Hand-Ray 연습..!!

아... 리버싱 처음 시작할 땐 정말 열심히 Hand-Ray를 연습했는데..

해킹대회 때나  조금 복잡한 코드가 나오면 맨날 IDA의 Hex-Ray를 사용하다보니 Hand-Ray능력이 퇴화되는거 같다..ㅠㅠ

그래서 어떤 문제 사이트에 있던 어셈코드를 C로 바꾸는 연습을 해보았다. 얍얍! ^^

역시나 간단한 어셈블리 구문이지만 숙달이 덜되서 조금 시간이 걸렸다;; 쑥쓰럽네요..;;

AT&T 어셈블리 구문

0x0804854c <main+104>: movl $0x804883c,(%esp) //0x804883c = Input Num : 0x08048553 <main+111>: call 0x80483f4 <printf@plt> 0x08048558 <main+116>: lea -0x8(%ebp),%eax 0x0804855b <main+119>: mov %eax,0x4(%esp) 0x0804855f <main+123>: movl $0x8048852,(%esp) //0x8048852 = %d 0x08048566 <main+130>: call 0x80483d4 <scanf@plt> 0x08048592 <main+174>: movl $0x8048864,(%esp) //0x8048864 = Input String : 0x08048599 <main+181>: call 0x80483f4 <printf@plt> 0x0804859e <main+186>: call 0x8048394 <getchar@plt> 0x080485a3 <main+191>: lea -0x6c(%ebp),%eax 0x080485a6 <main+194>: mov %eax,0x4(%esp) 0x080485aa <main+198>: movl $0x8048880,(%esp) //0x8048880 = %s 0x080485b1 <main+205>: call 0x80483d4 <scanf@plt> 0x080485b6 <main+210>: mov -0x8(%ebp),%eax 0x080485b9 <main+213>: mov %eax,0x4(%esp) 0x080485bd <main+217>: lea -0x6c(%ebp),%eax 0x080485c0 <main+220>: mov %eax,(%esp) 0x080485c3 <main+223>: call 0x8048614 <toCipher> 0x080485f0 <main+268>: lea -0x6c(%ebp),%eax 0x080485f3 <main+271>: mov %eax,0x4(%esp) 0x080485f7 <main+275>: movl $0x8048894,(%esp) //0x8048894 = Encoding String : 0x080485fe <main+282>: call 0x80483f4 <printf@plt> 0x08048603 <main+287>: mov $0x0,%eax 0x08048608 <main+292>: add $0x84,%esp 0x0804860e <main+298>: pop %ecx 0x0804860f <main+299>: pop %ebp 0x08048610 <main+300>: lea -0x4(%ecx),%esp 0x08048613 <main+303>: ret =======<toCipher>========= 0x08048614 <toCipher+0>: push %ebp 0x08048615 <toCipher+1>: mov %esp,%ebp 0x08048617 <toCipher+3>: push %ebx 0x08048618 <toCipher+4>: sub $0x14,%esp 0x0804861b <toCipher+7>: movl $0x0,-0x8(%ebp) 0x08048622 <toCipher+14>: jmp 0x80486e9 <toCipher+213> 0x08048627 <toCipher+19>: mov -0x8(%ebp),%eax 0x0804862a <toCipher+22>: add 0x8(%ebp),%eax 0x0804862d <toCipher+25>: movzbl (%eax),%eax 0x08048630 <toCipher+28>: cmp $0x20,%al 0x08048632 <toCipher+30>: je 0x80486e5 <toCipher+209> 0x08048638 <toCipher+36>: mov -0x8(%ebp),%eax 0x0804863b <toCipher+39>: add 0x8(%ebp),%eax 0x0804863e <toCipher+42>: movzbl (%eax),%eax 0x08048641 <toCipher+45>: movsbl %al,%eax 0x08048644 <toCipher+48>: add 0xc(%ebp),%eax 0x08048647 <toCipher+51>: cmp $0x7a,%eax 0x0804864a <toCipher+54>: jle 0x804866c <toCipher+88> 0x0804864c <toCipher+56>: mov -0x8(%ebp),%eax 0x0804864f <toCipher+59>: mov %eax,%ecx 0x08048651 <toCipher+61>: add 0x8(%ebp),%ecx 0x08048654 <toCipher+64>: mov -0x8(%ebp),%eax 0x08048657 <toCipher+67>: add 0x8(%ebp),%eax 0x0804865a <toCipher+70>: movzbl (%eax),%eax 0x0804865d <toCipher+73>: mov %eax,%edx 0x0804865f <toCipher+75>: mov 0xc(%ebp),%eax 0x08048662 <toCipher+78>: lea (%edx,%eax,1),%eax 0x08048665 <toCipher+81>: sub $0x1a,%eax 0x08048668 <toCipher+84>: mov %al,(%ecx) 0x0804866a <toCipher+86>: jmp 0x80486e5 <toCipher+209> 0x0804866c <toCipher+88>: mov -0x8(%ebp),%eax 0x0804866f <toCipher+91>: add 0x8(%ebp),%eax 0x08048672 <toCipher+94>: movzbl (%eax),%eax 0x08048675 <toCipher+97>: movsbl %al,%eax 0x08048678 <toCipher+100>: add 0xc(%ebp),%eax 0x0804867b <toCipher+103>: cmp $0x5a,%eax 0x0804867e <toCipher+106>: jle 0x80486ca <toCipher+182> 0x08048680 <toCipher+108>: mov -0x8(%ebp),%eax 0x08048683 <toCipher+111>: add 0x8(%ebp),%eax 0x08048686 <toCipher+114>: movzbl (%eax),%eax 0x08048689 <toCipher+117>: cmp $0x5a,%al 0x0804868b <toCipher+119>: jg 0x80486ad <toCipher+153> 0x0804868d <toCipher+121>: mov -0x8(%ebp),%eax 0x08048690 <toCipher+124>: mov %eax,%ecx 0x08048692 <toCipher+126>: add 0x8(%ebp),%ecx 0x08048695 <toCipher+129>: mov -0x8(%ebp),%eax 0x08048698 <toCipher+132>: add 0x8(%ebp),%eax 0x0804869b <toCipher+135>: movzbl (%eax),%eax 0x0804869e <toCipher+138>: mov %eax,%edx 0x080486a0 <toCipher+140>: mov 0xc(%ebp),%eax 0x080486a3 <toCipher+143>: lea (%edx,%eax,1),%eax 0x080486a6 <toCipher+146>: sub $0x1a,%eax 0x080486a9 <toCipher+149>: mov %al,(%ecx) 0x080486ab <toCipher+151>: jmp 0x80486e5 <toCipher+209> 0x080486ad <toCipher+153>: mov -0x8(%ebp),%eax 0x080486b0 <toCipher+156>: mov %eax,%ecx 0x080486b2 <toCipher+158>: add 0x8(%ebp),%ecx 0x080486b5 <toCipher+161>: mov -0x8(%ebp),%eax 0x080486b8 <toCipher+164>: add 0x8(%ebp),%eax 0x080486bb <toCipher+167>: movzbl (%eax),%eax 0x080486be <toCipher+170>: mov %eax,%edx 0x080486c0 <toCipher+172>: mov 0xc(%ebp),%eax 0x080486c3 <toCipher+175>: lea (%edx,%eax,1),%eax 0x080486c6 <toCipher+178>: mov %al,(%ecx) 0x080486c8 <toCipher+180>: jmp 0x80486e5 <toCipher+209> 0x080486ca <toCipher+182>: mov -0x8(%ebp),%eax 0x080486cd <toCipher+185>: mov %eax,%ecx 0x080486cf <toCipher+187>: add 0x8(%ebp),%ecx 0x080486d2 <toCipher+190>: mov -0x8(%ebp),%eax 0x080486d5 <toCipher+193>: add 0x8(%ebp),%eax 0x080486d8 <toCipher+196>: movzbl (%eax),%eax 0x080486db <toCipher+199>: mov %eax,%edx 0x080486dd <toCipher+201>: mov 0xc(%ebp),%eax 0x080486e0 <toCipher+204>: lea (%edx,%eax,1),%eax 0x080486e3 <toCipher+207>: mov %al,(%ecx) 0x080486e5 <toCipher+209>: addl $0x1,-0x8(%ebp) 0x080486e9 <toCipher+213>: mov -0x8(%ebp),%ebx 0x080486ec <toCipher+216>: mov 0x8(%ebp),%eax 0x080486ef <toCipher+219>: mov %eax,(%esp) 0x080486f2 <toCipher+222>: call 0x80483e4 <strlen@plt> 0x080486f7 <toCipher+227>: cmp %eax,%ebx 0x080486f9 <toCipher+229>: jb 0x8048627 <toCipher+19> 0x080486ff <toCipher+235>: add $0x14,%esp 0x08048702 <toCipher+238>: pop %ebx 0x08048703 <toCipher+239>: pop %ebp 0x08048704 <toCipher+240>: ret

Hand-Ray 후 C언어로 프로그램 재 구성!

#include <stdio.h> #include <string.h> #include <stdlib.h> char* toCipher(char* buf, int Num); int main(void) { int a = 0; char buf[100]; char* pbuf = (char*)malloc(sizeof(char)*100); printf("Input Num : "); scanf("%d",&a); printf("Input String : "); scanf("%s",buf); pbuf = toCipher(buf,a); printf("Encoding String : %s \n",pbuf); return 0; } char* toCipher(char* buf, int Num) { int a = 0; //ebp[-0x8] while(1) { if(strlen(buf) <= a) return buf; if(buf[a] == 0x20) { a++; continue; } if(0x7a < (buf[a]+Num)) { buf[a] = buf[a]+Num-0x1a; a++; continue; } if(0x5a < (buf[a]+Num)) { if(0x5a >= buf[a]) { buf[a] = buf[a]+Num-0x1a; a++; continue; } else { buf[a] = buf[a]+Num; a++; continue; } } else { buf[a] = buf[a]+Num; a++; continue; } } }

일단 출력은 아래와 같습니다.

위와 같이 출력되면 잘 된 것입니다. 원본 프로그램 실행결과와 같았습니다.

어셈블리 구문에서 불필요한 main함수 코드와 해당 주소에 맞는 문자열은 주석으로 적어놨으니..

직접 해보실 분은 해보세요~! ^^ 연습차원에서 말이죠.

제 c코드는 최적화는 안되었네요;;ㅠㅠ 

일단 보이는대로 쭉 써가면서 정상적으로 실행시키는데 급급해서 그만..ㅠㅠ

그리고 main함수 부분은.. 코드대로 짜지 않고 조금 바꿨네요 -_-;;