Binexp_intro
Register duties
RIP : Instruction pointer RSP: Stack pointer RBP: (Stack) Base pointer RSI, RDI: Generally used for passing args RAX, RBX, RCX, RDX , R8, R9 …R15 : General purpose
Flags
These are bits which set or unset acc. to the latest operation ZF : Zero Flag SF : Sign Flag CF: Carry Flag OF: Overflow Flag PF: Parity Flag AF: Auxillary Flag IF: Interrupt enable Flag DF: Direction Flag
Basic operations
`mov rax, rsi` rax = rsi
`add rbx, 0x1` rbx = rbx +0x1
`sub rax, rbx` rax = rax - rbx
`mov rax, [addr.] ` rax = value_at[addr]
`push 0x7` pushes 0x into stack
'pop eax' pop the value into eax
`cmp R9, R10` compares them and later used in decisions like je, jg,..etc
`test R9 R10` performs bitwise AND and modifies the flags SF ZF and PF
`jmp addr` jump to given address , more often comes as je, jne..etc
PS: The stack grows downwards (litle endian)
Most used keywords :
- pie
- aslr
- nx
- canary
Application memory structure
| Heap | | ------- | | Stack | | ------- | | variables | | ------- | | instructions|
Exploits:
- BOF (buffer overflow)
- ret2libc and rop
- ret2plt
- Format string vuln
Tips
To find the occurances of libc functions
we can use ltrace and find them
checksec ./vuln
to perform security check seg fault with demsg