c - 找到入口点和返回点

Question

向大家问好。

过去两天我一直在努力寻找这个 C 程序代码的入口和返回点。基本上我正在尝试使用 C 中的 strcpy 函数来理解缓冲区溢出。如果有人可以在这里帮助我，我将非常感激。C程序:

    #include<stdio.h>
    #include<string.h>
    #include<stdlib.h>
    int main(int argc, char *argv[])    // PROGRAM START
    {   char buf[64];               // Define buf var.
    //    if(argc>1)                // Avoided it to make assembly code short
        strcpy(buf,argv[1]);        // Copy the argument to buf var
        printf("%s",buf);
        return(0);                  // EXIT RETURN

    //    system("PAUSE");          // PAUSE THE PROGRAM, Again commented it
    }

现在，当我在 Immunity 调试器中打开它时，它是一堆代码。我发布下面的代码(将程序加载在内存中并将字符串加载在内存中，可能我留下了正确的部分。)

00401226   . C70424 0100000>MOV DWORD PTR SS:[ESP],1
0040122D   . FF15 D0504000  CALL DWORD PTR DS:[<&msvcrt.__set_app_ty>;  msvcrt.__set_app_type
00401233   . E8 C8FEFFFF    CALL buff1.00401100
00401238   . 90             NOP
00401239   . 8DB426 0000000>LEA ESI,DWORD PTR DS:[ESI]
00401240   . 55             PUSH EBP
00401241   . 89E5           MOV EBP,ESP
00401243   . 83EC 08        SUB ESP,8
00401246   . C70424 0200000>MOV DWORD PTR SS:[ESP],2
0040124D   . FF15 D0504000  CALL DWORD PTR DS:[<&msvcrt.__set_app_ty>;  msvcrt.__set_app_type
00401253   . E8 A8FEFFFF    CALL buff1.00401100
00401258   . 90             NOP
00401259   . 8DB426 0000000>LEA ESI,DWORD PTR DS:[ESI]
00401260   $ 55             PUSH EBP
00401261   . 8B0D E8504000  MOV ECX,DWORD PTR DS:[<&msvcrt.atexit>]  ;  msvcrt.atexit
00401267   . 89E5           MOV EBP,ESP
00401269   . 5D             POP EBP
0040126A   . FFE1           JMP ECX
0040126C     8D7426 00      LEA ESI,DWORD PTR DS:[ESI]
00401270   . 55             PUSH EBP
00401271   . 8B0D DC504000  MOV ECX,DWORD PTR DS:[<&msvcrt._onexit>] ;  msvcrt._onexit
00401277   . 89E5           MOV EBP,ESP
00401279   . 5D             POP EBP
0040127A   . FFE1           JMP ECX
0040127C     90             NOP
0040127D     90             NOP
0040127E     90             NOP
0040127F     90             NOP
00401280   > 55             PUSH EBP
00401281   . 89E5           MOV EBP,ESP
00401283   . 5D             POP EBP
00401284   . E9 67020000    JMP buff1.004014F0
00401289     90             NOP
0040128A     90             NOP
0040128B     90             NOP
0040128C     90             NOP
0040128D     90             NOP
0040128E     90             NOP
0040128F     90             NOP
00401290  /$ 55             PUSH EBP
00401291  |. 89E5           MOV EBP,ESP
00401293  |. 83EC 68        SUB ESP,68
00401296  |. 83E4 F0        AND ESP,FFFFFFF0
00401299  |. B8 00000000    MOV EAX,0
0040129E  |. 83C0 0F        ADD EAX,0F
004012A1  |. 83C0 0F        ADD EAX,0F
004012A4  |. C1E8 04        SHR EAX,4
004012A7  |. C1E0 04        SHL EAX,4
004012AA  |. 8945 B4        MOV DWORD PTR SS:[EBP-4C],EAX
004012AD  |. 8B45 B4        MOV EAX,DWORD PTR SS:[EBP-4C]
004012B0  |. E8 7B040000    CALL buff1.00401730
004012B5  |. E8 16010000    CALL buff1.004013D0
004012BA  |. 8B45 0C        MOV EAX,DWORD PTR SS:[EBP+C]             ; ||
004012BD  |. 83C0 04        ADD EAX,4                                ; ||
004012C0  |. 8B00           MOV EAX,DWORD PTR DS:[EAX]               ; ||
004012C2  |. 894424 04      MOV DWORD PTR SS:[ESP+4],EAX             ; ||
004012C6  |. 8D45 B8        LEA EAX,DWORD PTR SS:[EBP-48]            ; ||
004012C9  |. 890424         MOV DWORD PTR SS:[ESP],EAX               ; ||
004012CC  |. E8 5F050000    CALL <JMP.&msvcrt.strcpy>                ; |\strcpy
004012D1  |. 8D45 B8        LEA EAX,DWORD PTR SS:[EBP-48]            ; |
004012D4  |. 894424 04      MOV DWORD PTR SS:[ESP+4],EAX             ; |
004012D8  |. C70424 0030400>MOV DWORD PTR SS:[ESP],buff1.00403000    ; |ASCII "%s"
004012DF  |. E8 3C050000    CALL <JMP.&msvcrt.printf>                ; \printf
004012E4  |. B8 00000000    MOV EAX,0
004012E9  |. C9             LEAVE
004012EA  \. C3             RETN
004012EB     90             NOP
004012EC     90             NOP
004012ED     90             NOP
004012EE     90             NOP
004012EF     90             NOP
004012F0  /$ 55             PUSH EBP
004012F1  |. B9 F0304000    MOV ECX,buff1.004030F0
004012F6  |. 89E5           MOV EBP,ESP
004012F8  |. EB 14          JMP SHORT buff1.0040130E
004012FA  |  8DB6 00000000  LEA ESI,DWORD PTR DS:[ESI]
00401300  |> 8B51 04        MOV EDX,DWORD PTR DS:[ECX+4]
00401303  |. 8B01           MOV EAX,DWORD PTR DS:[ECX]
00401305  |. 83C1 08        ADD ECX,8
00401308  |. 0182 00004000  ADD DWORD PTR DS:[EDX+400000],EAX
0040130E  |> 81F9 F0304000  CMP ECX,buff1.004030F0
00401314  |.^72 EA          JB SHORT buff1.00401300
00401316  |. 5D             POP EBP
00401317  \. C3             RETN
00401318     90             NOP
00401319     90             NOP
0040131A     90             NOP
0040131B     90             NOP
0040131C     90             NOP
0040131D     90             NOP
0040131E     90             NOP
0040131F     90             NOP
00401320  /$ 55             PUSH EBP
00401321  |. 89E5           MOV EBP,ESP
00401323  |. DBE3           FINIT
00401325  |. 5D             POP EBP
00401326  \. C3             RETN
00401327     90             NOP
00401328     90             NOP
00401329     90             NOP
0040132A     90             NOP
0040132B     90             NOP
0040132C     90             NOP
0040132D     90             NOP
0040132E     90             NOP
0040132F     90             NOP
00401330  /. 55             PUSH EBP
00401331  |. 89E5           MOV EBP,ESP
00401333  |. 83EC 08        SUB ESP,8
00401336  |. A1 20204000    MOV EAX,DWORD PTR DS:[402020]
0040133B  |. 8B08           MOV ECX,DWORD PTR DS:[EAX]
0040133D  |. 85C9           TEST ECX,ECX

在调用strcpy函数之前，该程序(程序名称:buff1)有6个调用函数。我无法理解哪一个是 MAIN 函数的入口点。并从该点开始返回。

感谢大家在百忙之中抽出时间来完成此任务...

马克

Answer 1

我以为是00401290。它所做的第一件事(在堆栈指针之后)是将 buf 压入堆栈。它在 004012EA 处返回 RET。