视频
参考资料
[原创][花指令]由易到难全面解析CTF中的花指令-软件逆向-看雪-安全社区|安全招聘|kanxue.com
基础花指令
test
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
#include <stdio.h>
void fun1 () {
__asm {
lea eax , lab1
jmp eax
_emit 0x90
};
lab1 :
printf ( "fun1 \n " );
}
void fun2 () {
__asm {
cmp eax , ecx
jnz lab1
jz lab1
_emit 0xb8
};
lab1 :
printf ( "fun2 \n " );
}
int main () {
fun1 ();
fun2 ();
return 0 ;
}
[GFCTF 2021]wordy
1
2
3
4
5
6
7
8
startaddr = 0x1135
endaddr = 0x3100
for i in range ( startaddr , endaddr ) :
if get_wide_byte ( i ) == 0xEB :
if get_wide_byte ( i + 1 ) == 0xFF :
patch_byte ( i , 0x90 )
print ( "[+] Addr {} is patched" . format ( hex ( i )))
[NSSRound#3 Team]jump_by_jump
互补跳转
[HZNUCTF 2023 final]虽然他送了我玫瑰花
条件跳转
jnz zf = 0跳转
ns2024 drity_flower
call + ret
自定义花指令
vnctf2024Fuko’s startfish
Licensed under CC BY-NC-SA 4.0