2013년 10월 12일 토요일
2013년 10월 11일 금요일
IMAGE_IMPORT_DESCRIPTOR
C:\work>gcc codeob.c -o codeob.exe
codeob.c: In function 'find_kernel32_import':
codeob.c:41:1: warning: passing argument 2 of 'SetFilePointer' makes integer fro
m pointer without a cast [enabled by default]
c:\program files\mingw\mingw\bin\../lib/gcc/mingw32/4.6.2/../../../../include/wi
nbase.h:2087:25: note: expected 'LONG' but argument is of type 'void *'
C:\work>codeob
Examining c:\work\putty.exe
/* Locate Import Directory Table */
DOS magic: 0x5a4d @ [raw:0x0000]
PE header offset: 0xf8 @ [raw:0x003C]
Vjh$?@ [raw:0xffff]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x4c01b821]
Dissing MZ?@ [raw:0x6f6e6e61]
Dissing MZ?@ [raw:0x65646f6d]
Dissing MZ?@ [raw:0x18f67e2a]
Dissing MZ?@ [raw:0x1896722f]
Dissing MZ?@ [raw:0x18f67e28]
Dissing MZ?@ [raw:0x18f77e2a]
Dissing MZ?@ [raw:0x18f67e2b]
Dissing MZ?@ [raw:0x0]
Dissing S?끕YYSP @ [raw:0x4014c]
Dissing S?끕YYSP @ [raw:0xa07010b]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing @ [raw:0x4]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing V?@쥘 땸?G @ [raw:0x100000]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Past max imports...
/* Locate the FirstThunk member of Kernel32's
IMAGE_IMPORT_DESCRIPTOR structure for a pointer
to the Import Address Table entry */
Kernel32 FirstThunk: [raw:0x1a0] -> [raw:0x0]
Address of imported function: 0x905a4d @ [raw:0x0]
function returned 0x905a4d
C:\work>
codeob.c: In function 'find_kernel32_import':
codeob.c:41:1: warning: passing argument 2 of 'SetFilePointer' makes integer fro
m pointer without a cast [enabled by default]
c:\program files\mingw\mingw\bin\../lib/gcc/mingw32/4.6.2/../../../../include/wi
nbase.h:2087:25: note: expected 'LONG' but argument is of type 'void *'
C:\work>codeob
Examining c:\work\putty.exe
/* Locate Import Directory Table */
DOS magic: 0x5a4d @ [raw:0x0000]
PE header offset: 0xf8 @ [raw:0x003C]
Vjh$?@ [raw:0xffff]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x4c01b821]
Dissing MZ?@ [raw:0x6f6e6e61]
Dissing MZ?@ [raw:0x65646f6d]
Dissing MZ?@ [raw:0x18f67e2a]
Dissing MZ?@ [raw:0x1896722f]
Dissing MZ?@ [raw:0x18f67e28]
Dissing MZ?@ [raw:0x18f77e2a]
Dissing MZ?@ [raw:0x18f67e2b]
Dissing MZ?@ [raw:0x0]
Dissing S?끕YYSP @ [raw:0x4014c]
Dissing S?끕YYSP @ [raw:0xa07010b]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing @ [raw:0x4]
Dissing V?@쥘 땸?G @ [raw:0x1000]
Dissing V?@쥘 땸?G @ [raw:0x100000]
Dissing MZ?@ [raw:0x0]
Dissing MZ?@ [raw:0x0]
Past max imports...
/* Locate the FirstThunk member of Kernel32's
IMAGE_IMPORT_DESCRIPTOR structure for a pointer
to the Import Address Table entry */
Kernel32 FirstThunk: [raw:0x1a0] -> [raw:0x0]
Address of imported function: 0x905a4d @ [raw:0x0]
function returned 0x905a4d
C:\work>
2013년 10월 7일 월요일
pe
C:\work>peoep Hack.dll
Valid Dos Exe File
------------------
Dumping DOS Header Info....
---------------------------
Magic number : MZ(Mark Zbikowski)
Bytes on last page of file : 0x90
Pages in file : 0x3
Relocation : 0
Size of header in paragraphs : 0x4
Minimum extra paragraphs needed : 0
Maximum extra paragraphs needed : 0xffff
Initial (relative) SS value : 0
Initial SP value : 0xb8
Checksum : 0
Initial IP value : 0
Initial (relative) CS value : 0
File address of relocation table : 0x40
Overlay number : 0
OEM identifier : 0
OEM information(e_oemid specific) : 0
RVA address of PE header : 0xd0
===============================================================================
Valid PE file
-------------
Dumping COFF/PE Header Info....
--------------------------------
Signature : PE
Machine Architechture : Intel i386,i486,i586
Characteristics : Executable Image ,Dll file ,
Time Stamp : Sun Oct 06 19:14:48 2013
No.sections(size) : 5
No.entries in symbol table : 0
Size of optional header : 224
Dumping PE Optional Header Info....
-----------------------------------
Address of Entry Point : 0x12e0
Base Address of the Image : 0x10000000
SubSystem type : Windows GUI
Given file is a : PE32
Size of code segment(.text) : 163840
Base address of code segment(RVA) : 0x1000
Size of Initialized data : 36864
Base address of data segment(RVA) : 0x1000
Section Alignment : 0x1000
Major Linker Version : 6
Minor Linker Version : 0
Dumping Sections Header Info....
--------------------------------
Section Info (1 of 5)
---------------------
Section Header name : .text
ActualSize of code or data : 0x27590
Virtual Address(RVA) : 0x1000
Size of raw data (rounded to FA) : 0x28000
Pointer to Raw Data : 0x1000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains executable code, Readable,
Section Info (2 of 5)
---------------------
Section Header name : .rdata
ActualSize of code or data : 0x1ee2
Virtual Address(RVA) : 0x29000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x29000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (3 of 5)
---------------------
Section Header name : .data
ActualSize of code or data : 0x3f64
Virtual Address(RVA) : 0x2b000
Size of raw data (rounded to FA) : 0x3000
Pointer to Raw Data : 0x2b000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (4 of 5)
---------------------
Section Header name : .idata
ActualSize of code or data : 0x9ce
Virtual Address(RVA) : 0x2f000
Size of raw data (rounded to FA) : 0x1000
Pointer to Raw Data : 0x2e000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (5 of 5)
---------------------
Section Header name : .reloc
ActualSize of code or data : 0x15cc
Virtual Address(RVA) : 0x30000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x2f000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
===============================================================================
This Program is written by
K.Vineel Kumar Reddy.
III/IV IT Gayathri Vidya Parishad college of Eng.
C:\work>
Valid Dos Exe File
------------------
Dumping DOS Header Info....
---------------------------
Magic number : MZ(Mark Zbikowski)
Bytes on last page of file : 0x90
Pages in file : 0x3
Relocation : 0
Size of header in paragraphs : 0x4
Minimum extra paragraphs needed : 0
Maximum extra paragraphs needed : 0xffff
Initial (relative) SS value : 0
Initial SP value : 0xb8
Checksum : 0
Initial IP value : 0
Initial (relative) CS value : 0
File address of relocation table : 0x40
Overlay number : 0
OEM identifier : 0
OEM information(e_oemid specific) : 0
RVA address of PE header : 0xd0
===============================================================================
Valid PE file
-------------
Dumping COFF/PE Header Info....
--------------------------------
Signature : PE
Machine Architechture : Intel i386,i486,i586
Characteristics : Executable Image ,Dll file ,
Time Stamp : Sun Oct 06 19:14:48 2013
No.sections(size) : 5
No.entries in symbol table : 0
Size of optional header : 224
Dumping PE Optional Header Info....
-----------------------------------
Address of Entry Point : 0x12e0
Base Address of the Image : 0x10000000
SubSystem type : Windows GUI
Given file is a : PE32
Size of code segment(.text) : 163840
Base address of code segment(RVA) : 0x1000
Size of Initialized data : 36864
Base address of data segment(RVA) : 0x1000
Section Alignment : 0x1000
Major Linker Version : 6
Minor Linker Version : 0
Dumping Sections Header Info....
--------------------------------
Section Info (1 of 5)
---------------------
Section Header name : .text
ActualSize of code or data : 0x27590
Virtual Address(RVA) : 0x1000
Size of raw data (rounded to FA) : 0x28000
Pointer to Raw Data : 0x1000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains executable code, Readable,
Section Info (2 of 5)
---------------------
Section Header name : .rdata
ActualSize of code or data : 0x1ee2
Virtual Address(RVA) : 0x29000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x29000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
Section Info (3 of 5)
---------------------
Section Header name : .data
ActualSize of code or data : 0x3f64
Virtual Address(RVA) : 0x2b000
Size of raw data (rounded to FA) : 0x3000
Pointer to Raw Data : 0x2b000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (4 of 5)
---------------------
Section Header name : .idata
ActualSize of code or data : 0x9ce
Virtual Address(RVA) : 0x2f000
Size of raw data (rounded to FA) : 0x1000
Pointer to Raw Data : 0x2e000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable, Writabl
e,
Section Info (5 of 5)
---------------------
Section Header name : .reloc
ActualSize of code or data : 0x15cc
Virtual Address(RVA) : 0x30000
Size of raw data (rounded to FA) : 0x2000
Pointer to Raw Data : 0x2f000
Pointer to Relocations : 0
Pointer to Line numbers : 0
Number of relocations : 0
Number of line numbers : 0
Characteristics : Contains initialized data, Readable,
===============================================================================
This Program is written by
K.Vineel Kumar Reddy.
III/IV IT Gayathri Vidya Parishad college of Eng.
C:\work>
2013년 10월 6일 일요일
gdb intel syntax
C:\work>gdb -q memcpy
Reading symbols from C:\work\memcpy.exe...done.
(gdb) set dis intel
Ambiguous set command "dis intel": disable-randomization, disassemble-next-line,
disassembly-flavor, disconnected-tracing...
(gdb) list
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <string.h>
4 int main()
5 {
6 char* str1="this is sample string";
7 char* str2;
8
9 str2=(char*)malloc(strlen(str1));
10 memcpy(str2, str1, strlen(str1)+1);(gdb) set disassembly-flavor intel
(gdb) disass main
Dump of assembler code for function main:
0x0040138c <+0>: push ebp
0x0040138d <+1>: mov ebp,esp
0x0040138f <+3>: push edi
0x00401390 <+4>: push esi
0x00401391 <+5>: push ebx
0x00401392 <+6>: and esp,0xfffffff0
0x00401395 <+9>: sub esp,0x30
0x00401398 <+12>: call 0x401944 <__main>
0x0040139d <+17>: mov DWORD PTR [esp+0x2c],0x403064
0x004013a5 <+25>: mov eax,DWORD PTR [esp+0x2c]
0x004013a9 <+29>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013b1 <+37>: mov edx,eax
0x004013b3 <+39>: mov al,0x0
0x004013b5 <+41>: mov ecx,DWORD PTR [esp+0x1c]
0x004013b9 <+45>: mov edi,edx
0x004013bb <+47>: repnz scas al,BYTE PTR es:[edi]
0x004013bd <+49>: mov eax,ecx
0x004013bf <+51>: not eax
0x004013c1 <+53>: dec eax
0x004013c2 <+54>: mov DWORD PTR [esp],eax
0x004013c5 <+57>: call 0x401b7c <malloc>
0x004013ca <+62>: mov DWORD PTR [esp+0x28],eax
0x004013ce <+66>: mov eax,DWORD PTR [esp+0x2c]
0x004013d2 <+70>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013da <+78>: mov edx,eax
0x004013dc <+80>: mov al,0x0
0x004013de <+82>: mov ecx,DWORD PTR [esp+0x1c]
0x004013e2 <+86>: mov edi,edx
0x004013e4 <+88>: repnz scas al,BYTE PTR es:[edi]
0x004013e6 <+90>: mov eax,ecx
0x004013e8 <+92>: not eax
0x004013ea <+94>: dec eax
0x004013eb <+95>: inc eax
0x004013ec <+96>: mov edx,DWORD PTR [esp+0x28]
0x004013f0 <+100>: mov ecx,DWORD PTR [esp+0x2c]
0x004013f4 <+104>: mov ebx,ecx
0x004013f6 <+106>: mov edi,edx
0x004013f8 <+108>: mov esi,ebx
0x004013fa <+110>: mov ecx,eax
0x004013fc <+112>: rep movs BYTE PTR es:[edi],BYTE PTR ds:[esi]
0x004013fe <+114>: mov eax,DWORD PTR [esp+0x28]
0x00401402 <+118>: mov DWORD PTR [esp+0x8],eax
0x00401406 <+122>: mov eax,DWORD PTR [esp+0x2c]
0x0040140a <+126>: mov DWORD PTR [esp+0x4],eax
0x0040140e <+130>: mov DWORD PTR [esp],0x40307a
0x00401415 <+137>: call 0x401b84 <printf>
0x0040141a <+142>: mov eax,0x0
0x0040141f <+147>: lea esp,[ebp-0xc]
0x00401422 <+150>: pop ebx
0x00401423 <+151>: pop esi
0x00401424 <+152>: pop edi
0x00401425 <+153>: pop ebp
0x00401426 <+154>: ret
End of assembler dump.
(gdb)
Reading symbols from C:\work\memcpy.exe...done.
(gdb) set dis intel
Ambiguous set command "dis intel": disable-randomization, disassemble-next-line,
disassembly-flavor, disconnected-tracing...
(gdb) list
1 #include <stdio.h>
2 #include <stdlib.h>
3 #include <string.h>
4 int main()
5 {
6 char* str1="this is sample string";
7 char* str2;
8
9 str2=(char*)malloc(strlen(str1));
10 memcpy(str2, str1, strlen(str1)+1);(gdb) set disassembly-flavor intel
(gdb) disass main
Dump of assembler code for function main:
0x0040138c <+0>: push ebp
0x0040138d <+1>: mov ebp,esp
0x0040138f <+3>: push edi
0x00401390 <+4>: push esi
0x00401391 <+5>: push ebx
0x00401392 <+6>: and esp,0xfffffff0
0x00401395 <+9>: sub esp,0x30
0x00401398 <+12>: call 0x401944 <__main>
0x0040139d <+17>: mov DWORD PTR [esp+0x2c],0x403064
0x004013a5 <+25>: mov eax,DWORD PTR [esp+0x2c]
0x004013a9 <+29>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013b1 <+37>: mov edx,eax
0x004013b3 <+39>: mov al,0x0
0x004013b5 <+41>: mov ecx,DWORD PTR [esp+0x1c]
0x004013b9 <+45>: mov edi,edx
0x004013bb <+47>: repnz scas al,BYTE PTR es:[edi]
0x004013bd <+49>: mov eax,ecx
0x004013bf <+51>: not eax
0x004013c1 <+53>: dec eax
0x004013c2 <+54>: mov DWORD PTR [esp],eax
0x004013c5 <+57>: call 0x401b7c <malloc>
0x004013ca <+62>: mov DWORD PTR [esp+0x28],eax
0x004013ce <+66>: mov eax,DWORD PTR [esp+0x2c]
0x004013d2 <+70>: mov DWORD PTR [esp+0x1c],0xffffffff
0x004013da <+78>: mov edx,eax
0x004013dc <+80>: mov al,0x0
0x004013de <+82>: mov ecx,DWORD PTR [esp+0x1c]
0x004013e2 <+86>: mov edi,edx
0x004013e4 <+88>: repnz scas al,BYTE PTR es:[edi]
0x004013e6 <+90>: mov eax,ecx
0x004013e8 <+92>: not eax
0x004013ea <+94>: dec eax
0x004013eb <+95>: inc eax
0x004013ec <+96>: mov edx,DWORD PTR [esp+0x28]
0x004013f0 <+100>: mov ecx,DWORD PTR [esp+0x2c]
0x004013f4 <+104>: mov ebx,ecx
0x004013f6 <+106>: mov edi,edx
0x004013f8 <+108>: mov esi,ebx
0x004013fa <+110>: mov ecx,eax
0x004013fc <+112>: rep movs BYTE PTR es:[edi],BYTE PTR ds:[esi]
0x004013fe <+114>: mov eax,DWORD PTR [esp+0x28]
0x00401402 <+118>: mov DWORD PTR [esp+0x8],eax
0x00401406 <+122>: mov eax,DWORD PTR [esp+0x2c]
0x0040140a <+126>: mov DWORD PTR [esp+0x4],eax
0x0040140e <+130>: mov DWORD PTR [esp],0x40307a
0x00401415 <+137>: call 0x401b84 <printf>
0x0040141a <+142>: mov eax,0x0
0x0040141f <+147>: lea esp,[ebp-0xc]
0x00401422 <+150>: pop ebx
0x00401423 <+151>: pop esi
0x00401424 <+152>: pop edi
0x00401425 <+153>: pop ebp
0x00401426 <+154>: ret
End of assembler dump.
(gdb)
피드 구독하기:
글 (Atom)