{"id":1974,"date":"2024-03-08T10:45:10","date_gmt":"2024-03-08T01:45:10","guid":{"rendered":"https:\/\/h4ck.kr\/?p=1974"},"modified":"2024-05-20T13:27:52","modified_gmt":"2024-05-20T04:27:52","slug":"imageprc","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=1974","title":{"rendered":"ImagePrc"},"content":{"rendered":"\n

Exeinfo PE<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

Analysis<\/h2>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\uadf8\ub9bc\uc744 \uadf8\ub9b4 \uc218 \uc788\uace0, Check \ubc84\ud2bc\uc744 \ub204\ub974\uba74 \uc62c\ubc14\ub978 \uadf8\ub9bc\uc778\uc9c0 \ud655\uc778\ud558\ub294 \ud504\ub85c\uadf8\ub7a8\uc778 \ub4ef \ud558\ub2e4.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

Wrong\uc744 \ub744\uc6b0\ub294 \ubb38\uc790\uc5f4\uc744 \uc5ed\ucc38\uc870\ud574\uc11c,
Wrong\uc744 \ub744\uc6b0\ub294 \uba54\uc2dc\uc9c0 \ubc15\uc2a4\ub97c \ud638\ucd9c\ud558\ub294 \uc8fc\uc18c\uc5d0 \ube0c\ub808\uc774\ud06c \ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4\uc8fc\uc5c8\ub2e4.<\/p>\n\n\n\n

\uc774\uc81c Check \ubc84\ud2bc\uc744 \ub204\ub974\uba74, \uac70\uae30\uc11c \uba48\ucd9c \uac83\uc774\ub2e4.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\ub192\uc774 150, \ub108\ube44 200\uc778 24\ube44\ud2b8\ub9f5\uc5d0\uc11c \ube44\ud2b8\uc5f4\uc744 \ubf51\uc544\ub0b4\uc11c
\uc9c0\uc815\ub41c \ud3ec\ub9f7\uc744 \uc0ac\uc6a9\ud558\ub294 DIB\ub85c \ubc84\ud37c\uc5d0 \ubcf5\uc0ac\ud558\ub294 GetDIBits \ud568\uc218\ub97c \ud1b5\ud574 \ub370\uc774\ud130\ub97c \uac00\uc838\uc628\ub2e4.<\/p>\n\n\n\n

while \ubb38\uc5d0\uc11c \uadf8\ub9bc\uc744 \ube44\ud2b8 \ud558\ub098\uc529 \ube44\uad50\ud558\uace0,
if (v12 >= 0x15F90)\uc5d0\uc11c 0x15f90\uc740 \ube44\ud2b8\ub9f5 \ub370\uc774\ud130\uc758 \ub05d\uc744 \uc758\ubbf8\ud55c\ub2e4.<\/p>\n\n\n\n

while \ubb38\uc5d0 \ub4e4\uc5b4\uc788\ub294 \ub514\uc2a4\uc5b4\uc148\ube14\ub7ec \ucf54\ub4dc\ub97c \uc0b4\ud3b4\ubcf4\uba74,<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\uc774\ub807\uac8c cmp \uba85\ub839\uc5b4\ub97c \ud1b5\ud574 \ube44\ud2b8 \ud558\ub098\uc529 \ube44\uad50\ub97c \ud558\uace0 \uc788\ub2e4.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\ub514\ubc84\uae45\ud588\uc744\ub54c,
[ecx]=0x4a90048<\/strong>,
[eax+ecx]=(0xfb9ee018+0x4a90048)&0xffffffff=0x47e060<\/strong><\/p>\n\n\n\n

0x4a90048\uc5d0\uc11c 0x15f90\uc744 \ub354\ud55c 0x4aa5fd8\uae4c\uc9c0,
0x47e060\uc5d0\uc11c 0x15f90\uc744 \ub354\ud55c 0x493ff0\uae4c\uc9c0,<\/p>\n\n\n\n

\uac01\uac01 \ub364\ud504\ub97c \ub5a0\uc11c \ube44\ud2b8\ub9f5\uc744 \ud655\uc778\ud574\ubcf8\uacb0\uacfc,<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\ube44\uad50\ud558\ub294 \uadf8\ub9bc\uc740 47e060\uc5d0\uc11c \ub364\ud504\ub72c bmp \ud30c\uc77c\uc774\uc5c8\ub2e4.<\/p>\n\n\n\n

\ub364\ud504\ub5a0\uc11c bmp \ud30c\uc77c\uc744 \ud655\uc778\ud558\ub294 \ubc29\ubc95\uc740 <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\uadf8\ub9bc\ud310\uc5d0\uc11c \uc138\ub85c 150, \uac00\ub85c 200\uc778 24\ube44\ud2b8 \uc774\ubbf8\uc9c0 \ud30c\uc77c\uc744 \ub9cc\ub4e0\ub2e4\uc74c,
lines[150]\uc5d0 \uc788\ub294 \ub370\uc774\ud130\ub9cc \uc9c0\uc6b0\uace0, header\uc640 info\ub294 \uc720\uc9c0\ud55c\ucc44
\ub364\ud504\ub72c \ub370\uc774\ud130\ub97c \ubd99\uc5ec\ub123\uc73c\uba74 bmp \ud30c\uc77c\uc744 \uc5f4\uc5b4\uc11c \ud655\uc778\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n

FLAG<\/h2>\n\n\n\n

GOT<\/strong><\/p>\n","protected":false},"excerpt":{"rendered":"

Exeinfo PE Analysis \uadf8\ub9bc\uc744 \uadf8\ub9b4 \uc218 \uc788\uace0, Check \ubc84\ud2bc\uc744 \ub204\ub974\uba74 \uc62c\ubc14\ub978 \uadf8\ub9bc\uc778\uc9c0 \ud655\uc778\ud558\ub294 \ud504\ub85c\uadf8\ub7a8\uc778 \ub4ef \ud558\ub2e4. Wrong\uc744 \ub744\uc6b0\ub294 \ubb38\uc790\uc5f4\uc744 \uc5ed\ucc38\uc870\ud574\uc11c,Wrong\uc744 \ub744\uc6b0\ub294 \uba54\uc2dc\uc9c0 \ubc15\uc2a4\ub97c \ud638\ucd9c\ud558\ub294 \uc8fc\uc18c\uc5d0 \ube0c\ub808\uc774\ud06c \ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4\uc8fc\uc5c8\ub2e4. \uc774\uc81c Check \ubc84\ud2bc\uc744 \ub204\ub974\uba74, \uac70\uae30\uc11c \uba48\ucd9c \uac83\uc774\ub2e4. \ub192\uc774 150, \ub108\ube44 200\uc778 24\ube44\ud2b8\ub9f5\uc5d0\uc11c \ube44\ud2b8\uc5f4\uc744 \ubf51\uc544\ub0b4\uc11c\uc9c0\uc815\ub41c \ud3ec\ub9f7\uc744 \uc0ac\uc6a9\ud558\ub294 DIB\ub85c \ubc84\ud37c\uc5d0 \ubcf5\uc0ac\ud558\ub294 GetDIBits \ud568\uc218\ub97c \ud1b5\ud574 \ub370\uc774\ud130\ub97c \uac00\uc838\uc628\ub2e4. while \ubb38\uc5d0\uc11c \uadf8\ub9bc\uc744… \ub354 \ubcf4\uae30 »ImagePrc<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[16],"tags":[24],"class_list":["post-1974","post","type-post","status-publish","format-standard","hentry","category-reversing-kr","tag-reversing"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1974","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1974"}],"version-history":[{"count":2,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1974\/revisions"}],"predecessor-version":[{"id":1987,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1974\/revisions\/1987"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1974"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1974"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1974"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}