{"id":344,"date":"2022-07-18T11:03:25","date_gmt":"2022-07-18T03:03:25","guid":{"rendered":"http:\/\/www.aqwu.net\/wp\/?p=344"},"modified":"2022-07-18T11:07:04","modified_gmt":"2022-07-18T03:07:04","slug":"%e9%80%86%e5%90%91%e5%92%8c%e5%88%a9%e7%94%a8-ios-%e4%ba%8c%e8%bf%9b%e5%88%b6%e6%96%87%e4%bb%b6%e6%8c%87%e5%8d%97%e7%ac%ac-2-%e9%83%a8%e5%88%86%ef%bc%9aarm64-rop-%e9%93%be","status":"publish","type":"post","link":"https:\/\/www.aqwu.net\/wp\/?p=344","title":{"rendered":"\u9006\u5411\u548c\u5229\u7528 iOS \u4e8c\u8fdb\u5236\u6587\u4ef6\u6307\u5357\u7b2c 2 \u90e8\u5206\uff1aARM64 ROP \u94fe"},"content":{"rendered":"\n<p>\u539f\u6587\u94fe\u63a5\uff1ahttps:\/\/www.inversecos.com\/2022\/06\/guide-to-reversing-and-exploiting-ios.html<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgmkvA_BmXTrQjwioWXKegvOC5pSLUxTzd9mE6Isd_gfxD7Bbf25OAFQIcLlRH-0J8o2s4ctXZ5c1Z2Z0QlNN_JjwspmEkl4ckv7wyrnp9Htzyaipo2liNUBsmkhW7iOGEzidZivM8LQbKnBhAOdXTJLN_l1UNmDASI_zb4ozqJHC9ICu-OzPvAze2m1A\/s16000\/Cover%20Photo.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><strong>\u6b22\u8fce\u56de\u6765\u6211\u7684\u56fd\u738b\u548c\u738b\u540e&#8230;\u8fd9\u662f\u5982\u4f55\u9006\u5411\u5de5\u7a0b\u548c\u5229\u7528iOS\u4e8c\u8fdb\u5236\u6587\u4ef6\u7684\u7b2c2\u90e8\u5206\u3002<\/strong><\/p>\n\n\n\n<p><a href=\"http:\/\/www.aqwu.net\/wp\/?p=342\">\u5728\u6b64\u5904\u67e5\u770b\u5982\u4f55\u5bf9 iOS \u5e94\u7528\u7a0b\u5e8f\u8fdb\u884c\u9006\u5411\u5de5\u7a0b\u548c\u4fee\u8865\u7684\u7b2c 1 \u90e8\u5206\u3002<\/a><\/p>\n\n\n\n<p>\u5728\u672c\u535a\u5ba2\u6587\u7ae0\u7ed3\u675f\u65f6\uff0c\u60a8\u5c06\u80fd\u591f\u5bf9arm64 iOS\u4e8c\u8fdb\u5236\u6587\u4ef6\u8fdb\u884c\u9006\u5411\u5de5\u7a0b\uff0c\u5e76\u4ee5\u4e24\u79cd\u65b9\u5f0f\u5229\u7528\u5b83 &#8211; \u9996\u5148\u901a\u8fc7\u7f13\u51b2\u533a\u6ea2\u51fa\uff0c\u7136\u540e\u901a\u8fc7ROP\u94fe\u3002\u518d\u4e00\u6b21\uff0c\u6211\u5c06\u9010\u6b65\u5f15\u5bfc\u60a8\u5b8c\u6210\u4ee5\u4e0b\u5185\u5bb9\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>\u6784\u5efa\u548c\u7f16\u8bd1\u60a8\u81ea\u5df1\u7684 iOS \u4e8c\u8fdb\u5236\u6587\u4ef6<\/li><li>\u5bf9\u4e8c\u8fdb\u5236\u6587\u4ef6\u8fdb\u884c\u9006\u5411\u5de5\u7a0b<\/li><li>\u5728\u4e0d\u7981\u7528 ASLR \u7684\u60c5\u51b5\u4e0b\u8ba1\u7b97\u8fd0\u884c\u65f6\u51fd\u6570\u5730\u5740<\/li><li>\u7f13\u51b2\u533a\u6ea2\u51fa\u653b\u51fb<\/li><li>\u673a\u68b0\u94bb\u7814\u94fe\u5f00\u53d1<\/li><\/ul>\n\n\n\n<p>\u6211\u4eec\u53ea\u4f1a\u4f7f\u7528\u514d\u8d39\u5de5\u5177\uff0c\u56e0\u4e3a\u6211\u4e0d\u559c\u6b22\u5728\u4e66\u7684\u4e8b\u60c5\u4e0a\u82b1\u94b1\u3002\u56e0\u6b64\uff0c\u5bf9\u4e8e\u8fd9\u7bc7\u535a\u5ba2\u6587\u7ae0\/\u6559\u7a0b\uff0c\u6211\u7f16\u8bd1\u5e76\u6784\u5efa\u4e86\u4e00\u4e2a\u53ef\u4ee5\u4f7f\u7528\u548c\u6ee5\u7528\u7684iOS\u4e8c\u8fdb\u5236\u6587\u4ef6\u3002\u6211\u8fd8\u5728GitHub\u4e0a\u4e3a\u6211\u6240\u6709\u90aa\u6076\u7684\u9a97\u5b50\u63d0\u4f9b\u4e86\u6e90\u4ee3\u7801!!!\u4e0d\u8981\u4ee5\u4e3a\u6211\u4e0d\u77e5\u9053\u4f60\u5b58\u5728:P\u3002<\/p>\n\n\n\n<p><a href=\"https:\/\/github.com\/inversecos\/ios-dontpopme\" target=\"_blank\" rel=\"noreferrer noopener\">\u4ece Github \u4e0b\u8f7d\u7ec3\u4e60\u4e8c\u8fdb\u5236\u6587\u4ef6\u201cdontpopme\u201d \u8fd9\u91cc.<\/a><\/p>\n\n\n\n<p>\u8fd9\u7bc7\u535a\u5ba2\u6587\u7ae0\u5efa\u7acb\u5728\u7b2c1\u90e8\u5206\u5173\u4e8e\u5982\u4f55\u5728iOS\u5e94\u7528\u7a0b\u5e8f\u4e0a\u6267\u884c\u57fa\u672c\u53cd\u8f6c\u7684\u77e5\u8bc6\u4e4b\u4e0a\u3002\u4e0d\u540c\u4e4b\u5904\u5728\u4e8e\uff0c\u8fd9\u7bc7\u535a\u5ba2\u6587\u7ae0\u5c06\u91cd\u70b9\u4ecb\u7ecd\u5982\u4f55\u5229\u7528iOS arm64\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u6211\u4eec\u5c06\u5229\u7528\u4ece\u53cd\u8f6c\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e2d\u5b66\u5230\u7684\u77e5\u8bc6\u6765\u6267\u884c\u4e24\u6b21\u653b\u51fb\u3002\u56e0\u6b64\uff0c\u6211\u5c06\u5411\u60a8\u4ecb\u7ecd\u7f13\u51b2\u533a\u6ea2\u51fa\u548cROP\u94fe\u653b\u51fb\u3002<\/p>\n\n\n\n<p>\u8fd9\u7bc7\u535a\u5ba2\u6587\u7ae0\u5206\u4e3a\u4e94\u4e2a\u90e8\u5206\uff0c\u5982\u679c\u4f60\u719f\u6089\u6211\u7684\u535a\u5ba2\u6587\u7ae0\uff0c\u90a3\u4e48\u8fd9\u5e94\u8be5\u4e0d\u8db3\u4e3a\u5947\u3002\u65e0\u8bba\u5982\u4f55\uff0c\u8fd9\u4e9b\u662f\u90e8\u5206\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>\u6211\u4eec\u5c06\u91c7\u53d6\u7684\u6b65\u9aa4\u7684\u9ad8\u7ea7\u6f14\u7ec3<\/li><li>\u5de5\u5177<\/li><li>\u73af\u5883\u8bbe\u7f6e<\/li><li>\u6211\u4eec\u6b63\u5728\u5229\u7528\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6\u7b80\u4ecb<\/li><li>Arm64 \u7f13\u51b2\u533a\u6ea2\u51fa<\/li><li>Arm64 ROP \u94fe<\/li><li>\u6211\u4e4c\u4e4c\u7684\u81ea\u62cd\u7167<\/li><\/ul>\n\n\n\n<p><strong>\u9ad8\u7ea7\u6b65\u9aa4<br><\/strong>\u4ee5\u4e0b\u662f\u672c\u535a\u5ba2\u6587\u7ae0\u5c06\u6db5\u76d6\u7684\u5185\u5bb9\u7684\u9ad8\u7ea7\u9010\u6b65\u4ecb\u7ecd\u3002\u6211\u4eec\u5c06\u8be6\u7ec6\u4ecb\u7ecd\u4e0b\u9762\u7684\u6bcf\u4e2a\u5c0f\u6b65\u9aa4\u3002<\/p>\n\n\n\n<ol class=\"wp-block-list\"><li>\u901a\u8fc7SFTP\u5c06iOS\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e0a\u4f20\u5230\u8d8a\u72f1\u7684iOS\u4e0a\u3002\u5982\u679c\u60a8\u4e0d\u77e5\u9053\u5982\u4f55\u8d8a\u72f1\u624b\u673a\uff0c\u8bf7\u53c2\u9605unC0ver\u6307\u5357\u3002<\/li><li>\u8fd0\u884c\u4e8c\u8fdb\u5236\u6587\u4ef6\u4ee5\u6d4b\u8bd5\u5176\u5de5\u4f5c\u539f\u7406<\/li><li>\u67e5\u627e\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e<\/li><li>\u68c0\u67e5iOS\u5d29\u6e83\u65e5\u5fd7\u4ee5\u83b7\u53d6\u94fe\u63a5\u5bc4\u5b58\u5668\uff08LR\uff09\u7684\u4f4d\u7f6e\uff0c\u4ee5\u4fbf\u6211\u4eec\u53ef\u4ee5\u5236\u4f5c\u6709\u6548\u8d1f\u8f7d<\/li><li>\u8c03\u8bd5\u4e8c\u8fdb\u5236\u6587\u4ef6\u4ee5\u67e5\u627e\u6211\u4eec\u5c06\u5728\u6709\u6548\u8d1f\u8f7d\u4e2d\u8df3\u8f6c\u5230\u7684\u6709\u8da3\u51fd\u6570<\/li><li>\u5728\u8fd0\u884c\u65f6\u8ba1\u7b97\u51fd\u6570\u5730\u5740\uff08\u5728 iOS \u4e0a\u542f\u7528\u4e86 ASLR\uff09<\/li><li>\u6267\u884c\u7f13\u51b2\u533a\u6ea2\u51fa\u653b\u51fb<\/li><li>\u627e\u5230\u6211\u4eec\u8981\u7528\u4e8eROP\u94fe\u7684\u4e0b\u4e00\u4e2a\u51fd\u6570<\/li><li>\u6267\u884c ROP \u94fe<\/li><\/ol>\n\n\n\n<p><strong>\u5de5\u5177<br><\/strong>\u4ee5\u4e0b\u662f\u6211\u4eec\u5c06\u7528\u4e8e\u6267\u884c\u5206\u6790\u7684\u5de5\u5177\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>LLDB &#8211;\u00a0<a href=\"https:\/\/lldb.llvm.org\/\">https:\/\/lldb.llvm.org\/<\/a><\/li><li>Radare 2 &#8211;\u00a0<a href=\"https:\/\/rada.re\/n\/\">https:\/\/rada.re\/n\/<\/a><\/li><li>Hopper Disassembler \uff08\u6f14\u793a\u7248\uff09 &#8211;\u00a0<a href=\"https:\/\/www.hopperapp.com\/\">https:\/\/www.hopperapp.com\/<\/a><\/li><li>\u4f60\u8d8a\u72f1\u7684iPhone\uff08\u6211\u4f7f\u7528\u7684\u662fiOS 14.1\u7684\u65e7\u624b\u673a\uff09<\/li><li>\u4f60\u7684\u80fd\u529b\u548c\u5de8\u5927\u7684\u5927\u8111<\/li><\/ul>\n\n\n\n<p><strong>\u73af\u5883\u8bbe\u7f6e<br><\/strong>\u4e3a\u4e86\u8ba9\u60a8\u9010\u6b65\u6309\u7167\u672c\u6f14\u7ec3\u8fdb\u884c\u64cd\u4f5c\uff0c\u8bf7\u786e\u4fdd\u60a8\u5df2\u51c6\u5907\u597d\u8d8a\u72f1\u7535\u8bdd\uff0c\u5e76\u5728\u540c\u4e00LAN\u4e0a\u8bbe\u7f6eSSH \/ SFTP\u5e76\u8fde\u63a5\u3002<\/p>\n\n\n\n<p><strong>\u7b2c 1 \u6b65\uff1a&nbsp;<\/strong>\u4ece<a href=\"https:\/\/github.com\/inversecos\/ios-dontpopme\" target=\"_blank\" rel=\"noreferrer noopener\">\u6211\u7684 GitHub \u9875\u9762<\/a><strong><br><\/strong>\u4e0b\u8f7d\u6613\u53d7\u653b\u51fb\u7684\u4e8c\u8fdb\u5236\u6587\u4ef6 \u8bf7\u4ec5\u4e0b\u8f7d dontpopme \u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u800c\u4e0d\u662f\u6e90\u4ee3\u7801\u3002\u6211\u4eec\u5c06\u628a\u6574\u4e2a\u7ec3\u4e60\u4f5c\u4e3a\u9ed1\u5323\u5b50\u653b\u51fb\u6765\u6267\u884c\u3002<\/p>\n\n\n\n<p><strong>\u7b2c 2 \u6b65\uff1a&nbsp;<\/strong>SFTP \u4e8c\u8fdb\u5236\u6587\u4ef6\u5230\u8d8a\u72f1\u7684 iOS \u8bbe\u5907\u4e0a\uff0c\u53d1\u9001\u5230 \/var\/mobile \u76ee\u5f55<br><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjFQMX8Eld1sNTV_D9DiIK-fUu2TZdwNAzURIluF2gQ5UOdl0rmHy8dkLykxrv9rL578MFqBzotIoqOfhcMOAPL5I0E12N_ETmzNGtc_p2fKCJbOXFn3TtXjMHYnp_IBOb_V27brv904A2l_Kc7oNkbBW_Zo5tLjp1fjeZZ7X8L-Bt0hOZ5iGoE8eWhGA\/s16000\/1.PNG\"><\/p>\n\n\n\n<p><strong>\u7b2c 3 \u6b65\uff1a\u00a0<\/strong>\u4fee\u6539\u4e8c\u8fdb\u5236\u6587\u4ef6<br>\u7684\u6743\u9650  chmod 777 dontpopme \ud83d\ude42<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhhzGwUXpDNnjxmi7B_gVqnh4X4joSz6iBmxLSXa15pfZjylWgSI9mSGDNGf4Thwy7yh6pd_115N3Qg-3pk2OOYRcvOcMrYXGdQFU3Tw1wbL0dvC9CBz_h7Pq43fEvN4PSM4ItXwN06CzwlUanz9D8ke2kqFwZL_CEZR_LWLrGJxj1ClnOhiuDf-W5VHw\/s16000\/2.PNG\" alt=\"\"\/><\/figure>\n\n\n\n<p><strong>\u7b2c 4 \u6b65\uff1a&nbsp;<\/strong>\u8fd0\u884c\u4e8c\u8fdb\u5236\u6587\u4ef6\u5e76\u68c0\u67e5\u5b83\u662f\u5426\u6b63\u5e38\u5de5\u4f5c:)<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjJJq6qSV8DalO1oKYjG-cq2rUpRhcRrzAbJvI4tJuAe0IO7xShNwKaxe_Jcyv-9Ey_UkY3JD-dXcP61x29VMT1r5TBrmIeI3Y0lFNEECRvDWK4b-ntyAW6oi-rKVwv7ZjWY_sfixXkCdFCVmPBXAZdF0PCgQSXO3PktQ5ab1LWdgaQEPEWty62MMtNvw\/s16000\/3.PNG\" alt=\"\"\/><\/figure>\n\n\n\n<p><strong>\u7b2c 5 \u6b65\uff1a\u00a0<\/strong>\u662f\u65f6\u5019\u5411\u4e8c\u8fdb\u5236\u663e\u793a\u8c01\u662f boss ^_^\u4e86<\/p>\n\n\n\n<p><strong>\u4e8c\u8fdb\u5236\u7b80\u4ecb<\/strong><\/p>\n\n\n\n<p>\u8fd9\u4e2a\u4e8c\u8fdb\u5236\u6587\u4ef6\u88ab\u79f0\u4e3a\u201cdontpopme\u201d\uff0c\u5b83\u662f\u4e00\u4e2aMach-O 64\u4f4d\u53ef\u6267\u884c\u6587\u4ef6\uff0c\u5b83\u5c06\u4e3a\u7f13\u51b2\u533a\u6ea2\u51fa\u548cROP\u5229\u7528\u76ee\u7684\u670d\u52a1\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiiE2-GZPIWIXSR_TtBQ2Mit6G-KUn98Tkvaogi-qeN6-2-BO23Djdkf5O5rIQrrS3sze70MD4qMhx2BEvHOdu15MAQfBy0uvuLZeNjWjTdvwICFop1WWAKezqL6bLqubzkzC2w3UhqLgS-Es9FM_Wnd01TmiXQQHtNeW-MiWgFU4-6j8DqurTMf3188w\/s16000\/Screen%20Shot%202022-06-14%20at%204.30.01%20pm.png\" alt=\"\"\/><\/figure>\n\n\n\n<p>\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e2d\u7684\u6587\u4ef6\u8bfb\u53d6\u51fd\u6570\u201cfread()\u201dC \u51fd\u6570\u4e2d\u5b58\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u6f0f\u6d1e\u3002\u8fd9\u4e2a\u51fd\u6570\u57fa\u672c\u4e0a\u4ece\u6587\u4ef6\u4e2d\u8bfb\u53d6\uff0c\u5185\u5b58\u4e0d\u5b89\u5168\uff01\u4e8c\u8fdb\u5236\u6587\u4ef6\u9700\u8981\u60a8\u5c06\u540d\u4e3a\u201cresume.txt\u201d\u7684\u6587\u4ef6\u653e\u5728\u4e0e\u4e8c\u8fdb\u5236\u6587\u4ef6\u76f8\u540c\u7684\u76ee\u5f55\u4e2d\u3002\u7136\u540e\uff0c\u5b83\u5c06\u5c1d\u8bd5\u8bfb\u53d6\u5185\u5bb9\u3002\u653e\u5165\u8fd9\u4e9b\u5185\u5bb9\u7684\u5185\u5bb9\u53ef\u80fd\u4f1a\u5bfc\u81f4\u7f13\u51b2\u533a\u6ea2\u51fa;)<\/p>\n\n\n\n<p>\u9690\u85cf\u5728\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e2d\u7684\u8fd8\u6709\u53e6\u5916\u4e24\u4e2a\u79d8\u5bc6\u51fd\u6570\uff0c\u5b83\u4eec\u6c38\u8fdc\u4e0d\u4f1a\u5728main\u4e2d\u8c03\u7528\u3002\u7f13\u51b2\u533a\u6ea2\u51fa\u7684\u76ee\u6807\u662f\u4f7f\u7a0b\u5e8f\u8df3\u8f6c\u5230\u8fd9\u4e9b\u51fd\u6570\u4e4b\u4e00\u3002ROP \u94fe\u7684\u76ee\u6807\u662f\u7f13\u51b2\u6ea2\u51fa>\u8df3\u8f6c\u5230\u51fd\u6570 1 >\u8dc3\u8f6c\u5230\u51fd\u6570 2\u3002<\/p>\n\n\n\n<p>\u6211\u7f16\u8bd1\u6b64C\u4ee3\u7801\u4ee5\u4f7f\u5176\u5728iOS\u4e0a\u8fd0\u884c\u7684\u65b9\u5f0f\u662f\u4f7f\u7528Theos\u548cclang\u7684\u7ec4\u5408\u3002\u4ee5\u4e0b\u662f\u6211\u5982\u4f55\u7f16\u8bd1\u548c\u7b7e\u7f72C\u4ee3\u7801\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgP3Si-YrlX-yD9LRXpVq5GzF1zwD3ITIEbTRVBB089R7cp3TApTh6PBu2tWuks1bnU0YmLi1fhoWq5CnHVt6qeWYUQoQjxDk0ojfpCDNlEQdwdzfsmM5w-jkum7RC4O4U2m5Tl7nWYUsatv1RJuztQT9oPB0VsTd-N1Mrg3D6eo2DtmDrfHgtkMuYIRQ\/s16000\/Screen%20Shot%202022-06-15%20at%202.19.53%20pm.png\" alt=\"\"\/><\/figure>\n\n\n\n<p><strong>ARM64 \u7f13\u51b2\u5668\u6ea2\u51fa\u6307\u5357\uff1a<\/strong><\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u5bf9\u7a0b\u5e8f\u8fdb\u884c\u53cd\u5411\u5de5\u7a0b\u5e76\u5229\u7528\u7f13\u51b2\u533a\u6ea2\u51fa\u3002<\/p>\n\n\n\n<p><strong>\u6b65\u9aa4 1\uff1a\u4e86\u89e3\u7f13\u51b2\u533a\u6ea2\u51fa\u653b\u51fb<\/strong><\/p>\n\n\n\n<p>\u8fd9\u662f\u6211\u80fd\u60f3\u5230\u7684\u6700\u7b80\u5355\u7684\u65b9\u6cd5\u6765\u89e3\u91ca\u8fd9\u79cd\u653b\u51fb\uff0c\u800c\u4e0d\u4f1a\u4e0d\u5fc5\u8981\u5730\u4f7f\u5176\u8fc7\u4e8e\u590d\u6742\u3002\u5728\u8fd9\u4e00\u6b65\u4e2d\uff0c\u6211\u5047\u8bbe\u60a8\u5df2\u7ecf\u4e86\u89e3\u4e86\u5806\u6808\u662f\u4ec0\u4e48\u4ee5\u53ca\u5806\u6808\u5982\u4f55\u589e\u957f\u3002\u5982\u679c\u60a8\u5bf9\u5176\u5de5\u4f5c\u539f\u7406\u611f\u5230\u56f0\u60d1\uff0cYouTube\u4e0a\u6709\u51e0\u4e2a\u5173\u4e8e\u5b83\u7684\u535a\u5ba2\u548c\u89c6\u9891:)<\/p>\n\n\n\n<p>\u7b80\u800c\u8a00\u4e4b\uff0c\u5bf9\u4e8e\u53d1\u751f\u7f13\u51b2\u533a\u6ea2\u51fa\uff0c\u7a0b\u5e8f\u4e2d\u4f7f\u7528\u4e86\u4e00\u6bb5\u6613\u53d7\u653b\u51fb\u7684\u4ee3\u7801\/\u51fd\u6570\u3002\u4e3e\u4e2a\u7b80\u5355\u7684\u4f8b\u5b50\uff0c\u4ee3\u7801\u53ef\u4ee5\u770b\u8d77\u6765\u50cf\u8fd9\u6837\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>char userInput&#91;5]; \/\/Create a char array of size 5\ngets(userInput);  \/\/Read user input into the char array<\/code><\/pre>\n\n\n\n<p>\u4e0a\u9762\u7684\u793a\u4f8b\u4ee3\u7801\u5b9a\u4e49\u4e86\u4e00\u4e2a\u5927\u5c0f\u4e3a 5 \u4e2a\u5b57\u8282\u7684\u5b57\u7b26\u6570\u7ec4\u3002\u4f46\u662f\uff0cC \u4e2d\u8bfb\u53d6\u7528\u6237\u8f93\u5165\u7684 gets() \u51fd\u6570\u4e0d\u4f1a\u68c0\u67e5\u7528\u6237\u662f\u5426\u53ea\u8f93\u5165 5 \u4e2a\u5b57\u8282\u3002\u56e0\u6b64\uff0c\u7528\u6237\u53ef\u4ee5\u8f93\u5165\u8d85\u8fc7 5 \u4e2a\u5b57\u8282\u5e76\u4f7f\u7f13\u51b2\u533a 5 \u6ea2\u51fa\uff0c\u4ece\u800c\u5bfc\u81f4\u5806\u6808\u4e0a\u7684\u533a\u57df\u8986\u76d6\u3002<\/p>\n\n\n\n<p>\u7ed3\u679c\u7c7b\u4f3c\u4e8e\u6211\u5728\u4e0b\u9762\u5236\u4f5c\u7684\u56fe\u8868\u4e2d\u63cf\u8ff0\u7684\u5185\u5bb9\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjf_k54Az4V9tYtqdKL_cOCkGhBxNCDnpYTyyBmTGqh5U7U4drV1bjhPrRae4qcBbzxMb24bJvtAZb5-39hcgHlY9XyCWWcxiH2Qm-ONNzUr989-fOa8rKfGOJrIIPoZ_m2bjHJN6cj29XmNuP1Cu1d2TX-dXiXZwBUWtn-81r6J188tNW9VfcCTuYUdg\/s16000\/Screen%20Shot%202022-06-14%20at%205.07.28%20pm.png\" alt=\"\"\/><\/figure>\n\n\n\n<p>\u7528\u6237\u5c06\u4e00\u7cfb\u5217\u8f93\u5165\u4f20\u9012\u5230\u7f13\u51b2\u533a\uff08\u5728\u672c\u4f8b\u4e2d\u4e3a\u4e00\u5806\u201cA\u201d\uff09\uff0c\u540e\u8ddf\u5185\u5b58\u4e2d\u67d0\u4e2a\u533a\u57df\u7684\u5341\u516d\u8fdb\u5236\u5730\u5740\u3002\u5982\u679c\u7f13\u51b2\u533a\u6ea2\u51fa\u8db3\u591f\u591a\uff0c\u5219\u53ef\u4ee5\u6ea2\u51fa\u5230\u8986\u76d6\u5806\u6808\u91cd\u8981\u533a\u57df\uff08\u5305\u62ec\u8fd4\u56de\u5730\u5740\uff09\u7684\u70b9\u3002\u901a\u8fc7\u6a21\u7cca\u5316\u7f13\u51b2\u533a\u8f93\u5165\u6765\u7cbe\u786e\u8ba1\u7b97\u8fd4\u56de\u5730\u5740\u5728\u5806\u6808\u4e0a\u7684\u4f4d\u7f6e\uff0c\u53ef\u4ee5\u5728\u7f13\u51b2\u533a\u7684\u8be5\u70b9\u653e\u7f6e\u4e00\u4e2a\u65b0\u7684\u5185\u5b58\u5730\u5740\uff0c\u4ece\u800c\u89e6\u53d1\u7a0b\u5e8f\u8df3\u8f6c\u5230\u6b64\u4f4d\u7f6e\u3002\u90aa\u6076\u65f6\u4ee3\u5e26\u6765\u90aa\u6076\u7684\u6c1b\u56f4\u3002\u8fd9\u662f\u7f13\u51b2\u533a\u6ea2\u51fa\u5de5\u4f5c\u7684\u9ad8\u7ea7\u524d\u63d0\uff01<\/p>\n\n\n\n<p><strong>\u6b65\u9aa42\uff1a\u6a21\u7cca\u7a0b\u5e8f\u4ee5\u67e5\u627e\u7f13\u51b2\u533a\u6ea2\u51fa<\/strong><\/p>\n\n\n\n<p>\u73b0\u5728\u4f60\u5df2\u7ecf\u4e86\u89e3\u4e86\u53d1\u751f\u4e86\u4ec0\u4e48\u3002\u6211\u4eec\u5c06\u5728\u7a0b\u5e8f\u4e0a\u89e6\u53d1\u7f13\u51b2\u533a\u6ea2\u51fa\u3002\u5982\u4e8c\u8fdb\u5236\u4ecb\u7ecd\u90e8\u5206\u6240\u8ff0\uff0c\u4e8c\u8fdb\u5236\u6587\u4ef6\u671f\u671b\u8bfb\u53d6\u540d\u4e3a\u201cresume.txt\u201d\u7684\u540c\u4e00\u76ee\u5f55\u4e2d\u7684\u6587\u4ef6\u3002<\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u5728iPhone\u4e0a\u521b\u5efa\u4e00\u4e2a\u540d\u4e3a\u201cresume.txt\u201d\u7684\u6587\u4ef6\uff0c\u5e76\u7ba1\u9053\u5316\u4e00\u7cfb\u5217\u503c\u6765\u6a21\u7cca\u5e76\u8ba1\u7b97\u51fa\u7f13\u51b2\u533a\u5927\u5c0f\u3002\u7531\u4e8e\u8fd9\u662f\u4e00\u4e2a 64 \u4f4d\u7cfb\u7edf\uff0c\u56e0\u6b64\u6211\u4eec\u5c06\u4e3a\u6bcf\u4e2a\u5b57\u6bcd\u4f20\u9012 8 \u4e2a\u5b57\u8282\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgdd4D-voj6XSO3yecAKQsKu5DV6-L2lcT3uaNjpfjuLE0RQrnaJiVbbA9jJFJ4u0S2klG3x1rdsd0gTdpmQ1hgWMZ_eT9GZ81aq7g00U-n_bjZGPyxA-Emxz5U8QpvlUkq7pspmY_hbkmrqSXgTjV61iJ0-u3NJrr62aH7xangbPoVx8S7h-vfX3a7eg\/s16000\/4.PNG\" alt=\"\"\/><\/figure>\n\n\n\n<p><strong>\u6b65\u9aa4 3\uff1a\u89e6\u53d1\u7f13\u51b2\u533a\u6ea2\u51fa<\/strong><\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u8fd0\u884c\u7a0b\u5e8f\u5e76\u5141\u8bb8\u5b83\u8bfb\u53d6\u201cresume.txt\u201d\u3002\u6b63\u5982\u9884\u671f\u7684\u90a3\u6837\uff0c\u6211\u4eec\u5df2\u7ecf\u6ea2\u51fa\u7f13\u51b2\u533a\uff0c\u5e76\u4e14\u6211\u4eec\u9047\u5230\u4e86\u201c\u603b\u7ebf\u9519\u8bef\uff1a10\u201d\u7684\u9519\u8bef\u3002\u8fd9\u57fa\u672c\u4e0a\u610f\u5473\u7740\u7a0b\u5e8f\u6b63\u5728\u5c1d\u8bd5\u8fd4\u56de\u6216\u8bbf\u95ee\u4e0d\u5b58\u5728\u7684\u5185\u5b58\u533a\u57df\u3002\u8fd9\u662f\u56e0\u4e3a\u6211\u4eec\u5df2\u7ecf\u8bbe\u6cd5\u7528\u4e0d\u6307\u5411\u771f\u5b9e\u5730\u5740\u7684\u968f\u673a\u5b57\u6bcd\u8986\u76d6\u4e86\u8fd4\u56de\u6307\u9488:)<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEixN6Hj0L84s32YwlajRE5TKYltUs-gMvaSVL9Kx7jmvwF_rwMWmva3xZKeK9yjAll0p2VOwnstcodukuqDObkeBQEt58Qow1WnfNnTOy5d9Z-9adgeFA4cjzsJfZXitmpEVGbN-418AizCirQ5bk7FDfze8U8i0PD66qR_bVQEBKuqfIQ3ePFHCOSeUQ\/s708\/5.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEixN6Hj0L84s32YwlajRE5TKYltUs-gMvaSVL9Kx7jmvwF_rwMWmva3xZKeK9yjAll0p2VOwnstcodukuqDObkeBQEt58Qow1WnfNnTOy5d9Z-9adgeFA4cjzsJfZXitmpEVGbN-418AizCirQ5bk7FDfze8U8i0PD66qR_bVQEBKuqfIQ3ePFHCOSeUQ\/s16000\/5.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p><strong>\u6b65\u9aa4 4\uff1a\u68c0\u67e5\u5d29\u6e83\u65e5\u5fd7\u4ee5\u786e\u5b9a\u7f13\u51b2\u533a\u5927\u5c0f<\/strong><\/p>\n\n\n\n<p>\u6bcf\u6b21\u5728 iOS \u4e2d\u4f7f\u7a0b\u5e8f\u5d29\u6e83\u65f6\uff0c\u90fd\u4f1a\u521b\u5efa\u76f8\u5e94\u7684\u6545\u969c\u8f6c\u50a8\u3002\u60a8\u53ef\u4ee5\u5728iPhone\u4e0a\u7684\/private\/var\/mobile\/Library\/Logs\/CrashReporter\/&lt;appname-date&gt;*\u76ee\u5f55\u4e2d\u8bbf\u95ee\u8fd9\u4e9b\u5185\u5bb9\u3002<\/p>\n\n\n\n<p>\u6b63\u5982\u4f60\u5728\u8fd9\u91cc\u770b\u5230\u7684\uff0c\u6211\u5df2\u7ecf\u4e3a\u6211\u7684\u201cdontpopme\u201d\u4e8c\u8fdb\u5236\u6587\u4ef6\u751f\u6210\u4e86\u4e00\u4e2a\u5d29\u6e83\u8f6c\u50a8\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhhgAdRi2GsVrbCH4oJEy9P_AmQs4ajyYesf97TAA-hu5XnocZ6HA1C6Cp3jELvTmsVKUSpZ0HmcoklSaA6cTRMszkJ7Of3MvZEcIJUoerT3tJYw_5mNgxlHOnt-Bwfwl8O3dp0k0QDeo_KwzFplx4qgnmkZWQmiRRALpCz_0Enr-YGcmHM-yQKSfyKaw\/s894\/6.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhhgAdRi2GsVrbCH4oJEy9P_AmQs4ajyYesf97TAA-hu5XnocZ6HA1C6Cp3jELvTmsVKUSpZ0HmcoklSaA6cTRMszkJ7Of3MvZEcIJUoerT3tJYw_5mNgxlHOnt-Bwfwl8O3dp0k0QDeo_KwzFplx4qgnmkZWQmiRRALpCz_0Enr-YGcmHM-yQKSfyKaw\/s16000\/6.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u5982\u679c\u5728\u6b64\u6545\u969c\u8f6c\u50a8\u4e2d\u5411\u4e0b\u6eda\u52a8\uff0c\u60a8\u5c06\u770b\u5230\u6240\u6709\u5404\u79cd\u5bc4\u5b58\u5668\u4ee5\u53ca\u5176\u4e2d\u5305\u542b\u54ea\u4e9b\u4fe1\u606f\u3002\u60a8\u9700\u8981\u6ce8\u610f\u7684\u4e00\u4e2a\u5bc4\u5b58\u5668\u662f\u201cLR\u201d\u62160x30\u5bc4\u5b58\u5668\u3002\u8fd9\u79f0\u4e3a\u94fe\u63a5\u5bc4\u5b58\u5668\uff0c\u5b83\u5c06\u8fd4\u56de\u5730\u5740\u4fdd\u5b58\u5728;)\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhH7C3lOhK5XP7-kkYzbszXiZi81y1iHwEmsYC9RCGIVM-X4bS1KFrXckmP6LQzo-NA8l2s82Y41rbOXdVOp71-UqsZH4_WDZlX_od42Z_fjunaezJLKVQe7Q9e9COTwYtcPr6TMNwIHegxPeqSJymOjLFnqX4S-PWbu9msiBAq9RAvZPrd1t_QYsxg2w\/s841\/7.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhH7C3lOhK5XP7-kkYzbszXiZi81y1iHwEmsYC9RCGIVM-X4bS1KFrXckmP6LQzo-NA8l2s82Y41rbOXdVOp71-UqsZH4_WDZlX_od42Z_fjunaezJLKVQe7Q9e9COTwYtcPr6TMNwIHegxPeqSJymOjLFnqX4S-PWbu9msiBAq9RAvZPrd1t_QYsxg2w\/s16000\/7.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u94fe\u8def\u5bc4\u5b58\u5668\u5185\u7684\u503c\u4e3a 0x4646464646454545\u5bf9\u4e8e FFFFFEEE \u4e3a\u5341\u516d\u8fdb\u5236\u3002\u5b83\u4e4b\u6240\u4ee5\u5012\u9000\uff0c\u662f\u56e0\u4e3a\u7cfb\u7edf\u662f\u5c0f\u7aef\u5e8f\u3002\u8fd9\u610f\u5473\u7740\u5728FFFFEE\u7684\u786e\u5207\u4f4d\u7f6e\u662f\u6211\u4eec\u9700\u8981\u653e\u7f6e\u6211\u4eec\u60f3\u8981\u8df3\u8f6c\u5230\u7684\u51fd\u6570\u7684\u5730\u5740\u7684\u5730\u65b9\u3002<\/p>\n\n\n\n<p>\u4f60\u600e\u4e48\u77e5\u9053\u7cfb\u7edf\u662f\u5c0f\u7aef\u5e8f\u8fd8\u662f\u5927\u7aef\u5e8f\uff1f\u60a8\u5982\u4f55\u77e5\u9053\u8fd8\u542f\u7528\u4e86\u54ea\u4e9b\u5176\u4ed6\u63a7\u4ef6\uff1f\u8ba9\u6211\u5411\u60a8\u5c55\u793a\u4e00\u4e2a\u53ef\u4ee5\u5728iOS\u8bbe\u5907\u4e0a\u8fd0\u884c\u7684\u547d\u4ee4:)\u5982\u4e0b\u9762\u7684\u5c4f\u5e55\u622a\u56fe\u6240\u793a\uff0c\u60a8\u53ef\u4ee5\u770b\u5230\u201c\u5b57\u8282\u5e8f\u201d\u662f\u201c\u5c0f\u201d\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuRjVSGFVja1iao4kogpAiZuArE0VCCEVvn_N_HoqYu9kXJNliTgjKhfv_YlpciTifjDu8asNT7NMO35Ew4xSLSDN3J4VgME2lKyLCPFBo-No0_oohIUMLIiW_qDtpdTAwb0lnC3q5LliwH8KsrROaHaTikYH4U0jmpse-67Yso6Ja3plf7DL6Eb52aQ\/s589\/settings.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjuRjVSGFVja1iao4kogpAiZuArE0VCCEVvn_N_HoqYu9kXJNliTgjKhfv_YlpciTifjDu8asNT7NMO35Ew4xSLSDN3J4VgME2lKyLCPFBo-No0_oohIUMLIiW_qDtpdTAwb0lnC3q5LliwH8KsrROaHaTikYH4U0jmpse-67Yso6Ja3plf7DL6Eb52aQ\/s16000\/settings.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p><strong>\u6b65\u9aa45\uff1a\u627e\u5230\u4e00\u4e2a\u6709\u8da3\u7684\u51fd\u6570\u8df3\u8f6c\u5230<\/strong><\/p>\n\n\n\n<p>\u8981\u627e\u5230\u8fd9\u4e9b\u51fd\u6570\uff0c\u8ba9\u6211\u4eec\u4f7f\u7528 radare2\u3002\u6b64\u5de5\u5177\u662f\u514d\u8d39\u7684\uff0c\u60a8\u53ef\u4ee5\u5c06\u5176\u5b89\u88c5\u5230\u8d8a\u72f1\u7684iOS\u8bbe\u5907\u4e0a\u3002\u8981\u8fd0\u884c\u5b83\uff0c\u60a8\u53ea\u9700\u952e\u5165\u201cr2&lt;\u4e8c\u8fdb\u5236\u540d\u79f0&gt;\u201d\u3002\u7136\u540e\u6211\u4eec\u8981\u8fd0\u884c\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>aaa \u2013 \u5206\u6790\u4e8c\u8fdb\u5236<\/li><li>afl \u2013 \u5217\u51fa\u4e8c\u8fdb\u5236\u6587\u4ef6\u4e2d\u5b58\u5728\u7684\u6240\u6709\u51fd\u6570<\/li><\/ul>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg6FsKzbdSWS2sfB3chxz75nyCAgcVMzvCTcpbyQUWGpedpbAET_0SxLs-dIPOJZypC1wt0LgDq9StvDXxg2kbmpX0Z_FvnVvtVsylzUhz1iXqEHFXGrix1hkXN2qAPoto_nj96xI63EUXrqfyuViR-WNTyTIfKiPVoOtmDs_6_wXwG89n9cd5BmyADOA\/s661\/Screen%20Shot%202022-06-15%20at%202.30.20%20pm.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg6FsKzbdSWS2sfB3chxz75nyCAgcVMzvCTcpbyQUWGpedpbAET_0SxLs-dIPOJZypC1wt0LgDq9StvDXxg2kbmpX0Z_FvnVvtVsylzUhz1iXqEHFXGrix1hkXN2qAPoto_nj96xI63EUXrqfyuViR-WNTyTIfKiPVoOtmDs_6_wXwG89n9cd5BmyADOA\/s16000\/Screen%20Shot%202022-06-15%20at%202.30.20%20pm.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u4ece\u4e0a\u9762\u7684\u5c4f\u5e55\u622a\u56fe\u4e2d\u53ef\u4ee5\u770b\u51fa\uff0c\u6709\u4e24\u4e2a\u53ef\u80fd\u662f\u7528\u6237\u5b9a\u4e49\u7684\u51fd\u6570\u201cchange\u201d\u548c\u201crunCode\u201d\uff0c\u5176\u4f59\u7684\u90fd\u662fC-native\u51fd\u6570\u3002\u901a\u8fc7\u9605\u8bfb\u8fd9\u4e9b\u51fd\u6570\uff0c\u60a8\u53ef\u4ee5\u770b\u5230\u201cscanf\u201d\u548c\u201cfread\u201d\uff0c\u5b83\u4eec\u90fd\u5bb9\u6613\u53d7\u5230\u7f13\u51b2\u533a\u6ea2\u51fa\u653b\u51fb\u3002\u60a8\u8fd8\u53ef\u4ee5\u770b\u5230\u4e00\u4e2a\u540d\u4e3a\u201cexecl\u201d\u7684\u51fd\u6570\u3002\u5982\u679c\u60a8\u9605\u8bfb\u624b\u518c\u9875\uff0c\u60a8\u5c06\u770b\u5230\u5b83\u7684\u529f\u80fd\u7c7b\u4f3c\u4e8e\u8fd0\u884c\u7cfb\u7edf\u547d\u4ee4\u7684\u51fd\u6570\u201csystem()\u201d\u3002<\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u66f4\u6df1\u5165\u5730\u4e86\u89e3\u4e00\u4e0b runCode() \u51fd\u6570\u3002\u60a8\u53ef\u4ee5\u901a\u8fc7\u952e\u5165\u4ee5\u4e0b\u547d\u4ee4\u6765\u6267\u884c\u6b64\u64cd\u4f5c\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>s sym._runCode<\/li><li>pdf<\/li><\/ul>\n\n\n\n<p>\u901a\u8fc7\u67e5\u770b\u4e0b\u9762\u7684 asm\uff0c\u60a8\u53ef\u4ee5\u770b\u5230\u6b64\u51fd\u6570\u89e6\u53d1\u4e86 execl() \u51fd\u6570\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgJRauMFhQvpPdxkqqjPCNtXihTXOyBr-LtYU97k8DG0T9koFS-1EEvh4qjncFLRw3z-jJ0agdIaoOTLmU0gLJXQ4TCOxT9SUoz9E2BRCUEiicfTrYUvlvUWogXV9E1hQrGXT_ByZlVYWIFD8pT0-Tx16X1dTfY8rQA0d5b9_arga3zGI6S1BP_WysTBg\/s904\/9.2.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgJRauMFhQvpPdxkqqjPCNtXihTXOyBr-LtYU97k8DG0T9koFS-1EEvh4qjncFLRw3z-jJ0agdIaoOTLmU0gLJXQ4TCOxT9SUoz9E2BRCUEiicfTrYUvlvUWogXV9E1hQrGXT_ByZlVYWIFD8pT0-Tx16X1dTfY8rQA0d5b9_arga3zGI6S1BP_WysTBg\/s16000\/9.2.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u67e5\u770b change() \u7684\u51fd\u6570\uff0c\u53ef\u4ee5\u770b\u5230\u8fd9\u4e2a\u51fd\u6570\u66f4\u6539\u4e86\u4e00\u4e9b\u53d8\u91cf\u5e76\u8c03\u7528 printf\uff0c\u4f46\u662f\u6ca1\u6709 execl() \u51fd\u6570\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgU20EUsk88NY1cvujnmP5nvvMHz5Km1UyCiunfz0fRVLMBDm5idsEMok_ce_VQzUUTmD149vhXzIM4RMlnXEgs3499aVwosSL_xWLUXOJZgS3UN-5VLPtRW7l0IYH6FJpOesPDNWDYh9cx5850ckoPGuwQLHnnDTbz9ZPiNvT8X_9r-LObMMTVPaha2A\/s1035\/9.3.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgU20EUsk88NY1cvujnmP5nvvMHz5Km1UyCiunfz0fRVLMBDm5idsEMok_ce_VQzUUTmD149vhXzIM4RMlnXEgs3499aVwosSL_xWLUXOJZgS3UN-5VLPtRW7l0IYH6FJpOesPDNWDYh9cx5850ckoPGuwQLHnnDTbz9ZPiNvT8X_9r-LObMMTVPaha2A\/s16000\/9.3.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p><strong>\u6b65\u9aa4 6\uff1a\u53cd\u6c47\u7f16\u51fd\u6570\u4ee5\u66f4\u597d\u5730\u4e86\u89e3\u53d1\u751f\u7684\u60c5\u51b5<\/strong><\/p>\n\n\n\n<p>\u4e3a\u6b64\uff0c\u6211\u4eec\u5c06\u4f7f\u7528\u6f0f\u6597\u62c6\u89e3\u5668\u7684\u6f14\u793a\u7248\u672c\u3002\u52a0\u8f7d\u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u7136\u540e\u5355\u51fb\u51fd\u6570\u201crunCode\u201d\u3002\u60a8\u5c06\u770b\u5230\u5b83\u8df3\u8f6c\u5230\u51fd\u6570\u7684\u7a0b\u5e8f\u96c6\u8f93\u51fa\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiCbPqn98NOLpCZapW3sctKHqBlAKLgyW4614Z8gYy-RKpICXRg7naaIoBZ900903WgHneYiIjEaNfPk_pN4ceewMXrJOX01V_uPL_QGQeUiukYzpacLHzWJAIs1nQZnqSU42lcHFjXJSaIrJcpctaWT_TmBoxQoFjy7Bb5G_H2RIKBd7E_Sn_NCAxIzw\/s966\/hopper%201.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiCbPqn98NOLpCZapW3sctKHqBlAKLgyW4614Z8gYy-RKpICXRg7naaIoBZ900903WgHneYiIjEaNfPk_pN4ceewMXrJOX01V_uPL_QGQeUiukYzpacLHzWJAIs1nQZnqSU42lcHFjXJSaIrJcpctaWT_TmBoxQoFjy7Bb5G_H2RIKBd7E_Sn_NCAxIzw\/s16000\/hopper%201.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u4ece\u4e0a\u9762\u7684\u5c4f\u5e55\u622a\u56fe\u4e2d\uff0c\u60a8\u5e94\u8be5\u80fd\u591f\u63a8\u65ad\u51fa\u6b64\u51fd\u6570\u6b63\u5728\u8fd0\u884cexecl()\u51fd\u6570\uff0c\u5e76\u5c06\u201c\/bin\/ls\u201d\u548c\u201c-la\u201d\u7684\u53c2\u6570\u4f20\u9012\u7ed9\u5b83\u3002\u8fd9\u610f\u5473\u7740\u5982\u679c\u6211\u4eec\u8df3\u8f6c\u5230\u6b64\u51fd\u6570\uff0c\u6211\u4eec\u5e94\u8be5\u671f\u671b\u5b83\u8fd0\u884c\u6b64\u547d\u4ee4\u3002<\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u4ed4\u7ec6\u770b\u770b\u4f7f\u7528Hopper\u7684change()\u51fd\u6570\u3002\u5728\u8fd9\u4e2a\u7279\u5b9a\u7684\u51fd\u6570\u4e2d\uff0c\u6211\u4eec\u53ef\u4ee5\u63a8\u65ad\u51fa\u5b83\u5c06\u53d8\u91cf\u66f4\u6539\u4e3a\u201c\/bin\/uname\u201d\u548c\u201c-a\u201d\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiJune1g0lrovf02xqAOuZ3G60z8CkTHaLd0dlG0EZ_lSmlP4xx2l6R7jKHCa_8_gpNrunEFV15ZWc1CROjHhRwvd0X6-U3shixL3CGYMh_0YcsgswoWkmLlYeosQxOQlcKS1qxNGOctjAfyaU5S7yM5aijfMSb4lh3rODNOpywbLcP2LXI73FIyPd_4w\/s812\/hopper%202.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEiJune1g0lrovf02xqAOuZ3G60z8CkTHaLd0dlG0EZ_lSmlP4xx2l6R7jKHCa_8_gpNrunEFV15ZWc1CROjHhRwvd0X6-U3shixL3CGYMh_0YcsgswoWkmLlYeosQxOQlcKS1qxNGOctjAfyaU5S7yM5aijfMSb4lh3rODNOpywbLcP2LXI73FIyPd_4w\/s16000\/hopper%202.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p><strong>\u6b65\u9aa47\uff1a\u8bb0\u4e0b\u8981\u8df3\u8f6c\u5230\u7684\u5730\u5740<\/strong><\/p>\n\n\n\n<p>\u6211\u4eec\u5df2\u7ecf\u68c0\u67e5\u4e86\u7a0b\u5e8f\u4e2d\u7684\u4e24\u4e2a\u51fd\u6570\u3002\u603b\u800c\u8a00\u4e4b\uff0c\u6211\u4eec\u5236\u5b9a\u4e86\u4ee5\u4e0b\u4fe1\u606f\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>runCode() \u2013 \u6267\u884c\u547d\u4ee4 \u201c\/bin\/ls -la\u201d<\/li><li>change() \u2013 \u4e0d\u6267\u884c\u4ee3\u7801\uff0c\u4f46\u5c06\u5168\u5c40\u53d8\u91cf\u66f4\u6539\u4e3a\u201c\/bin\/uname -a\u201d<\/li><\/ul>\n\n\n\n<p>\u4e3a\u4e86\u9632\u6b62\u7f13\u51b2\u533a\u6ea2\u51fa\uff0c\u8ba9\u6211\u4eec\u8df3\u8f6c\u5230 runCode\uff08\uff09 \u51fd\u6570\u3002\u8ba9\u6211\u4eec\u8bb0\u4e0b\u9759\u6001\u53cd\u6c47\u7f16\u4e2d runCode\uff08\uff09 \u7684\u6761\u76ee\u5730\u5740\uff1a0x100007c88\u3002<\/p>\n\n\n\n<p><strong>\u6b65\u9aa4 8\uff1a\u83b7\u53d6\u51fd\u6570\u5730\u5740\u4ee5\u8ba1\u7b97 <strong>slide<\/strong><\/strong><\/p>\n\n\n\n<p>\u5982\u679c\u6bd4\u8f83 radare2 \u548c Hopper \u7684\u4e3b\u5730\u5740\uff0c\u60a8\u4f1a\u6ce8\u610f\u5230\u8fd9\u4e9b\u5730\u5740\u4e0e\u7a0b\u5e8f\u4e2d\u6cc4\u9732\u7684\u4e3b\u5730\u5740\u4e0d\u540c\uff08\u5982\u4e0b\u6240\u793a\uff09\u3002\u8fd9\u662f\u56e0\u4e3aASLR\u5728iOS\u4e0a\u542f\u7528\u4e86\uff0c\u56e0\u6b64\u5b9e\u9645\u7684\u529f\u80fd\u5730\u5740\u5c06\u4f4d\u4e8e\u4e0d\u540c\u7684\u4f4d\u7f6e\u3002\u6211\u4eec\u5df2\u7ecf\u77e5\u9053\u4e3b\u5730\u5740\uff0c\u56e0\u4e3a\u5b83\u88ab\u7a0b\u5e8f\u6cc4\u9732\uff0c\u6211\u4eec\u53ea\u9700\u8981\u5728\u8fd0\u884c\u65f6\u8ba1\u7b97\u51fd\u6570\u7684\u771f\u5b9e\u5730\u5740\u4f4d\u7f6e\u3002\u8fd9\u5f88\u5bb9\u6613\u505a\u5230\uff01\u8ba9\u6211\u6765\u544a\u8bc9\u4f60\u3002<\/p>\n\n\n\n<p>\u9996\u5148\u4ece\u7a0b\u5e8f\u4e2d\u83b7\u53d6main\u7684\u6cc4\u6f0f\u5730\u5740\u3002\u4e0d\u8981\u9000\u51fa\u7a0b\u5e8f\uff0c\u56e0\u4e3a\u5730\u5740\u6bcf\u6b21\u90fd\u4f1a\u66f4\u6539\u3002\u60a8\u7684\u5730\u5740\u53ef\u80fd\u4e0e\u6211\u7684\u5730\u5740\u4e0d\u540c:)<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVyutJEsPdbvIaK286g1yPRqUBdXEBJgOAGexU3sT-Hus9SmNQC5mr2Knv0Ns-auWZMvb_I5LyFLo9vMn8bsyFK2o35d4KKS5C6zipS5rNk4oJZiAbh797Ffsc8RbQuzNFDlBw8VmxAlcZLdDIoGWViRuQgjfu00lijIioAVy1WkeGYw9IlRWPjRXY1A\/s772\/buffermain.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjVyutJEsPdbvIaK286g1yPRqUBdXEBJgOAGexU3sT-Hus9SmNQC5mr2Knv0Ns-auWZMvb_I5LyFLo9vMn8bsyFK2o35d4KKS5C6zipS5rNk4oJZiAbh797Ffsc8RbQuzNFDlBw8VmxAlcZLdDIoGWViRuQgjfu00lijIioAVy1WkeGYw9IlRWPjRXY1A\/s16000\/buffermain.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u8981\u8ba1\u7b97<strong>slide<\/strong>\uff08\u4ece\u9759\u6001\u5730\u5740\u5230\u8fd0\u884c\u65f6\u5730\u5740\u7684\u5185\u5b58\u5dee\u5f02\uff09\uff0c\u6211\u4eec\u8fd8\u9700\u8981\u83b7\u53d6main()\u7684\u9759\u6001\u5730\u5740\u3002\u6211\u4eec\u53ef\u4ee5\u901a\u8fc7\u4f7f\u7528LLDB\u5e76\u53cd\u6c47\u7f16main\u51fd\u6570\u6765\u505a\u5230\u8fd9\u4e00\u70b9\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgMJSUYouEpBj12jM_aJ0zAQDKdGfjHUf4iH_yie1KhA44mMn4c3Ng8HFaaOU09RA-mqfUco5szr67Xd1jqG6ZCIyXXOXeNTMOD32EqsLMoTab8fiNKHq3TUkKOhLU5pWoZW7jTZ4HHxZxVII16HpAgilOJTomIaTYwmon4_cn62BU3v6jy7p5EAzwHbA\/s729\/11.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgMJSUYouEpBj12jM_aJ0zAQDKdGfjHUf4iH_yie1KhA44mMn4c3Ng8HFaaOU09RA-mqfUco5szr67Xd1jqG6ZCIyXXOXeNTMOD32EqsLMoTab8fiNKHq3TUkKOhLU5pWoZW7jTZ4HHxZxVII16HpAgilOJTomIaTYwmon4_cn62BU3v6jy7p5EAzwHbA\/s16000\/11.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u5982\u60a8\u5728\u4e0a\u9762\u770b\u5230\u7684\uff0cmain\u7684\u9759\u6001\u5730\u5740\u662f\uff1a0x100007cc8\u3002\u5199\u4e0b\u8fd9\u4e24\u4e2a\u5730\u5740\uff01<\/p>\n\n\n\n<p><strong>\u6b65\u9aa4 9\uff1a\u8ba1\u7b97 <strong>slide<\/strong><\/strong><\/p>\n\n\n\n<p>\u6570\u5b66\u8fd0\u7b97\u7b80\u5355\u5982\u4e0b\uff1a<\/p>\n\n\n\n<p>\u8981\u8ba1\u7b97 <strong>slide<\/strong>\uff0c\u8bf7\u6267\u884c\u4ee5\u4e0b\u8ba1\u7b97\uff1a<\/p>\n\n\n\n<p>\u6cc4\u6f0f\u7684\u4e3b\u5730\u5740 \u2013 \u8c03\u8bd5\u5668\u4e3b\u5730\u5740 = \u5dee\u503c<\/p>\n\n\n\n<p>\u8981\u8ba1\u7b97 runCode() \u51fd\u6570\u5728\u8fd0\u884c\u65f6\u7684\u5b9e\u9645\u5730\u5740\u4f4d\u7f6e\uff0c\u8bf7\u6267\u884c\u4ee5\u4e0b\u64cd\u4f5c\uff1a<\/p>\n\n\n\n<p>\u8c03\u8bd5\u5668 runCode() \u5730\u5740 + \u5dee\u5f02 = \u8fd0\u884c\u65f6 RunCode\uff08\uff09 \u7684\u5b9e\u9645\u5730\u5740\u3002<\/p>\n\n\n\n<p>\u73b0\u5728\u6211\u4eec\u6709\u4ee5\u4e0b\u7ec4\u4ef6\uff1a<\/p>\n\n\n\n<p>\u6cc4\u9732\u4e3b\u5730\u5740\uff1a0x1047c7cc8<\/p>\n\n\n\n<p>\u8c03\u8bd5\u5668\u4e3b\uff1a0x100007cc8<\/p>\n\n\n\n<p>\u5dee\u503c\uff1a0x1047c7cc8 &#8211; 0x100007cc8 = 0x47C0000<\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u8ba1\u7b97 runCode() \u7684\u5b9e\u9645\u5730\u5740\uff1a<\/p>\n\n\n\n<p>\u8c03\u8bd5\u5668 runCode() \u5730\u5740\uff1a 0x100007c88<\/p>\n\n\n\n<p>\u5b9e\u9645 runCode() \u5730\u5740\uff1a 0x47C0000 + 0x100007c88 = 0x1047C7C88\u77a7\uff01\u6b64\u6b63\u5728\u8fd0\u884c\u7684\u7a0b\u5e8f\u4e2d runCode() \u7684\u5b9e\u9645\u5730\u5740\u662f 0x1047C7C88\u3002<\/p>\n\n\n\n<p><strong>\u6b65\u9aa4 10\uff1a\u51c6\u5907\u7f13\u51b2\u533a\u8d1f\u8f7d<\/strong><\/p>\n\n\n\n<p>\u73b0\u5728\u6211\u4eec\u5df2\u51c6\u5907\u597d\u6267\u884c\u653b\u51fb\u3002\u6211\u4eec\u77e5\u9053LR\u5bc4\u5b58\u5668\u5728\u201cFFFFFEEE\u201d\u5904\u4ece\u6211\u4eec\u539f\u59cb\u6709\u6548\u8f7d\u8377\u4e2d\u88ab\u8986\u76d6\u3002\u56e0\u6b64\uff0c\u6211\u4eec\u7684\u6709\u6548\u8d1f\u8f7d\u9700\u8981\u5982\u4e0b\u6240\u793a\uff1a<\/p>\n\n\n\n<p>AAAAAAAABBBBBBBBCCCCCDDDDDDDEEEEEee&lt;MALICIOUS ADDRESS&gt;<\/p>\n\n\n\n<p>\u4e3a\u4e86\u5b9e\u73b0\u8fd9\u4e00\u70b9\uff0c\u8ba9\u6211\u4eec\u5c06\u6587\u672c\u8f6c\u6362\u4e3a\u5341\u516d\u8fdb\u5236\u7b49\u6548\u9879\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>A = x41\nB = x42\nC = x43\nD = x44\nE = x45\nF = x46<\/code><\/pre>\n\n\n\n<p>\u7531\u4e8e\u5904\u7406\u5668\u5904\u4e8e\u5c0f\u7aef\u5e8f\u4e2d\uff0c\u56e0\u6b64\u6211\u4eec\u8fd8\u8f6c\u6362runCode()\uff080x1047C7C88\uff09\u7684\u5730\u5740\u4ee5\u5339\u914d\u5b83\u3002\u8fd9\u4f7f\u5176\u6210\u4e3a\u201c\\x88\\x7c\\x7c\\x04\\01\u201d\u3002\u7531\u4e8e\u8fd9\u662f 64 \u4f4d\uff0c\u56e0\u6b64\u6240\u6709\u5730\u5740\u90fd\u6709 8 \u4e2a\u5b57\u8282\uff0c\u56e0\u6b64\u8ba9\u6211\u4eec\u5c06\u6b64\u5730\u5740\u586b\u5145\u4e3a\u201c\\x88\\x7c\\x7c\\x04\\01\\x00\\x00\\x00\\x00\u201d\uff0c\u8fd9\u76f8\u5f53\u4e8e0x0000001047C7C88\u3002<\/p>\n\n\n\n<p>\u56e0\u6b64\uff0c\u6211\u4eec\u7684\u6709\u6548\u8d1f\u8f7d\u9700\u8981\u5982\u4e0b\u6240\u793a\uff1a<\/p>\n\n\n\n<p>echo -ne \u201c\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x45\\x45\\x45\\x45\\x45\\x88\\x7c\\x7c\\x04\\x01\\x00\\x00\\x00\\x00\u201d > resume.txt<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhNqCNaMV-pxe_K10uiPE-bqXboR9ebkm4tUg_JgG3eQISIgOEKrqiCNjPbnJXVL-QlpQKgmexl4OrMgMROkgUcZQnK9OhG45NnL1UAImgb6MCwAJ2E5lcKd1QqgktDTGADf0jo1JnBbuaMXHDbS3RO9JtDfoviJob_3gSuP6qXsaeDxMkGZUnDRldEaA\/s747\/buffer1.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEhNqCNaMV-pxe_K10uiPE-bqXboR9ebkm4tUg_JgG3eQISIgOEKrqiCNjPbnJXVL-QlpQKgmexl4OrMgMROkgUcZQnK9OhG45NnL1UAImgb6MCwAJ2E5lcKd1QqgktDTGADf0jo1JnBbuaMXHDbS3RO9JtDfoviJob_3gSuP6qXsaeDxMkGZUnDRldEaA\/s16000\/buffer1.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p><strong>\u6b65\u9aa4 11\uff1a\u68c0\u67e5\u653b\u51fb\u662f\u5426\u6210\u529f<\/strong><\/p>\n\n\n\n<p>\u73b0\u5728\uff0c\u8ba9\u6211\u4eec\u8fd0\u884c\u6211\u4eec\u7684 dontpopme \u4e8c\u8fdb\u5236\u6587\u4ef6\uff0c\u5e76\u68c0\u67e5\u6211\u4eec\u662f\u5426\u6210\u529f\u6267\u884c\u4e86 runCode()\uff0c\u4ece\u800c\u5bfc\u81f4\u8fd0\u884c \u201cls -la\u201d \u547d\u4ee4\u3002\u5982\u60a8\u6240\u89c1\uff0c\u6211\u4eec\u6210\u529f\u4e86!!!1337\u8b66\u62a5\uff01<\/p>\n\n\n\n<p>\u4f46\u662f\u5982\u679c\u4f60\u9605\u8bfb\u7a0b\u5e8f\u8f93\u51fa\uff0c\u5b83\u8bf4\u201c\u5982\u679c\u4f60\u5f04\u6e05\u695a\u6211\u7684\u540d\u5b57\uff0c\u4f60\u5c31\u88ab\u5f55\u7528\u4e86\u201d\u3002\u770b\u8d77\u6765\u6211\u4eec\u65e0\u6cd5\u4ec5\u901a\u8fc7\u7b80\u5355\u7684\u7f13\u51b2\u533a\u6ea2\u51fa\u6765\u627e\u51fa\u540d\u79f0:(\u8fd9\u610f\u5473\u7740\u6211\u4eec\u9700\u8981\u505a\u4e00\u4e2aROP\u94fe\uff01<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg7Ox5k701R0nrH0QrOXlPHS1Bj1qHAOj8aTZw0gdPvntkYaG03-tTXRH98XXxuFHEfJ01bTUO44PEl1ZNrj_w3Ghi8PmZElQAeuoUgKByyaa_TtCRqLGvNl4Hnsc63O73ABpJK40CFJ-QtWlqFrjNjuSnf-OU0t5Ouzyhq9LM9gJTwGYawiYXsrphsEw\/s793\/buffer2.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEg7Ox5k701R0nrH0QrOXlPHS1Bj1qHAOj8aTZw0gdPvntkYaG03-tTXRH98XXxuFHEfJ01bTUO44PEl1ZNrj_w3Ghi8PmZElQAeuoUgKByyaa_TtCRqLGvNl4Hnsc63O73ABpJK40CFJ-QtWlqFrjNjuSnf-OU0t5Ouzyhq9LM9gJTwGYawiYXsrphsEw\/s16000\/buffer2.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p><strong>ARM64 ROP \u94fe\u6307\u5bfc<\/strong><\/p>\n\n\n\n<p>\u4f60\u51c6\u5907\u597d\u4eab\u53d7\u771f\u6b63\u7684\u4e50\u8da3\u4e86\u5417\uff1f\u6211\u4eec\u5c06\u5b66\u4e60\u5982\u4f55\u505aROP\u94fe!!!!!\u8036\uff01<\/p>\n\n\n\n<p><strong>\u6b65\u9aa41\uff1a\u4e86\u89e3\u6211\u4eec\u5c06\u5982\u4f55\u8fdb\u884cROP\u94fe<\/strong><\/p>\n\n\n\n<p>\u5982\u679c\u60a8\u4e0d\u719f\u6089ROP\u94fe\u7684\u6982\u5ff5\uff0c<a href=\"https:\/\/ctf101.org\/binary-exploitation\/return-oriented-programming\/#:~:text=Return%20Oriented%20Programming%20(or%20ROP,to%20do%20more%20complex%20things\" target=\"_blank\" rel=\"noreferrer noopener\">\u8bf7\u67e5\u770bCTF101\u7684\u8fd9\u7bc7\u6587\u7ae0<\/a>\u3002\u6211\u4e5f\u4f1a\u7528\u6700\u7b80\u5355\u7684\u65b9\u5f0f\u89e3\u91ca\u5b83\u3002<\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u53c2\u8003\u4e0b\u9762\u7684\u57fa\u672c\u56fe\uff0c\u6211\u4eec\u57fa\u672c\u4e0a\u8981\u6269\u5c55\u521d\u59cb\u7f13\u51b2\u533a\u6ea2\u51fa\u653b\u51fb\uff0c\u901a\u8fc7\u8df3\u8f6c\u5230\u94fe\u4e2d\u4e00\u4e2a\u63a5\u4e00\u4e2a\u7684\u4e24\u4e2a\u51fd\u6570\u3002\u60a8\u53ef\u4ee5\u8fdb\u884c\u591a\u6b21\u8df3\u8f6c\uff0c\u4f46\u5bf9\u4e8e\u6b64\u793a\u4f8b\uff0c\u6211\u4eec\u53ea\u6267\u884c\u4e24\u6b21\u8df3\u8f6c\u3002\u901a\u5e38\uff0c\u5728\u66f4\u590d\u6742\u7684ROP\u94fe\u4e2d\uff0c\u60a8\u5c06\u4f7f\u7528\u79f0\u4e3a\u201c\u5c0f\u5de5\u5177\u201d\u7684\u4e1c\u897f\uff0c\u5b83\u662f\u7a0b\u5e8f\u4e2d\u67d0\u5904\u5b58\u5728\u7684\u4e00\u7cfb\u5217\u6307\u4ee4\u3002\u8fd9\u4e9b\u5c0f\u5de5\u5177\u5305\u542b\u5141\u8bb8\u60a8\u64cd\u4f5c\u5bc4\u5b58\u5668\u6216\u6267\u884c\u4f7f\u60a8\u66f4\u63a5\u8fd1\u5229\u7528\u76ee\u6807\u7684\u64cd\u4f5c\u7684\u6307\u4ee4\uff0c\u5e76\u4e14\u901a\u5e38\u4ee5 RET \u6307\u4ee4\u7ed3\u5c3e\u3002\u6211\u4eec\u4e4b\u6240\u4ee5\u5b66\u4e60ROP\u94fe\uff0c\u662f\u56e0\u4e3a\u7531\u4e8eDEP\uff0c\u5b83\u53ef\u4ee5\u9632\u6b62\u60a8\u5c06\u81ea\u5df1\u7684\u6076\u610f\u53ef\u6267\u884c\u4ee3\u7801\u6ce8\u5165\u5806\u6808\u3002\u8fd9\u610f\u5473\u7740\u60a8\u88ab\u8feb\u4f7f\u7528\u7a0b\u5e8f\u4e2d\u5b58\u5728\u7684\u73b0\u6709\u4ee3\u7801\u548c\u51fd\u6570\u6765\u6267\u884c\u60a8\u7684\u6f0f\u6d1e\u5229\u7528\u3002\u901a\u8fc7\u626b\u63cf\u7a0b\u5e8f\u4e2d\u6709\u7528\u7684\u5c0f\u5de5\u5177\u548c\u529f\u80fd\uff0c\u60a8\u53ef\u4ee5\u6309\u987a\u5e8f\u91cd\u65b0\u8c03\u6574\u4ee3\u7801\u7684\u7528\u9014\uff0c\u4ece\u800c\u5b9e\u73b0\u6700\u7ec8\u76ee\u6807\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgh0tZ6jpnM4WfCIuvXYDU9vwg5n5EH5ApRzTlay43ED95-O_pZDURDCpcl7q9VYNjVkKtnxgF3FSzWO8MQyxi6Mh6Y1WAsTlh4gZbS-pMaStlnRAeyqk24Ps1I9u_-9SKcW3L2jmbyOQB1utbfeTpc8ALTsq_x9REflhy79Cedf45elvLTlZV4inSdOw\/s965\/Screen%20Shot%202022-06-14%20at%206.27.17%20pm.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgh0tZ6jpnM4WfCIuvXYDU9vwg5n5EH5ApRzTlay43ED95-O_pZDURDCpcl7q9VYNjVkKtnxgF3FSzWO8MQyxi6Mh6Y1WAsTlh4gZbS-pMaStlnRAeyqk24Ps1I9u_-9SKcW3L2jmbyOQB1utbfeTpc8ALTsq_x9REflhy79Cedf45elvLTlZV4inSdOw\/s16000\/Screen%20Shot%202022-06-14%20at%206.27.17%20pm.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u5728\u201cdontpopme\u201d\u7a0b\u5e8f\u7684\u4e0a\u4e0b\u6587\u4e2d\uff0c\u6211\u4eec\u5c06\u94fe\u63a5\u6211\u4eec\u4e4b\u524d\u786e\u5b9a\u7684\u4ee5\u4e0b\u4e24\u4e2a\u51fd\u6570\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>change() \u2013 \u5c06\u4e24\u4e2a\u5168\u5c40\u53d8\u91cf\u66f4\u6539\u4e3a\u201c\/bin\/uname\u201d\u548c\u201c-a\u201d<\/li><li>runCode() \u2013 \u6267\u884c\u6267\u884c\u6267\u884c\u4e24\u4e2a\u5168\u5c40\u53d8\u91cf\u4e2d\u7684\u6267\u884c execl() \u4f20\u9012<\/li><\/ul>\n\n\n\n<p>\u8fd9\u5c06\u4f7f\u6211\u4eec\u80fd\u591f\u5b8c\u5168\u7ed5\u8fc7\u7a0b\u5e8f\u5e76\u5b9e\u73b0\u83b7\u53d6\u201cname\u201d\u6807\u5fd7\u7684\u6700\u7ec8\u76ee\u6807 &#8211; \u8be5\u6807\u5fd7\u5c06\u7531\u201c\/bin\/uname -a\u201d\u547d\u4ee4\u6253\u5370\u3002<\/p>\n\n\n\n<p>\u8ba9\u6211\u4eec\u8fdb\u5165:)<\/p>\n\n\n\n<p><strong>\u6b65\u9aa4 2\uff1a\u8ba1\u7b97slide<\/strong><\/p>\n\n\n\n<p>\u4e3a\u4e86\u751f\u6210\u6709\u6548\u8d1f\u8f7d\uff0c\u6211\u4eec\u9700\u8981\u518d\u6b21\u6536\u96c6\u4ee5\u4e0b\u503c\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>Leaked Main Address<\/li><li>Change() entry address<\/li><li>runCode() entry address<\/li><li>Debugger Main Address<\/li><li>Debugger Change() address<\/li><li>Debugger runCode() address<\/li><\/ul>\n\n\n\n<p>\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u90e8\u5206\u4e2d\u6267\u884c\u7684\u76f8\u540c\u683c\u5f0f\u4e2d\uff0c\u6211\u4eec\u9700\u8981\u8ba1\u7b97slide\uff0c\u8fd9\u662f\u6cc4\u6f0f\u5730\u5740\u548c\u8c03\u8bd5\u5668\u4e3b\u5730\u5740\u4e4b\u95f4\u7684\u5dee\u5f02\uff1a<\/p>\n\n\n\n<p>\u6cc4\u6f0f\u7684\u4e3b\u5730\u5740 \u2013 \u8c03\u8bd5\u5668\u4e3b\u5730\u5740 = \u5dee\u5f02<\/p>\n\n\n\n<p>main \u7684\u5b9e\u9645\u8fd0\u884c\u65f6\u5730\u5740\u5982\u4e0b\u6240\u793a\uff1a0x102527cc8\u3002\u8bf7\u6ce8\u610f\uff0c\u8fd9\u5df2\u66f4\u6539\uff0c\u56e0\u4e3a\u6211\u91cd\u65b0\u8fd0\u884c\u4e86\u8be5\u7a0b\u5e8f:)<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgp9wy2Xy_PAiPbp5AZyYQPTIBcsy4Z-ft9wcITfvbcwjnVl55yFPBYuETouo8LWiSVANlNiAMfZL4ONgDFIeaHU4zXTO-Oo5I9coCffRq-lU9Y6rzgW0bYXedmcXX5gt-A2todnO9gHeWIn462Te3ar6BgLxreW9YXmny77NAF3QamVVzEt0DFkIldAw\/s709\/8.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgp9wy2Xy_PAiPbp5AZyYQPTIBcsy4Z-ft9wcITfvbcwjnVl55yFPBYuETouo8LWiSVANlNiAMfZL4ONgDFIeaHU4zXTO-Oo5I9coCffRq-lU9Y6rzgW0bYXedmcXX5gt-A2todnO9gHeWIn462Te3ar6BgLxreW9YXmny77NAF3QamVVzEt0DFkIldAw\/s16000\/8.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>change() \u7684\u9759\u6001\u5730\u5740\u5982\u4e0b\u6240\u793a\uff0c\u5982\u4e0b\u6240\u793a0x100007c50\u3002\u6211\u4eec\u4e0d\u60f3\u6536\u96c6\u6761\u76ee\u7684\u5730\u5740\uff0c\u800c\u662f\u6536\u96c6\u7b2c\u4e8c\u6761\u6307\u4ee4\uff08\u7a81\u51fa\u663e\u793a\uff09\u3002\u6211\u4f7f\u7528 radare2 \u6309\u7167\u6211\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u90e8\u5206\u4e2d\u63d0\u4f9b\u7684\u8bf4\u660e\u6267\u884c\u6b64\u64cd\u4f5c\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjinfiIxzYMQ7pdYWXOzi8aRmawSbXUwJnNH1woPxxKvDuUWeLgGoN_rCvrlz-Nk75qLx_rq09dsSwsIwhkYOd6WKlUGkMkWWIg0ssBBLcREviNDsiMwHf0zOQr9OuQVnhTDgEC3qgfzmXYsjVQNTVQcYu2TPF0xE2QcuLRciAeBKURVfVLKPvAy7BtTg\/s1119\/10.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjinfiIxzYMQ7pdYWXOzi8aRmawSbXUwJnNH1woPxxKvDuUWeLgGoN_rCvrlz-Nk75qLx_rq09dsSwsIwhkYOd6WKlUGkMkWWIg0ssBBLcREviNDsiMwHf0zOQr9OuQVnhTDgEC3qgfzmXYsjVQNTVQcYu2TPF0xE2QcuLRciAeBKURVfVLKPvAy7BtTg\/s16000\/10.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u5165\u53e3\u70b9\u5904 runCode \u7684\u9759\u6001\u5730\u5740\uff0c\u5982\u4e0b\u6240\u793a\uff1a0x100007c88<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0rPkOkoC2URe0lTrWtFM6EIfDR6bZfHXFxEGVGBI5MRgJGQszkJPrIVXL5vP488D7QS6fxPUGecoaNnO2Q2t_C_I8gu9iQA46-qP33A_noclny2dKJ4FiaVahq9BN0EmabKHxoRBcytIEDgNHk2xnEWj95nYK3Nw0bSrazcmh9h_HyFLzCNa-URhISQ\/s904\/9.2.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEh0rPkOkoC2URe0lTrWtFM6EIfDR6bZfHXFxEGVGBI5MRgJGQszkJPrIVXL5vP488D7QS6fxPUGecoaNnO2Q2t_C_I8gu9iQA46-qP33A_noclny2dKJ4FiaVahq9BN0EmabKHxoRBcytIEDgNHk2xnEWj95nYK3Nw0bSrazcmh9h_HyFLzCNa-URhISQ\/s16000\/9.2.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u4ee5\u4e0b\u662f\u6211\u4eec\u6536\u96c6\u7684\u4fe1\u606f\u6458\u8981\uff1a<\/p>\n\n\n\n<pre class=\"wp-block-code\"><code>Leaked main: 0x102527cc8\nDebugger change(): 0x100007c50\nDebugger runCode(): 0x100007c88\nDebugger main(): 0x100007cc8<\/code><\/pre>\n\n\n\n<p>\u9996\u5148\uff0c\u8ba9\u6211\u4eec\u518d\u6b21\u8ba1\u7b97slide\uff1a<\/p>\n\n\n\n<p>Leaked Main \u2013 Debugger Main: 4333927624 &#8211; 4294999240 = 38928384<\/p>\n\n\n\n<p>\u73b0\u5728\uff0c\u8ba9\u6211\u4eec\u4f7f\u7528slide\u8ba1\u7b97\u5b9e\u9645\u7684\u8fd0\u884c\u65f6\u51fd\u6570\u5730\u5740\uff1a<\/p>\n\n\n\n<p>Real runCode() Address: 38928384 + 4294999176 = 4,333,927,560 = 0x102527C88<\/p>\n\n\n\n<p>Real change() address: 38928384 + 4294999120 = 4,333,927,504 = 0x102527C50<\/p>\n\n\n\n<p>\u8fd9\u7ed9\u6211\u4eec\u7559\u4e0b\u4e86ROP\u94fe\u7684\u4e24\u4e2a\u5173\u952e\u4fe1\u606f\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>change() entry point: 0x102527C50<\/li><li>runCode() entry point: 0x102527C88<\/li><\/ul>\n\n\n\n<p><strong>\u6b65\u9aa4 3\uff1a\u51c6\u5907payload<\/strong><\/p>\n\n\n\n<p>\u6b63\u5982\u6211\u4eec\u5728\u7f13\u51b2\u533a\u6ea2\u51fa\u4e2d\u6307\u51fa\u7684\u90a3\u6837\uff0cLR \u8986\u76d6\u53d1\u751f\u5728\u201cFFFFFEEE\u201d\u5904\u3002\u4f46\u662f\uff0c\u8d1f\u8f7d\u770b\u8d77\u6765\u4e0e\u7f13\u51b2\u533a\u6ea2\u51fa\u7565\u6709\u4e0d\u540c\u3002<\/p>\n\n\n\n<p>\u5982\u679c\u4f60\u6ce8\u610f\u5230\uff0cchange() \u51fd\u6570\u4e2d\u201cret\u201d\u4e4b\u524d\u7684\u6700\u540e\u4e00\u6761\u6307\u4ee4\u662f\u201cLDP x29, x30\u201d\u3002\u8fd9\u57fa\u672c\u4e0a\u662f\u4ece\u5806\u6808\u4e2d\u5f39\u51fax29\u548cx30\u5bc4\u5b58\u5668\uff0c\u8fd9\u610f\u5473\u7740x30\u5185\u7684\u4efb\u4f55\u5185\u5bb9\u90fd\u5c06\u662f\u5b83\u8df3\u5165\u7684\u8fd4\u56de\u5730\u5740\u3002<\/p>\n\n\n\n<p>\u5bf9\u4e8e\u8fdb\u4e00\u6b65\u7684\u4e0a\u4e0b\u6587\uff0cx30\u5bc4\u5b58\u5668\u662f\u201cLR\u201d\uff0c\u53c8\u540d\u94fe\u8def\u5bc4\u5b58\u5668\uff0cx29\u662f\u201cFP\u201d\uff0c\u4e5f\u5c31\u662f\u5e27\u6307\u9488\u3002<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgN_LGilQMYMx2Uisd4rcIMfbCu6ZYFO2y0SwUStYQz7UktsQ-W-cLtnpQs8J1lQnNWV0qz7zjq-T6ll07Vtc682UcXUqx5fJ-OPP8r8wlZTj9wxxXew5z-UB0s_4AxVNzn07tWDg-7AorZy4qVKB_rPG0VAU-vPHzy01h0n-wkhFXiyD64qqYi84WlIw\/s694\/Screen%20Shot%202022-06-15%20at%202.47.13%20pm.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgN_LGilQMYMx2Uisd4rcIMfbCu6ZYFO2y0SwUStYQz7UktsQ-W-cLtnpQs8J1lQnNWV0qz7zjq-T6ll07Vtc682UcXUqx5fJ-OPP8r8wlZTj9wxxXew5z-UB0s_4AxVNzn07tWDg-7AorZy4qVKB_rPG0VAU-vPHzy01h0n-wkhFXiyD64qqYi84WlIw\/s16000\/Screen%20Shot%202022-06-15%20at%202.47.13%20pm.png\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u8fd9\u610f\u5473\u7740\u6211\u4eec\u7684\u6709\u6548\u8d1f\u8f7d\u9700\u8981\u50cf\u8fd9\u6837\u6784\u5efa\uff1a<\/p>\n\n\n\n<ul class=\"wp-block-list\"><li>AAAAAAAABBBBBBBBCCCCCCCCDDDDDDDDEEEEE\u00a0<\/li><li>Address of change()\u00a0 &#8211; \\x50\\x7c\\x52\\x02\\x01\\x00\\x00\\x00<\/li><li>8 bytes of whatever &#8211; \\xff\\xff\\xff\\xff\\xff\\xff\\xff\\xff<\/li><li>Address of runCode() \u2013 \\x88\\x7c\\x52\\x02\\x01\\x00\\x00\\x00<\/li><\/ul>\n\n\n\n<p>\u6211\u4eec\u7684\u6f0f\u6d1e\u5229\u7528\u6709\u6548\u8d1f\u8f7d\u5c06\u5982\u4e0b\u6240\u793a\uff1a<\/p>\n\n\n\n<p>echo -ne \u201c\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x41\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x42\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x43\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x44\\x45\\x45\\x45\\x45\\x45\\x45\\x50\\x7c\\x52\\x02\\x01\\x00\\x00\\x00\\x00\\xff\\xff\\xff\\xff\\xff\\x88\\x7c\\x52\\x02\\x01\\x00\\x00\\x00\u201d > resume.txt<\/p>\n\n\n\n<p><strong>\u6b65\u9aa4 4\uff1a\u6267\u884c ROP \u94fe\uff01<\/strong><\/p>\n\n\n\n<p>\u9996\u5148\uff0c\u8ba9\u6211\u4eec\u4f7f\u7528\u6709\u6548\u8d1f\u8f7d\u521b\u5efa\u201cresume.txt\u201d\uff1a<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgCTo74QIsbhaB7E6GT0Wlf1-468XxFVMjA1zhdTZ1rFHvNIdLom1eEBOaoSeYxr0oFJDCnnbcRi1o3psm1f52RehJbdXGqDzLUFVql74thU8zBqX4cJGMuEwKgRrSBQrM6SNrgGJmk7KleP8xtQ2obf3Q00ZzGhJEM4WsgQgd40rt6-8lqGhopG7EhrA\/s930\/15.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEgCTo74QIsbhaB7E6GT0Wlf1-468XxFVMjA1zhdTZ1rFHvNIdLom1eEBOaoSeYxr0oFJDCnnbcRi1o3psm1f52RehJbdXGqDzLUFVql74thU8zBqX4cJGMuEwKgRrSBQrM6SNrgGJmk7KleP8xtQ2obf3Q00ZzGhJEM4WsgQgd40rt6-8lqGhopG7EhrA\/s16000\/15.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p>\u63a5\u4e0b\u6765\uff0c\u8ba9\u6211\u4eec\u6267\u884c\u7a0b\u5e8f\uff01\u77a7\uff0c\u6211\u4eec\u505a\u5230\u4e86:)\u6211\u4eec\u5f97\u5230\u4e86\u8fbe\u5c14\u6587\uff01<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi5rgbQKO1gM_U7Hif9I3E9fATtlAp4Ryv-vUeuJksIsKpthfo9NErJXqY4grh1hMtTRNAnjZMnHjNuHlsEqLhuYHaYNrjOzXWNv_r450OwY52qEBNdAaqV_w9JUcw8PQcj9zkhC6eoj_pCx2JfyPOPmRsaR-ldbEtLAGNl5XRd_yUy--hMNx6qPlDMnA\/s909\/16.PNG\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEi5rgbQKO1gM_U7Hif9I3E9fATtlAp4Ryv-vUeuJksIsKpthfo9NErJXqY4grh1hMtTRNAnjZMnHjNuHlsEqLhuYHaYNrjOzXWNv_r450OwY52qEBNdAaqV_w9JUcw8PQcj9zkhC6eoj_pCx2JfyPOPmRsaR-ldbEtLAGNl5XRd_yUy--hMNx6qPlDMnA\/s16000\/16.PNG\" alt=\"\"\/><\/a><\/figure>\n\n\n\n<p><strong>\u7ed3\u8bed<\/strong><\/p>\n\n\n\n<p>\u5982\u679c\u60a8\u60f3\u8981\u66f4\u591a\u8fd9\u6837\u7684\u6559\u7a0b\uff0c\u8bf7\u544a\u8bc9\u6211\u3002\u6211\u60f3\u5206\u4eab\u8fd9\u5f20\u5468\u672b\u7684\u53ef\u7231\u7167\u7247\uff0c\u5b83\u6fc0\u53d1\u4e86\u6211\u5199\u672c\u6559\u7a0b\u7684\u7075\u611f\u3002\u4e4c\u4e4c\u3002\u8fd9\u662finspo\u56fe\u7247&lt;3<\/p>\n\n\n\n<figure class=\"wp-block-image\"><a href=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjX7FSA8K7nxcID0u2lgM98uGNBrMsASFGfUabYkfpErAZWfeFse1gyYbtlV5whyqJ_ihkCpfn31FZj7QPygZ6gwaeR1sTvln-t_x5di8Ud0oWFpxAiJdHv7dgjh1GaSaOVUjCEU_VItzR4PhOPVuBbIY2vE3XU83T6uJXxVds2GOj-47u2D9ORIjNfvA\/s1163\/Screen%20Shot%202022-06-14%20at%206.58.01%20pm.png\"><img decoding=\"async\" src=\"https:\/\/blogger.googleusercontent.com\/img\/b\/R29vZ2xl\/AVvXsEjX7FSA8K7nxcID0u2lgM98uGNBrMsASFGfUabYkfpErAZWfeFse1gyYbtlV5whyqJ_ihkCpfn31FZj7QPygZ6gwaeR1sTvln-t_x5di8Ud0oWFpxAiJdHv7dgjh1GaSaOVUjCEU_VItzR4PhOPVuBbIY2vE3XU83T6uJXxVds2GOj-47u2D9ORIjNfvA\/w385-h400\/Screen%20Shot%202022-06-14%20at%206.58.01%20pm.png\" alt=\"\"\/><\/a><\/figure>\n","protected":false},"excerpt":{"rendered":"<p>\u539f\u6587\u94fe\u63a5\uff1ahttps:\/\/www.inversecos.com\/2022\/06\/guide-to-revers [&hellip;]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[95,43,1],"tags":[65],"class_list":["post-344","post","type-post","status-publish","format-standard","hentry","category-ios","category-infoarticle","category-uncategorized","tag-ios"],"views":1871,"jetpack_sharing_enabled":true,"jetpack_featured_media_url":"","_links":{"self":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/344","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=344"}],"version-history":[{"count":4,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/344\/revisions"}],"predecessor-version":[{"id":348,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=\/wp\/v2\/posts\/344\/revisions\/348"}],"wp:attachment":[{"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=344"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=344"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.aqwu.net\/wp\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=344"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}