2026-10-16-DockingCheck

2026-10-16-DockingCheck

十月 16, 2026

DockingCheck

题目地址：https://www.ctfplus.cn/problem-detail/2059190657041305600/description

方向：RE

由于动调太菜，本题目我依旧使用静态分析法。

objdump逆出一大段

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294

Disassembly of section .init:

0000000000001000 <.init>:
    1000:       f3 0f 1e fa             endbr64
    1004:       48 83 ec 08             sub    $0x8,%rsp
    1008:       48 8b 05 d9 2f 00 00    mov    0x2fd9(%rip),%rax        # 3fe8 <__printf_chk@plt+0x2f18>
    100f:       48 85 c0                test   %rax,%rax
    1012:       74 02                   je     1016 <__cxa_finalize@plt-0x6a>
    1014:       ff d0                   call   *%rax
    1016:       48 83 c4 08             add    $0x8,%rsp
    101a:       c3                      ret

Disassembly of section .plt:

0000000000001020 <.plt>:
    1020:       ff 35 7a 2f 00 00       push   0x2f7a(%rip)        # 3fa0 <__printf_chk@plt+0x2ed0>
    1026:       f2 ff 25 7b 2f 00 00    bnd jmp *0x2f7b(%rip)        # 3fa8 <__printf_chk@plt+0x2ed8>
    102d:       0f 1f 00                nopl   (%rax)
    1030:       f3 0f 1e fa             endbr64
    1034:       68 00 00 00 00          push   $0x0
    1039:       f2 e9 e1 ff ff ff       bnd jmp 1020 <__cxa_finalize@plt-0x60>
    103f:       90                      nop
    1040:       f3 0f 1e fa             endbr64
    1044:       68 01 00 00 00          push   $0x1
    1049:       f2 e9 d1 ff ff ff       bnd jmp 1020 <__cxa_finalize@plt-0x60>
    104f:       90                      nop
    1050:       f3 0f 1e fa             endbr64
    1054:       68 02 00 00 00          push   $0x2
    1059:       f2 e9 c1 ff ff ff       bnd jmp 1020 <__cxa_finalize@plt-0x60>
    105f:       90                      nop
    1060:       f3 0f 1e fa             endbr64
    1064:       68 03 00 00 00          push   $0x3
    1069:       f2 e9 b1 ff ff ff       bnd jmp 1020 <__cxa_finalize@plt-0x60>
    106f:       90                      nop
    1070:       f3 0f 1e fa             endbr64
    1074:       68 04 00 00 00          push   $0x4
    1079:       f2 e9 a1 ff ff ff       bnd jmp 1020 <__cxa_finalize@plt-0x60>
    107f:       90                      nop

Disassembly of section .plt.got:

0000000000001080 <__cxa_finalize@plt>:
    1080:       f3 0f 1e fa             endbr64
    1084:       f2 ff 25 6d 2f 00 00    bnd jmp *0x2f6d(%rip)        # 3ff8 <__printf_chk@plt+0x2f28>
    108b:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)

Disassembly of section .plt.sec:

0000000000001090 <puts@plt>:
    1090:       f3 0f 1e fa             endbr64
    1094:       f2 ff 25 15 2f 00 00    bnd jmp *0x2f15(%rip)        # 3fb0 <__printf_chk@plt+0x2ee0>
    109b:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)

00000000000010a0 <__stack_chk_fail@plt>:
    10a0:       f3 0f 1e fa             endbr64
    10a4:       f2 ff 25 0d 2f 00 00    bnd jmp *0x2f0d(%rip)        # 3fb8 <__printf_chk@plt+0x2ee8>
    10ab:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)

00000000000010b0 <fgets@plt>:
    10b0:       f3 0f 1e fa             endbr64
    10b4:       f2 ff 25 05 2f 00 00    bnd jmp *0x2f05(%rip)        # 3fc0 <__printf_chk@plt+0x2ef0>
    10bb:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)

00000000000010c0 <fflush@plt>:
    10c0:       f3 0f 1e fa             endbr64
    10c4:       f2 ff 25 fd 2e 00 00    bnd jmp *0x2efd(%rip)        # 3fc8 <__printf_chk@plt+0x2ef8>
    10cb:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)

00000000000010d0 <__printf_chk@plt>:
    10d0:       f3 0f 1e fa             endbr64
    10d4:       f2 ff 25 f5 2e 00 00    bnd jmp *0x2ef5(%rip)        # 3fd0 <__printf_chk@plt+0x2f00>
    10db:       0f 1f 44 00 00          nopl   0x0(%rax,%rax,1)

Disassembly of section .text:

00000000000010e0 <.text>:
    10e0:       f3 0f 1e fa             endbr64
    10e4:       55                      push   %rbp
    10e5:       48 8d 3d 18 0f 00 00    lea    0xf18(%rip),%rdi        # 2004 <__printf_chk@plt+0xf34>
    10ec:       53                      push   %rbx
    10ed:       48 81 ec 98 00 00 00    sub    $0x98,%rsp
    10f4:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
    10fb:       00 00
    10fd:       48 89 84 24 88 00 00    mov    %rax,0x88(%rsp)
    1104:       00
    1105:       31 c0                   xor    %eax,%eax
    1107:       48 89 e5                mov    %rsp,%rbp
    110a:       e8 81 ff ff ff          call   1090 <puts@plt>
    110f:       48 8d 35 0a 0f 00 00    lea    0xf0a(%rip),%rsi        # 2020 <__printf_chk@plt+0xf50>
    1116:       bf 01 00 00 00          mov    $0x1,%edi
    111b:       31 c0                   xor    %eax,%eax
    111d:       e8 ae ff ff ff          call   10d0 <__printf_chk@plt>
    1122:       48 8b 3d e7 2e 00 00    mov    0x2ee7(%rip),%rdi        # 4010 <stdout@GLIBC_2.2.5>
    1129:       e8 92 ff ff ff          call   10c0 <fflush@plt>
    112e:       48 8b 15 eb 2e 00 00    mov    0x2eeb(%rip),%rdx        # 4020 <stdin@GLIBC_2.2.5>
    1135:       be 80 00 00 00          mov    $0x80,%esi
    113a:       48 89 ef                mov    %rbp,%rdi
    113d:       e8 6e ff ff ff          call   10b0 <fgets@plt>
    1142:       48 89 ea                mov    %rbp,%rdx
    1145:       48 85 c0                test   %rax,%rax
    1148:       0f 84 23 01 00 00       je     1271 <__printf_chk@plt+0x1a1>
    114e:       8b 0a                   mov    (%rdx),%ecx
    1150:       48 83 c2 04             add    $0x4,%rdx
    1154:       8d 81 ff fe fe fe       lea    -0x1010101(%rcx),%eax
    115a:       f7 d1                   not    %ecx
    115c:       21 c8                   and    %ecx,%eax
    115e:       25 80 80 80 80          and    $0x80808080,%eax
    1163:       74 e9                   je     114e <__printf_chk@plt+0x7e>
    1165:       89 c1                   mov    %eax,%ecx
    1167:       c1 e9 10                shr    $0x10,%ecx
    116a:       a9 80 80 00 00          test   $0x8080,%eax
    116f:       0f 44 c1                cmove  %ecx,%eax
    1172:       48 8d 4a 02             lea    0x2(%rdx),%rcx
    1176:       48 0f 44 d1             cmove  %rcx,%rdx
    117a:       89 c3                   mov    %eax,%ebx
    117c:       00 c3                   add    %al,%bl
    117e:       48 83 da 03             sbb    $0x3,%rdx
    1182:       48 29 ea                sub    %rbp,%rdx
    1185:       0f 84 a0 00 00 00       je     122b <__printf_chk@plt+0x15b>
    118b:       48 8d 44 15 ff          lea    -0x1(%rbp,%rdx,1),%rax
    1190:       80 38 0a                cmpb   $0xa,(%rax)
    1193:       0f 84 d0 00 00 00       je     1269 <__printf_chk@plt+0x199>
    1199:       48 83 c9 ff             or     $0xffffffffffffffff,%rcx
    119d:       31 c0                   xor    %eax,%eax
    119f:       48 89 ef                mov    %rbp,%rdi
    11a2:       f2 ae                   repnz scas %es:(%rdi),%al
    11a4:       48 83 f9 e2             cmp    $0xffffffffffffffe2,%rcx
    11a8:       0f 85 7d 00 00 00       jne    122b <__printf_chk@plt+0x15b>
    11ae:       41 ba 17 00 00 00       mov    $0x17,%r10d
    11b4:       41 b9 06 00 00 00       mov    $0x6,%r9d
    11ba:       41 b8 3c 00 00 00       mov    $0x3c,%r8d
    11c0:       31 f6                   xor    %esi,%esi
    11c2:       48 8d 1d b7 0e 00 00    lea    0xeb7(%rip),%rbx        # 2080 <__printf_chk@plt+0xfb0>
    11c9:       49 bb 25 49 92 24 49    movabs $0x4924924924924925,%r11
    11d0:       92 24 49
    11d3:       eb 15                   jmp    11ea <__printf_chk@plt+0x11a>
    11d5:       0f 1f 00                nopl   (%rax)
    11d8:       48 83 c6 01             add    $0x1,%rsi
    11dc:       41 83 c1 0d             add    $0xd,%r9d
    11e0:       41 83 c2 11             add    $0x11,%r10d
    11e4:       48 83 fe 1c             cmp    $0x1c,%rsi
    11e8:       74 6f                   je     1259 <__printf_chk@plt+0x189>
    11ea:       48 89 f0                mov    %rsi,%rax
    11ed:       0f b6 7c 35 00          movzbl 0x0(%rbp,%rsi,1),%edi
    11f2:       48 89 f1                mov    %rsi,%rcx
    11f5:       49 f7 eb                imul   %r11
    11f8:       48 89 f0                mov    %rsi,%rax
    11fb:       48 c1 f8 3f             sar    $0x3f,%rax
    11ff:       44 31 cf                xor    %r9d,%edi
    1202:       44 01 d7                add    %r10d,%edi
    1205:       48 d1 fa                sar    $1,%rdx
    1208:       48 29 c2                sub    %rax,%rdx
    120b:       48 8d 04 d5 00 00 00    lea    0x0(,%rdx,8),%rax
    1212:       00
    1213:       48 29 d0                sub    %rdx,%rax
    1216:       48 29 c1                sub    %rax,%rcx
    1219:       83 c1 01                add    $0x1,%ecx
    121c:       40 d2 c7                rol    %cl,%dil
    121f:       83 f7 a5                xor    $0xffffffa5,%edi
    1222:       41 31 f8                xor    %edi,%r8d
    1225:       44 3a 04 33             cmp    (%rbx,%rsi,1),%r8b
    1229:       74 ad                   je     11d8 <__printf_chk@plt+0x108>
    122b:       48 8d 3d 0d 0e 00 00    lea    0xe0d(%rip),%rdi        # 203f <__printf_chk@plt+0xf6f>
    1232:       e8 59 fe ff ff          call   1090 <puts@plt>
    1237:       b8 01 00 00 00          mov    $0x1,%eax
    123c:       48 8b 9c 24 88 00 00    mov    0x88(%rsp),%rbx
    1243:       00
    1244:       64 48 33 1c 25 28 00    xor    %fs:0x28,%rbx
    124b:       00 00
    124d:       75 35                   jne    1284 <__printf_chk@plt+0x1b4>
    124f:       48 81 c4 98 00 00 00    add    $0x98,%rsp
    1256:       5b                      pop    %rbx
    1257:       5d                      pop    %rbp
    1258:       c3                      ret
    1259:       48 8d 3d f8 0d 00 00    lea    0xdf8(%rip),%rdi        # 2058 <__printf_chk@plt+0xf88>
    1260:       e8 2b fe ff ff          call   1090 <puts@plt>
    1265:       31 c0                   xor    %eax,%eax
    1267:       eb d3                   jmp    123c <__printf_chk@plt+0x16c>
    1269:       c6 00 00                movb   $0x0,(%rax)
    126c:       e9 28 ff ff ff          jmp    1199 <__printf_chk@plt+0xc9>
    1271:       48 8d 3d b6 0d 00 00    lea    0xdb6(%rip),%rdi        # 202e <__printf_chk@plt+0xf5e>
    1278:       e8 13 fe ff ff          call   1090 <puts@plt>
    127d:       b8 01 00 00 00          mov    $0x1,%eax
    1282:       eb b8                   jmp    123c <__printf_chk@plt+0x16c>
    1284:       e8 17 fe ff ff          call   10a0 <__stack_chk_fail@plt>
    1289:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
    1290:       f3 0f 1e fa             endbr64
    1294:       31 ed                   xor    %ebp,%ebp
    1296:       49 89 d1                mov    %rdx,%r9
    1299:       5e                      pop    %rsi
    129a:       48 89 e2                mov    %rsp,%rdx
    129d:       48 83 e4 f0             and    $0xfffffffffffffff0,%rsp
    12a1:       50                      push   %rax
    12a2:       54                      push   %rsp
    12a3:       4c 8d 05 46 01 00 00    lea    0x146(%rip),%r8        # 13f0 <__printf_chk@plt+0x320>
    12aa:       48 8d 0d cf 00 00 00    lea    0xcf(%rip),%rcx        # 1380 <__printf_chk@plt+0x2b0>
    12b1:       48 8d 3d 28 fe ff ff    lea    -0x1d8(%rip),%rdi        # 10e0 <__printf_chk@plt+0x10>
    12b8:       ff 15 22 2d 00 00       call   *0x2d22(%rip)        # 3fe0 <__printf_chk@plt+0x2f10>
    12be:       f4                      hlt
    12bf:       90                      nop
    12c0:       48 8d 3d 49 2d 00 00    lea    0x2d49(%rip),%rdi        # 4010 <stdout@GLIBC_2.2.5>
    12c7:       48 8d 05 42 2d 00 00    lea    0x2d42(%rip),%rax        # 4010 <stdout@GLIBC_2.2.5>
    12ce:       48 39 f8                cmp    %rdi,%rax
    12d1:       74 15                   je     12e8 <__printf_chk@plt+0x218>
    12d3:       48 8b 05 fe 2c 00 00    mov    0x2cfe(%rip),%rax        # 3fd8 <__printf_chk@plt+0x2f08>
    12da:       48 85 c0                test   %rax,%rax
    12dd:       74 09                   je     12e8 <__printf_chk@plt+0x218>
    12df:       ff e0                   jmp    *%rax
    12e1:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
    12e8:       c3                      ret
    12e9:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
    12f0:       48 8d 3d 19 2d 00 00    lea    0x2d19(%rip),%rdi        # 4010 <stdout@GLIBC_2.2.5>
    12f7:       48 8d 35 12 2d 00 00    lea    0x2d12(%rip),%rsi        # 4010 <stdout@GLIBC_2.2.5>
    12fe:       48 29 fe                sub    %rdi,%rsi
    1301:       48 89 f0                mov    %rsi,%rax
    1304:       48 c1 ee 3f             shr    $0x3f,%rsi
    1308:       48 c1 f8 03             sar    $0x3,%rax
    130c:       48 01 c6                add    %rax,%rsi
    130f:       48 d1 fe                sar    $1,%rsi
    1312:       74 14                   je     1328 <__printf_chk@plt+0x258>
    1314:       48 8b 05 d5 2c 00 00    mov    0x2cd5(%rip),%rax        # 3ff0 <__printf_chk@plt+0x2f20>
    131b:       48 85 c0                test   %rax,%rax
    131e:       74 08                   je     1328 <__printf_chk@plt+0x258>
    1320:       ff e0                   jmp    *%rax
    1322:       66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)
    1328:       c3                      ret
    1329:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
    1330:       f3 0f 1e fa             endbr64
    1334:       80 3d ed 2c 00 00 00    cmpb   $0x0,0x2ced(%rip)        # 4028 <stdin@GLIBC_2.2.5+0x8>
    133b:       75 2b                   jne    1368 <__printf_chk@plt+0x298>
    133d:       55                      push   %rbp
    133e:       48 83 3d b2 2c 00 00    cmpq   $0x0,0x2cb2(%rip)        # 3ff8 <__printf_chk@plt+0x2f28>
    1345:       00
    1346:       48 89 e5                mov    %rsp,%rbp
    1349:       74 0c                   je     1357 <__printf_chk@plt+0x287>
    134b:       48 8b 3d b6 2c 00 00    mov    0x2cb6(%rip),%rdi        # 4008 <__printf_chk@plt+0x2f38>
    1352:       e8 29 fd ff ff          call   1080 <__cxa_finalize@plt>
    1357:       e8 64 ff ff ff          call   12c0 <__printf_chk@plt+0x1f0>
    135c:       c6 05 c5 2c 00 00 01    movb   $0x1,0x2cc5(%rip)        # 4028 <stdin@GLIBC_2.2.5+0x8>
    1363:       5d                      pop    %rbp
    1364:       c3                      ret
    1365:       0f 1f 00                nopl   (%rax)
    1368:       c3                      ret
    1369:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
    1370:       f3 0f 1e fa             endbr64
    1374:       e9 77 ff ff ff          jmp    12f0 <__printf_chk@plt+0x220>
    1379:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
    1380:       f3 0f 1e fa             endbr64
    1384:       41 57                   push   %r15
    1386:       4c 8d 3d 0b 2a 00 00    lea    0x2a0b(%rip),%r15        # 3d98 <__printf_chk@plt+0x2cc8>
    138d:       41 56                   push   %r14
    138f:       49 89 d6                mov    %rdx,%r14
    1392:       41 55                   push   %r13
    1394:       49 89 f5                mov    %rsi,%r13
    1397:       41 54                   push   %r12
    1399:       41 89 fc                mov    %edi,%r12d
    139c:       55                      push   %rbp
    139d:       48 8d 2d fc 29 00 00    lea    0x29fc(%rip),%rbp        # 3da0 <__printf_chk@plt+0x2cd0>
    13a4:       53                      push   %rbx
    13a5:       4c 29 fd                sub    %r15,%rbp
    13a8:       48 83 ec 08             sub    $0x8,%rsp
    13ac:       e8 4f fc ff ff          call   1000 <__cxa_finalize@plt-0x80>
    13b1:       48 c1 fd 03             sar    $0x3,%rbp
    13b5:       74 1f                   je     13d6 <__printf_chk@plt+0x306>
    13b7:       31 db                   xor    %ebx,%ebx
    13b9:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
    13c0:       4c 89 f2                mov    %r14,%rdx
    13c3:       4c 89 ee                mov    %r13,%rsi
    13c6:       44 89 e7                mov    %r12d,%edi
    13c9:       41 ff 14 df             call   *(%r15,%rbx,8)
    13cd:       48 83 c3 01             add    $0x1,%rbx
    13d1:       48 39 dd                cmp    %rbx,%rbp
    13d4:       75 ea                   jne    13c0 <__printf_chk@plt+0x2f0>
    13d6:       48 83 c4 08             add    $0x8,%rsp
    13da:       5b                      pop    %rbx
    13db:       5d                      pop    %rbp
    13dc:       41 5c                   pop    %r12
    13de:       41 5d                   pop    %r13
    13e0:       41 5e                   pop    %r14
    13e2:       41 5f                   pop    %r15
    13e4:       c3                      ret
    13e5:       66 66 2e 0f 1f 84 00    data16 cs nopw 0x0(%rax,%rax,1)
    13ec:       00 00 00 00
    13f0:       f3 0f 1e fa             endbr64
    13f4:       c3                      ret

Disassembly of section .fini:

00000000000013f8 <.fini>:
    13f8:       f3 0f 1e fa             endbr64
    13fc:       48 83 ec 08             sub    $0x8,%rsp
    1400:       48 83 c4 08             add    $0x8,%rsp
    1404:       c3                      ret

看.text段就行了

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
10e0:       f3 0f 1e fa             endbr64 
   10e4:       55                      push   %rbp
   10e5:       48 8d 3d 18 0f 00 00    lea    0xf18(%rip),%rdi        # 2004 <__printf_chk@plt+0xf34>
   10ec:       53                      push   %rbx
   10ed:       48 81 ec 98 00 00 00    sub    $0x98,%rsp
   10f4:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
   10fb:       00 00
   10fd:       48 89 84 24 88 00 00    mov    %rax,0x88(%rsp)
   1104:       00
   1105:       31 c0                   xor    %eax,%eax
   1107:       48 89 e5                mov    %rsp,%rbp
   110a:       e8 81 ff ff ff          call   1090 <puts@plt>
   110f:       48 8d 35 0a 0f 00 00    lea    0xf0a(%rip),%rsi        # 2020 <__printf_chk@plt+0xf50>
   1116:       bf 01 00 00 00          mov    $0x1,%edi
   111b:       31 c0                   xor    %eax,%eax
   111d:       e8 ae ff ff ff          call   10d0 <__printf_chk@plt>
   1122:       48 8b 3d e7 2e 00 00    mov    0x2ee7(%rip),%rdi        # 4010 <stdout@GLIBC_2.2.5>
   1129:       e8 92 ff ff ff          call   10c0 <fflush@plt>
   112e:       48 8b 15 eb 2e 00 00    mov    0x2eeb(%rip),%rdx        # 4020 <stdin@GLIBC_2.2.5>
   1135:       be 80 00 00 00          mov    $0x80,%esi
   113a:       48 89 ef                mov    %rbp,%rdi
   113d:       e8 6e ff ff ff          call   10b0 <fgets@plt>
   1142:       48 89 ea                mov    %rbp,%rdx
   1145:       48 85 c0                test   %rax,%rax
   1148:       0f 84 23 01 00 00       je     1271 <__printf_chk@plt+0x1a1>
   114e:       8b 0a                   mov    (%rdx),%ecx
   1150:       48 83 c2 04             add    $0x4,%rdx
   1154:       8d 81 ff fe fe fe       lea    -0x1010101(%rcx),%eax
   115a:       f7 d1                   not    %ecx
   115c:       21 c8                   and    %ecx,%eax
   115e:       25 80 80 80 80          and    $0x80808080,%eax
   1163:       74 e9                   je     114e <__printf_chk@plt+0x7e>
   1165:       89 c1                   mov    %eax,%ecx
   1167:       c1 e9 10                shr    $0x10,%ecx
   116a:       a9 80 80 00 00          test   $0x8080,%eax
   116f:       0f 44 c1                cmove  %ecx,%eax
   1172:       48 8d 4a 02             lea    0x2(%rdx),%rcx
   1176:       48 0f 44 d1             cmove  %rcx,%rdx
   117a:       89 c3                   mov    %eax,%ebx
   117c:       00 c3                   add    %al,%bl
   117e:       48 83 da 03             sbb    $0x3,%rdx
   1182:       48 29 ea                sub    %rbp,%rdx
   1185:       0f 84 a0 00 00 00       je     122b <__printf_chk@plt+0x15b>
   118b:       48 8d 44 15 ff          lea    -0x1(%rbp,%rdx,1),%rax
   1190:       80 38 0a                cmpb   $0xa,(%rax)
   1193:       0f 84 d0 00 00 00       je     1269 <__printf_chk@plt+0x199>
   1199:       48 83 c9 ff             or     $0xffffffffffffffff,%rcx
   119d:       31 c0                   xor    %eax,%eax
   119f:       48 89 ef                mov    %rbp,%rdi
   11a2:       f2 ae                   repnz scas %es:(%rdi),%al
   11a4:       48 83 f9 e2             cmp    $0xffffffffffffffe2,%rcx
   11a8:       0f 85 7d 00 00 00       jne    122b <__printf_chk@plt+0x15b>
   11ae:       41 ba 17 00 00 00       mov    $0x17,%r10d
   11b4:       41 b9 06 00 00 00       mov    $0x6,%r9d
   11ba:       41 b8 3c 00 00 00       mov    $0x3c,%r8d
   11c0:       31 f6                   xor    %esi,%esi
   11c2:       48 8d 1d b7 0e 00 00    lea    0xeb7(%rip),%rbx        # 2080 <__printf_chk@plt+0xfb0>
   11c9:       49 bb 25 49 92 24 49    movabs $0x4924924924924925,%r11
   11d0:       92 24 49
   11d3:       eb 15                   jmp    11ea <__printf_chk@plt+0x11a>
   11d5:       0f 1f 00                nopl   (%rax)
   11d8:       48 83 c6 01             add    $0x1,%rsi
   11dc:       41 83 c1 0d             add    $0xd,%r9d
   11e0:       41 83 c2 11             add    $0x11,%r10d
   11e4:       48 83 fe 1c             cmp    $0x1c,%rsi
   11e8:       74 6f                   je     1259 <__printf_chk@plt+0x189>
   11ea:       48 89 f0                mov    %rsi,%rax
   11ed:       0f b6 7c 35 00          movzbl 0x0(%rbp,%rsi,1),%edi
   11f2:       48 89 f1                mov    %rsi,%rcx
   11f5:       49 f7 eb                imul   %r11
   11f8:       48 89 f0                mov    %rsi,%rax
   11fb:       48 c1 f8 3f             sar    $0x3f,%rax
   11ff:       44 31 cf                xor    %r9d,%edi
   1202:       44 01 d7                add    %r10d,%edi
   1205:       48 d1 fa                sar    $1,%rdx
   1208:       48 29 c2                sub    %rax,%rdx
   120b:       48 8d 04 d5 00 00 00    lea    0x0(,%rdx,8),%rax
   1212:       00
   1213:       48 29 d0                sub    %rdx,%rax
   1216:       48 29 c1                sub    %rax,%rcx
   1219:       83 c1 01                add    $0x1,%ecx
   121c:       40 d2 c7                rol    %cl,%dil
   121f:       83 f7 a5                xor    $0xffffffa5,%edi
   1222:       41 31 f8                xor    %edi,%r8d
   1225:       44 3a 04 33             cmp    (%rbx,%rsi,1),%r8b
   1229:       74 ad                   je     11d8 <__printf_chk@plt+0x108>
   122b:       48 8d 3d 0d 0e 00 00    lea    0xe0d(%rip),%rdi        # 203f <__printf_chk@plt+0xf6f>
   1232:       e8 59 fe ff ff          call   1090 <puts@plt>
   1237:       b8 01 00 00 00          mov    $0x1,%eax
   123c:       48 8b 9c 24 88 00 00    mov    0x88(%rsp),%rbx
   1243:       00
   1244:       64 48 33 1c 25 28 00    xor    %fs:0x28,%rbx
   124b:       00 00
   124d:       75 35                   jne    1284 <__printf_chk@plt+0x1b4>
   124f:       48 81 c4 98 00 00 00    add    $0x98,%rsp
   1256:       5b                      pop    %rbx
   1257:       5d                      pop    %rbp
   1258:       c3                      ret
   1259:       48 8d 3d f8 0d 00 00    lea    0xdf8(%rip),%rdi        # 2058 <__printf_chk@plt+0xf88>
   1260:       e8 2b fe ff ff          call   1090 <puts@plt>
   1265:       31 c0                   xor    %eax,%eax
   1267:       eb d3                   jmp    123c <__printf_chk@plt+0x16c>
   1269:       c6 00 00                movb   $0x0,(%rax)
   126c:       e9 28 ff ff ff          jmp    1199 <__printf_chk@plt+0xc9>
   1271:       48 8d 3d b6 0d 00 00    lea    0xdb6(%rip),%rdi        # 202e <__printf_chk@plt+0xf5e>
   1278:       e8 13 fe ff ff          call   1090 <puts@plt>
   127d:       b8 01 00 00 00          mov    $0x1,%eax
   1282:       eb b8                   jmp    123c <__printf_chk@plt+0x16c>
   1284:       e8 17 fe ff ff          call   10a0 <__stack_chk_fail@plt>
   1289:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
   1290:       f3 0f 1e fa             endbr64
   1294:       31 ed                   xor    %ebp,%ebp
   1296:       49 89 d1                mov    %rdx,%r9
   1299:       5e                      pop    %rsi
   129a:       48 89 e2                mov    %rsp,%rdx
   129d:       48 83 e4 f0             and    $0xfffffffffffffff0,%rsp
   12a1:       50                      push   %rax
   12a2:       54                      push   %rsp
   12a3:       4c 8d 05 46 01 00 00    lea    0x146(%rip),%r8        # 13f0 <__printf_chk@plt+0x320>
   12aa:       48 8d 0d cf 00 00 00    lea    0xcf(%rip),%rcx        # 1380 <__printf_chk@plt+0x2b0>
   12b1:       48 8d 3d 28 fe ff ff    lea    -0x1d8(%rip),%rdi        # 10e0 <__printf_chk@plt+0x10>
   12b8:       ff 15 22 2d 00 00       call   *0x2d22(%rip)        # 3fe0 <__printf_chk@plt+0x2f10>
   12be:       f4                      hlt
   12bf:       90                      nop
   12c0:       48 8d 3d 49 2d 00 00    lea    0x2d49(%rip),%rdi        # 4010 <stdout@GLIBC_2.2.5>
   12c7:       48 8d 05 42 2d 00 00    lea    0x2d42(%rip),%rax        # 4010 <stdout@GLIBC_2.2.5>
   12ce:       48 39 f8                cmp    %rdi,%rax
   12d1:       74 15                   je     12e8 <__printf_chk@plt+0x218>
   12d3:       48 8b 05 fe 2c 00 00    mov    0x2cfe(%rip),%rax        # 3fd8 <__printf_chk@plt+0x2f08>
   12da:       48 85 c0                test   %rax,%rax
   12dd:       74 09                   je     12e8 <__printf_chk@plt+0x218>
   12df:       ff e0                   jmp    *%rax
   12e1:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
   12e8:       c3                      ret
   12e9:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
   12f0:       48 8d 3d 19 2d 00 00    lea    0x2d19(%rip),%rdi        # 4010 <stdout@GLIBC_2.2.5>
   12f7:       48 8d 35 12 2d 00 00    lea    0x2d12(%rip),%rsi        # 4010 <stdout@GLIBC_2.2.5>
   12fe:       48 29 fe                sub    %rdi,%rsi
   1301:       48 89 f0                mov    %rsi,%rax
   1304:       48 c1 ee 3f             shr    $0x3f,%rsi
   1308:       48 c1 f8 03             sar    $0x3,%rax
   130c:       48 01 c6                add    %rax,%rsi
   130f:       48 d1 fe                sar    $1,%rsi
   1312:       74 14                   je     1328 <__printf_chk@plt+0x258>
   1314:       48 8b 05 d5 2c 00 00    mov    0x2cd5(%rip),%rax        # 3ff0 <__printf_chk@plt+0x2f20>
   131b:       48 85 c0                test   %rax,%rax
   131e:       74 08                   je     1328 <__printf_chk@plt+0x258>
   1320:       ff e0                   jmp    *%rax
   1322:       66 0f 1f 44 00 00       nopw   0x0(%rax,%rax,1)
   1328:       c3                      ret
   1329:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
   1330:       f3 0f 1e fa             endbr64
   1334:       80 3d ed 2c 00 00 00    cmpb   $0x0,0x2ced(%rip)        # 4028 <stdin@GLIBC_2.2.5+0x8>
   133b:       75 2b                   jne    1368 <__printf_chk@plt+0x298>
   133d:       55                      push   %rbp
   133e:       48 83 3d b2 2c 00 00    cmpq   $0x0,0x2cb2(%rip)        # 3ff8 <__printf_chk@plt+0x2f28>
   1345:       00
   1346:       48 89 e5                mov    %rsp,%rbp
   1349:       74 0c                   je     1357 <__printf_chk@plt+0x287>
   134b:       48 8b 3d b6 2c 00 00    mov    0x2cb6(%rip),%rdi        # 4008 <__printf_chk@plt+0x2f38>
   1352:       e8 29 fd ff ff          call   1080 <__cxa_finalize@plt>
   1357:       e8 64 ff ff ff          call   12c0 <__printf_chk@plt+0x1f0>
   135c:       c6 05 c5 2c 00 00 01    movb   $0x1,0x2cc5(%rip)        # 4028 <stdin@GLIBC_2.2.5+0x8>
   1363:       5d                      pop    %rbp
   1364:       c3                      ret
   1365:       0f 1f 00                nopl   (%rax)
   1368:       c3                      ret
   1369:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
   1370:       f3 0f 1e fa             endbr64
   1374:       e9 77 ff ff ff          jmp    12f0 <__printf_chk@plt+0x220>
   1379:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
   1380:       f3 0f 1e fa             endbr64
   1384:       41 57                   push   %r15
   1386:       4c 8d 3d 0b 2a 00 00    lea    0x2a0b(%rip),%r15        # 3d98 <__printf_chk@plt+0x2cc8>
   138d:       41 56                   push   %r14
   138f:       49 89 d6                mov    %rdx,%r14
   1392:       41 55                   push   %r13
   1394:       49 89 f5                mov    %rsi,%r13
   1397:       41 54                   push   %r12
   1399:       41 89 fc                mov    %edi,%r12d
   139c:       55                      push   %rbp
   139d:       48 8d 2d fc 29 00 00    lea    0x29fc(%rip),%rbp        # 3da0 <__printf_chk@plt+0x2cd0>
   13a4:       53                      push   %rbx
   13a5:       4c 29 fd                sub    %r15,%rbp
   13a8:       48 83 ec 08             sub    $0x8,%rsp
   13ac:       e8 4f fc ff ff          call   1000 <__cxa_finalize@plt-0x80>
   13b1:       48 c1 fd 03             sar    $0x3,%rbp
   13b5:       74 1f                   je     13d6 <__printf_chk@plt+0x306>
   13b7:       31 db                   xor    %ebx,%ebx
   13b9:       0f 1f 80 00 00 00 00    nopl   0x0(%rax)
   13c0:       4c 89 f2                mov    %r14,%rdx
   13c3:       4c 89 ee                mov    %r13,%rsi
   13c6:       44 89 e7                mov    %r12d,%edi
   13c9:       41 ff 14 df             call   *(%r15,%rbx,8)
   13cd:       48 83 c3 01             add    $0x1,%rbx
   13d1:       48 39 dd                cmp    %rbx,%rbp
   13d4:       75 ea                   jne    13c0 <__printf_chk@plt+0x2f0>
   13d6:       48 83 c4 08             add    $0x8,%rsp
   13da:       5b                      pop    %rbx
   13db:       5d                      pop    %rbp
   13dc:       41 5c                   pop    %r12
   13de:       41 5d                   pop    %r13
   13e0:       41 5e                   pop    %r14
   13e2:       41 5f                   pop    %r15
   13e4:       c3                      ret
   13e5:       66 66 2e 0f 1f 84 00    data16 cs nopw 0x0(%rax,%rax,1)
   13ec:       00 00 00 00
   13f0:       f3 0f 1e fa             endbr64
   13f4:       c3                      ret

1.看main 函数 （AT&T真的烦！）

0x10e0开始 往下看

略过 控制流保护，栈帧基址

还有这段

1
2
3
4
5
6
7
8
9
10ec:       53                      push   %rbx
10ed:       48 81 ec 98 00 00 00    sub    $0x98,%rsp
10f4:       64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
10fb:       00 00
10fd:       48 89 84 24 88 00 00    mov    %rax,0x88(%rsp)
1104:       00
1105:       31 c0                   xor    %eax,%eax
1107:       48 89 e5                mov    %rsp,%rbp
110a:       e8 81 ff ff ff          call   1090 <puts@plt>

canary 看了没啥用

防栈溢出的，这又不是pwn！

跳过一个打印

1
2
3
4
5
6
7
<__printf_chk@plt+0xf50>
    1116:       bf 01 00 00 00          mov    $0x1,%edi
    111b:       31 c0                   xor    %eax,%eax
    111d:       e8 ae ff ff ff          call   10d0 <__printf_chk@plt>
    1122:       48 8b 3d e7 2e 00 00    mov    0x2ee7(%rip),%rdi        # 4010 <stdout@GLIBC_2.2.5>
    1129:       e8 92 ff ff ff          call   10c0 <fflush@plt>
    112e:       48 8b 15 eb 2e 00 00    mov    0x2eeb(%rip),%rdx        # 4020

然后来到1135行

113d: e8 6e ff ff ff call 10b0 <fgets@plt>

关键信息 fget 可以读取字符串

1
2
3
4
5
6
7
114e: mov    (%rdx), %ecx
1150: add    $0x4, %rdx 
1154: lea    -0x1010101(%rcx), %eax
115a: not    %ecx
115c: and    %ecx, %eax
115e: and    $0x80808080, %eax
1163: je     114e

mov (%rdx), %ecx 操作数是 %ecx，宽度是 32 位 读出4字节

add $0x4, %rdx指针移动4字节

1154: lea -0x1010101(%rcx), %eax利用位运算，判断 4 个字节中是否存在 0x00

用 0x80808080 过滤最高位

常量：

1
0x80808080 = 10000000 10000000 10000000 10000000

它的每个字节都只有最高位是 1。

因此：

1
eax &= 0x80808080;

就是只保留 4 个字节的最高位。

如果结果是 0，说明没有检测到零字节；如果结果非零，就说明检测到了零字节。

然后通过 je 114e 跳回 实现循环

因此这段实现的是 按 4 字节批量检测零字节

为什么要这样做？

：寻找字符串 \0的结束位置，来计算字符串长度

而且4字节检查更加高效（我又悟了）

接着往下看

1
2
3
4
1199: or  $0xffffffffffffffff,%rcx   ; rcx = -1
119f: mov %rbp,%rdi                  ; 从 input 开始
11a2: repnz scas %es:(%rdi),%al      ; 找 '\0'
11a4: cmp $0xffffffffffffffe2,%rcx

这里再次扫描一遍\0是为了确认，输入长度是否恰好是28字节，前面则是在确认换行符

简称：求长度

然后读到 11c9 movabs $0x4924924924924925,%r11

movabs 0x4924924924924925?

这个是编译器牛逼的点，用乘代替除

魔数：

1
0x4924924924924925

它的十进制值是：

[ 5270498306774157605 ]

它接近：

[ \frac{2^{65}}{7} ]

编译器可以利用乘法结果的高位，近似计算整数除法，再通过移位和修正得到精确的商。

你后面看到的指令正是在完成这个过程：

1
2
3
4
5
6
1205: sar    $1, %rdx
1208: sub    %rax, %rdx
1213: lea    0x0(,%rdx,8), %rax
1218: sub    %rdx, %rax
121b: sub    %rax, %rcx
121e: add    $0x1, %ecx

其中：

1
2
lea 0x0(,%rdx,8), %rax
sub %rdx, %rax

等价于：

1
rax = rdx * 8 - rdx;

也就是：

[ rax=7q ]

然后通过减法计算索引除以 7 后的余数，供后续的字符变换使用。

真的复杂…

最后

1
2
3
4
5
6
7
8
11ed: movzbl 0x0(%rbp,%rsi,1),%edi   ; edi = input[i]
11ff: xor %r9d,%edi                  ; edi = input[i] ^ r9
1202: add %r10d,%edi                 ; edi = (input[i]^r9) + r10
121c: rol %cl,%dil                   ; 循环左移
121f: xor $0xffffffa5,%edi
1222: xor %edi,%r8d                  ; acc ^= 上一步
1225: cmp (%rbx,%rsi,1),%r8b         ; acc 低字节 == table[i] ?
1229: je  11d8                       ; 相等继续，否则 fail

寻找密文：

11c2: lea 0xeb7(%rip),%rbx # 2080 给出线索

1
2
3
4
5
6
7
8
(base) ┌──(cure㉿LAPTOP-CMAM5D0J)-[~]
└─$ objdump -s --start-address=0x2080 --stop-address=0x209c /mnt/c/Users/33454/Downloads/RE/1/dock_check/dock_check

/mnt/c/Users/33454/Downloads/RE/1/dock_check/dock_check：     文件格式 elf64-x86-64

Contents of section .rodata:
 2080 774c3ad6 e027d533 14d6fae9 e037297e  wL:..'.3.....7)~
 2090 3d946db3 7a56a0ba bf07a37b           =.m.zV.....{

拿到

77 4c 3a d6 e0 27 d5 33 14 d6 fa e9 e0 37 29 7e 3d 94 6d b3 7a 56 a0 ba bf 07 a3 7b

第 0 轮：i=0，r9=6，r10=23，k=(0%7)+1=1，acc 初值=0x3c=60

  1. f(0) = table[0] ^ acc = 0x77 ^ 0x3c = 0x4b（十进制 75）
  2. f(0) ^ 0xa5 = 0x4b ^ 0xa5 = 0xee（238）
  3. ror8(0xee, 1)：0xee=1110 1110 右循环 1 位 = 0111 0111 = 0x77（119）
  4. c = (119 - 23) ^ 6 = 96 ^ 6 = 102 = 字符 ‘f’

第一个字符就是 ‘f’。

然后第 1 轮：acc 变成上一轮的 table[0]=0x77，r9=6+13=19，r10=23+17=40，k=2……同样算出第 2 个字符 ‘l’。

如此循环 28 轮，就得到： f l a g { Z e r o G v m d o c k i n g _ c h e c k }

心累！！！！！！！

心累！！！！！！！

心累！！！！！！！

  1. 1. DockingCheck