首页 > 其他分享 >玩具虚拟机

玩具虚拟机

时间:2022-12-30 21:33:35浏览次数:59  
标签:00 return esp 虚拟机 mov 玩具 eax ebp

otccelfn.c编译出来的ELF,格式太古老运行不了。80386 Programmer's Reference Manual

试了点高档些的办法,太麻烦了,还是做个虚拟机吧:

#include <stdio.h>
#include <stdlib.h>
typedef unsigned char byte;

byte  mem[65536];
int   reg[32];

#define eax reg[0]
#define ecx reg[2]
#define eip reg[15]
#define esp reg[14]
#define ebp reg[13]
#define _(i) break;

inline int  rmem(byte* p) { return *p | (p[1] << 8) | (p[2] << 16) | (p[3] << 24); } // little endian
inline int  rmem(int a) { return rmem(mem + a); } // little endian
inline void wmem(int a, int v) { *((int*)&mem[a]) = v; } // 4 bytes

void print() {
  printf("%3x: %02x sp %04x bp %04x ax %04x cx %04x | ", eip, mem[eip], esp, ebp, eax, ecx);
  for (int j = 0; j < 16; j++) printf("%02x ", mem[esp+j]);
  getchar();
}

int main() {
  FILE* fp = fopen("a.bin", "rb"); fread(mem, 1, sizeof(mem), fp); fclose(fp);
  for (esp = 65532;;) {
  byte op = mem[eip], *p = &mem[eip];
  print();
  int i;
  switch (op) {
  case 0x0f: eax *= ecx; eip += 3; _(imul %ecx %eax)
  case 0x50: wmem(esp -= 4, eax); ++eip; _(push %eax)
  case 0x55: wmem(esp -= 4, ebp); ++eip; _(push %ebp)
  case 0x59: ecx = mem[esp]; esp += 4; ++eip; _(pop %ecx)
  case 0x81:
    if (p[1] == 0xec) { esp -= rmem(p+2); eip += 6; }
    else if (p[1] == 0xc4) { esp += rmem(p+2); eip += 6; }
    break;
  case 0x89:
    if (p[1] == 0xe5) { ebp = esp; eip += 2; } // mov %esp,%ebp
    else if (p[1] == 0x84) { wmem(esp + rmem(p+3), eax); eip += 7; } // mov %eax,imm(%esp)
    else if (p[1] == 0x85) { wmem(ebp + rmem(p+2), eax); eip += 6; } // mov %eax,imm(%ebp)
    break;
  case 0x8b:
    if (p[1] == 0x85) { eax = mem[ebp + rmem(p+2)]; eip += 6; } // mov imm(%ebp),%eax
    break;
  case 0xb8: eax = rmem(p+1); eip += 5; _(mov imm %eax)
  case 0xc3: { eip = rmem(esp); esp += 4; } _(pop)
  case 0xc9: { ebp = rmem(esp = ebp); esp += 4; ++eip;} _(leave)
  case 0xcd: exit(0);
  case 0xe8:
    eip += 5;
    i = rmem(p+1);
    if (i == -4) { printf("printf: %d\n", rmem(esp + 4)); }
    else { wmem(esp -= 4, eip); eip += i; }
    break;
  }}
  return 0;
}

C:

fn(i) {
  i = i * 3;
  printf("%d\n", i);
}
main() {
  fn(3);
}

汇编:

   0: e8 4d 00 00 00        call   0x52
   5: cd 80                 int    $0x80
   7: 55                    push   %ebp
   8: 89 e5                 mov    %esp,%ebp
   a: 81 ec 00 00 00 00     sub    $0x0,%esp
  10: 8b 85 08 00 00 00     mov    0x8(%ebp),%eax
  16: 50                    push   %eax
  17: b8 03 00 00 00        mov    $0x3,%eax
  1c: 59                    pop    %ecx
  1d: 0f af c1              imul   %ecx,%eax
  20: 89 85 08 00 00 00     mov    %eax,0x8(%ebp)
  26: 81 ec 08 00 00 00     sub    $0x8,%esp
  2c: b8 fc 68 00 00        mov    $0x68fc,%eax
  31: 89 84 24 00 00 00 00  mov    %eax,0x0(%esp)
  38: 8b 85 08 00 00 00     mov    0x8(%ebp),%eax
  3e: 89 84 24 04 00 00 00  mov    %eax,0x4(%esp)
  45: e8 fc ff ff ff        call   0x46
  4a: 81 c4 08 00 00 00     add    $0x8,%esp
  50: c9                    leave  
  51: c3                    ret    
  52: 55                    push   %ebp
  53: 89 e5                 mov    %esp,%ebp
  55: 81 ec 00 00 00 00     sub    $0x0,%esp
  5b: 81 ec 04 00 00 00     sub    $0x4,%esp
  61: b8 03 00 00 00        mov    $0x3,%eax
  66: 89 84 24 00 00 00 00  mov    %eax,0x0(%esp)
  6d: e8 95 ff ff ff        call   0x7
  72: 81 c4 04 00 00 00     add    $0x4,%esp
  78: c9                    leave  
  79: c3                    ret    

改进中:

gcd(a, b) {
    int    i;
    i = a - b;
  if (i == 0) return a;
  else if (i > 0) return gcd(i, b);
  else return gcd(a, -i);
}
tonum(s) {
  int n, i;
  for (n = 0; ;s++) {
    if ((i = *(char*)s) == 0) break;
    n = n * 10 + i - '0';
  }
  return n;
}
main() {
  int i, j; 
  i = tonum("20"); j = tonum("24"); 
  printf("%d\n", gcd(i, j));
  return 0;
}

标签:00,return,esp,虚拟机,mov,玩具,eax,ebp
From: https://www.cnblogs.com/funwithwords/p/17015853.html

相关文章

  • java开发的玩具商城系统玩具店
    简介Java使用ssm框架开发的玩具商城,用户可以浏览商品,搜索,分类查看商品,添加购物车和购买商品,可注册登录,在个人中心管理自己的订单。商家也就是管理员可以在后台发布商品,上......
  • INTENT2022--一道包含12个反调试反虚拟机操作的ctf题解
    作者:selph查看全文请去公众号:极安御信安全研究院查看原文。从一道Re题学习12种反调试反虚拟技术题目:AntiDebuggingEmporium来源:INTENTCTF2022Re这个题目很有意思,里......
  • VirtualBox嵌套使用虚拟机
    VirtualBoxsupportsAMD-V,but"EnableNestedVT-x/AMD-V"can'tbecheckedinSystem->Processor->ExtendedFeaturesCommandline:VBoxManage.exemodifyvm"vm......
  • 虚拟机--部署欧拉系统--Linux
    一、首先,去欧拉系统官网下载相应ISO镜像​​https://www.openeuler.org/zh/download/​​​二、准备好VMware虚拟机---OracleVMvirtual我也用过,不过部署欧拉系统,感觉VMwar......
  • 安装虚拟机鼠标无法移动问题
    【1】问题描述安装完虚拟机后,开机鼠标无法在虚拟机系统里移动; 【2】解决问题如下图:添加一个usb2.0,然后稍微让系统识别2分钟,就可以移动了,绝了。感谢群友的指点 ......
  • vm12 安装ubuntu15.10详细图文教程 虚拟机安装ubuntu安装 ubuntu更新软件 ubuntu一直
    vm12安装ubuntu15.10详细图文教程虚拟机安装ubuntu安装ubuntu更新软件ubuntu一直卡在下载语言怎么办官网下载ubuntu下载ubuntu镜像文件虚拟机安装......
  • CS5280H 无网络安装KVM虚拟机的过程
    背景信创海光机器想进行虚拟化自带了银河麒麟V10SP1的操作系统.但是没有安装virt-manager等工具会议室里面的网口又都坏了.所以准备挑战一下无网络安装KVM.过程1......
  • VMware Linux虚拟机在线增加磁盘/磁盘扩容
    扩容前状态只有一块60GB的磁盘[root@RHEL6~]#fdisk-lDisk/dev/sda:53.7GB,53687091200bytes64heads,32sectors/track,51200cylindersUnits=cylindersof204......
  • 随笔(十一)『虚拟机安装docker』
    1、进入虚拟机:vagrantssh2、docker安装文档:https://docs.docker.com/engine/install/centos/3、安装步骤3.1)卸载系统之前的dockersudoyumremovedocker\......
  • 虚拟机(centos7)启动后没有ens33 ip地址的解决办法
    虚拟机(centos7)启动后,执行ipaddr命令,显示ens33没有ip地址,无法使用远程连接,这是由于网卡未加入托管所致;临时解决方案:执行命令:dhclientens33执行后查看ipaddr,ens33......