97, 2/4 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   ahotsuna
   http://twitter.com/ahotsuna
   6¹ø ÆÄÆ® ¾Èµé¸®´Â °Íµé ¸¹ÀÌ ¸øÇ߳׿ä

http://www.hackerschool.org/HS_Boards/zboard.php?id=HS_Translate&no=82 [º¹»ç]


À̹ø¿£ ³Ê¹« ¸øÇÑ °Í °°¾Æ Á˼ÛÇմϴ٤ФÐ
Àß ¾È µé¸®´Â ºÎºÐÀÌ ¸¹¾Æ Çؼ®À» ¸øÇÑ °Íµµ ¸¹½À´Ï´Ù..
ÀÏ´Ü ´õ µé¸®´Â°Ô ÀÖÀ¸¸é °è¼Ó Ãß°¡Çغ¼°Ô¿ä!

*** checks for that
*

so i've previously terminated is the f**** function.
Á¦°¡ ¹æ±Ý ¾ø¾Ø °Ô **** ±â´ÉÀÔ´Ï´Ù.

I'm gonna put the mic down
¼³¸íÀ» Çص帮±â À§ÇØ

a little bit so i can tell you
Àá½Ã ¸¶ÀÌÅ©¸¦ ³»·Á³õ°Ú½À´Ï´Ù.

so i've found the function i wanna focus on
Á¦°¡ ÁßÁ¡À» µÎ°í ½ÍÀº ±â´ÉÀ» ã°í

and i wanna show you a little bit how i would go
¸ðµç ±â´ÉÀ» ÀÏÀÏÈ÷ Ç¥½ÃÇÏ´Â°Ô Á¤¸»
½Ç¿ëÀûÀÌ°í ¹Ù¶÷Á÷ÇÑ ÀÏÀÎÁö

about marking every function so does it actually useful and likable
Àá½Ã ¿©·¯ºÐ¿¡°Ô º¸¿©µå¸®°í ½Í½À´Ï´Ù.

and i can actually start getting in the ***** see what it does

what are the very first thing that i wanna do with
Á¦°¡ °¡Àå ¸ÕÀú ÇÏ°í ½ÍÀº °ÍÀº

the function is trying to identify the mpoints.
mpointµéÀ» ã¾Æ È®ÀÎÇÏ´Â °ÍÀÔ´Ï´Ù.

so here's where returns.
¿©±â¼­ ¹ÝȯÇϳ׿ä

umm, (often?)***** times you don't know what's going on quite yet,
*** ¾ÆÁ÷±îÁö´Â ¹¹°¡ ¾î¶»°Ô µÇ´ÂÁö Àß ¸ð¸£½Ç °Ì´Ï´Ù,

so ah let's go ahead marker ****

you don't know **** who's gonna call this call returning @@@

uh my habit is to mark up the return functions
Á¦ ½À°üÀº ****¸¦ Ç¥½ÃÇÏ´Â °Í

native? return underscore where *** turning

trying anything force not being set here *******

returning 1 or call returns 0 returning to register

and a lot of functions what ha** return variable ***

if there's any loose on the program,
¸¸¾à ÇÁ·Î±×·¥¿¡ ÇãÁ¡ÀÌ ÀÖ´Ù¸é

find and mark of those.
À̰͵éÀ» ã¾Æ³»¼­ Ç¥½ÃÇÕ´Ï´Ù.

i don't see any obvious ones
Àú´Â È®½ÇÇÑ °Ô º¸ÀÌÁø ¾Ê³×¿ä

i'm looking on the side where's the arrows are,
Áö±Ý È­»ìÇ¥°¡ ÀÖ´Â ÂÊÀ» º¸°íÀִµ¥¿ä,

you can see a stick black line if you jumps upwards.
À§·Î ¿Ã¶ó°¡¸é? °ËÀº»ö ÁÙÀÌ º¸ÀÌ½Ç °Ì´Ï´Ù.

which often times **** cames but not always
°¡²û *** º¸ÀÌÁö¸¸ Ç×»óÀº ¾Æ´Ñ

so uhm, i'm gonna do it **** graf? down from here,

im running out of time
½Ã°£ÀÌ ´Ù µÇ¾î°¡°íÀֳ׿ä

trying to ** ** ****

ok, so this * call too many children funcions that aren't library *****
³×, ÀÌ *´Â ¶óÀ̺귯¸®¿¡ ¾ø´Â ³Ê¹« ¸¹Àº ºÎ¼Ó ±â´É(ÀÚ½Ä ±â´É?)À» È£ÃâÇÕ´Ï´Ù.

i'll take a look at this ***
ÀÌ°É Çѹø ºÁº¸ÁÒ

ok so here's one of  ****************applications

if you used this IDA pro normally used *** behaviors

the problem is.. was at IDA pro was not realized
¹®Á¦´Â, IDA pro°¡ ÀÌ ±â´ÉÀÌ EEP¸¦

that this function uses EEP as variable pointer.
º¯¼ö Æ÷ÀÎÅÍ·Î »ç¿ëÇÑ´Ù´Â °É ¾Ë¾ÆäÁö ¸øÇÑ´Ù´Â °Ì´Ï´Ù.

it's normally looking for its signature **

**** this C++ program ****

the way in do that (fix that) is ** edit > function
±×°É °íÄ¡´Â ¹æ¹ýÀº, ¼öÁ¤ > ±â´ÉÀ¸·Î °¡¼­

and you'll see ****(eep?) basic frame
*** ±âº» ÇÁ·¹ÀÓÀ» **Çϴ°̴ϴÙ

if you prefer use in keyboard ***
Å°º¸µå·Î ÇϽô °É ¿øÇϽøé ****

here we go

****** announces *** argument functions..

this is import because it'll start picking up variable

names in the system ***

if it knows particular parameters * system ca** name this,

if it's clear your program is also uses init the same way

so uhm.. we can see some of the funcions on

here, and again * mark return ******next *** here

but some of the key pieces ***just you wanna do

in terms in naming variables if * when you can go up?

and put in the functions proto type

so down here, i've got arguments to this program

i've got a list (least?) one** name

i can go up here and press ***
ÀÌÁ¦ ÇÁ·ÎÆ÷ ŸÀÔ ±â´ÉÀ» ½ÇÇàÇغ¸±â À§ÇØ

to start function proto type
À§·Î ¿Ã¶ó°¡¼­ * ¹öÆ°À» ´­·¯º¸°Ú½À´Ï´Ù.

now *****another prompt to ****

i'm using c++ here which is uhmm

most of function was programmed ***

exception handler srewed up ****

  Hit : 1780     Date : 2011/08/02 08:02



    
  6¹ø ÆÄÆ® ¾Èµé¸®´Â °Íµé ¸¹ÀÌ ¸øÇ߳׿䠠   ahotsuna
08/02 1779
71   ÆÄÆ® 2¹ø ºÐ·®ÀÔ´Ï´Ù. (90% Á¤µµµÆ°í ¾ÆÁ÷ 10% - ¾à 30~40Ãʺз®- ¹Ì¿ÏÀÔ´Ï´Ù.))     CodeAche
08/02 1662
70   Á¦ 2ȸ ¹ø¿ª ÁøÇà»óȲ ´ñ±Û ¹Ù¶ø´Ï´Ù.[9]     ¸Û¸Û
08/02 1732
69   ÆÄÆ®1 ºÐ·®ÀÔ´Ï´Ù.     ¸Û¸Û
08/02 1890
68   ÆÄÆ®8 ºÐ·®ÀÔ´Ï´Ù.     lycan
08/02 1598
67   ¾ÆÁ÷¸¹ÀÌÇÏÁö¸øÇ߳׿䠠   d4rkang3l
08/01 1515
66   13¹ø ÆÄÆ® ¹ø¿ªÀÔ´Ï´Ù.     20500
08/01 1584
65   4¹ø ÆÄÆ® ¹ø¿ª ¿Ã¸³´Ï´Ù.     babyalpha
08/01 1653
64   ´Ù¸¥ ºÐµéÀº ¾ó¸¶³ª Çϼ̳ª¿ä?[3]     ahotsuna
07/31 1676
63   ±âÇÑÀÌ...[3]     20500
07/31 1496
62   [Á¦ 2ȸ] ¹ø¿ª ÆÄÆ®°¡ Á¤ÇØÁ³½À´Ï´Ù[12]     ¸Û¸Û
07/18 1886
61   [Á¦ 2ȸ] µ¿¿µ»ó ÆÄÀÏ[1]     lycan
07/16 2685
60   [Á¦ 2ȸ] À¯Åõºê ¸µÅ©[1]     lycan
07/16 1759
59   [Á¦ 2ȸ] Á¦ 2ȸ ¸®½º´×&¹ø¿ª ÀÛ¾÷À» ½ÃÀÛÇÕ´Ï´Ù.[20]     ¸Û¸Û
07/14 2063
58   [1ȸ] recon - auditing source code ºÐÇÒ ÆÄÀÏÀÔ´Ï´Ù (ÃÑ 9°³)[8]     ¸Û¸Û
05/04 1874
57   [°øÁö] Á¦ 1ȸ ¹ø¿ª ½ºÄÉÁìÀÔ´Ï´Ù. (ÁøÇà»óȲÀ» °¢ÀÚ ´ñ±Û·Î update)[10]     ¸Û¸Û
05/03 1770
56   ÀÚ¸· - ÃÖÁ¾ ¼öÁ¤º»ÀÔ´Ï´Ù~     ¸Û¸Û
06/30 1597
55   ÀÚ¸· - darkangel´Ô °Í°ú lycan´Ô °Í ÅëÇÕ     ¸Û¸Û
06/22 1817
54   ÀÚ¸·[1]     d4rkang3l
06/21 1462
53   µÎ ¹ø° ¹ø¿ª ´ë»ó °ü·Ã..[5]     ¸Û¸Û
06/16 1879
52   ÀÚ¸·(¿µ¾î,Çѱ۸¸ ¿Ï¼º ½ÌÅ© ¿¡·¯)[1]     d4rkang3l
06/16 1715
51   ÀÚ¸· ¿Ã¸³´Ï´Ù~[4]     lycan
06/13 1591
50     [re] °³Çà ¹× ÀϺΠ¼öÁ¤ÇÑ ÀÚ¸· ¿Ã¸³´Ï´Ù.[1]     lycan
06/15 1593
49   ÀúÀÚ¸·ÀÌ¿ä(¹Ì¿Ï¼º)[1]     d4rkang3l
06/09 1497
48   Á¦ 1ȸ ¹ø¿ª ÀÚ¸· °ü·ÃÀÔ´Ï´Ù.     ¸Û¸Û
06/02 1669
[1] 2 [3][4]

Copyright 1999-2024 Zeroboard / skin by Hackerschool.org / Secure Patch by Hackerschool.org