97, 2/4 ȸ¿ø°¡ÀÔ  ·Î±×ÀΠ 
   ahotsuna
   http://twitter.com/ahotsuna
   6¹ø ÆÄÆ® ¾Èµé¸®´Â °Íµé ¸¹ÀÌ ¸øÇ߳׿ä

http://www.hackerschool.org/HS_Boards/zboard.php?id=HS_Translate&no=82 [º¹»ç]


À̹ø¿£ ³Ê¹« ¸øÇÑ °Í °°¾Æ Á˼ÛÇմϴ٤ФÐ
Àß ¾È µé¸®´Â ºÎºÐÀÌ ¸¹¾Æ Çؼ®À» ¸øÇÑ °Íµµ ¸¹½À´Ï´Ù..
ÀÏ´Ü ´õ µé¸®´Â°Ô ÀÖÀ¸¸é °è¼Ó Ãß°¡Çغ¼°Ô¿ä!

*** checks for that
*

so i've previously terminated is the f**** function.
Á¦°¡ ¹æ±Ý ¾ø¾Ø °Ô **** ±â´ÉÀÔ´Ï´Ù.

I'm gonna put the mic down
¼³¸íÀ» Çص帮±â À§ÇØ

a little bit so i can tell you
Àá½Ã ¸¶ÀÌÅ©¸¦ ³»·Á³õ°Ú½À´Ï´Ù.

so i've found the function i wanna focus on
Á¦°¡ ÁßÁ¡À» µÎ°í ½ÍÀº ±â´ÉÀ» ã°í

and i wanna show you a little bit how i would go
¸ðµç ±â´ÉÀ» ÀÏÀÏÈ÷ Ç¥½ÃÇÏ´Â°Ô Á¤¸»
½Ç¿ëÀûÀÌ°í ¹Ù¶÷Á÷ÇÑ ÀÏÀÎÁö

about marking every function so does it actually useful and likable
Àá½Ã ¿©·¯ºÐ¿¡°Ô º¸¿©µå¸®°í ½Í½À´Ï´Ù.

and i can actually start getting in the ***** see what it does

what are the very first thing that i wanna do with
Á¦°¡ °¡Àå ¸ÕÀú ÇÏ°í ½ÍÀº °ÍÀº

the function is trying to identify the mpoints.
mpointµéÀ» ã¾Æ È®ÀÎÇÏ´Â °ÍÀÔ´Ï´Ù.

so here's where returns.
¿©±â¼­ ¹ÝȯÇϳ׿ä

umm, (often?)***** times you don't know what's going on quite yet,
*** ¾ÆÁ÷±îÁö´Â ¹¹°¡ ¾î¶»°Ô µÇ´ÂÁö Àß ¸ð¸£½Ç °Ì´Ï´Ù,

so ah let's go ahead marker ****

you don't know **** who's gonna call this call returning @@@

uh my habit is to mark up the return functions
Á¦ ½À°üÀº ****¸¦ Ç¥½ÃÇÏ´Â °Í

native? return underscore where *** turning

trying anything force not being set here *******

returning 1 or call returns 0 returning to register

and a lot of functions what ha** return variable ***

if there's any loose on the program,
¸¸¾à ÇÁ·Î±×·¥¿¡ ÇãÁ¡ÀÌ ÀÖ´Ù¸é

find and mark of those.
À̰͵éÀ» ã¾Æ³»¼­ Ç¥½ÃÇÕ´Ï´Ù.

i don't see any obvious ones
Àú´Â È®½ÇÇÑ °Ô º¸ÀÌÁø ¾Ê³×¿ä

i'm looking on the side where's the arrows are,
Áö±Ý È­»ìÇ¥°¡ ÀÖ´Â ÂÊÀ» º¸°íÀִµ¥¿ä,

you can see a stick black line if you jumps upwards.
À§·Î ¿Ã¶ó°¡¸é? °ËÀº»ö ÁÙÀÌ º¸ÀÌ½Ç °Ì´Ï´Ù.

which often times **** cames but not always
°¡²û *** º¸ÀÌÁö¸¸ Ç×»óÀº ¾Æ´Ñ

so uhm, i'm gonna do it **** graf? down from here,

im running out of time
½Ã°£ÀÌ ´Ù µÇ¾î°¡°íÀֳ׿ä

trying to ** ** ****

ok, so this * call too many children funcions that aren't library *****
³×, ÀÌ *´Â ¶óÀ̺귯¸®¿¡ ¾ø´Â ³Ê¹« ¸¹Àº ºÎ¼Ó ±â´É(ÀÚ½Ä ±â´É?)À» È£ÃâÇÕ´Ï´Ù.

i'll take a look at this ***
ÀÌ°É Çѹø ºÁº¸ÁÒ

ok so here's one of  ****************applications

if you used this IDA pro normally used *** behaviors

the problem is.. was at IDA pro was not realized
¹®Á¦´Â, IDA pro°¡ ÀÌ ±â´ÉÀÌ EEP¸¦

that this function uses EEP as variable pointer.
º¯¼ö Æ÷ÀÎÅÍ·Î »ç¿ëÇÑ´Ù´Â °É ¾Ë¾ÆäÁö ¸øÇÑ´Ù´Â °Ì´Ï´Ù.

it's normally looking for its signature **

**** this C++ program ****

the way in do that (fix that) is ** edit > function
±×°É °íÄ¡´Â ¹æ¹ýÀº, ¼öÁ¤ > ±â´ÉÀ¸·Î °¡¼­

and you'll see ****(eep?) basic frame
*** ±âº» ÇÁ·¹ÀÓÀ» **Çϴ°̴ϴÙ

if you prefer use in keyboard ***
Å°º¸µå·Î ÇϽô °É ¿øÇϽøé ****

here we go

****** announces *** argument functions..

this is import because it'll start picking up variable

names in the system ***

if it knows particular parameters * system ca** name this,

if it's clear your program is also uses init the same way

so uhm.. we can see some of the funcions on

here, and again * mark return ******next *** here

but some of the key pieces ***just you wanna do

in terms in naming variables if * when you can go up?

and put in the functions proto type

so down here, i've got arguments to this program

i've got a list (least?) one** name

i can go up here and press ***
ÀÌÁ¦ ÇÁ·ÎÆ÷ ŸÀÔ ±â´ÉÀ» ½ÇÇàÇغ¸±â À§ÇØ

to start function proto type
À§·Î ¿Ã¶ó°¡¼­ * ¹öÆ°À» ´­·¯º¸°Ú½À´Ï´Ù.

now *****another prompt to ****

i'm using c++ here which is uhmm

most of function was programmed ***

exception handler srewed up ****

  Hit : 1786     Date : 2011/08/02 08:02



    
72   12¹ø ÆÄÆ® (ºóÄ­ÀÌ ¸¹¾Æ¿ä)     Prox
08/03 2016
71   ¹ø¿ª part 7 status     babyalpha
08/21 2001
70   ±ÞÇÑ´ë·Î 6¹øÆÄÆ®[1]     bluemario
05/11 1916
69   ÆÄÆ®1 ºÐ·®ÀÔ´Ï´Ù.     ¸Û¸Û
08/02 1895
68   [Á¦ 2ȸ] ¹ø¿ª ÆÄÆ®°¡ Á¤ÇØÁ³½À´Ï´Ù[12]     ¸Û¸Û
07/18 1892
67   µÎ ¹ø° ¹ø¿ª ´ë»ó °ü·Ã..[5]     ¸Û¸Û
06/16 1887
66   3¹ø° ÆÄÆ® ¾Èµé¸®´Â ºÎºÐ »©°í ´ÙÇß½À´Ï´Ù[9]     ahotsuna
05/04 1886
65   [1ȸ] recon - auditing source code ºÐÇÒ ÆÄÀÏÀÔ´Ï´Ù (ÃÑ 9°³)[8]     ¸Û¸Û
05/04 1878
64   À¯Æ©ºê µ¿¿µ»ó ¾÷·Îµå[3]     d4rkang3l
05/16 1856
63   Á¦ 1ȸ ¹ø¿ª ÀÚ¸· ´Þ¾ÆÁÖ½Ç ºÐ ã½À´Ï´Ù~[3]     ¸Û¸Û
05/25 1845
62   ¾ÕÀ¸·Î ¸®½º´×&¹ø¿ªÇϸé ÁÁ°Ú´Ù°í »ý°¢µÇ´Â µ¿¿µ»óµéÀÔ´Ï´Ù.     ¸Û¸Û
05/15 1828
61   ÀÚ¸· - darkangel´Ô °Í°ú lycan´Ô °Í ÅëÇÕ     ¸Û¸Û
06/22 1825
60   À§Å° ÆäÀÌÁö º¯°æ ¹× ¸ðµÎ ¸¸µé¾î ³õ°Ú½À´Ï´Ù. + ¸Û¸Û´Ô Çѹø ºÁÁÖ¼¼¿ä[1]     W.H.
05/13 1796
59   ¸¶Áö¸· ÆÄÆ® ÀÔ´Ï´Ù. ´Ê¾î¼­ Á˼ÛÇÕ´Ï´Ù. ¤¾[1]     k1rha
05/12 1788
  6¹ø ÆÄÆ® ¾Èµé¸®´Â °Íµé ¸¹ÀÌ ¸øÇ߳׿䠠   ahotsuna
08/02 1785
57   µ¿¿µ»ó ÆÄÀÏÀÔ´Ï´Ù. <- ÀÌ µ¿¿µ»óÀº Á¤ÇØÁø µ¿¿µ»óÀÌ ¾Æ´Ï¿¡¿ä~~[8]     W.H.
05/27 1775
56   [°øÁö] Á¦ 1ȸ ¹ø¿ª ½ºÄÉÁìÀÔ´Ï´Ù. (ÁøÇà»óȲÀ» °¢ÀÚ ´ñ±Û·Î update)[10]     ¸Û¸Û
05/03 1772
55   [Á¦ 2ȸ] À¯Åõºê ¸µÅ©[1]     lycan
07/16 1767
54   ºÐÇÒµÈ µ¿¿µ»óÀ» À¯Åõºê¿¡ ¿Ã·ÁÁÖ½Ç ºÐ ã½À´Ï´Ù.[2]     ¸Û¸Û
05/15 1749
53   À§¿¡ ¸Û¸Û´ÔÀÌ ¿Ã¸®½Å µ¿¿µ»óÀ¸·Î ÀÛ¾÷ÇØÁÖ¼¼¿ä~ (ÀÌ °Ô½Ã¹°X)[21]     W.H.
05/03 1749
52   [1ȸ] ¿ªÇÒ ºÐ´ãÇÕ´Ï´Ù.[1]     ¸Û¸Û
05/03 1749
51   4¹ø ÆÄÆ® ¸®½º´×&¹ø¿ª ³»¿ëÀÔ´Ï´Ù.[1]     ¸Û¸Û
05/09 1748
50   1¹ø ÆÄÆ® ÀÏ´Ü Áö±Ý±îÁö ÇÑ°Å ¿Ã¸³´Ï´Ù.[2]     W.H.
05/10 1744
49   ÀÛ¾÷ÇÏ´Ù ¸·È÷½Å ºÐ, ±×¸®°í ÀÛ¾÷ ÇÒ´ç ¸ø¹ÞÀ¸½Å ºÐ ºÁÁÖ¼¼¿ä     ¸Û¸Û
05/06 1743
48   Á¦ 2ȸ ¹ø¿ª ÁøÇà»óȲ ´ñ±Û ¹Ù¶ø´Ï´Ù.[9]     ¸Û¸Û
08/02 1736
[1] 2 [3][4]

Copyright 1999-2024 Zeroboard / skin by Hackerschool.org / Secure Patch by Hackerschool.org