BMBT newbie 必读

技能清单

• QEMU
  • 二进制翻译器基本原理
  • memory model
  • PCI 模拟
• Linux Kernel
  • irq domain
  • memory
    • page fault 的过程
    • 进程地址空间
• LoongArch
  • TLB
• BTMMU
• HSPT
• ESPT
• Dune
• Linux Programming Interface
• 深入理解计算机体系结构
• gdb bash makefile and …
• busybox

调试细节

• guest ip 来反汇编

裸机环境搭建

使用 U 盘

使用网络

gnu grub doc

似乎是一个深渊

minicom 的使用注意点

如果在 grub 中在 Linux Kernel 的启动项中添加上 console=ttyS0,115200， 那么可以就可以使用串口来获取这个 Kernel 的 dmesg 输出了，调试 3A5000 的时候发现 无法输出 “密码” 两个中文字，使用下面的参数就可以了:

minicom -D /dev/ttyUSB0 -R UTF-8

minicom 无法发送字符，解决方法参考 ¹，因为 uart 不需要中断的时候同样可以 正常工作（采用 poll ） 模式，所以如果 Guest 的 shell 不能交互，那么应该是 minicom 的配置有问题。

还可以继续开发的事情

• 从论文中抄过来

From hack to elaborate technique - A survey on binary rewriting

好吧，其实我大失所望，以后再看吧!

Our findings emphasize that although much work has been done over the last decades, most of the effort was put into improvements aiming at rewriting general purpose applications, but ignoring other challenges like altering throughput-oriented programs, or software with real-time requirements, that are often used in the emerging field of the Internet of Things.

修改 throughput-oriented programs 和 real-time 的有什么特殊需求吗?

monitor the adherence to specification (e.g., Pebil [82]), or for reverse engineering of data structures (e.g, Howard [123])

Jennings and Poimboeuf [67]

like a high number of cache faults due to misalignment is of interest in high performance computing domains [86]

Specifically the insertion of stack canaries [41] or address layout randomization [133]. Additional exploit aversion techniques applied at run-time, like attack recognition, also fall in this category (e.g., Zhang et al. [156])

will start an in-depth investigation of the identified building blocks.

Additionally, Larsen et al. [79] conducted a survey on automated software diversity approaches, which when done at post-compile or run-time utilize binary rewriting to apply security related augmentations to software, such as adding stack canaries or implementing address layout randomization schemes.

https://www.usenix.org/system/files/conference/usenixsecurity16/sec16_paper_andriesse.pdf

本站所有文章转发 CSDN 将按侵权追究法律责任，其它情况随意。

1. https://stackoverflow.com/questions/3913246/cannot-send-character-with-minicom ↩