Assembly v1.0

  • View
    19

  • Download
    2

Embed Size (px)

Text of Assembly v1.0

  1. 1. MC TIU Gip cc bn c mt ci nhn tng quan v ngn ng Assembly p dng mt s phng php phn tch chng trnh bng tool Olly Hiu c phng php ly BaseAddress bng tool Cheat Engine Page 2
  2. 2. NI DUNG Gii thiu mn hnh Cu hnh chng trinh v ci t plugin cn thit 5 ca s chnh Cc ca s khc Gii thiu tool Ollydbg v1.1 Thanh ghi d liu Thanh ghi con tr C trng thi C php hp ng Cc lnh lin quan n stack Cc lnh lu tr d liu Cc lnh dng cho tnh ton Cc lnh logic Cc lnh so snh Cc lnh nhy c iu kin, khng iu kin Hp ng - Assembly Bi 1 Debug search thng tin cn thit Bi 2 Reverse engine tm CD.Key Code C++ demo Chng trinh demo Gii thiu mn hnh Chng trnh demo Code C++ demo Hng dn s dng tool Cheat Engine 6.2 Page 3
  3. 3. OLLYDBG V1.1
  4. 4. OLLYDBG V1.1 Gii thiu Ollydbg gi tt l Olly, l mt chng trnh dng debug b nh d s dng, trc quan. Hin nay c phin bn 2.0, phin bn ny ang b li font v nh dng Page 5
  5. 5. OLLYDBG V1.1 Ci t v cu hnh Olly Download trn link: http://www.ollydbg.de/ Appearance Directories UDD Path Plugin Path Page 6
  6. 6. OLLYDBG V1.1 5 ca s Chnh Mn hnh chnh ca Olly chia thnh 5 ca s chnh (nhn Tab/shift-Tab chuyn i cc ca s vi nhau). Page 7
  7. 7. OLLYDBG V1.1 5 ca s chnh The Disassembler window: xem code ca chng trnh dng ngn ng ASM The Registers window: ca s cha thng tin chi tit cc thanh ghi: EAX, EBX, ECX, EDX, cc c trng thi The Dump window: xem d liu b nh hai dng hex v ascii The Stack window: cho php xem d liu trc khi c thc hin phi c np vo stack. The Tip window: cho xem thng tin chi tit v cc dng code. Page 8
  8. 8. OLLYDBG V1.1 Registers Window The Registers window Page 9
  9. 9. OLLYDBG V1.1 Stack Window The Stack window Ni lu tr tm thi cc d liu v a ch L cu trc d liu mt chiu (cc phn t c ct vo v ly ra t mt u ca cu trc ny) C ch x l: LIFO (Last In First Out) Page 10
  10. 10. OLLYDBG V1.1 Dump Window The Dump window Ca s hin th ni dung b nh hay file. Cho php tm kim cng nh thc hin cc chc nng chnh sa, thit lp Break points Page 11
  11. 11. OLLYDBG V1.1 ca s khc (1) Cc ca s khc L: m ca s log ca Olly E: m ca s Executables, ca s a ra danh sch nhng file c kh nng thc thi c chng trnh s dng nh file exe, dlls, ocsx, M: m ca s Memory, cho bit thng tin v b nh ang s dng bi chng trnh. T: m ca s Thread, lit k cc Threads ca chng trnh W: m ca s windows H: m ca s Handles Page 12
  12. 12. OLLYDBG V1.1ca s khc (2) C: m ca s CPU. /: m ca s Patches, ca s ny s cho chng ta cc thng tin v nhng g m chng ta edit trong chng trnh K: m ca s call stack, hin th mt danh sch cc lnh call m chng trnh chng ta thc hin B: m ca s Break Points R: m ca s References, ca s ny l kt qu cho nhng g chng ta thc hin chc nng search trong Olly Page 13
  13. 13. ASSEMBLY LANGUAGE
  14. 14. ASSEMBLY Thanh ghi d liu (1) Thanh ghi d liu (32 bit) EAX: thng s dng trong cc lnh s hc v chuyn d liu. EBX: thanh ghi a ch, ch n v tr nh. ECX: xc nh s ln lp ca mt lnh. EDX: lu kt qu ca php * hot /. Thanh ghi d liu (16 bit) AX = AH + AL (H: High; L: Low) BX = BH + BL CX = CH + CL DX = DH + DL Page 15
  15. 15. ASSEMBLY Thanh ghi d liu (2) V d: EAX = 0x12345678H (32 bits) AH = 0x56H (8 bits) AX = 0x5678H AL = 0x78H (8 bits) Cc thanh ghi khc cng c phn tch tng t nh thanh ghi EAX Page 16
  16. 16. ASSEMBLY Thanh ghi con tr Thanh ghi ESP Tr ti nh hin thi ca ngn xp Thanh ghi EBP Truy xut d liu trong ngn xp Thanh ghi EIP Khng b tc ng trc tip bi cc lnh Cho bit a ch ca cu lnh tip theo s c thc hin Page 17
  17. 17. ASSEMBLY C trng thi CF (Carry Flag): C nh Bt khi php tnh va thc hin c s dng bit nh AF (Auxiliary Carry Flag): c nh ph Bt khi php tnh va thc hin c s dng bit nh ph PF (Parity Flag): C chn l Bt khi kt qu ca php tnh va thc hin c chn bit 1 ZF (Zero Flag): C Zero Bt khi kt qu ca php tnh va thc hin = 0 SF (Sign Flag): C du Bt khi kt qu ca php tnh c bit cao nht c bt OF (Overflow Flag): C trn Bt khi php tnh va thc hin gy ra trn s Page 18
  18. 18. ASSEMBLY C php Cu lnh hp ng c c php sau: Tn Ton hng ch Ton hng ngun V d: MOV EAX, 0x12; MOV EAX, DWORD PTR [401000]; Page 19
  19. 19. ASSEMBLYlnh lin quan Stack (1) PUSH Dng ct / thm d liu vo trong ngn xp V d: Page 20
  20. 20. ASSEMBLYlnh lin quan Stack (2) POP Ly gi tr t nh stack vo mt ni m chng ta ch nh nhn gi tr c ly ra V d: POP Eax; // ly gi tr t nh stack v lu n vo thanh ghi EAX Page 21
  21. 21. ASSEMBLYlnh lu tr d liu (1) MOV Gn d liu hay s vo thanh ghi b nh V d: Page 22
  22. 22. ASSEMBLYlnh lu tr d liu (2) MOVSX Thc hin sao chp ni dung ca ton hng ngun, c th l thanh ghi hay nh (vi iu kin ton hng ngun phi c di nh hn ton hng ch) vo ton hng ch ng thi s in y cc bit bn tri bng bt c trng s cao nht (s 1 hay F) V d: Page 23
  23. 23. ASSEMBLYlnh lu tr d liu (3) XCHG Trao i ni dung ca hai ton hng. V d: Page 24
  24. 24. ASSEMBLYlnh lu tr d liu (4) NOP Lnh ny khng thc hin mt cng vic g c ngoi tr vic tng ni dung ca thanh ghi EIP (khng gy ra bt k thay i no trong thanh ghi, stack hay memory). Dng vo vic hy b bt k cu lnh no Page 25
  25. 25. ASSEMBLYlnh cho tnh ton (1) INC Cng thm 1 vo ni dung ca thanh ghi hay mt nh DEC Tr thm 1 vo ni dung ca thanh ghi hay mt nh V d: Page 26
  26. 26. ASSEMBLYlnh cho tnh ton (2) ADD Lnh ny c s dng cng ni dung Gia hai thanh ghi, Mt thanh ghi v mt nh Cng mt s vi mt thanh ghi Cng mt s vi mt nh Lnh sau tng ng ADD EAX, 1 INC EAX Page 27
  27. 27. ASSEMBLYlnh cho tnh ton (3) SUB Lnh ny c s dng tr hai ni dung Gia hai thanh ghi, Mt thanh ghi v mt nh Tr mt s vi mt thanh ghi Tr mt s vi mt nh Lnh sau tng ng SUB EAX, 1 DEC EAX Page 28
  28. 28. ASSEMBLYlnh cho tnh ton (4) MUL C php: MUL Ton hng gc Nhn s khng du, trong trng hp ny ton hng gc l s nhn. Ty theo di ca ton hng gc m ta c ba trng hp t chc php nhn, Nu gc l s 8 bit: AL * Gc S b nhn phi l s 8 bit trong AL Kt qu sau khi nhn lu trong : AX Nu gc l s 16 bit: AX * Gc S b nhn phi l s 16 bit trong AX Kt qu sau khi nhn lu trong DX, AX Nu gc l s 32 bit: EAX * Gc S b nhn phi l s 32 bit trong EAX Kt qu sau khi nhn lu trong EDX, EAX Page 29
  29. 29. ASSEMBLYlnh cho tnh ton (5) V d (MUL): MUL ECX thc hin nhn ECX vi EAX, kt qu s c lu vo EDX:EAX EAX: lu tr kt qu php nhn EDX: lu tr phn d Page 30
  30. 30. ASSEMBLYlnh cho tnh ton (6) IMUL C php: MUL Ton hng gc Nhn s c du, trong trng hp ny ton hng gc l s nhn. Ty theo di ca ton hng gc m ta c ba trng hp t chc php nhn, Nu gc l s 8 bit: AL * Gc S b nhn phi l s 8 bit trong AL Kt qu sau khi nhn lu trong : AX Nu gc l s 16 bit: AX * Gc S b nhn phi l s 16 bit trong AX Kt qu sau khi nhn lu trong DX, AX Nu gc l s 32 bit: EAX * Gc S b nhn phi l s 32 bit trong EAX Kt qu sau khi nhn lu trong EDX, EAX Page 31
  31. 31. ASSEMBLYlnh dng tnh ton (7) DIV C php: DIV Ton hng gc Chia s khng du, trong trng hp ny ton hng gc l s chia. Ty theo di ca ton hng gc m ta c hai trng hp t chc php chia, Nu s 16 bits chia cho gc l s 8 bit: AX / Gc S d lu trong AH Thng lu trong AL Nu s 32 bits chia cho gc l s 16 bit: EAX / Gc S d lu trong DX Thng lu trong AX Page 32
  32. 32. ASSEMBLYlnh dng tnh ton (8) IDIV C php: IDIV Ton hng gc Chia s c du, trong trng hp ny ton hng gc l s chia. Ty theo di ca ton hng gc m ta c hai trng hp t chc php chia, Nu s 16 bits chia cho gc l s 8 bit: AX / Gc S d lu trong AH Thng lu trong AL Nu s 32 bits chia cho gc l s 16 bit: EAX / Gc S d lu trong DX Thng lu trong AX Page 33
  33. 33. ASSEMBLYlnh cho tnh ton (9) XADD Thc hin hai lnh XCHG, ADD NEG Thc hin b hai ca mt ton hng hay cn gi l o du ca mt ton hng ( b hai o bit ca ton hng v cng thm 1) V d Page 34
  34. 34. ASSEMBLY Cc lnh logic Page 35
  35. 35. ASSEMBLY lnh so snh (1) CMP C php: CMP Ton hng ich, Ton hng ngun Mc ch dng so sanh hai ton hng vi nhau Tc dng ch yu ln c Bng cng thc Page 36
  36. 36. ASSEMBLY lnh so snh (2) TEST C php: TEST Ton hng ich, Ton hng ngun Cng thc Ton hng ngun = Ton hng ch ZF = 1 Ton hng ngun khc ton hng ch ZF = 0 Page 37
  37. 37. ASSEMBLY Cc lnh nhy (1) Lnh nhy khng iu kin C php: JMP Chng trnh gp lnh ny s nhy ngay lp tc V d: JMP [401000]; Page 38
  38. 38. ASSEMBLY Cc lnh nhy (2) Lnh nhy c iu kin Page 39
  39. 39. ASSEMBLY Cc lnh nhy (3) Page 40
  40. 40. DEMO
  41. 41. OLLYDBG, DEMO Bi 1 Phn tch chng trnh Page 42
  42. 42. OLLYDBG, DEMO Bi 2 Phn tch chng trnh Code C++ demo Page 43
  43. 43. CHEAT ENGINE 6.2
  44. 44. CHEAT ENGINE 6.2 Gii thiu Phn tch chng trnh Code C++ demo Page 45
  45. 45. Page 46