TWCTF 2017-swap-writeup

TWCTF 2017-swap-writeup
PLT GOT

分析

chybeta@ubuntu:~/pwn/ctf/twctf$ ./swap
==============================================
1. Set addrsses
2. Swap both addrress of value
0. Exit
Your choice:

程序有三个功能。选1是设置两个地址，选2是交换两个地址上的值，选0是退出。用IDA反汇编后。

main函数 ：

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // eax@2
  void *v4; // rax@6
  void *v5; // rax@6
  void *src; // [sp+20h] [bp-20h]@0
  void *v7; // [sp+28h] [bp-18h]@0
  char dest; // [sp+30h] [bp-10h]@7
  __int64 v9; // [sp+38h] [bp-8h]@1

  v9 = *MK_FP(__FS__, 40LL);
  initialize(*(_QWORD *)&argc, argv, envp);
  while ( 1 )
  {
    while ( 1 )
    {
      print_menu(*(_QWORD *)&argc);
      v3 = read_int(*(_QWORD *)&argc);
      if ( v3 != 1 )
        break;
      puts("Please input 1st addr");
      LODWORD(v4) = read_ll("Please input 1st addr");
      src = v4;
      *(_QWORD *)&argc = "Please input 2nd addr";
      puts("Please input 2nd addr");
      LODWORD(v5) = read_ll("Please input 2nd addr");
      v7 = v5;
    }
    if ( v3 == 2 )
    {
      memcpy(&dest, src, 8uLL);
      memcpy(src, v7, 8uLL);
      *(_QWORD *)&argc = v7;
      memcpy(v7, &dest, 8uLL);
    }
    else if ( !v3 )
    {
      puts("Bye.");
      exit(0);
    }
  }
}

其中有个read_ll()，反汇编后代码为：

__int64 read_ll()
{
  __int64 result; // rax@1
  __int64 v1; // rcx@1
  char buf; // [sp+10h] [bp-110h]@1
  __int64 v3; // [sp+118h] [bp-8h]@1

  v3 = *MK_FP(__FS__, 40LL);
  read(0, &buf, 0x20uLL);
  result = atoll(&buf);
  v1 = *MK_FP(__FS__, 40LL) ^ v3;
  return result;
}

exp

晚上写完后再贴上来hh