{"id":2558,"date":"2024-05-31T08:15:41","date_gmt":"2024-05-30T23:15:41","guid":{"rendered":"https:\/\/h4ck.kr\/?p=2558"},"modified":"2024-06-04T10:05:02","modified_gmt":"2024-06-04T01:05:02","slug":"arm64-%ed%99%98%ea%b2%bd%ec%97%90%ec%84%9c-rop-jop-%ea%b3%b5%ea%b2%a9-%ec%9d%b4%ed%95%b4%ed%95%98%ea%b8%b0-%ec%9e%91%ec%84%b1-%ec%a4%91","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=2558","title":{"rendered":"arm64 \ud658\uacbd\uc5d0\uc11c rop, jop \uacf5\uaca9 \uc774\ud574\ud558\uae30"},"content":{"rendered":"\n

\uc774\ubc88 \uc2dc\uac04\uc5d0\ub294 rop, jop \uacf5\uaca9\uc744 \uc774\ud574\ud558\uae30 \uc704\ud574 \uc544\ub798 \ud504\ub85c\uc81d\ud2b8\ub97c \ud65c\uc6a9\ud558\uc5ec
\uc9c1\uc811 \ub514\ubc84\uae45\ud558\uba74\uc11c \uc2a4\ud0dd \ud504\ub808\uc784\uc774 \uc0dd\uaca8\uc9c0\ub294 \uacfc\uc815\uacfc \uac01 \uba85\ub839\uc5b4 \uc758\ubbf8, \uac01 \ubc94\uc6a9 \ub808\uc9c0\uc2a4\ud130\ub4e4\uc774 \uc5b4\ub5bb\uac8c \ud65c\uc6a9\ub418\ub294\uc9c0 \uc54c\uc544\ubcfc \uac83\uc774\ub2e4.<\/p>\n\n\n\n

https:\/\/github.com\/geesun\/arm64_rop_jop<\/a><\/p>\n\n\n\n

ROP<\/h1>\n\n\n\n

1. \uc2a4\ud0dd \ud504\ub808\uc784 \ud615\uc131 \ubc0f \uac01 \uba85\ub839\uc5b4 \uc218\ud589 \uacfc\uc815 \uc774\ud574\ud558\uae30<\/h2>\n\n\n\n

main<\/h3>\n\n\n\n
\n
peda-arm > disas main\nDump of assembler code for function main:\n   0x0000000000400464 <+0>:\tstp\tx29, x30, [sp, #-16]!\n   0x0000000000400468 <+4>:\tmov\tx29, sp\n   0x000000000040046c <+8>:\tbl\t0x40041c <rop_bad_func>\n   0x0000000000400470 <+12>:\tmov\tw0, #0x0                   \t\/\/ #0\n   0x0000000000400474 <+16>:\tldp\tx29, x30, [sp], #16\n   0x0000000000400478 <+20>:\tret\nEnd of assembler dump.<\/pre>\n\n\n\n
\ucf54\ub4dc<\/h3>\n<\/div><\/div>\n\n\n\n
\n
int main()\n{<\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400464 <+0>:\tstp\tx29, x30, [sp, #-16]!<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
x29 \ub808\uc9c0\uc2a4\ud130<\/strong>
\ud504\ub808\uc784 \ud3ec\uc778\ud130 \ub808\uc9c0\uc2a4\ud130\ub85c, \uc2a4\ud0dd \ud504\ub808\uc784\uc744 \ucd94\uc801\ud560 \ub54c \uc0ac\uc6a9\ub41c\ub2e4.
\ud568\uc218\uac00 \ud638\ucd9c\ub418\uc5b4 \uc0c8\ub85c\uc6b4 \uc2a4\ud0dd \ud504\ub808\uc784\uc774 \uc0dd\uc131\ub420 \ub54c, x29 \ub808\uc9c0\uc2a4\ud130\uac00 \uc2a4\ud0dd\uc5d0 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n
x30 \ub808\uc9c0\uc2a4\ud130<\/strong>
lr \ub9c1\ud06c \ub808\uc9c0\uc2a4\ud130\ub85c, BL\/BLR \uba85\ub839\uc5d0 \uc758\ud574 \ub2e4\ub978 \uc8fc\uc18c\ub85c \ubd84\uae30\ub420 \ub54c 
pc \ub808\uc9c0\uc2a4\ud130\uac12\uc744 \uc774 \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc800\uc7a5\ud55c\ub2e4.
\uc774\uc804 \ud568\uc218\ub85c \ub3cc\uc544\uac00\uae30 \uc704\ud55c \uc8fc\uc18c\uac00 \ub2f4\uaca8\uc788\ub2e4\uace0 \ubcf4\uba74 \ub41c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c, \ud604\uc7ac \ud568\uc218\uc758 \ud504\ub808\uc784\uc744 \uc0dd\uc131\uc2dc\ud0a4\uae30 \uc704\ud55c \uc900\ube44 \uc791\uc5c5\uc73c\ub85c, 
\uc774\uc804 \ud568\uc218\uc758 \ud504\ub808\uc784 \ud3ec\uc778\ud130 \uc8fc\uc18c\uc778 x29 \ub808\uc9c0\uc2a4\ud130\uac12\uacfc 
\uc774\uc804 \ud568\uc218\ub85c \ub418\ub3cc\uc544\uac00\uae30 \uc704\ud55c \ubcf5\uadc0 \uc8fc\uc18c\ub97c \uc758\ubbf8\ud558\ub294 x30 \ub808\uc9c0\uc2a4\ud130\uac12\uc774 \uc2a4\ud0dd\uc5d0 \uc800\uc7a5\ud558\ub294\ub370,
\uc774\ub54c \uc800\uc7a5\ud558\uae30 \uc704\ud574 16\ubc14\uc774\ud2b8 \uacf5\uac04\uc744 \uba3c\uc800 \ub298\ub9ac\uace0 \uc9c4\ud589\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400468 <+4>:\tmov\tx29, sp<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
\ud604\uc7ac \uc2a4\ud0dd \ud3ec\uc778\ud130\ub97c \uc758\ubbf8\ud558\ub294 sp \ub808\uc9c0\uc2a4\ud130 \uac12\uc744 \ud504\ub808\uc784 \ud3ec\uc778\ud130\ub97c \uc758\ubbf8\ud558\ub294 x29 \ub808\uc9c0\uc2a4\ud130\ub85c \ubcf5\uc0ac\ud55c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c, \ud604\uc7ac \ud568\uc218\uc758 \uc0c8\ub85c\uc6b4 \ud504\ub808\uc784 \ud3ec\uc778\ud130\ub97c \uc124\uc815\ud558\uae30 \uc704\ud55c \ubaa9\uc801\uc73c\ub85c, \ud574\ub2f9 \uba85\ub839\uc5b4\uac00 \uc874\uc7ac\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
rop_bad_func();<\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x000000000040046c <+8>:\tbl\t0x40041c <rop_bad_func><\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
BL (Branch with Link)<\/strong> <rop_bad_func><\/p>\n\n\n\n
\ub0b4\ubd80\uc801\uc73c\ub85c \uc544\ub798\uc640 \uac19\uc774 \uc218\ud589\ub41c\ub2e4.
(1) mov lr, = next instruction (pc)
(2) mov pc, =dest<\/p>\n\n\n\n
BL \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 rop_bad_func \ud568\uc218\uac00 \ud638\ucd9c\ub418\uace0 \ub09c\ub4a4\uc5d0 lr \ub808\uc9c0\uc2a4\ud130\uc5d0 \ub2e4\uc2dc main \ud568\uc218\ub85c \ub418\ub3cc\uc544\uac08 \ubcf5\uadc0 \uc8fc\uc18c\uac00 \uc800\uc7a5\ub418\uace0,
rop_bad_func \ud568\uc218\ub85c \ubd84\uae30\ub418\uc5b4, \uadf8 \ud568\uc218\uc758 \uc8fc\uc18c\ub85c pc \uac12\uc774 \ubc14\ub00c\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n
\uc5ec\uae30\uc11c pc \ub808\uc9c0\uc2a4\ud130\ub294 \ud504\ub85c\uadf8\ub7a8 \uce74\uc6b4\ud130\ub85c, \ub2e4\uc74c \uba85\ub839\uc744 \uac00\ub9ac\ud0a4\uac8c \uc0ac\uc6a9\ub41c\ub2e4.
x86_64 \uc544\ud0a4\ud14d\ucc98\uc5d0 \uc0ac\uc6a9\ub418\ub294 RIP \ub808\uc9c0\uc2a4\ud130 \uc0ac\uc6a9 \uc6a9\ub3c4\uc640 \ube44\uc2b7\ud558\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
void rop_bad_func()\n{<\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x000000000040041c <+0>:\tstp\tx29, x30, [sp, #-48]!\n0x0000000000400420 <+4>:\tmov\tx29, sp<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/strong><\/h3>\n\n\n\n
\ub2e4\uc2dc \ud55c\ubc88 \ub354 \ud504\ub808\uc784\uc744 \uc0dd\uc131\uc2dc\ud0a4\uae30 \uc704\ud55c \uc900\ube44 \uc791\uc5c5\uc73c\ub85c, \uc2a4\ud0dd \ud3ec\uc778\ud130 sp\ub97c 48\ub9cc\ud07c \ube7c\uc11c \uadf8\ub9cc\ud07c \uc2a4\ud0dd \uacf5\uac04\uc744 \ud655\uc7a5\uc2dc\ud0a8\ub2e4.
main \ud568\uc218\uc5d0\uc11c\uc758 \ud504\ub808\uc784 \ud3ec\uc778\ud130 \uc8fc\uc18c\uc640 main \ud568\uc218\ub85c \ubcf5\uadc0\ud558\uae30 \uc704\ud55c \uc8fc\uc18c\uac00 \uc2a4\ud0dd\uc5d0 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n
\ub610, mov x29, sp \uba85\ub839\uc5b4\uc5d0 \uc758\ud574
\ud604\uc7ac rop_bad_func \ud568\uc218\uc758 \uc0c8\ub85c\uc6b4 \ud504\ub808\uc784 \ud3ec\uc778\ud130\ub97c \uc124\uc815\ud558\uae30 \uc704\ud55c \ubaa9\uc801\uc73c\ub85c, 
sp \ub808\uc9c0\uc2a4\ud130\uac12\uc744 x29 \ub808\uc9c0\uc2a4\ud130\ub85c \ubcf5\uc0ac\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
rop_bad_func<\/strong><\/h3>\n\n\n\n
\n
peda-arm > disas rop_bad_func\nDump of assembler code for function rop_bad_func:\n   0x000000000040041c <+0>:\tstp\tx29, x30, [sp, #-48]!\n   0x0000000000400420 <+4>:\tmov\tx29, sp\n   0x0000000000400424 <+8>:\tstp\txzr, xzr, [x29, #24]\n   0x0000000000400428 <+12>:\tstr\txzr, [x29, #16]\n   0x000000000040042c <+16>:\tstr\twzr, [x29, #44]\n   0x0000000000400430 <+20>:\tadrp\tx0, 0x450000 <_nl_locale_subfreeres+440>\n   0x0000000000400434 <+24>:\tadd\tx0, x0, #0x5c0\n   0x0000000000400438 <+28>:\tmov\tw1, #0x0\n   0x000000000040043c <+32>:\tbl\t0x418de0 <open64>\n   0x0000000000400440 <+36>:\tstr\tw0, [x29, #44]\n   0x0000000000400444 <+40>:\tadd\tx0, x29, #0x10\n   0x0000000000400448 <+44>:\tmov\tx2, #0x200\n   0x000000000040044c <+48>:\tmov\tx1, x0\n   0x0000000000400450 <+52>:\tldr\tw0, [x29, #44]\n   0x0000000000400454 <+56>:\tbl\t0x418fd8 <read>\n   0x0000000000400458 <+60>:\tnop\n   0x000000000040045c <+64>:\tldp\tx29, x30, [sp], #48\n   0x0000000000400460 <+68>:\tret<\/pre>\n<\/div><\/div>\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
char data[16] = {0}; <\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400424 <+8>:\tstp\txzr, xzr, [x29, #24]<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
STP \uba85\ub839\uc5b4\ub294 Store Pair of Registers\ub85c,
\ub808\uc9c0\uc2a4\ud130\ub97c \uc30d\uc73c\ub85c \uc800\uc7a5, \uc989 \ub450 \ub808\uc9c0\uc2a4\ud130\ub97c \uc5f0\uc18d\ub41c \uba54\ubaa8\ub9ac \uc704\uce58\uc5d0 \uc800\uc7a5\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c, x29 \ud504\ub808\uc784\ud3ec\uc778\ud130\ub85c\ubd80\ud130 24\ubc14\uc774\ud2b8, 32\ubc14\uc774\ud2b8 \ub5a8\uc5b4\uc9c4 \uc8fc\uc18c\uc5d0 \uac01\uac01 0\uc73c\ub85c \uac12\uc744 \uc9c0\uc815\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
unsigned long long u64 = 0; <\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400428 <+12>:\tstr\txzr, [x29, #16]<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
STR \uba85\ub839\uc5b4\ub294 Store, \uc989 \ub808\uc9c0\uc2a4\ud130\uc758 \uac12\uc744 \uba54\ubaa8\ub9ac\uc5d0 \uc800\uc7a5\ud558\ub77c\ub294 \uc758\ubbf8\uc774\ub2e4.<\/p>\n\n\n\n
x29 \ud504\ub808\uc784 \ud3ec\uc778\ud130\ub85c\ubd80\ud130 16\ubc14\uc774\ud2b8 \ub5a8\uc5b4\uc9c4 \uc704\uce58\uc5d0 \uac12\uc744 0\uc73c\ub85c \uc800\uc7a5\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
int fd = 0;<\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x000000000040042c <+16>:\tstr\twzr, [x29, #44]<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/strong><\/h3>\n\n\n\n
WZR\uc740 4\ubc14\uc774\ud2b8 \ud0c0\uc785\uc758 \uc81c\ub85c \ub808\uc9c0\uc2a4\ud130\ub97c \uc758\ubbf8\ud55c\ub2e4.<\/p>\n\n\n\n
x29 \ud504\ub808\uc784\ud3ec\uc778\ud130\ub85c\ubd80\ud130 44\ubc14\uc774\ud2b8 \ub5a8\uc5b4\uc9c4 \uc704\uce58\uc5d0 4\ubc14\uc774\ud2b8 \ud0c0\uc785\uc758 0\uac12\uc744 \uc800\uc7a5\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400430 <+20>:\tadrp\tx0, 0x450000 <_nl_locale_subfreeres+440>\n0x0000000000400434 <+24>:\tadd\tx0, x0, #0x5c0<\/pre>\n<\/div><\/div>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
ADRP \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 x0 \ub808\uc9c0\uc2a4\ud130\uc5d0 0x450000 \ud398\uc774\uc9c0 \uc8fc\uc18c\uac00 \uc800\uc7a5\ub418\uae30\uc5d0, x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 0x450000\uc774 \ub41c\ub2e4.
\uc5ec\uae30\uc11c ADD \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 0x5c0 \uac12\uc774 \ub354\ud574\uc838, x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 0x4505c0\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400438 <+28>:\tmov\tw1, #0x0<\/pre>\n<\/div><\/div>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
O_RDONLY\ub97c \uc758\ubbf8\ud558\ub294 1\uc774 w1 \ub808\uc9c0\uc2a4\ud130 \uac12\uc73c\ub85c \uc9c0\uc815\ub41c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x000000000040043c <+32>:\tbl\t0x418de0 <open64><\/pre>\n<\/div><\/div>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
open \ud568\uc218\ub97c \ud638\ucd9c\ud558\uae30 \uc704\ud574 BL \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 \ubd84\uae30\ub41c\ub2e4.<\/p>\n\n\n\n
\uc5ec\uae30\uc11c \uc54c\uc544\uc57c\ub420 \uc810\uc740 \ub9e4\uac1c\ubcc0\uc218\uac00 \uccab \uc5ec\ub35f \uac1c\uae4c\uc9c0\ub294  x0<\/code>\ubd80\ud130 x7<\/code> \ub808\uc9c0\uc2a4\ud130\ub97c \ud1b5\ud574 \uc804\ub2ec\ub418\uace0, 
\ucd94\uac00 \ub9e4\uac1c\ubcc0\uc218\ub294 \uc2a4\ud0dd\uc744 \ud1b5\ud574\uc11c \uc804\ub2ec\ub41c\ub2e4\uace0 \ud55c\ub2e4.<\/p>\n\n\n\n
\uc2e4\uc81c\ub85c, 
x0\uc740 open \ud568\uc218\uc758 1\ubc88\uc9f8 \ub9e4\uac1c\ubcc0\uc218\ub85c\uc368 “.\/rop.data” \ubb38\uc790\uc5f4\uc744 \uac00\ub9ac\ud0a4\ub294 \uc8fc\uc18c\uac00 \ub2f4\uaca8\uc788\uc73c\uba70
x1\uc740 open \ud568\uc218\uc758 2\ubc88\uc9f8 \ub9e4\uac1c\ubcc0\uc218\ub85c\uc368 O_RDONLY\ub97c \uc758\ubbf8\ud558\ub294 1\uc774 \ub2f4\uaca8\uc788\ub2e4.<\/p>\n\n\n\n
\uadf8\ub807\uac8c open \ud568\uc218\uac00 \ud638\ucd9c\ub418\uace0\ub098\uc11c \ubcf5\uadc0\ud558\uba74, \uadf8 \ud568\uc218\uc758 \ub9ac\ud134\uac12\uc774 x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc5d0 \uc800\uc7a5\ub41c\ub2e4. 
(x86_64 \ud658\uacbd\uc5d0\uc11c\uc758 \ud568\uc218 \ub9ac\ud134\uac12\uc774 rax \ub808\uc9c0\uc2a4\ud130\ub85c \uc800\uc7a5\ub418\ub294 \uac83\uacfc \ube44\uc2b7\ud558\ub2e4.)<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/strong><\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400440 <+36>:\tstr\tw0, [x29, #44]<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
x29 \ud504\ub808\uc784\ud3ec\uc778\ud130\ub85c\ubd80\ud130 44\ubc14\uc774\ud2b8 \ub5a8\uc5b4\uc9c4 \uc704\uce58 (=fd)\uc5d0 
4\ubc14\uc774\ud2b8 \ud0c0\uc785\uc758 w0 \ub808\uc9c0\uc2a4\ud130\uac12\uc778 3 (=open \ub9ac\ud134\uac12)\uc744 \uc800\uc7a5\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
read(fd,&u64,512);<\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400444 <+40>:\tadd\tx0, x29, #0x10\n0x0000000000400448 <+44>:\tmov\tx2, #0x200\n0x000000000040044c <+48>:\tmov\tx1, x0\n0x0000000000400450 <+52>:\tldr\tw0, [x29, #44]\n0x0000000000400454 <+56>:\tbl\t0x418fd8 <read><\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
add x0, x29, #0x10<\/strong>
read \ud568\uc218\uc758 \ub9e4\uac1c\ubcc0\uc218\uc5d0 u64 \ubcc0\uc218\ub97c \uac00\ub9ac\ud0a4\uae30 \uc704\ud574 
x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 x29 \ud504\ub808\uc784\ud3ec\uc778\ud130 \uac12\uc5d0 16\uc744 \ub354\ud55c \uac12\uc774 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n
mov x2, #0x200<\/strong>
read \ud568\uc218\uc758 3\ubc88\uc9f8 \ub9e4\uac1c\ubcc0\uc218\uc5d0 512\ub97c \ub123\uae30 \uc704\ud574
x2 \ub808\uc9c0\uc2a4\ud130 \uac12\uc740 512 \uac12\uc774 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n
mov x1, x0<\/strong>
read \ud568\uc218\uc758 2\ubc88\uc9f8 \ub9e4\uac1c\ubcc0\uc218<\/strong>\uc5d0 u64 \ubcc0\uc218\ub97c \uac00\ub9ac\ud0a4\uae30 \uc704\ud574
x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc744 x1 \ub808\uc9c0\uc2a4\ud130\ub85c \ubcf5\uc0ac\ud55c\ub2e4.<\/p>\n\n\n\n
ldr w0, [x29, #44]<\/strong>
ldr \uba85\ub839\uc5b4\ub294 load register\ub85c, \uba54\ubaa8\ub9ac\uc5d0\uc11c \uac12\uc744 \uc77d\uc5b4\uc640 \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc800\uc7a5\ud558\ub294 \uba85\ub839\uc5b4\uc774\ub2e4.
read \ud568\uc218\uc758 1\ubc88\uc9f8 \ub9e4\uac1c\ubcc0\uc218\uc5d0 fd \uac12\uc744 \ub123\uae30 \uc704\ud574 
x29 \ud504\ub808\uc784\ud3ec\uc778\ud130\uc5d0\uc11c +44\ubc14\uc774\ud2b8\ub9cc\ud07c \ub5a8\uc5b4\uc9c4 \uc704\uce58\uc5d0 \uc788\ub294 32\ube44\ud2b8 \uac12 (fd\uac12)\uc744 \uc77d\uc5b4\uc640\uc11c ‘w0’ \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc800\uc7a5\ud55c\ub2e4.<\/p>\n\n\n\n
bl 0x418fd8 <read><\/strong>
\ub9c8\ucc2c\uac00\uc9c0\ub85c x0, x1, x2 \ub9e4\uac1c\ubcc0\uc218\uc640 \ud568\uaed8 read \ud568\uc218\uac00 \ud638\ucd9c\ub418\uace0 \ub09c\ub4a4\uc5d0 
read \ub9ac\ud134 \uac12\uc774 x0 \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc800\uc7a5\ub418\uace0, x29+16 \uc9c0\uc810(u64)\uc5d0 read \ud568\uc218\ub97c \ud1b5\ud574 \uc77d\uc5b4\uc628 \ubc84\ud37c\uac00 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400458 <+60>:\tnop<\/pre>\n<\/div><\/div>\n\n\n\n
\uc544\ubb34\ub7f0 \ub3d9\uc791\ub3c4 \ud558\uc9c0 \uc54a\ub294 \uba85\ub839\uc5b4\uc774\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
}<\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x000000000040045c <+64>:\tldp\tx29, x30, [sp], #48<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h3>\n\n\n\n
LDP<\/code> \uba85\ub839\uc5b4\ub294 “Load Pair”\ub85c, 
\ub450 \uac1c\uc758 64\ube44\ud2b8 \ub808\uc9c0\uc2a4\ud130 \uac12\uc744 \uba54\ubaa8\ub9ac\uc5d0\uc11c \ud55c \uc30d\uc73c\ub85c \ub85c\ub4dc\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n
\uba3c\uc800, \uc2a4\ud0dd\uc5d0\uc11c \ud504\ub808\uc784 \ud3ec\uc778\ud130 (x29<\/code>)\uc640 \ub9c1\ud06c \ub808\uc9c0\uc2a4\ud130 (x30<\/code>)(=lr) \uac12\uc744 sp+0, +8 \uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\ud558\uc5ec 
\uc774\uc804 \ud568\uc218 \ud638\ucd9c\uc758 \uc0c1\ud0dc\ub97c \ubcf5\uc6d0\ud55c\ub2e4.<\/p>\n\n\n\n
\ub610, \uc2a4\ud0dd \ud3ec\uc778\ud130 sp\ub97c +48 \uc99d\uac00\uc2dc\ucf1c, 
rop_bad_func \ud568\uc218 \ud638\ucd9c \uc804\uc758 \uc2a4\ud0dd \ud3ec\uc778\ud130\uc758 \uc704\uce58\ub85c \ub418\ub3cc\ub9b0\ub2e4.<\/p>\n\n\n\n
<\/p>\n\n\n\n
\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
ret<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
RET \uba85\ub839\uc5b4\ub294 \ub0b4\ubd80\uc801\uc73c\ub85c \uc544\ub798\uc640 \uac19\uc774 \uc218\ud589\ub41c\ub2e4.
mov pc, lr<\/strong><\/p>\n\n\n\n
lr (=x30) \ub808\uc9c0\uc2a4\ud130 \uac12\uc73c\ub85c pc \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc9c0\uc815\ud558\uc5ec
\ub2e4\uc2dc main \ud568\uc218\ub85c \ubcf5\uadc0\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
\ucf54\ub4dc<\/h3>\n\n\n\n
\n
int main()\n{\n...\n\treturn 0;\n}<\/pre>\n<\/div><\/div>\n\n\n\n
\uc5b4\uc148\ube14\ub7ec<\/h3>\n\n\n\n
\n
0x0000000000400470 <+12>:\tmov\tw0, #0x0\n0x0000000000400474 <+16>:\tldp\tx29, x30, [sp], #16\n0x0000000000400478 <+20>:\tret<\/pre>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc124\uba85<\/h2>\n\n\n\n
main \ud568\uc218\uc758 \uc5d0\ud544\ub85c\uadf8 \uc5ed\ud560\uc744 \ud55c\ub2e4.<\/p>\n\n\n\n
mov w0, #0x0<\/strong>
main \ud568\uc218\uc758 \ubc18\ud658 \uac12\uc774 0\uc774\uae30\uc5d0 w0 \ub808\uc9c0\uc2a4\ud130\uac12\uc744 0\uc73c\ub85c \uc9c0\uc815\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n
ldp x29, x30, [sp], #16<\/strong>
\ub9c8\ucc2c\uac00\uc9c0\ub85c, \uba3c\uc800 \uc2a4\ud0dd\uc5d0\uc11c \ud504\ub808\uc784 \ud3ec\uc778\ud130 (x29<\/code>)\uc640 \ub9c1\ud06c \ub808\uc9c0\uc2a4\ud130 (x30<\/code>)(=lr) \uac12\uc744 sp+0, +8 \uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\ud558\uc5ec 
\uc774\uc804 \ud568\uc218 \ud638\ucd9c\uc758 \uc0c1\ud0dc\ub97c \ubcf5\uc6d0\ud55c\ub2e4.
\uadf8 \ub2e4\uc74c, \uc2a4\ud0dd \ud3ec\uc778\ud130 sp\ub97c +16 \uc99d\uac00\uc2dc\ucf1c, 
main \ud568\uc218 \ud638\ucd9c \uc804\uc758 \uc2a4\ud0dd \ud3ec\uc778\ud130\uc758 \uc704\uce58\ub85c \ub418\ub3cc\ub9b0\ub2e4.<\/p>\n\n\n\n
ret<\/strong>
pc \ub808\uc9c0\uc2a4\ud130\uc5d0 lr (=x30) \ub808\uc9c0\uc2a4\ud130 \uac12\uc73c\ub85c \uc9c0\uc815\ud558\uc5ec
main \uc774\uc804 \ud568\uc218\ub85c \ubcf5\uadc0\ud55c\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
2. ROP \uacf5\uaca9 \uc774\ud574\ud558\uae30<\/h2>\n\n\n\n
\n
void rop_bad_func()\n{\n\tchar data[16] = {0}; \n\tunsigned long long u64 = 0; \n\tint fd = 0; \n\tfd = open(\".\/rop.data\",O_RDONLY); \n\tread(fd,&u64,512);\n}<\/pre>\n<\/div><\/div>\n\n\n\n
\ubcf4\ub2e4\uc2dc\ud53c read \ud568\uc218\ub97c \ucf54\ub4dc\ub97c \ubcf4\uba74 \ud560\ub2f9\ub41c 8\ubc14\uc774\ud2b8 \ud06c\uae30\uc758 u64 \ubcc0\uc218\uc5d0 512\ubc14\uc774\ud2b8 \ub9cc\ud07c \uc785\ub825\ubc1b\uc744 \uc218 \uc788\uc5b4
\ubc84\ud37c \uc624\ubc84\ud50c\ub85c\uc6b0 \ucde8\uc57d\uc810\uc774 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n
rop.data \ud30c\uc77c\uc744 open, 
read \ud568\uc218\uac00 \uc218\ud589\ub418\uace0 \ub09c \ub4a4\uc758 \uc2a4\ud0dd\uc744 \uc0b4\ud3b4\ubcf4\uba74 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc6b0\uc120\uc740 main \ud568\uc218\uac00 \ub05d\ub098\uace0 \ub098\uba74, 0x44f02c \uc8fc\uc18c\ub85c \ubcf5\uadc0\ud558\uac8c \ub41c\ub2e4.
0x44f02 \uc5b4\uc148\ube14\ub7ec \ucf54\ub4dc\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n
\n
...\n0x000000000044f02c <+220>:\tldr\tx19, [sp, #16]\n0x000000000044f030 <+224>:\tldp\tx29, x30, [sp], #48\n0x000000000044f034 <+228>:\tret<\/pre>\n<\/div><\/div>\n\n\n\n
0x44f02 \uc8fc\uc18c\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0, 
\uc704 \uc5b4\uc148\ube14\ub9ac \ucf54\ub4dc\uac00 \uc2e4\ud589\ub418\uae30 \uc804\uc758 \uc2a4\ud0dd \uad6c\uc870\ub294 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\n
\uc544\ub798 \uba85\ub839\uc5b4\ub4e4\uc744 \uc218\ud589\ud574\ubcf4\uba74 \uc758\ubbf8\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n
ldr x19, [sp, #16]<\/strong>
sp\uc5d0\uc11c +16\ubc14\uc774\ud2b8\ub9cc\ud07c \ub5a8\uc5b4\uc9c4 \uc704\uce58\uc5d0 \uc788\ub294 0x450d10 \uc8fc\uc18c\uc5d0 \uc788\ub294 \uac12\uc744 \uc77d\uc5b4\uc640\uc11c x19 \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc800\uc7a5\ud55c\ub2e4.<\/p>\n\n\n\n
ldp x29, x30, [sp], #48<\/strong>
\ud504\ub808\uc784 \ud3ec\uc778\ud130 (x29<\/code>)\ub97c \ub9c1\ud06c \ub808\uc9c0\uc2a4\ud130 (x30<\/code>(= lr)) \uac12\uc744 (\ucd5c\uadfc) sp+0, sp+8\uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\ud558\uae30 \ub54c\ubb38\uc5d0
x29 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 0xffffffffffffffff, x30 (= lr) \ub808\uc9c0\uc2a4\ud130\uac12\uc740 0x44f080\uc774 \ub41c\ub2e4.
\uadf8 \ub2e4\uc74c, \uc2a4\ud0dd \ud3ec\uc778\ud130 sp\ub97c +48\ub9cc\ud07c \uc99d\uac00\uc2dc\ud0a8\ub2e4<\/p>\n\n\n\n
0x44f02f \uac00\uc82f\uc774 \uc2e4\ud589\ub418\uace0 \ub09c \ub4a4 (ret \uc218\ud589 \uc804) \uc758 \uc2a4\ud0dd \uad6c\uc870\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n<\/div><\/div>\n\n\n\n
\"\"<\/figure>\n\n\n\n
ret\uc774 \uc218\ud589\ub418\uace0 \ub09c\ub4a4\uc5d0\ub294 \uc774\uc81c pc \ub808\uc9c0\uc2a4\ud130\uac12\uc774 0x44f080\uac00 \ub420 \uac83\uc774\ub2e4.
0x44f080 \uc8fc\uc18c\uc5d0 \uc788\ub294 \uac00\uc82f\ub3c4 \uc0b4\ud3b4\ubcf4\uba74,,<\/p>\n\n\n\n
\n
0x000000000044f080 <+304>:\tmov\tx0, x19\n0x000000000044f084 <+308>:\tldr\tx19, [sp, #16]\n0x000000000044f088 <+312>:\tldp\tx29, x30, [sp], #48\n0x000000000044f08c <+316>:\tret<\/pre>\n<\/div><\/div>\n\n\n\n
0x44f02f \uac00\uc82f\uc774 \uc2e4\ud589\ub418\uace0 \ub09c \ub4a4 (ret \uc218\ud589 \uc804) \uc758 \uc2a4\ud0dd \uad6c\uc870\ub294 \ub2e4\uc74c\uacfc \uac19\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
mov x0, x19<\/strong>
x19 \ub808\uc9c0\uc2a4\ud130\uac12\uc774 x0 \ub808\uc9c0\uc2a4\ud130\ub85c \ubcf5\uc0ac\ub41c\ub2e4.
\ub530\ub77c\uc11c x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 “\/bin\/sh” \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c \uac00\uc9c0\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n
ldr x19, [sp, #16]<\/strong>
(\ucd5c\uadfc) sp\uc5d0\uc11c +16\ubc14\uc774\ud2b8\ub9cc\ud07c \ub5a8\uc5b4\uc9c4 \uc704\uce58\uc5d0 \uc788\ub294 0x7ffffff340 \uc8fc\uc18c\uc5d0 \uc788\ub294 \uac12\uc744 \uc77d\uc5b4\uc640\uc11c x19 \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc800\uc7a5\ud55c\ub2e4.
\ub530\ub77c\uc11c x19 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 0xffffffffffffffff\uac00 \ub41c\ub2e4.<\/p>\n\n\n\n
ldp x29, x30, [sp], #48<\/strong>
\ud504\ub808\uc784 \ud3ec\uc778\ud130 (x29<\/code>)\ub97c \ub9c1\ud06c \ub808\uc9c0\uc2a4\ud130 (x30<\/code>(= lr)) \uac12\uc744 (\ucd5c\uadfc) sp+0, sp+8\uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\ud558\uae30 \ub54c\ubb38\uc5d0
x29 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 0xffffffffffffffff, x30 (= lr) \ub808\uc9c0\uc2a4\ud130\uac12\uc740 0x406ae8\uc774 \ub41c\ub2e4.
\uadf8 \ub2e4\uc74c, \uc2a4\ud0dd \ud3ec\uc778\ud130 sp\ub97c +48\ub9cc\ud07c \uc99d\uac00\uc2dc\ud0a8\ub2e4.<\/p>\n\n\n\n
\uc5ec\uae30\uae4c\uc9c0 \uc218\ud589\ud55c \ud6c4, ret\uc744 \uc218\ud589\ud558\uba74 
LR \ub808\uc9c0\uc2a4\ud130 \uac12\uc740 \uace7 pc \ub808\uc9c0\uc2a4\ud130\uac12\uc774 \ub418\uba70, LR \uac12\uc740 0x406ae8\uc778 system \ud568\uc218 \uc8fc\uc18c, 
x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 “\/bin\/sh” \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c \uac00\uc9c0\uac8c \ub418\ubbc0\ub85c,
system(“\/bin\/sh”) \ud568\uc218\uac00 \ud638\ucd9c\ub418\uba74\uc11c \uc258\uc774 \ub530\uc9c0\uac8c \ub418\ub294 \uac83\uc774\ub2e4.<\/p>\n\n\n\n
\n\n\n\n
JOP<\/h1>\n\n\n\n
jop.c<\/strong><\/p>\n\n\n\n
\n
#include <stdio.h>\n#include <fcntl.h>\n#include <unistd.h>\n#include <stdlib.h>\n\ntypedef void (*jop_func_t)(); \n\nvoid jop_symbol()\n{\n\tsystem(\"\/bin\/ls\");\n}\n\nvoid jop_bad_func()\n{\n\tjop_func_t func = NULL;\n\tchar data[16] = {0}; \n\tunsigned long long u64 = 0; \n\tint fd = 0; \n\n\tfd = open(\".\/jop.data\",O_RDONLY); \n\tfunc = jop_symbol;\n\tread(fd,&u64,512);\n\tfunc();\n}\n\nint main()\n{\n\tjop_bad_func();\n\treturn 0;\n}<\/pre>\n<\/div><\/div>\n\n\n\n
IDA\uc5d0\uc11c \ub514\ucef4\ud30c\uc77c\uc2dc\ucf1c \uc2a4\ud0dd \uc624\ud504\uc14b\uc744 \ud655\uc778\ud574\ubcf4\uba74 \uc544\ub798\uc640 \uac19\uace0,<\/p>\n\n\n\n
\n
void __cdecl jop_bad_func()\n{\n  unsigned __int64 u64; \/\/ [xsp+18h] [xbp+18h] BYREF\n  unsigned __int8 data[16]; \/\/ [xsp+20h] [xbp+20h] BYREF\n  int fd; \/\/ [xsp+34h] [xbp+34h]\n  jop_func_t func; \/\/ [xsp+38h] [xbp+38h]\n...<\/pre>\n<\/div><\/div>\n\n\n\n
jop.data \ud30c\uc77c \ub0b4\uc6a9\uc73c\ub85c \ubc84\ud37c \uc624\ubc84\ud50c\ub85c\uc6b0\ub97c \ubc1c\uc0dd\uc2dc\ud0a4\uba74 
\uc2a4\ud0dd \ub0b4\uc6a9\uc740 \uc544\ub798\uc640 \uac19\uc774 \ubcc0\ud558\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ubcf4\ub2e4\uc2dc\ud53c func \uc8fc\uc18c\uc5d0 \uc788\ub358 \uc790\ub9ac\uac00 0x441d84\uac12\uc73c\ub85c \ub36e\uc5b4\uc4f0\uc774\uac8c \ub418\uba74\uc11c,
\uc774\uc81c func() \ud568\uc218\ub97c \ud638\ucd9c\ud558\ub824\uace0 \ud558\uba74, 0x441d84 \uac00\uc82f \ucf54\ub4dc\uac00 \uc2e4\ud589\ub41c\ub2e4.<\/p>\n\n\n\n
\ucf54\ub4dc\ub294 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n
\n
0x0000000000441d84 <+260>:\tldp\tx0, x1, [x29, #48]\n0x0000000000441d88 <+264>:\tldp\td0, d1, [x29, #64]\n0x0000000000441d8c <+268>:\tldp\td2, d3, [x29, #80]\n0x0000000000441d90 <+272>:\tldr\tx30, [x29, #232]\n0x0000000000441d94 <+276>:\tmov\tsp, x29\n0x0000000000441d98 <+280>:\tldr\tx29, [x29]\n0x0000000000441d9c <+284>:\tadd\tsp, sp, #0x100\n0x0000000000441da0 <+288>:\tbr\tx30<\/pre>\n<\/div><\/div>\n\n\n\n
\uc704 \uba85\ub839\uc5b4\ub4e4\uc744 \uc218\ud589\ud588\uc744\ub54c\ub97c \uc2a4\ud0dd\uacfc \uac19\uc774 \uadf8\ub9bc\uc73c\ub85c \uc124\uba85\ud558\uba74 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
0x0000000000441d84 <+260>: ldp x0, x1, [x29, #48]<\/strong>
\uac01\uac01 
x0 \ub808\uc9c0\uc2a4\ud130\ub294 x29+48 \uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\ud558\uae30 \ub54c\ubb38\uc5d0 system \ud568\uc218 \uc8fc\uc18c,<\/strong>
x1 \ub808\uc9c0\uc2a4\ud130\ub294 x29+56 \uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\ud558\uae30 \ub54c\ubb38\uc5d0 0x441d84 \uac12\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n
0x0000000000441d88 <+264>: ldp d0, d1, [x29, #64]
0x0000000000441d8c <+268>: ldp d2, d3, [x29, #80]<\/strong>
d0, d1, d2… \ub808\uc9c0\uc2a4\ud130\ub294 \ubca1\ud130 \ubc0f \ubd80\ub3d9 \uc18c\uc218\uc810 \uc5f0\uc0b0\ud558\ub294\ub370 \uc0ac\uc6a9\ub418\ubbc0\ub85c \ubb34\uc2dc\ud55c\ub2e4.<\/p>\n\n\n\n
0x0000000000441d90 <+272>: ldr x30, [x29, #232]<\/strong>
x30 \ub808\uc9c0\uc2a4\ud130\uac00 x29+232 \uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\ud558\uae30 \ub54c\ubb38\uc5d0 
x30 \ub808\uc9c0\uc2a4\ud130\ub294 0x441cf4 \uac00\uc82f \uc8fc\uc18c\ub97c \uac00\uc9c4\ub2e4.<\/strong><\/p>\n\n\n\n
0x0000000000441d94 <+276>: mov sp, x29<\/strong>
\uc774\ubbf8 sp\uc640 x29\uac12\uc774 \uac19\uae30 \ub54c\ubb38\uc5d0 \ubb34\uc2dc\ud55c\ub2e4.<\/p>\n\n\n\n
0x0000000000441d98 <+280>: ldr x29, [x29]<\/strong>
x29 \ub808\uc9c0\uc2a4\ud130\ub294 \ub85c\ub4dc\uc2dc\ucf1c \uc774\uc81c x29 \uc8fc\uc18c\uc5d0 \uc788\ub294 \uac12\uc744 \uac00\uc9c0\uac8c \ub418\uc5b4
main() \ud504\ub808\uc784 \ud3ec\uc778\ud130 \uc8fc\uc18c\uac12\uc778 0x7ffffff2f0\uc774 \ub41c\ub2e4.<\/p>\n\n\n\n
0x0000000000441d9c <+284>: add sp, sp, #0x100<\/strong>
sp \uc2a4\ud0dd \ud504\uc778\ud130\uac00 0x100\ub9cc\ud07c \uc99d\uac00\ud55c\ub2e4.<\/p>\n\n\n\n
0x0000000000441da0 <+288>: br x30<\/strong>
BR\uc740 Branch\ub85c, BL\/BLR \uba85\ub839\uc5b4\uc640 \ub2ec\ub9ac \ud568\uc218\uac00 \ub05d\ub098\uace0 \ubcf5\uadc0\ud558\uc9c0 \uc54a\ub294\ub2e4. 
x86_64 \uc544\ud0a4\ud14d\ucc98\uc758 jmp \uba85\ub839\uc5b4\uc640 \ube44\uc2b7\ud558\ub2e4\uace0 \ubcf4\uba74 \ub41c\ub2e4.
\ub530\ub77c\uc11c, pc\ub294 x30 \ub808\uc9c0\uc2a4\ud130 \uac12\uc778 0x441cf4 \uac00\uc82f\uc73c\ub85c \ubd84\uae30\ub41c\ub2e4.<\/strong><\/p>\n\n\n\n
\ubd84\uae30\ub41c \ud6c4, \uc2e4\ud589\ub420 0x441cf4 \uac00\uc82f\uc744 \ud55c\ubc88 \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n
\n
0x0000000000441cf4 <+116>:\tmov\tx16, x0\n0x0000000000441cf8 <+120>:\tldp\tx0, x1, [x29, #96]\n0x0000000000441cfc <+124>:\tldp\tx2, x3, [x29, #112]\n0x0000000000441d00 <+128>:\tldp\tx4, x5, [x29, #128]\n0x0000000000441d04 <+132>:\tldp\tx6, x7, [x29, #144]\n0x0000000000441d08 <+136>:\tldp\td0, d1, [x29, #160]\n0x0000000000441d0c <+140>:\tldp\td2, d3, [x29, #176]\n0x0000000000441d10 <+144>:\tldp\td4, d5, [x29, #192]\n0x0000000000441d14 <+148>:\tldp\td6, d7, [x29, #208]\n0x0000000000441d18 <+152>:\tldp\tx29, x30, [x29]\n0x0000000000441d1c <+156>:\tadd\tsp, sp, #0x100\n0x0000000000441d20 <+160>:\tbr\tx16<\/pre>\n<\/div><\/div>\n\n\n\n
\uc704 \uba85\ub839\uc5b4\ub4e4\uc744 \uc218\ud589\ud588\uc744\ub54c\ub97c \uc2a4\ud0dd\uacfc \uac19\uc774 \uadf8\ub9bc\uc73c\ub85c \uc911\uc694\ud55c \ubd80\ubd84\ub9cc \ub098\ud0c0\ub0b4\uba74 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc911\uc694\ud55c \ubd80\ubd84\ub9cc \uc124\uba85\ud558\uc790\uba74,<\/p>\n\n\n\n
0x0000000000441cf4 <+116>: mov x16, x0<\/strong>
x0 \ub808\uc9c0\uc2a4\ud130\ub85c\ubd80\ud130 \ubcf5\uc0ac\ubc1b\uae30 \ub54c\ubb38\uc5d0
x16 \ub808\uc9c0\uc2a4\ud130\uac12\uc740 system \ud568\uc218 \uc8fc\uc18c\ub97c \uac00\uc9c4\ub2e4.<\/strong><\/p>\n\n\n\n
0x0000000000441cf8 <+120>: ldp x0, x1, [x29, #96]<\/strong>
x29+96 \uc9c0\uc810\uc73c\ub85c\ubd80\ud130 \ub85c\ub4dc\uc2dc\ud0a4\uae30 \ub54c\ubb38\uc5d0 
x0 \ub808\uc9c0\uc2a4\ud130\uac12\uc774 “\/bin\/sh” \ubb38\uc790\uc5f4 \uc8fc\uc18c\ub97c \uac00\uc9c0\uac8c \ub41c\ub2e4.<\/strong><\/p>\n\n\n\n
\ub098\uba38\uc9c0\ub294 \ud06c\uac8c \uc2e0\uacbd \uc548\uc368\ub3c4 \ub418\uace0,<\/p>\n\n\n\n
0x0000000000441d20 <+160>: br x16<\/strong>
\uc774\uc81c x16 \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc788\ub358 system \ud568\uc218 \uc8fc\uc18c\ub85c \ubd84\uae30\ub418\uae30 \ub418\ubbc0\ub85c,
\ucd5c\uc885\uc801\uc73c\ub85c system(“\/bin\/sh”) \ud568\uc218\uac00 \ud638\ucd9c\ub418\ub294 \uac83\uc774\ub2e4.<\/p>\n\n\n\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
\uc774\ubc88 \uc2dc\uac04\uc5d0\ub294 rop, jop \uacf5\uaca9\uc744 \uc774\ud574\ud558\uae30 \uc704\ud574 \uc544\ub798 \ud504\ub85c\uc81d\ud2b8\ub97c \ud65c\uc6a9\ud558\uc5ec \uc9c1\uc811 \ub514\ubc84\uae45\ud558\uba74\uc11c \uc2a4\ud0dd \ud504\ub808\uc784\uc774 \uc0dd\uaca8\uc9c0\ub294 \uacfc\uc815\uacfc \uac01 \uba85\ub839\uc5b4 \uc758\ubbf8, \uac01 \ubc94\uc6a9 \ub808\uc9c0\uc2a4\ud130\ub4e4\uc774 \uc5b4\ub5bb\uac8c \ud65c\uc6a9\ub418\ub294\uc9c0 \uc54c\uc544\ubcfc \uac83\uc774\ub2e4. https:\/\/github.com\/geesun\/arm64_rop_jop ROP 1. \uc2a4\ud0dd \ud504\ub808\uc784 \ud615\uc131 \ubc0f \uac01 \uba85\ub839\uc5b4 \uc218\ud589 \uacfc\uc815 \uc774\ud574\ud558\uae30 main \ucf54\ub4dc \uc5b4\uc148\ube14\ub7ec \uc124\uba85 x29 \ub808\uc9c0\uc2a4\ud130\ud504\ub808\uc784 \ud3ec\uc778\ud130 \ub808\uc9c0\uc2a4\ud130\ub85c, \uc2a4\ud0dd \ud504\ub808\uc784\uc744 \ucd94\uc801\ud560 \ub54c \uc0ac\uc6a9\ub41c\ub2e4.\ud568\uc218\uac00 \ud638\ucd9c\ub418\uc5b4 \uc0c8\ub85c\uc6b4 \uc2a4\ud0dd \ud504\ub808\uc784\uc774… \ub354 \ubcf4\uae30 »arm64 \ud658\uacbd\uc5d0\uc11c rop, jop \uacf5\uaca9 \uc774\ud574\ud558\uae30<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","footnotes":""},"categories":[1],"tags":[],"class_list":["post-2558","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2558","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=2558"}],"version-history":[{"count":28,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2558\/revisions"}],"predecessor-version":[{"id":2662,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/2558\/revisions\/2662"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=2558"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=2558"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=2558"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}