代码还原之 pstree (一)

原创已于 2023-11-29 17:02:35 修改 · 1.1k 阅读

18 ·

CC 4.0 BY-SA版权

文章标签：

#c语言 #汇编

于 2023-11-29 16:54:15 首次发布

Assembly 专栏收录该内容

533 篇文章

订阅专栏

本文详细解读了一个C程序，特别是pstree命令的源代码，涉及结构选项的定义、参数传递以及对系统调用ioctl的使用，展示了逆向工程中的一项技术应用。

32位的 pstree 命令，通过逆向的方式还原源代码。错误之处，再来修改；

#include <stdio.h>
#include <string.h>
#include <stdlib.h>
#include <getopt.h>
#include <unistd.h>
#include <signal.h>
#include <fcntl.h>
#include <sys/stat.h>
#include <time.h>
#include <errno.h>
#include <sys/wait.h>
#include <sys/ioctl.h>
#include <locale.h>
#include <libintl.h>
#include <dirent.h>
#include <langinfo.h>

int g_0x804d1a0 = 0;
int g_0x804d0fc = 0;
int g_0x804d0f0 = 0x8c;
int g_0x804d1ac = 0;
int g_0x804d1b0;
int g_0x804d0f8;
int g_0x804d1b4;
int g_0x804d1a8;
int g_0x804d1a4;
int g_0x804d0f4;
int g_0x804d168 = 1; /* optind */

/* Names for the values of the 'has_arg' field of 'struct option'. */
# define no_argument            0
# define required_argument      1
# define optional_argument      2

static struct option long_options[16] =
{
   {"arguments", no_argument, NULL, 'a'},
   {"ascii", no_argument, NULL, 'A'},
   {"compact", no_argument, NULL, 'c'},
   {"vt100", no_argument, NULL, 'G'},
   {"highlight-all", no_argument, NULL, 'h'},
   {"highlight-pid", required_argument, NULL, 'H'},
   {"long", no_argument, NULL, 'l'},
   {"numeric-sort", no_argument, NULL, 'n'},
   {"show-pids", no_argument, NULL, 'p'},
   {"show-pgids", no_argument, NULL, 'g'},
   {"show-parents", no_argument, NULL, 's'},
   {"uid-changes", no_argument, NULL, 'u'},
   {"unicode", no_argument, NULL, 'U'},
   {"version", no_argument, NULL, 'V'},
   {"security-context", no_argument, NULL, 'Z'},
   {NULL, 0, NULL, 0}
};

int g_0x804d1b8 = 0;

/*
* ebp+0x8 = argc
* ebp+0xc = argv
*/

int main(int argc, char **argv)
{
/*8049060:   55                      push   %ebp
8049061:   b9 40 00 00 00          mov    $0x40,%ecx   // ecx=0x40=64
8049066:   89 e5                   mov    %esp,%ebp   // ebp=esp=0xbffff168
8049068:   57                      push   %edi       // esp=0xbffff164
8049069:   56                      push   %esi       // esp=0xbffff160
804906a:   be c0 b9 04 08          mov    $0x804b9c0,%esi   // esi=0x804b9c0 "arguments" note:help info, long_options
804906f:   53                      push   %ebx       // esp = 0xbffff15c
8049070:   83 e4 f0                and    $0xfffffff0,%esp   // esp = 0xbffff150
8049073:   8d a4 24 20 da ff ff    lea    -0x25e0(%esp),%esp   // esp = 0xbfffcb70*/
   char buff_25e0[0x25e0];   // 2424

/*804907a:   8b 45 0c                mov    0xc(%ebp),%eax       // eax = 0xbffff204 = (ebp+0xc)=0xbffff174:0xbffff204 (**argv)
                                                               // /home/share/work/ac-code/command/pstree/reverse/intel-r2/pstree
                                                               // x/x $ebp+8   --> 0x00000001
804907d:   8d 9c 24 d8 00 00 00    lea    0xd8(%esp),%ebx       // ebx = 0xbfffcc48 0xd8=216 216/4=54, buff_d8
8049084:   8d 3b                   lea    (%ebx),%edi           // edi = 0xbfffcc48
8049086:   f3 a5                   rep movsl %ds:(%esi),%es:(%edi)*/
   struct option buff_d8[16];
    char *pgetenv = NULL;

memcpy(buff_d8, long_options, sizeof(long_options));

/*8049088:   89 44 24 4c             mov    %eax,0x4c(%esp)       // 0xbfffcbbc:0x00000000bffff204, eax=0xbffff204, (esp+0x4c)=argv
804908c:   c7 44 24 04 13 54 00    movl   $0x5413,0x4(%esp)   // 0xbfffcb74:0x0000000000005413
8049093:   00 */
   char *pargv = argv[0];
   long int v_0x5413 = 0x5413;

/*8049094:   65 a1 14 00 00 00       mov    %gs:0x14,%eax       // eax=gs:0x14=0x58bdd000   (hui bian)
804909a:   89 84 24 dc 25 00 00    mov    %eax,0x25dc(%esp)   // (esp+0x25dc)=0x58bdd000
80490a1:   31 c0                   xor    %eax,%eax           // eax=0
80490a3:   c7 04 24 01 00 00 00    movl   $0x1,(%esp)           // (esp)=1
80490aa:   8d 44 24 70             lea    0x70(%esp),%eax       // eax=esp+0x70
80490ae:   89 44 24 08             mov    %eax,0x8(%esp)       // (esp+0x8)=esp+0x70
80490b2:   e8 49 fd ff ff          call   8048e00 <ioctl@plt>*/
   int v_0x25dc = 0x58bdd000;
   struct winsize p_0x70;

    // include/uapi/asm-generic/ioctls.h:38:#define TIOCGWINSZ 0x5413
   // extern int ioctl (int __fd, unsigned long int __request, ...) __THROW;   // /usr/include/sys/ioctl.h:41:12:
   int ret = ioctl(1, v_0x5413, &p_0x70);
   printf("ret = %d\n", ret);

/*80490b7: 85 c0 test %eax,%eax // eax=0, sf=0. if eax<0, sf=1
80490b9: 78 0e js 80490c9 <tigetstr@plt+0x79> */ // sf=0, no jump.

if (ret >= 0) {

/*80490bb:   0f b7 44 24 72          movzwl 0x72(%esp),%eax   // eax=0x00000050
80490c0:   66 85 c0                test   %ax,%ax   // ax=0x50, zf=0
80490c3:   0f 85 9d 02 00 00       jne    8049366 <tigetstr@plt+0x316> */ // zf=0, jump
       if (p_0x70.ws_col != 0) {
           // jump 8049366
            g_0x804d0f0 = p_0x70.ws_col;
       }
   }