hand-ray 연습5

 0x080485bb <+0>: lea    ecx,[esp+0x4]

   0x080485bf <+4>: and    esp,0xfffffff0

   0x080485c2 <+7>: push   DWORD PTR [ecx-0x4]

   0x080485c5 <+10>: push   ebp

   0x080485c6 <+11>: mov    ebp,esp

   0x080485c8 <+13>: push   ecx

   0x080485c9 <+14>: sub    esp,0x84

   0x080485cf <+20>: mov    eax,ecx

   0x080485d1 <+22>: mov    edx,DWORD PTR [eax+0x4]

   0x080485d4 <+25>: mov    DWORD PTR [ebp-0x7c],edx

   0x080485d7 <+28>: mov    ecx,DWORD PTR gs:0x14

   0x080485de <+35>: mov    DWORD PTR [ebp-0xc],ecx

   0x080485e1 <+38>: xor    ecx,ecx

   0x080485e3 <+40>: cmp    DWORD PTR [eax],0x1

   0x080485e6 <+43>: jg     0x804860e <main+83>

   0x080485e8 <+45>: mov    eax,DWORD PTR [ebp-0x7c]

   0x080485eb <+48>: mov    edx,DWORD PTR [eax]

   0x080485ed <+50>: mov    eax,ds:0x804a040

   0x080485f2 <+55>: sub    esp,0x4

   0x080485f5 <+58>: push   edx

   0x080485f6 <+59>: push   0x80487e0

   0x080485fb <+64>: push   eax

   0x080485fc <+65>: call   0x8048490 <fprintf@plt>

   0x08048601 <+70>: add    esp,0x10

   0x08048604 <+73>: mov    eax,0x1

   0x08048609 <+78>: jmp    0x804870c <main+337>

   0x0804860e <+83>: mov    eax,DWORD PTR [ebp-0x7c]

   0x08048611 <+86>: add    eax,0x4

   0x08048614 <+89>: mov    eax,DWORD PTR [eax]

   0x08048616 <+91>: sub    esp,0x8

   0x08048619 <+94>: push   0x0

   0x0804861b <+96>: push   eax

   0x0804861c <+97>: call   0x8048460 <open@plt>

   0x08048621 <+102>: add    esp,0x10

   0x08048624 <+105>: mov    DWORD PTR [ebp-0x6c],eax

   0x08048627 <+108>: sub    esp,0x8

   0x0804862a <+111>: lea    eax,[ebp-0x64]

   0x0804862d <+114>: push   eax

   0x0804862e <+115>: push   DWORD PTR [ebp-0x6c]

   0x08048631 <+118>: call   0x80487a0 <fstat>

   0x08048636 <+123>: add    esp,0x10

   0x08048639 <+126>: cmp    eax,0xffffffff

   0x0804863c <+129>: jne    0x8048648 <main+141>

   0x0804863e <+131>: mov    eax,0x1

   0x08048643 <+136>: jmp    0x804870c <main+337>

   0x08048648 <+141>: mov    eax,DWORD PTR [ebp-0x54]

   0x0804864b <+144>: and    eax,0xf000

   0x08048650 <+149>: cmp    eax,0x8000

   0x08048655 <+154>: je     0x8048680 <main+197>

   0x08048657 <+156>: mov    eax,DWORD PTR [ebp-0x7c]

   0x0804865a <+159>: add    eax,0x4

   0x0804865d <+162>: mov    edx,DWORD PTR [eax]

   0x0804865f <+164>: mov    eax,ds:0x804a040

   0x08048664 <+169>: sub    esp,0x4

   0x08048667 <+172>: push   edx

   0x08048668 <+173>: push   0x80487f1

   0x0804866d <+178>: push   eax

   0x0804866e <+179>: call   0x8048490 <fprintf@plt>

   0x08048673 <+184>: add    esp,0x10

   0x08048676 <+187>: mov    eax,0x1

   0x0804867b <+192>: jmp    0x804870c <main+337>

   0x08048680 <+197>: mov    eax,DWORD PTR [ebp-0x38]

   0x08048683 <+200>: sub    esp,0x8

   0x08048686 <+203>: push   0x0

   0x08048688 <+205>: push   DWORD PTR [ebp-0x6c]

   0x0804868b <+208>: push   0x1

   0x0804868d <+210>: push   0x1

   0x0804868f <+212>: push   eax

   0x08048690 <+213>: push   0x0

   0x08048692 <+215>: call   0x8048470 <mmap@plt>

   0x08048697 <+220>: add    esp,0x20

   0x0804869a <+223>: mov    DWORD PTR [ebp-0x68],eax

   0x0804869d <+226>: cmp    DWORD PTR [ebp-0x68],0xffffffff

   0x080486a1 <+230>: jne    0x80486aa <main+239>

   0x080486a3 <+232>: mov    eax,0x1

   0x080486a8 <+237>: jmp    0x804870c <main+337>

   0x080486aa <+239>: mov    DWORD PTR [ebp-0x70],0x0

   0x080486b1 <+246>: jmp    0x80486d1 <main+278>

   0x080486b3 <+248>: mov    edx,DWORD PTR [ebp-0x70]

   0x080486b6 <+251>: mov    eax,DWORD PTR [ebp-0x68]

   0x080486b9 <+254>: add    eax,edx

   0x080486bb <+256>: movzx  eax,BYTE PTR [eax]

   0x080486be <+259>: movsx  eax,al

   0x080486c1 <+262>: sub    esp,0xc

   0x080486c4 <+265>: push   eax

   0x080486c5 <+266>: call   0x80484a0 <putchar@plt>

   0x080486ca <+271>: add    esp,0x10

   0x080486cd <+274>: add    DWORD PTR [ebp-0x70],0x1

   0x080486d1 <+278>: mov    eax,DWORD PTR [ebp-0x38]

   0x080486d4 <+281>: cmp    eax,DWORD PTR [ebp-0x70]

   0x080486d7 <+284>: jg     0x80486b3 <main+248>

   0x080486d9 <+286>: mov    eax,DWORD PTR [ebp-0x38]

   0x080486dc <+289>: sub    esp,0x8

   0x080486df <+292>: push   eax

   0x080486e0 <+293>: push   DWORD PTR [ebp-0x68]

   0x080486e3 <+296>: call   0x80484b0 <munmap@plt>

   0x080486e8 <+301>: add    esp,0x10

   0x080486eb <+304>: cmp    eax,0xffffffff

   0x080486ee <+307>: jne    0x8048707 <main+332>

   0x080486f0 <+309>: sub    esp,0xc

   0x080486f3 <+312>: push   0x8048803

   0x080486f8 <+317>: call   0x8048430 <perror@plt>

   0x080486fd <+322>: add    esp,0x10

   0x08048700 <+325>: mov    eax,0x1

   0x08048705 <+330>: jmp    0x804870c <main+337>

   0x08048707 <+332>: mov    eax,0x0

   0x0804870c <+337>: mov    ecx,DWORD PTR [ebp-0xc]

   0x0804870f <+340>: xor    ecx,DWORD PTR gs:0x14

   0x08048716 <+347>: je     0x804871d <main+354>

   0x08048718 <+349>: call   0x8048420 <__stack_chk_fail@plt>

   0x0804871d <+354>: mov    ecx,DWORD PTR [ebp-0x4]

   0x08048720 <+357>: leave  

   0x08048721 <+358>: lea    esp,[ecx-0x4]

   0x08048724 <+361>: ret 

#include <stdio.h>

#include <sys/types.h>

#include <sys/stat.h>

#include <fcntl.h>

#include <unistd.h>

#include <sys/mman.h>

int main(int argc,char *argv[])

{

struct stat s;

int fd; // ebp - 0x6c

int v1; // ebp-0x54

int v2; // ebp-0x38

char *v3; // ebp-0x68

int v4; // ebp-0x70

if(argc < 1)

{

fprintf(stderr,”Usage %s\n”,argv[0]);

return 1;

}

fd = open(argv[1],???);

if(fstat(fd,&s) == -1 )

{

return 1;

}

v1 = v1&0xf000;

if(v1 != 0x8000)

{

fprintf(fd,0x80487f1,argv[0]);

return 1;

}

v3 = mmap(0,v2,1,1,fd,0);

if(v3 == -1 )

{

return 1;

}

v4 = 0

while(v2 > v4)

{

v3 = v3+v4;    

putchar(v3[v2])

v4++;

}

if(munmap(v3,v2) == -1)

{        

perror(“error”);

return 1;

}

return 0;

}

아직 미완성입니다.