共计 4204 个字符,预计需要花费 11 分钟才能阅读完成。
ROP 绕过片段简略科普一下,你能够了解成一个能够关闭系统本身内存保护的一段机器指令,这段代码须要咱们本人结构,这就波及到在对端内存搜查这样的指令,LyScript 插件加强了指令片段的查找性能,但须要咱们在 LyScript 插件根底上封装一些办法,实现起来也不难。
- 插件地址:https://github.com/lyshark/Ly…
封装机器码获取性能: 首先封装一个办法,当用户传入指定汇编指令的时候,主动的将其转换成对应的机器码,这是为搜寻 ROP 片段做铺垫的,代码很简略,首先 dbg.create_alloc(1024)
在过程内存中开拓堆空间,用于寄存咱们的机器码,而后调用 dbg.assemble_write_memory(alloc_address,"sub esp,10")
将一条汇编指令变成机器码写到对端内存,而后再 op = dbg.read_memory_byte(alloc_address + index)
顺次将其读取进去即可。
from LyScript32 import MyDebug
# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
pass
if __name__ == "__main__":
dbg = MyDebug()
connect_flag = dbg.connect()
print("连贯状态: {}".format(connect_flag))
machine_code_list = []
# 开拓堆空间
alloc_address = dbg.create_alloc(1024)
print("调配堆: {}".format(hex(alloc_address)))
# 失去汇编机器码
machine_code = dbg.assemble_write_memory(alloc_address,"sub esp,10")
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 失去汇编指令长度
machine_code_size = dbg.assemble_code_size("sub esp,10")
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 读取机器码
for index in range(0,machine_code_size):
op = dbg.read_memory_byte(alloc_address + index)
machine_code_list.append(op)
# 开释堆空间
dbg.delete_alloc(alloc_address)
# 输入机器码
print(machine_code_list)
dbg.close()
咱们持续封装如上办法,封装成一个能够间接应用的 get_assembly_machine_code
函数。
from LyScript32 import MyDebug
# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
machine_code_list = []
# 开拓堆空间
alloc_address = dbg.create_alloc(1024)
print("调配堆: {}".format(hex(alloc_address)))
# 失去汇编机器码
machine_code = dbg.assemble_write_memory(alloc_address,asm)
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 失去汇编指令长度
machine_code_size = dbg.assemble_code_size(asm)
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 读取机器码
for index in range(0,machine_code_size):
op = dbg.read_memory_byte(alloc_address + index)
machine_code_list.append(op)
# 开释堆空间
dbg.delete_alloc(alloc_address)
return machine_code_list
if __name__ == "__main__":
dbg = MyDebug()
connect_flag = dbg.connect()
print("连贯状态: {}".format(connect_flag))
# 转换第一对
opcode = get_assembly_machine_code(dbg,"mov eax,1")
for index in opcode:
print("0x{:02X}".format(index),end="")
print()
# 转换第二对
opcode = get_assembly_machine_code(dbg,"sub esp,10")
for index in opcode:
print("0x{:02X}".format(index),end="")
print()
dbg.close()
执行后即可失去后果:
扫描符合条件的内存: 通过应用上方封装的 get_assembly_machine_code()
并配合 scan_memory_one(scan_string)
函数,在对端内存搜寻是否存在符合条件的指令。
from LyScript32 import MyDebug
# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
machine_code_list = []
# 开拓堆空间
alloc_address = dbg.create_alloc(1024)
print("调配堆: {}".format(hex(alloc_address)))
# 失去汇编机器码
machine_code = dbg.assemble_write_memory(alloc_address,asm)
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 失去汇编指令长度
machine_code_size = dbg.assemble_code_size(asm)
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 读取机器码
for index in range(0,machine_code_size):
op = dbg.read_memory_byte(alloc_address + index)
machine_code_list.append(op)
# 开释堆空间
dbg.delete_alloc(alloc_address)
return machine_code_list
if __name__ == "__main__":
dbg = MyDebug()
connect_flag = dbg.connect()
print("连贯状态: {}".format(connect_flag))
# 转换成列表
opcode = get_assembly_machine_code(dbg,"push eax")
print("失去机器码列表:",opcode)
# 列表转换成字符串
scan_string = " ".join([str(_) for _ in opcode])
print("搜寻机器码字符串:", scan_string)
address = dbg.scan_memory_one(scan_string)
print("第一个符合条件的内存块: {}".format(hex(address)))
dbg.close()
扫描后果如下:
将咱们须要搜寻的 ROP 指令集片段放到数组内间接搜寻,即可间接返回 ROP 内存地址。
from LyScript32 import MyDebug
# 传入汇编指令, 获取该指令的机器码
def get_assembly_machine_code(dbg,asm):
machine_code_list = []
# 开拓堆空间
alloc_address = dbg.create_alloc(1024)
print("调配堆: {}".format(hex(alloc_address)))
# 失去汇编机器码
machine_code = dbg.assemble_write_memory(alloc_address,asm)
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 失去汇编指令长度
machine_code_size = dbg.assemble_code_size(asm)
if machine_code == False:
dbg.delete_alloc(alloc_address)
# 读取机器码
for index in range(0,machine_code_size):
op = dbg.read_memory_byte(alloc_address + index)
machine_code_list.append(op)
# 开释堆空间
dbg.delete_alloc(alloc_address)
return machine_code_list
if __name__ == "__main__":
dbg = MyDebug()
connect_flag = dbg.connect()
print("连贯状态: {}".format(connect_flag))
for item in ["push eax","mov eax,1","jmp eax","pop eax"]:
# 转换成列表
opcode = get_assembly_machine_code(dbg,item)
#print("失去机器码列表:",opcode)
# 列表转换成字符串
scan_string = " ".join([str(_) for _ in opcode])
#print("搜寻机器码字符串:", scan_string)
address = dbg.scan_memory_one(scan_string)
print("第一个符合条件的内存块: {}".format(hex(address)))
dbg.close()
检索成果如下:
正文完