reverse engineering and program understanding外语英文电子书

《reverse engineering and program understanding外语英文电子书》由会员上传分享，免费在线阅读，更多相关内容在教育资源-天天文库。

1、3029403071-146r10jm.ps1/30/042:18PMPage71ReverseEngineeringandProgramUnderstanding3ostpeopleinteractwithcomputerprogramsatasurfacelevel,Menteringinputandeagerly(impatiently?!)awaitingaresponse.Thepublicfaçadeofmostprogramsmaybefairlythin,butmostprogramsgomuchdeeperthantheyappearatfirstglance.Progra

2、mshaveapreponder-anceofguts,wheretherealfunhappens.Thesegutscanbeverycomplex.Exploitingsoftwareusuallyrequiressomelevelofunderstandingofsoftwareguts.Thesinglemostimportantskillofapotentialattackeristheabil-itytounravelthecomplexitiesoftargetsoftware.Thisiscalledreverseengineeringorsometimesjustrev

3、ersing.Softwareattackersaregreattoolusers,butexploitingsoftwareisnotmagicandtherearenomagicsoftwareexploitationtools.Tobreakanontrivialtargetprogram,anattackermustmanipulatethetargetsoftwareinunusualways.Soalthoughanattackalmostalwaysinvolvestools(disassemblers,scriptingengines,inputgenerators),th

4、esetoolstendtobefairlybasic.Therealsmartsremaintheattacker’sprerogative.Whenattackingsoftware,thebasicideaistogroktheassumptionsmadebythepeoplewhocreatedthesystemandthenunderminethoseassumptions.(Thisispreciselywhyitiscriticaltoidentifyasmanyassump-tionsaspossiblewhendesigningandcreatingsoftware.)

5、Reverseengineer-ingisanexcellentapproachtoferretingoutassumptions,especiallyimplicitassumptionsthatcanbeleveragedinanattack.11.AfriendatMicrosoftrelatedananecdoteinvolvingasuccessfulattackerwhomadeuseoftheword“assume”tofindinterestingplacestoattackincode.Unsuspectingdevelopersassumedthatwritingabou

6、twhattheyassumedwouldbeOK.Thisisasocial-levelattackpattern.SimilarsearchesthroughcodeforBUG,XXX,FIX,orTODOalsotendtowork.713029403071-146r10jm.ps1/30/042:18PMPage7272Chapter3ReverseEngineeringandProgramUnderstandingIntotheHouseofLogicInsomesense,programswrapthemselvesaroundvaluabledata,makinganden

7、forcingrulesaboutwhocangettothedataandwhen.Theveryedgesoftheprogramareexposedtotheoutsideworldjustthewaytheinteriorofahousehasdoorsatitspublicedges.Politeusersgothroughthesedoorstogettothedatatheyneedthatisstored