8장. 연습문제

// Architecture type typedef enum cs_arch { CS_ARCH_ARM = 0, // ARM architecture (including Thumb, Thumb-2) CS_ARCH_ARM64, // ARM-64, also called AArch64 CS_ARCH_MIPS, // Mips architecture CS_ARCH_X86, // X86 architecture (including x86 & x86-64) CS_ARCH_PPC, // PowerPC architecture CS_ARCH_SPARC, // Sparc architecture CS_ARCH_SYSZ, // SystemZ architecture CS_ARCH_XCORE, // XCore architecture CS_ARCH_MAX, CS_ARCH_ALL = 0xFFFF, // All architectures - for cs_support() } cs_arch; // Mode type typedef enum cs_mode { CS_MODE_LITTLE_ENDIAN = 0, // little-endian mode (default mode) CS_MODE_ARM = 0, // 32-bit ARM CS_MODE_16 = 1 << 1, // 16-bit mode (X86) CS_MODE_32 = 1 << 2, // 32-bit mode (X86) CS_MODE_64 = 1 << 3, // 64-bit mode (X86, PPC) CS_MODE_THUMB = 1 << 4, // ARM's Thumb mode, including Thumb-2 CS_MODE_MCLASS = 1 << 5, // ARM's Cortex-M series CS_MODE_V8 = 1 << 6, // ARMv8 A32 encodings for ARM CS_MODE_MICRO = 1 << 4, // MicroMips mode (MIPS) CS_MODE_MIPS3 = 1 << 5, // Mips III ISA CS_MODE_MIPS32R6 = 1 << 6, // Mips32r6 ISA CS_MODE_MIPSGP64 = 1 << 7, // General Purpose Registers are 64-bit wide (MIPS) CS_MODE_V9 = 1 << 4, // SparcV9 mode (Sparc) CS_MODE_BIG_ENDIAN = 1 << 31, // big-endian mode CS_MODE_MIPS32 = CS_MODE_32, // Mips32 ISA (Mips) CS_MODE_MIPS64 = CS_MODE_64, // Mips64 ISA (Mips) } cs_mode;

// basic_capstone_linear /* Linearly disassemble a given binary using Capstone. */ #include <stdio.h> #include <string> //#include <capstone/capstone.h> #include "../inc/loader.h" // 캡스톤 해더를 로더 안에서 받아서 사용 int disasm(Binary *bin) { csh dis; cs_insn *insns; Section *text; size_t n; text = bin->get_text_section(); if(!text) { fprintf(stderr, "Nothing to disassemble\n"); return 0; } if(cs_open(bin->csarch, bin->csmode, &dis) != CS_ERR_OK) { // 변경 fprintf(stderr, "Failed to open Capstone\n"); return -1; }

#ifndef LOADER_H #define LOADER_H #include <stdint.h> #include <string> #include <vector> #include <capstone/capstone.h> // 추가함 ... class Binary { public: enum BinaryType { BIN_TYPE_AUTO = 0, BIN_TYPE_ELF = 1, BIN_TYPE_PE = 2 }; // 기존의 arch, mode 타입을 삭제하고 capstone에서 사용하는 타입으로 통일 Binary() : type(BIN_TYPE_AUTO), csarch(CS_ARCH_ALL), csmode(CS_MODE_LITTLE_ENDIAN), entry(0) {} Section *get_text_section() { for(auto &s : sections) if(s.name == ".text") return &s; return NULL; } std::string filename; BinaryType type; std::string type_str; cs_arch csarch; std::string arch_str; cs_mode csmode; uint64_t entry; std::vector<Section> sections; std::vector<Symbol> symbols; };

static int load_binary_bfd(std::string &fname, Binary *bin, Binary::BinaryType type) { int ret; bfd *bfd_h; const bfd_arch_info_type *bfd_info; bfd_h = NULL; bfd_h = open_bfd(fname); if(!bfd_h) { goto fail; } bin->filename = std::string(fname); bin->entry = bfd_get_start_address(bfd_h); bin->type_str = std::string(bfd_h->xvec->name); switch(bfd_h->xvec->flavour) { case bfd_target_elf_flavour: 228,3 70% switch(bfd_h->xvec->flavour) { case bfd_target_elf_flavour: bin->type = Binary::BIN_TYPE_ELF; break; case bfd_target_coff_flavour: bin->type = Binary::BIN_TYPE_PE; break; case bfd_target_unknown_flavour: default: fprintf(stderr, "unsupported binary type (%s)\n", bfd_h->xvec->name); goto fail; } bfd_info = bfd_get_arch_info(bfd_h); bin->arch_str = std::string(bfd_info->printable_name); switch(bfd_info->mach) { case bfd_mach_i386_i386: bin->csarch = Binary::CS_ARCH_X86; bin->csmode = Binary::CS_MODE_32; break; case bfd_mach_x86_64: bin->csarch = Binary::CS_ARCH_X86; bin->csmode = Binary::CS_MODE_64; break; default: fprintf(stderr, "unsupported architecture (%s)\n", bfd_info->printable_name); goto fail; } /* Symbol handling is best-effort only (they may not even be present) */ load_symbols_bfd(bfd_h, bin); load_dynsym_bfd(bfd_h, bin); if(load_sections_bfd(bfd_h, bin) < 0) goto fail; ret = 0; goto cleanup; fail: ret = -1; cleanup: if(bfd_h) bfd_close(bfd_h); return ret; }

objdump -d ori_alignment 0000000000400526 <main>: 400526: 55 push %rbp 400527: 48 89 e5 mov %rsp,%rbp 40052a: bf d4 05 40 00 mov $0x4005d4,%edi 40052f: e8 cc fe ff ff callq 400400 <puts@plt> 400534: bf ec 05 40 00 mov $0x4005ec,%edi 400539: e8 c2 fe ff ff callq 400400 <puts@plt> 40053e: b8 00 00 00 00 mov $0x0,%eax 400543: 5d pop %rbp 400544: c3 retq 400545: 66 2e 0f 1f 84 00 00 nopw %cs:0x0(%rax,%rax,1) 40054c: 00 00 00 40054f: 90 nop

./basic_capstone_linear a.out 0x0000000000400526: 55 push rbp 0x0000000000400527: 48 89 e5 mov rbp, rsp 0x000000000040052a: bf d4 05 40 00 mov edi, 0x4005d4 0x000000000040052f: e8 cc fe ff ff call 0x400400 0x0000000000400534: eb 01 jmp 0x400537 0x0000000000400536: e8 bf ec 05 40 call 0x4045f1fa // 처음 깨진 라인 A 0x000000000040053b: 00 e8 add al, ch // A2 0x000000000040053d: bf fe ff ff b8 mov edi, 0xb8fffffe // A3 0x0000000000400542: 00 00 add byte ptr [rax], al // A4 0x0000000000400544: 00 00 add byte ptr [rax], al // A5 0x0000000000400546: 5d pop rbp 0x0000000000400547: c3 ret

0x00000000004005f6: 55 push rbp 0x00000000004005f7: 48 89 e5 mov rbp, rsp 0x00000000004005fa: 89 7d ec mov dword ptr [rbp - 0x14], edi 0x00000000004005fd: c7 45 fc 00 00 00 00 mov dword ptr [rbp - 4], 0 0x0000000000400604: 8b 45 ec mov eax, dword ptr [rbp - 0x14] 0x0000000000400607: 83 f8 00 cmp eax, 0 0x000000000040060a: 0f 85 02 00 00 00 jne 0x400612 0x0000000000400610: 83 f0 04 xor eax, 4 0x0000000000400613: 04 90 add al, 0x90 0x0000000000400615: 89 45 fc mov dword ptr [rbp - 4], eax 0x0000000000400618: 8b 45 fc mov eax, dword ptr [rbp - 4] 0x000000000040061b: 5d pop rbp 0x000000000040061c: c3 ret

int disasm(Binary *bin) { csh dis; cs_insn *insns; Section *text; size_t n; text = bin->get_text_section(); if(!text) { fprintf(stderr, "Nothing to disassemble\n"); return 0; } if(cs_open(bin->csarch, bin->csmode, &dis) != CS_ERR_OK) { fprintf(stderr, "Failed to open Capstone\n"); return -1; } n = cs_disasm(dis, text->bytes, text->size, text->vma, 0, &insns); if(n <= 0) { fprintf(stderr, "Disassembly error: %s\n", cs_strerror(cs_errno(dis))); return -1; } for(size_t i = 0; i < n; i++) { printf("0x%016jx: ", insns[i].address); for(size_t j = 0; j < 16; j++) { if(j < insns[i].size)printf("%02x ", insns[i].bytes[j]); else printf(" "); } printf("%-12s %s\n", insns[i].mnemonic, insns[i].op_str);// 해당 부분 밑으로 추가 if(insns[i].mnemonic[0] == 'j' && insns[i].mnemonic[1] != 'm') { if(insns[i].op_str[0] == '0' && insns[i].op_str[1] == 'x') { uint64_t addr = (uint64_t)strtol(insns[i].op_str,NULL,0); for(size_t fi = i; fi < n; fi++){ if(insns[fi+1].address > addr){ if(insns[fi].address < addr) { char wrongstring[45] = "\t[Instruction Overlapping Detection!]"; strcat(insns[fi].op_str,wrongstring); break; } } } } } } cs_free(insns, n); cs_close(&dis); return 0; } ./basic_capstone_linear overlapping_bb 0x00000000004005eb: 48 89 e5 mov rbp, rsp 0x00000000004005ee: ff d0 call rax 0x00000000004005f0: 5d pop rbp 0x00000000004005f1: e9 7a ff ff ff jmp 0x400570 0x00000000004005f6: 55 push rbp 0x00000000004005f7: 48 89 e5 mov rbp, rsp 0x00000000004005fa: 89 7d ec mov dword ptr [rbp - 0x14], edi 0x00000000004005fd: c7 45 fc 00 00 00 00 mov dword ptr [rbp - 4], 0 0x0000000000400604: 8b 45 ec mov eax, dword ptr [rbp - 0x14] 0x0000000000400607: 83 f8 00 cmp eax, 0 0x000000000040060a: 0f 85 02 00 00 00 jne 0x400612 0x0000000000400610: 83 f0 04 xor eax, 4 [Instruction Overlapping Detection!] 0x0000000000400613: 04 90 add al, 0x90 0x0000000000400615: 89 45 fc mov dword ptr [rbp - 4], eax 0x0000000000400618: 8b 45 fc mov eax, dword ptr [rbp - 4] 0x000000000040061b: 5d pop rbp 0x000000000040061c: c3 ret 0x000000000040061d: 55 push rbp 0x000000000040061e: 48 89 e5 mov rbp, rsp 0x0000000000400621: 48 83 ec 10 sub rsp, 0x10 0x0000000000400625: 89 7d fc mov dword ptr [rbp - 4], edi 0x0000000000400628: 48 89 75 f0 mov qword ptr [rbp - 0x10], rsi

#define IMAGE_FILE_MACHINE_UNKNOWN 0 #define IMAGE_FILE_MACHINE_I386 0x014c // Intel 386. #define IMAGE_FILE_MACHINE_R3000 0x0162 // MIPS little-endian, 0x160 big-endian #define IMAGE_FILE_MACHINE_R4000 0x0166 // MIPS little-endian #define IMAGE_FILE_MACHINE_R10000 0x0168 // MIPS little-endian #define IMAGE_FILE_MACHINE_WCEMIPSV2 0x0169 // MIPS little-endian WCE v2 #define IMAGE_FILE_MACHINE_ALPHA 0x0184 // Alpha_AXP #define IMAGE_FILE_MACHINE_SH3 0x01a2 // SH3 little-endian #define IMAGE_FILE_MACHINE_SH3DSP 0x01a3 #define IMAGE_FILE_MACHINE_SH3E 0x01a4 // SH3E little-endian #define IMAGE_FILE_MACHINE_SH4 0x01a6 // SH4 little-endian #define IMAGE_FILE_MACHINE_SH5 0x01a8 // SH5 #define IMAGE_FILE_MACHINE_ARM 0x01c0 // ARM Little-Endian #define IMAGE_FILE_MACHINE_THUMB 0x01c2 #define IMAGE_FILE_MACHINE_AM33 0x01d3 #define IMAGE_FILE_MACHINE_POWERPC 0x01F0 // IBM PowerPC Little-Endian #define IMAGE_FILE_MACHINE_POWERPCFP 0x01f1 #define IMAGE_FILE_MACHINE_IA64 0x0200 // Intel 64 #define IMAGE_FILE_MACHINE_MIPS16 0x0266 // MIPS #define IMAGE_FILE_MACHINE_ALPHA64 0x0284 // ALPHA64 #define IMAGE_FILE_MACHINE_MIPSFPU 0x0366 // MIPS #define IMAGE_FILE_MACHINE_MIPSFPU16 0x0466 // MIPS #define IMAGE_FILE_MACHINE_AXP64 IMAGE_FILE_MACHINE_ALPHA64 #define IMAGE_FILE_MACHINE_TRICORE 0x0520 // Infineon #define IMAGE_FILE_MACHINE_CEF 0x0CEF #define IMAGE_FILE_MACHINE_EBC 0x0EBC // EFI Byte Code #define IMAGE_FILE_MACHINE_AMD64 0x8664 // AMD64 (K8) #define IMAGE_FILE_MACHINE_M32R 0x9041 // M32R little-endian #define IMAGE_FILE_MACHINE_CEE 0xC0EE