diff --git a/2000/01/01/hello-world/index.html b/2000/01/01/hello-world/index.html index a80554e8..3ea8e290 100644 --- a/2000/01/01/hello-world/index.html +++ b/2000/01/01/hello-world/index.html @@ -657,7 +657,7 @@ - 14.9k + 15.6k diff --git a/2018/11/16/BIBA访问控制模型实现(python)/index.html b/2018/11/16/BIBA访问控制模型实现(python)/index.html index 2480fbc7..374c8ff2 100644 --- a/2018/11/16/BIBA访问控制模型实现(python)/index.html +++ b/2018/11/16/BIBA访问控制模型实现(python)/index.html @@ -845,7 +845,7 @@ - 14.9k + 15.6k diff --git a/2018/12/15/miio-control/index.html b/2018/12/15/miio-control/index.html index ac48e4c8..4a80960f 100644 --- a/2018/12/15/miio-control/index.html +++ b/2018/12/15/miio-control/index.html @@ -747,7 +747,7 @@ - 14.9k + 15.6k diff --git a/2018/12/23/基于规则引擎发现IOT设备/index.html b/2018/12/23/基于规则引擎发现IOT设备/index.html index 8e0423b3..504c0494 100644 --- a/2018/12/23/基于规则引擎发现IOT设备/index.html +++ b/2018/12/23/基于规则引擎发现IOT设备/index.html @@ -747,7 +747,7 @@ - 14.9k + 15.6k diff --git a/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html b/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html index 9db86d5e..f056d8bf 100644 --- a/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html +++ b/2018/12/25/TCPDUMP拒绝服务攻击漏洞/index.html @@ -752,7 +752,7 @@ - 14.9k + 15.6k diff --git a/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html b/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html index 673e7f6d..693bbd33 100644 --- a/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html +++ b/2019/01/16/wifi半双工侧信道攻击学习笔记/index.html @@ -875,7 +875,7 @@ Server -------wire----------| - 14.9k + 15.6k diff --git a/2019/02/22/qq数据库的加密解密/index.html b/2019/02/22/qq数据库的加密解密/index.html index d10542eb..9f18fb91 100644 --- a/2019/02/22/qq数据库的加密解密/index.html +++ b/2019/02/22/qq数据库的加密解密/index.html @@ -724,7 +724,7 @@ - 14.9k + 15.6k diff --git a/2019/03/16/小米固件工具mkxqimage/index.html b/2019/03/16/小米固件工具mkxqimage/index.html index 6e2ed64d..a4127fd8 100644 --- a/2019/03/16/小米固件工具mkxqimage/index.html +++ b/2019/03/16/小米固件工具mkxqimage/index.html @@ -731,7 +731,7 @@ - 14.9k + 15.6k diff --git a/2019/03/23/auto-send-WX/index.html b/2019/03/23/auto-send-WX/index.html index 9a2eea1a..2975aaca 100644 --- a/2019/03/23/auto-send-WX/index.html +++ b/2019/03/23/auto-send-WX/index.html @@ -741,7 +741,7 @@ - 14.9k + 15.6k diff --git a/2019/03/25/Samba-CVE/index.html b/2019/03/25/Samba-CVE/index.html index 8e9bad8e..5eda1323 100644 --- a/2019/03/25/Samba-CVE/index.html +++ b/2019/03/25/Samba-CVE/index.html @@ -766,7 +766,7 @@ - 14.9k + 15.6k diff --git a/2019/03/28/逆向工程实验/index.html b/2019/03/28/逆向工程实验/index.html index ba59fdf2..67d6273c 100644 --- a/2019/03/28/逆向工程实验/index.html +++ b/2019/03/28/逆向工程实验/index.html @@ -88,7 +88,9 @@ - + + + @@ -409,7 +411,7 @@ - 194 字 + 928 字 @@ -423,7 +425,7 @@ - 1 分钟 + 3 分钟 @@ -501,6 +503,27 @@
  • 使调试器窗口不可用
  • 终止调试器进程
    • +

    PE文件格式基础

    实验1：软件破解

    对象

    crack.exe，28.0 KB

    + +

    爆破

      +

    1. 查找显示注册结果相关代码
      当输入错误验证码时，程序会输出“Bad Boy”，因此我们将程序拖入IDA，以流程图显示函数内部的跳转。查找“Bad Boy”字符串，我们可以定位到显示注册结果的相关代码：

      +
      2. +

    2. 查找注册码验证相关代码
      用鼠标选中程序分支点，按空格切换回汇编指令界面

      +
      3. +
    +

    可以看到，这条指令位于PE文件的.text节，并且IDA已经自动将地址转换为运行时的内存地址VA:

    1
    2
    3
    4
    5
    6
    3. 修改程序跳转
    现在关闭IDA，换用OllyDbg进行动态调试来看看程序时如何分支跳转的
    ```Ctrl+G``` 直接跳到由IDA得到的VA:```004010F9```处查看那条引起程序分支的关键指令
    选中这条指令，按F2设置断点，再按F9运行程序，这时候控制权会回到程序，OllyDbg暂时挂起。到程序提示输入名字和序列号，随意输入（名字大于五个字节），点击ok后，OllyDbg会重新中断程序，收回控制权，如图：
    ![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1553775053/%E8%BD%AF%E4%BB%B6%E7%A0%B4%E8%A7%A3/%E6%8D%95%E8%8E%B74.png)
    验证函数的返回值存于EAX寄存器中，if语句通过以下两条指令执行

    +

    cmp eax,ecx
    jnz xxxxxxx

    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    也就是说，当序列号输入错误时，EAX中的值为0，跳转将被执行。
    如果我们把jnz这条指令修改为jz，那么整个程序的逻辑就会反过来。
    双击jnz这条指令，将其改为jz，单击"汇编"将其写入内存
    ![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1553775817/%E8%BD%AF%E4%BB%B6%E7%A0%B4%E8%A7%A3/%E6%8D%95%E8%8E%B75.png)
    可以看到此时程序执行了相反的路径

    上面只是在内存中修改程序，我们还需要在二进制文件中也修改相应的字节，这里考察VA与文件地址之间的关系
    用LordPE打开.exe文件，查看PE文件的节信息
    ![](https://res.cloudinary.com/dozyfkbg3/image/upload/v1553776239/%E8%BD%AF%E4%BB%B6%E7%A0%B4%E8%A7%A3/%E6%8D%95%E8%8E%B76.png)
    VA:```004010F9

    +

    根据VA与文件地址的换算公式：

    1
    2
    3
    文件偏移地址 = VA - Image Base - 节偏移
                = 0x004010F9 - 0x00400000 - 0
                = 0x10F9

    +

    也就是说，这条指令在PE文件中位于10F9字节处，使用010Editer打开crack.exe，将这一字节的75(JNZ)改为74(JZ)，保存后重新执行，破解成功！

    +

    编写注册机

      +
    1. 查找显示注册结果相关代码
      2. +
    2. 查找注册码验证相关代码
      3. +
    3. 根据注册码验证代码编写注册机
      4. +
    @@ -737,7 +760,7 @@ -
    1. 1. 软件保护方式
    2. 2. 分析工具
    3. 3. 对抗分析技术
    +
    1. 1. 软件保护方式
    2. 2. 分析工具
    3. 3. 对抗分析技术
    4. 4. PE文件格式基础
    5. 5. 实验1：软件破解
      1. 5.1. 对象
      2. 5.2. 爆破
      3. 5.3. 编写注册机
    @@ -769,7 +792,7 @@ - 14.9k + 15.6k diff --git a/about/index.html b/about/index.html index 55b89450..0f15fa17 100644 --- a/about/index.html +++ b/about/index.html @@ -466,7 +466,7 @@ - 14.9k + 15.6k diff --git a/archives/2000/01/index.html b/archives/2000/01/index.html index 4a92cf74..d553151b 100644 --- a/archives/2000/01/index.html +++ b/archives/2000/01/index.html @@ -496,7 +496,7 @@ - 14.9k + 15.6k diff --git a/archives/2000/index.html b/archives/2000/index.html index 28fac996..d0152911 100644 --- a/archives/2000/index.html +++ b/archives/2000/index.html @@ -496,7 +496,7 @@ - 14.9k + 15.6k diff --git a/archives/2018/11/index.html b/archives/2018/11/index.html index 131d4304..9178a779 100644 --- a/archives/2018/11/index.html +++ b/archives/2018/11/index.html @@ -496,7 +496,7 @@ - 14.9k + 15.6k diff --git a/archives/2018/12/index.html b/archives/2018/12/index.html index 9772af1c..e8b02a7c 100644 --- a/archives/2018/12/index.html +++ b/archives/2018/12/index.html @@ -566,7 +566,7 @@ - 14.9k + 15.6k diff --git a/archives/2018/index.html b/archives/2018/index.html index c8e39a3a..03dea0bf 100644 --- a/archives/2018/index.html +++ b/archives/2018/index.html @@ -601,7 +601,7 @@ - 14.9k + 15.6k diff --git a/archives/2019/01/index.html b/archives/2019/01/index.html index 3cb3413c..85306ce8 100644 --- a/archives/2019/01/index.html +++ b/archives/2019/01/index.html @@ -496,7 +496,7 @@ - 14.9k + 15.6k diff --git a/archives/2019/02/index.html b/archives/2019/02/index.html index dc77aca0..6f3b2a07 100644 --- a/archives/2019/02/index.html +++ b/archives/2019/02/index.html @@ -496,7 +496,7 @@ - 14.9k + 15.6k diff --git a/archives/2019/03/index.html b/archives/2019/03/index.html index 77eb8c37..d2ee2d41 100644 --- a/archives/2019/03/index.html +++ b/archives/2019/03/index.html @@ -601,7 +601,7 @@ - 14.9k + 15.6k diff --git a/archives/2019/index.html b/archives/2019/index.html index d6b089fb..60e5904c 100644 --- a/archives/2019/index.html +++ b/archives/2019/index.html @@ -671,7 +671,7 @@ - 14.9k + 15.6k diff --git a/archives/index.html b/archives/index.html index a8672321..c9acef47 100644 --- a/archives/index.html +++ b/archives/index.html @@ -820,7 +820,7 @@ - 14.9k + 15.6k diff --git a/archives/page/2/index.html b/archives/page/2/index.html index 6ba5f51f..aad87b4d 100644 --- a/archives/page/2/index.html +++ b/archives/page/2/index.html @@ -500,7 +500,7 @@ - 14.9k + 15.6k diff --git a/baidusitemap.xml b/baidusitemap.xml index 1e042039..b1ab3f24 100644 --- a/baidusitemap.xml +++ b/baidusitemap.xml @@ -1,10 +1,10 @@ - https://cool-y.github.io/2018/12/25/TCPDUMP%E6%8B%92%E7%BB%9D%E6%9C%8D%E5%8A%A1%E6%94%BB%E5%87%BB%E6%BC%8F%E6%B4%9E/ + https://cool-y.github.io/2019/03/28/%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%E5%AE%9E%E9%AA%8C/ 2019-03-28 - https://cool-y.github.io/2019/03/28/%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%E5%AE%9E%E9%AA%8C/ + https://cool-y.github.io/2018/12/25/TCPDUMP%E6%8B%92%E7%BB%9D%E6%9C%8D%E5%8A%A1%E6%94%BB%E5%87%BB%E6%BC%8F%E6%B4%9E/ 2019-03-28 https://cool-y.github.io/2019/03/25/Samba-CVE/ diff --git a/bookmarks/index.html b/bookmarks/index.html index 6bf279f7..2e5ebcf8 100644 --- a/bookmarks/index.html +++ b/bookmarks/index.html @@ -518,7 +518,7 @@ - 14.9k + 15.6k diff --git a/categories/IOT/index.html b/categories/IOT/index.html index 2578911f..dc9aa902 100644 --- a/categories/IOT/index.html +++ b/categories/IOT/index.html @@ -529,7 +529,7 @@ - 14.9k + 15.6k diff --git a/categories/index.html b/categories/index.html index a5c17299..d21b1d8b 100644 --- a/categories/index.html +++ b/categories/index.html @@ -468,7 +468,7 @@ - 14.9k + 15.6k diff --git a/categories/二进制/index.html b/categories/二进制/index.html index 5799e5ea..55d47ac7 100644 --- a/categories/二进制/index.html +++ b/categories/二进制/index.html @@ -477,7 +477,7 @@ - 14.9k + 15.6k diff --git a/categories/加密解密/index.html b/categories/加密解密/index.html index 3304481a..3c221681 100644 --- a/categories/加密解密/index.html +++ b/categories/加密解密/index.html @@ -477,7 +477,7 @@ - 14.9k + 15.6k diff --git a/categories/杂七杂八/index.html b/categories/杂七杂八/index.html index f70d0c4f..53bdff51 100644 --- a/categories/杂七杂八/index.html +++ b/categories/杂七杂八/index.html @@ -477,7 +477,7 @@ - 14.9k + 15.6k diff --git a/categories/理论学习/index.html b/categories/理论学习/index.html index 56f459b9..32ccc3a4 100644 --- a/categories/理论学习/index.html +++ b/categories/理论学习/index.html @@ -477,7 +477,7 @@ - 14.9k + 15.6k diff --git a/categories/顶会论文/index.html b/categories/顶会论文/index.html index b9994f63..32af792b 100644 --- a/categories/顶会论文/index.html +++ b/categories/顶会论文/index.html @@ -503,7 +503,7 @@ - 14.9k + 15.6k diff --git a/index.html b/index.html index 901524b7..cc025570 100644 --- a/index.html +++ b/index.html @@ -395,7 +395,7 @@ - 194 字 + 928 字 @@ -409,7 +409,7 @@ - 1 分钟 + 3 分钟 @@ -2354,7 +2354,7 @@ ettercap嗅探智能设备和网关之间的流量sudo ettercap -i ens33 -T -q - 14.9k + 15.6k diff --git a/page/2/index.html b/page/2/index.html index 38c80d8e..1572d0c3 100644 --- a/page/2/index.html +++ b/page/2/index.html @@ -604,7 +604,7 @@ - 14.9k + 15.6k diff --git a/search.xml b/search.xml index 6339bdef..b8351fe3 100644 --- a/search.xml +++ b/search.xml @@ -3,7 +3,7 @@ <![CDATA[逆向工程实验]]> %2F2019%2F03%2F28%2F%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%E5%AE%9E%E9%AA%8C%2F - + -二进制 diff --git a/sitemap.xml b/sitemap.xml index 33485675..bf82e556 100644 --- a/sitemap.xml +++ b/sitemap.xml @@ -1,6 +1,13 @@ + + https://cool-y.github.io/2019/03/28/%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%E5%AE%9E%E9%AA%8C/ + + 2019-03-28T12:37:51.266Z + + + https://cool-y.github.io/2018/12/25/TCPDUMP%E6%8B%92%E7%BB%9D%E6%9C%8D%E5%8A%A1%E6%94%BB%E5%87%BB%E6%BC%8F%E6%B4%9E/ @@ -8,13 +15,6 @@ - - https://cool-y.github.io/2019/03/28/%E9%80%86%E5%90%91%E5%B7%A5%E7%A8%8B%E5%AE%9E%E9%AA%8C/ - - 2019-03-28T07:54:18.434Z - - - https://cool-y.github.io/bookmarks/index.html diff --git a/tags/CVE/index.html b/tags/CVE/index.html index 3afbaa57..a121dd3a 100644 --- a/tags/CVE/index.html +++ b/tags/CVE/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/QQ/index.html b/tags/QQ/index.html index c147fab2..1817a891 100644 --- a/tags/QQ/index.html +++ b/tags/QQ/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/SSH/index.html b/tags/SSH/index.html index b3dbef69..8256025f 100644 --- a/tags/SSH/index.html +++ b/tags/SSH/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/Samba/index.html b/tags/Samba/index.html index 3016bbbe..927d4048 100644 --- a/tags/Samba/index.html +++ b/tags/Samba/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/TCPDUMP/index.html b/tags/TCPDUMP/index.html index 80c820f3..1add1028 100644 --- a/tags/TCPDUMP/index.html +++ b/tags/TCPDUMP/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/USENIX/index.html b/tags/USENIX/index.html index a24a4d12..0b12985a 100644 --- a/tags/USENIX/index.html +++ b/tags/USENIX/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/index.html b/tags/index.html index 4247e419..b2e0cfab 100644 --- a/tags/index.html +++ b/tags/index.html @@ -468,7 +468,7 @@ - 14.9k + 15.6k diff --git a/tags/itchat/index.html b/tags/itchat/index.html index 0e321f5c..e312ed61 100644 --- a/tags/itchat/index.html +++ b/tags/itchat/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/miio/index.html b/tags/miio/index.html index 4ab9a7da..a9a672b6 100644 --- a/tags/miio/index.html +++ b/tags/miio/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/python/index.html b/tags/python/index.html index 34825d11..057b5da4 100644 --- a/tags/python/index.html +++ b/tags/python/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/wifi/index.html b/tags/wifi/index.html index e3d3a5a6..8a305540 100644 --- a/tags/wifi/index.html +++ b/tags/wifi/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/中间人/index.html b/tags/中间人/index.html index 507cc448..3a5d0d8c 100644 --- a/tags/中间人/index.html +++ b/tags/中间人/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/侧信道攻击/index.html b/tags/侧信道攻击/index.html index 69d9d2f5..f42f79d8 100644 --- a/tags/侧信道攻击/index.html +++ b/tags/侧信道攻击/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/密码/index.html b/tags/密码/index.html index 851f0a3b..d0ae5a66 100644 --- a/tags/密码/index.html +++ b/tags/密码/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/小米/index.html b/tags/小米/index.html index 90b0f90d..d2ab8a57 100644 --- a/tags/小米/index.html +++ b/tags/小米/index.html @@ -502,7 +502,7 @@ - 14.9k + 15.6k diff --git a/tags/微信/index.html b/tags/微信/index.html index 49993cd7..8643f315 100644 --- a/tags/微信/index.html +++ b/tags/微信/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/拒绝服务攻击/index.html b/tags/拒绝服务攻击/index.html index 1b4f0abb..34dbe64f 100644 --- a/tags/拒绝服务攻击/index.html +++ b/tags/拒绝服务攻击/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/数据库/index.html b/tags/数据库/index.html index 3311aa8f..0bc8029f 100644 --- a/tags/数据库/index.html +++ b/tags/数据库/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/数据挖掘/index.html b/tags/数据挖掘/index.html index d356e528..8f3a5673 100644 --- a/tags/数据挖掘/index.html +++ b/tags/数据挖掘/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/文件格式/index.html b/tags/文件格式/index.html index d02d787a..6febb6a4 100644 --- a/tags/文件格式/index.html +++ b/tags/文件格式/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/模型实现/index.html b/tags/模型实现/index.html index 64c701d1..7a7a6517 100644 --- a/tags/模型实现/index.html +++ b/tags/模型实现/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/自然语言处理/index.html b/tags/自然语言处理/index.html index 0ca66a2d..bce817d5 100644 --- a/tags/自然语言处理/index.html +++ b/tags/自然语言处理/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/访问控制/index.html b/tags/访问控制/index.html index b9f63f50..66d82a38 100644 --- a/tags/访问控制/index.html +++ b/tags/访问控制/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/远程执行/index.html b/tags/远程执行/index.html index b0b4856b..49330312 100644 --- a/tags/远程执行/index.html +++ b/tags/远程执行/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/逆向/index.html b/tags/逆向/index.html index 7af7dc34..dd35cd64 100644 --- a/tags/逆向/index.html +++ b/tags/逆向/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k diff --git a/tags/重放攻击/index.html b/tags/重放攻击/index.html index c02424a7..ef74366d 100644 --- a/tags/重放攻击/index.html +++ b/tags/重放攻击/index.html @@ -476,7 +476,7 @@ - 14.9k + 15.6k