逆向_root_me_2

逆向 root_me

PE .NET

https://www.root-me.org/en/Challenges/Cracking/PE-DotNet-0-protection

MIPS. ELF MIPS - Basic Crackme

https://www.root-me.org/en/Challenges/Cracking/ELF-MIPS-Basic-Crackme

在MIPS架构中，“ $ ra”寄存器保存返回地址，类似于x86指令指针“ EIP”

ELF fake instrucations

https://www.root-me.org/en/Challenges/Cracking/ELF-x86-No-software-breakpoints

dis main  
gdb-peda$ set disassembly-flavor intel //汇编用intel语言显示
gdb-peda$ i r $edx //显示edx值
ni //ni/si都是汇编级别的断点定位。si会进入汇编和C函数内部,ni不会
//这两个命令（si/ni）所针对的是汇编指令，而s/n针对的是源代码

jz 表示当zf =1 时跳转，即结果为0跳转。
jnz 即 zf=0 时跳转，即结果不为0 跳转。

gdb-peda$ i r //全显示
gdb-peda$ set $eax=0

gdb-peda$ x/s $eax //查看寄存器指向的内容

call WPA("toto", "toto") //直接在gdb中运行命令？？

ELF ptrace

https://www.root-me.org/en/Challenges/Cracking/ELF-x86-Ptrace

Load the application into IDA pro,search main function,press F5 to disassemble it,get the code below:
IDA 按F5 反编译 生成伪代码

---

r2 -ww ./ch3.bin

 -w           open file in write mode
 ww foobar            write wide string 'f\x00o\x00o\x00b\x00a\x00r\x00'

 wx 9090     write two intel nops

[0x080482f0]> wx eb @ 0x0804841A
Short Jump（短跳转）机器码 EB

pd N disassemble N instructions

gdb-peda$ i b
 set $al=$dl