[ncc2008@localhost]$ objdump -x cm2
cm2: file format elf32-i386
cm2
architecture: i386, flags 0x00000102:
EXEC_P, D_PAGED
start address 0x08048080
程序头：
LOAD off 0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
filesz 0x000005b8 memsz 0x000005b8 flags r-x
LOAD off 0x000005b8 vaddr 0x080495b8 paddr 0x080495b8 align 2**12
filesz 0x0000002c memsz 0x0000002c flags rw-
Sections:
Idx Name Size VMA LMA File off Algn
SYMBOL TABLE:
no symbols
00000000 7F 45 4C 46 01 01 01 00 4C 69 6E 75 78 00 00 00 .ELF....Linux...
00000010 02 00 03 00 01 00 00 00 80 80 04 08 34 00 00 00 ............4...
00000020 00 00 00 00 00 00 00 00 34 00 20 00 02 00 00 00 ........4. .....
00000030 00 00 00 00 01 00 00 00 00 00 00 00 00 80 04 08 ................
00000040 00 80 04 08 B8 05 00 00 B8 05 00 00 05 00 00 00 ................
00000050 00 10 00 00 01 00 00 00 B8 05 00 00 B8 95 04 08 ................
00000060 B8 95 04 08 2C 00 00 00 2C 00 00 00 06 00 00 00 ....,...,.......
00000070 00 10 00 00 77 6C EA 93 7F 55 50 58 E4 05 0B 0A ....wl...[COLOR=blue]UPX....
00000080 31 ED 58 89 E1 8D 54 81 04 50 83 E4 F8 52 51 E8 1.X...T..P...RQ.
00000090 FE 01 00 00 F4 0A 00 24 49 6E 66 6F 3A 20 54 68 .......$Info: Th
000000A0 69 73 20 66 69 6C 65 20 69 73 20 70 61 63 6B 65 is file is packe
000000B0 64 20 77 69 74 68 20 74 68 65 20 55 50 58 20 65 d with the UPX e
000000C0 78 65 63 75 74 61 62 6C 65 20 70 61 63 6B 65 72 xecutable packer
000000D0 20 68 74 74 70 3A 2F 2F 75 70 78 2E 73 66 2E 6E 8b6K9s2c8@1M7q4)9K6b7g2)9J5c8W2)9J5c8Y4g2H3P5q4)9J5k6i4y4X3i4K6u0W2L8R3`.`.
000000E0 65 74 20 24 0A 00 24 49 64 3A 20 55 50 58 20 31 et $..$Id: UPX 1
000000F0 2E 32 34 20 43 6F 70 79 72 69 67 68 74 20 28 43 .24 Copyright (C
00000100 29 20 31 39 39 36 2D 32 30 30 32 20 74 68 65 20 ) 1996-2002 the
00000110 55 50 58 20 54 65 61 6D 2E 20 41 6C 6C 20 52 69 UPX Team. All Ri
00000120 67 68 74 73 20 52 65 73 65 72 76 65 64 2E 20 24 ghts Reserved. [/COLOR]$
[ncc2008@localhost crack]$ upx -d cm2
Ultimate Packer for eXecutables
Copyright (C) 1996, 1997, 1998, 1999, 2000, 2001, 2002, 2003, 2004
UPX 1.25 Markus F.X.J. Oberhumer & Laszlo Molnar Jun 29th 2004
File size Ratio Format Name
-------------------- ------ ----------- -----------
10584 <- 4870 46.01% linux/386 cm2
Unpacked 1 file.
[ncc2008@localhost crack]$ objdump -x cm2
cm2: file format elf32-i386
cm2
architecture: i386, flags 0x00000112:
EXEC_P, HAS_SYMS, D_PAGED
start address 0x080488b0
程序头：
PHDR off 0x00000034 vaddr 0x08048034 paddr 0x08048034 align 2**2
filesz 0x000000c0 memsz 0x000000c0 flags r-x
INTERP off 0x000000f4 vaddr 0x080480f4 paddr 0x080480f4 align 2**0
filesz 0x00000013 memsz 0x00000013 flags r--
LOAD off 0x00000000 vaddr 0x08048000 paddr 0x08048000 align 2**12
filesz 0x0000109c memsz 0x0000109c flags r-x
LOAD off 0x00002000 vaddr 0x0804a000 paddr 0x0804a000 align 2**12
filesz 0x00000398 memsz 0x00000ff0 flags rw-
DYNAMIC off 0x00002248 vaddr 0x0804a248 paddr 0x0804a248 align 2**2
filesz 0x000000e0 memsz 0x000000e0 flags rw-
NOTE off 0x00000108 vaddr 0x08048108 paddr 0x08048108 align 2**2
filesz 0x00000020 memsz 0x00000020 flags r--
动态节：
NEEDED libgtk-1.2.so.0
NEEDED libgdk-1.2.so.0
NEEDED libglib-1.2.so.0
NEEDED libc.so.6
INIT 0x8048758
FINI 0x8049074
HASH 0x8048128
STRTAB 0x804841c
SYMTAB 0x80481fc
STRSZ 0x225
SYMENT 0x10
DEBUG 0x0
PLTGOT 0x804a33c
PLTRELSZ 0x98
PLTREL 0x11
JMPREL 0x80486c0
REL 0x80486b8
RELSZ 0x8
RELENT 0x8
VERNEED 0x8048688
VERNEEDNUM 0x1
VERSYM 0x8048642
版本引用：
required from libc.so.6:
0x0d696911 0x00 03 GLIBC_2.1
0x0d696910 0x00 02 GLIBC_2.0
Sections:
Idx Name Size VMA LMA File off Algn
0 .interp 00000013 080480f4 080480f4 000000f4 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
1 .note.ABI-tag 00000020 08048108 08048108 00000108 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
2 .hash 000000d4 08048128 08048128 00000128 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
3 .dynsym 00000220 080481fc 080481fc 000001fc 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
4 .dynstr 00000225 0804841c 0804841c 0000041c 2**0
CONTENTS, ALLOC, LOAD, READONLY, DATA
5 .gnu.version 00000044 08048642 08048642 00000642 2**1
CONTENTS, ALLOC, LOAD, READONLY, DATA
6 .gnu.version_r 00000030 08048688 08048688 00000688 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
7 .rel.dyn 00000008 080486b8 080486b8 000006b8 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
8 .rel.plt 00000098 080486c0 080486c0 000006c0 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
9 .init 00000017 08048758 08048758 00000758 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
10 .plt 00000140 08048770 08048770 00000770 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
11 .text 000007c4 080488b0 080488b0 000008b0 2**4
CONTENTS, ALLOC, LOAD, READONLY, CODE
12 .fini 0000001b 08049074 08049074 00001074 2**2
CONTENTS, ALLOC, LOAD, READONLY, CODE
13 .rodata 00000008 08049090 08049090 00001090 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
14 .eh_frame 00000004 08049098 08049098 00001098 2**2
CONTENTS, ALLOC, LOAD, READONLY, DATA
15 .data 00000248 0804a000 0804a000 00002000 2**2
CONTENTS, ALLOC, LOAD, DATA
16 .dynamic 000000e0 0804a248 0804a248 00002248 2**2
CONTENTS, ALLOC, LOAD, DATA
17 .ctors 00000008 0804a328 0804a328 00002328 2**2
CONTENTS, ALLOC, LOAD, DATA
18 .dtors 00000008 0804a330 0804a330 00002330 2**2
CONTENTS, ALLOC, LOAD, DATA
19 .jcr 00000004 0804a338 0804a338 00002338 2**2
CONTENTS, ALLOC, LOAD, DATA
20 .got 0000005c 0804a33c 0804a33c 0000233c 2**2
CONTENTS, ALLOC, LOAD, DATA
21 .bss 00000c58 0804a398 0804a398 00002398 2**2
ALLOC
22 .comment 00000119 00000000 00000000 00002398 2**0
CONTENTS, READONLY
SYMBOL TABLE:
no symbols
[ncc2008@localhost crack]$ objdump -T cm2
cm2: file format elf32-i386
DYNAMIC SYMBOL TABLE:
00000000 DF *UND* 0000013d gtk_widget_show
0804a248 g DO *ABS* 00000000 Base _DYNAMIC
08048780 DF *UND* 000000e4 gtk_widget_show_all
00000000 DF *UND* 00000027 gtk_dialog_new
08048790 DF *UND* 000001db gtk_container_add
08048758 g DF .init 00000000 Base _init
080487a0 DF *UND* 000000d1 gtk_window_set_default_size
080487b0 DF *UND* 00000056 gtk_label_new
080487c0 DF *UND* 00000085 gtk_window_new
080487d0 DF *UND* 00000213 gtk_widget_set_uposition
080487e0 DF *UND* 0000010d gtk_window_set_title
080487f0 DF *UND* 0000010c gtk_entry_get_text
08048800 DF *UND* 00000242 gtk_box_pack_start
08048810 DF *UND* 00000067 gtk_init
08048820 DF *UND* 0000010d g_print
08048830 DF *UND* 0000007c gtk_main_quit
08048840 DF *UND* 000001d3 gtk_main
0804a398 g D *ABS* 00000000 Base __bss_start
08048850 DF *UND* 000000e0 GLIBC_2.0 __libc_start_main
08049074 g DF .fini 00000000 Base _fini
08048860 DF *UND* 000000c7 GLIBC_2.0 exit
0804a398 g D *ABS* 00000000 Base _edata
0804a33c g DO *ABS* 00000000 Base _GLOBAL_OFFSET_TABLE_
0804aff0 g D *ABS* 00000000 Base _end
00000000 DF *UND* 00000028 GLIBC_2.1 fopen
08049094 g DO .rodata 00000004 Base _IO_stdin_used
00000000 DF *UND* 0000012e GLIBC_2.0 fwrite
08048870 DF *UND* 00000027 gtk_entry_new
00000000 w D *UND* 00000000 _Jv_RegisterClasses
08048880 DF *UND* 00000157 gtk_signal_connect
08048890 DF *UND* 0000006d gtk_button_new_with_label
080488a0 DF *UND* 00000044 gtk_vbox_new
00000000 w D *UND* 00000000 __gmon_start__
8048979: 68 00 00 00 00 push $0x0
804897e: 68 03 00 00 00 push $0x3
8048983: e8 88 fe ff ff call 0x8048810
main():
08048970 55 push ebp
08048971 89 E5 mov ebp, esp
08048973 81 EC 08 00 00 00 sub esp, 0x8
08048979 68 00 00 00 00 push 0x0
0804897E 68 03 00 00 00 push 0x3
08048983 E8 88 FE FF FF call gtk_init (08048810) ; (near - 0x178)
08048988 90 nop -\
08048989 90 nop \
0804898A 90 nop |->怎么会有nop指令出现？
0804898B 90 nop / 我们在这加入call Function___080489BD
0804898C 90 nop -/ 直接显示crackme窗口，跳过killme窗口的调用。因为在
0804898D BE D2 A0 04 08 mov esi, " Kill this window (p" (0804A0D2)
08048992 E8 5C 04 00 00 call Function___08048DF3 (08048DF3) ; [COLOR=red]建立killme窗口[/COLOR]
08048997 68 00 00 00 00 push 0x0
0804899C 68 BD 89 04 08 push Function___080489BD (80489BD)[COLOR=green] ; 回调函数，显示crackme窗口[/COLOR]
080489A1 68 28 A2 04 08 push "destroy" (0804A228)
080489A6 FF 35 A0 A3 04 08 push 0804A3A0
080489AC E8 CF FE FF FF call gtk_signal_connect (08048880) ; [COLOR=red]建立destroy事件回调函数0x080489BD[/COLOR]
080489B1 81 C4 10 00 00 00 add esp, 0x10
080489B7 E8 84 FE FF FF call gtk_main (08048840) ; [COLOR=red]显示killme窗口[/COLOR]
080489BC C3 ret
Function___08048DF3:
08048DF3 55 push ebp ; xref ( 08048992 08048C9A 08048CA6 08048DAC )
08048DF4 89 E5 mov ebp, esp
08048DF6 81 EC 08 00 00 00 sub esp, 0x8
08048DFC 68 01 00 00 00 push 0x1
08048E01 E8 BA F9 FF FF call gtk_window_new (080487C0) ; (near - 0x646)
08048E06 A3 A0 A3 04 08 mov 0x0804A3A0, eax
08048E0B 68 2C A0 04 08 push "CrackMe v13 (2 linux" (0804A02C)
08048E10 FF 35 A0 A3 04 08 push 0804A3A0
08048E16 E8 C5 F9 FF FF call gtk_window_set_title (080487E0) ; (near - 0x63B)
08048E1B 56 push esi
08048E1C E8 8F F9 FF FF call gtk_label_new (080487B0) ; (near - 0x671)
08048E21 50 push eax
08048E22 FF 35 A0 A3 04 08 push 0804A3A0
08048E28 E8 63 F9 FF FF call gtk_container_add (08048790) ; (near - 0x69D)
08048E2D 68 64 00 00 00 push 0x64
08048E32 68 2C 01 00 00 push 0x12C
08048E37 FF 35 A0 A3 04 08 push 0804A3A0
08048E3D E8 5E F9 FF FF call gtk_window_set_default_size (080487A0) ; (near - 0x6A2)
08048E42 FF 35 A0 A3 04 08 push 0804A3A0
08048E48 E8 33 F9 FF FF call gtk_widget_show_all (08048780) ; (near - 0x6CD)
08048E4D C9 leave
08048E4E C3 ret
08048988 90 nop -\
08048989 90 nop \
0804898A 90 nop |->怎么会有nop指令出现？
0804898B 90 nop / 我们在这加入call Function___080489BD
0804898C 90 nop -/ 直接显示crackme窗口，跳过killme窗口的调用。
0804898D BE D2 A0 04 08 mov esi, " Kill this window (p" (0804A0D2)
08048992 E8 5C 04 00 00 call Function___08048DF3 (08048DF3)
08048C22 68 3D A2 04 08 push "clicked" (0804A23D)
08048C27 FF 35 AC A3 04 08 push 0804A3AC
08048C2D E8 4E FC FF FF call gtk_signal_connect (08048880) ; (near - 0x3B2)
08048C32 81 C4 10 00 00 00 add esp, 0x10
08048C38 E8 03 FC FF FF call gtk_main (08048840) ; (near - 0x3FD)
08048C3D 68 2C A0 04 08 push "CrackMe v13 (2 linux" (0804A02C)
08048C42 E8 D9 FB FF FF call g_print (08048820) ; (near - 0x427)
08048C47 81 C4 04 00 00 00 add esp, 0x4
08048C4D 68 00 00 00 00 push 0x0
08048C52 E8 09 FC FF FF call exit (08048860) [COLOR=red]; 当点击crackme窗口上的quit按钮后程序直接退出[/COLOR]
Function___08048C57:
08048C57 55 push ebp
08048C58 89 E5 mov ebp, esp
08048C5A 81 EC 08 00 00 00 sub esp, 0x8
08048C60 E8 17 00 00 00 call Function___08048C7C (08048C7C) ; (near + 0x17)
08048C65 B8 00 00 00 00 mov eax, 0x0
08048C6A C9 leave
08048C6B C3 ret
[培训]内核驱动高级班，冲击BAT一流互联网大厂工作，每周日13:00-18:00直播授课
