
- How to obtain the subordinate / annotation information of KEGG channel
- ZigBee IOT development platform (Industrial IOT)
- Leetcode-919: complete binary tree inserter
- IEC61131 address representation
- When MySQL resets the root password and modifies the password, an error occurs. The password field does not exist
- ES6---4个强大运算符(??、??=、?.、?:)
- npm 模块 移除_【已解决】npm卸载模块后该模块并没有从package.json中去掉[通俗易懂]
猜你喜欢

Add startup software items when the win system starts up

Unity VS—— VS中默认调试为启动而不是附加到Unity调试

Canvas 填充渐变

leetcode-6129:全 0 子数组的数目

leetcode-6130:设计数字容器系统

Opencv learning Fourier transform experience and line direction Fourier transform code

Character function and string function (2)
![[online tutorial] iptables official tutorial -- learning notes 2](/img/7d/5f8328d1b4c8878f17c95d2658d2d6.jpg)
[online tutorial] iptables official tutorial -- learning notes 2

DDD的Go实战

Force deduction ----- calculate the money of the force deduction bank
随机推荐
leetcode-155:最小栈
What's special about Huawei's innovative solutions to consolidate the foundation of ERP for small and medium-sized enterprises?
resize函数的作用「建议收藏」
Leetcode-6130: designing digital container systems
leetcode-6127:优质数对的数目
两数,三数之和
黑盒(功能)测试基本方法
Leetcode-79: word search
预处理指令
476-82(322、64、2、46、62、114)
MySQL master-slave replication data synchronization, summary of common problems
Remote - actual combat
Opencv learning Fourier transform experience and line direction Fourier transform code
Leetcode-6129: number of all 0 subarrays
7.23
Basic method of black box (function) test
[online tutorial] iptables official tutorial -- learning notes 2
Use of C log4net: add file name and line number to the output log content; Repackaged class output file name and line number
Achieve accurate positioning based on Tencent map, and realize the attendance punch function of wechat applet
Leetcode-155: minimum stack