This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
================================================================================ | |
Write Executable Memory. 전부 NO-PIE 패턴 | |
========== | |
Pattern 1. | |
x86_smc1.out.ll | |
(바로 쓰기) | |
store i8 1, i8* @data_804807b |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
POINTER in LLVM IR | |
=============================================================================== | |
1. Pointer Type | |
inttoptr | |
ptrtoint | |
getelementptr | |
bitcast |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
Anderson Algorithm | |
=============================================================================== | |
0. Basic | |
C언어에서 pointer 는 다음 세가지의 값을 가진다. | |
0.1 Example Code | |
```c | |
int main(){ | |
int *pointerA; |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
SourceFiles | |
=============================================================================== | |
1. x86 nasm code | |
1.1. x86_smc1 | |
1.2. x86_smc2 | |
1.3. x86_smc3 | |
1.4. x86_smc4 | |
1.5. x86_smc5 | |
1.6. x86_smc6 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
SMC Codes in LL From Binary | |
=============================================================================== | |
X86, X64 Binary 파일로부터 Mcsema을 이용하여 Lifting된 LL 파일에 대하여 설명한다. | |
명령어 형태에 영향을 주는 기준 1. | |
1.1. NO-PIE SMC 코드 | |
1.2. PIE SMC 코드 | |
명령어 형태에 영향을 주는 기준 2. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
SMC Codes in C -> ll | |
=============================================================================== | |
C언어에서 작성한 SMC 코드가, LL 파일에서 나타나는 형태에 대하여 말한다. | |
=============================================================================== | |
1. 코드 영역을 직접 수정하는 경우 | |
=============================================================================== | |
1.1. PIE SMC 코드 | |
C언어에서 .text 영역 다음에 .data 영역이 오므로, offset이 function인 경우 양수이고 |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
SMC Codes in C | |
=============================================================================== | |
C언어를 통하여 만들 수 있는 SMC 코드. | |
=============================================================================== | |
1. 코드 영역을 수정하는 경우. | |
=============================================================================== | |
1.1. PIE 코드의 경우. | |
address가 결정되지 않았으므로, direct하게 명시하여 메모리를 수정할 수 없다. |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
C 언어에서 나타나는 SMC 코드. | |
=============================================================================== | |
C 언어에서의 메모리 모델은 다음과 같다. | |
High Address | |
stack (almost end of address. in gcc-x86 is 0xfffffff0, gcc-x64 is 0xfffffffffffffff0) | |
heap | |
uninitialized data | |
initalized data (data 영역) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
=============================================================================== | |
GCC 에서 PIE와 Non-PIE의 직접적인 차이점. | |
본 글은 GCC와 C언어에 대해서 말하고 있다. | |
들어가기에 앞서 주의할 사항. | |
1. PIE와 Non-PIE는 하드웨어 아키텍처의 물리적인 특성이 아니다. | |
2. PIE와 Non-PIE는 컴파일러와 Linker의 소프트웨어적인 특성이다. | |
3. X86 아키텍처에서는 EIP를 경유하는 명령어가 존재하지 않아서 Helper Assembly | |
Procedure를 사용한다. (GCC의 경우 get_thunk_pc, clang의 경우 별도의 Procedure는 | |
없고 call 명령어와 pop 명령어만으로 이를 구현한다.) |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import sys | |
sys.path.append("/path/to/anvill/python") | |
import anvill | |
p = anvill.get_program(cache=False) | |
p.add_function_definition(here()) | |
open("/tmp/spec.json", "w").write(p.proto()) |