跳转至

x86

字数:189 | 预计阅读时间:2分钟

Basic

构建可执行程序

vim test.s
as -o test.o test.s
ld -o test test.o

参数调用顺序

rdi,rsi,rdx

栈(stack)

   Address    |  Contents
 +---------------------------+
 | rsp        | value 0      |  <-- the argument count
 +---------------------------+
 | rsp+8      | value 1      |  <-- the address of program name
 +---------------------------+
 | rsp+16     | value 2      |  <-- the address of the first argument
 +---------------------------+
 | ...        | ...          |
 +---------------------------+

常用调试指令

objdump -d -M intel /tmp/your-program ; dissemble programs
strace /tmp/your-program ; to see the system call,parameter

gdb调试

quit/q 
#to quit gdb

starti 
#start the program at first command

disassemble 
#disassemble program

stepi 
#step one instruction forward

print $rdi 
#read register value

x $rsp 
#read the contents of memory

x/a $rsp+16 
#a means address

x/s 0x7ffc001c4750 
#s means string

run 
#run the whole program until break

File Descriptors (FDs).

  • FD 0: Standard Input is the channel through which the process takes input. For example, your shell uses Standard Input to read the commands that you input.
  • FD 1: Standard Output is the channel through which processes output normal data, such as the flag when it is printed to you in previous challenges or the output of utilities such as ls.
  • FD 2: Standard Error is the channel through which processes output error details. For example, if you mistype a command, the shell will output, over standard error, that this command does not exist.

linux x86

.intel_syntax noprefix
.global _start
_start:

instruction

mov a, b

mov rdi, rsp
move second value to the first value
if there is [rsp], it means move the value which address rsp point to

mov BYTE PTR [rsp], '/'

pop a

pop rdi
does two things:
Reads the value at [rsp] into rdi (just like mov rdi, [rsp]).
Adds 8 to rsp, advancing the stack pointer to the next value.

int3

stop the program

cmp a,b

if equal return 1, else return 0
cmp BYTE PTR [rax], 'p'
cmp rax, 42

setz dil

This checks the Zero Flag
If ZF = 1, it writes 1 to dil.
If ZF = 0, it writes 0 to dil.

jne fail

if cmp a,b return 0, jump to fail
usually like this
fail:
mov rdi 1
mov rax, 60
syscall

add,sub,xor

some math calculation

div

mul,imul

shl,shr

movzx

syscall

exit(exit code), 60

mov rdi, 42 ; use 42 as exit code
mov rax, 60
syscall

echo $? ; to see the exit code

write(fd, memory_address, number_write) , 1

write(1, memory_address, 10);

mov rax, 1
mov rdi, 1
mov rsi, rsp
mov rdx, 10
syscall

read(fd, memory_address, number_read) , 0

read(0, some_address, 5);

mov rax, 0
mov rdi, 0
mov rsi, rsp
mov rdx, 5
syscall

open(filename_address, flags), 2
flags:0 (read only), 1 (only write), 2 (read and write), 65 (create and write)

return : rax = fd number

mov rax, 2
mov rdi, [rsp+16]
mov rsi, 0 ; read only
syscall