How to do it...

Let's perform the following steps:

  1. Run the following command in the Terminal session:
$ edb --help
  1. Press Ctrl + Shift + T to open up a new Terminal tab. Once open, type the following in the new Terminal tab:
$ edb --run ./ch05-example rot13 TheBrownFoxJumpsThroughTheForest
  1. Navigate to Options | Preferences and left-click on the General tab.
  2. Under the Close Behavior section, select the option for Detach If Debugged Application Was Attached To, Kill if Launched.
  3. Left-click on the Appearance tab and increase the font size from 8 to 10 next to each of the 4 font settings.
  4. Left-click on the Debugging tab and review the available options.
  5. Left-click on the Signals/Exceptions tab and review the available options.
  1. Left-click on the Disassembly tab and review the various options. Keep the Intel Disassembly Syntax setting as it is.
  2. Left-click on the Directories tab and review the settings.
  3. Left-click on the Plugin Options tab and then left-click on the Assembly Plugin sub-tab.
  4. Change Assembler Helper Application to nasm and click the Close button to exit the preferences window.
  5. Next, press the Run button and examine what occurs in each output section of the GUI.
  6. Press the Step Into button and examine the output in each section of the GUI.
  7. Go to Plugins | Binary Info | Explore Binary Header.
  8. In the new window that appears, select the first row and click the Explore Header button.
  9. Expand the output in the bottom section of this window to reveal the ELF header information by left-clicking the down arrow.
  10. When you have completed the review of the output, left-click the Close button.
  11. Next, click on Plugins | BinarySearcher | Binary String Search.
  12. In the window that appears, next to the ASCII label, type rot13 without the quotes and left-click the Find button. Close this window when you finished reviewing the output.
  13. Click on Plugins | BreakpointManager | Breakpoints.
  14. In the new window that opens, click the Add Breakpoint button.
  15. Type 0x0804866e without quotes into the Add Breakpoint window underneath the Address label, then left-click the OK button.
  16. Next, highlight the breakpoint we just created and left-click the Remove Breakpoint button, then click the Close button to exit the Breakpoint Manager window.
  17. Navigate to Plugins | CheckVersion | Check For Latest Version.
  18. Next, navigate to Plugins | FunctionFinder | Function Finder. Alternatively, press the Shift + Ctrl + F keyboard shortcut.
  19. Left-click on the first row in the new window. It should have the permissions of read and execute. Then, click the Find button.
  1. Search for the ch05-example!_start symbol in the results section of the Function Finder window, left-click to highlight that row, and click on the Graph Selected Function button.
  2. After reviewing the new window that appears, close it by clicking on the x button in the upper left corner of that window.
  3. Next, left-click and highlight the row with the ch05-example!main symbol, and click the Graph Selected Function button. Review the output and close the result window when you've finished.
  4. Close the Function Finder window by clicking the Close button. 
  5. Navigate to Plugins | OpcodeSearcher | Opcode Search, or press the Ctrl + O keyboard shortcut.
  6. Left-click and highlight the first row in the Opcode Search window with permissions r-x, then select ANY REGISTER -> EIP from the What To Search For dropdown menu and click on the Find button.
  7. Examine the output in the Results: section of the Opcode Search window, then click the Close button when you've finished.
  8. Using the menu at the top of the EDB window, navigate to Plugins | ROPTool| ROP Tool. Alternatively, you can also use the Ctrl + Alt + R.
  9. Left-click and highlight the first row with the r-x permissions, make sure all the options under Gadgets to Display are selected, and click the Find button.
  10. Review the output in the Results: section of the ROP Gadget Search window and click the Close button when you've finished.
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset
18.217.182.45