主页 / unix / 问题

问题[reverse-engineering](unix)

Martin Hope
Kidburla
Asked: 2018-01-26 12:14:47 +0800 CST
  • 104

在发现几个常用命令（read如对true和为真false。

好吧，它们绝对是二进制文件。

sh-4.2$ which true
/usr/bin/true
sh-4.2$ which false
/usr/bin/false
sh-4.2$ file /usr/bin/true
/usr/bin/true: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=2697339d3c19235
06e10af65aa3120b12295277e, stripped
sh-4.2$ file /usr/bin/false
/usr/bin/false: ELF 64-bit LSB executable, x86-64, version 1 (SYSV), dynamically linked (uses shared libs), for GNU/Linux 2.6.32, BuildID[sha1]=b160fa513fcc13
537d7293f05e40444fe5843640, stripped
sh-4.2$

然而，我发现最令人惊讶的是它们的大小。我希望它们每个只有几个字节，true基本上只是exit 0和false是exit 1。

sh-4.2$ true
sh-4.2$ echo $?
0
sh-4.2$ false
sh-4.2$ echo $?
1
sh-4.2$

然而，令我惊讶的是，这两个文件的大小都超过了 28KB。

sh-4.2$ stat /usr/bin/true
  File: '/usr/bin/true'
  Size: 28920           Blocks: 64         IO Block: 4096   regular file
Device: fd2ch/64812d    Inode: 530320      Links: 1                     
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2018-01-25 19:46:32.703463708 +0000
Modify: 2016-06-30 09:44:27.000000000 +0100
Change: 2017-12-22 09:43:17.447563336 +0000
 Birth: -
sh-4.2$ stat /usr/bin/false
  File: '/usr/bin/false'
  Size: 28920           Blocks: 64         IO Block: 4096   regular file
Device: fd2ch/64812d    Inode: 530697      Links: 1                     
Access: (0755/-rwxr-xr-x)  Uid: (    0/    root)   Gid: (    0/    root)
Access: 2018-01-25 20:06:27.210764704 +0000
Modify: 2016-06-30 09:44:27.000000000 +0100
Change: 2017-12-22 09:43:18.148561245 +0000
 Birth: -
sh-4.2$

所以我的问题是：它们为什么这么大？除了返回码之外，可执行文件中还有什么？

PS：我使用的是 RHEL 7.4

linux reverse-engineering
Martin Hope
Rui F Ribeiro
Asked: 2018-01-24 18:39:49 +0800 CST
  • 3

我有一个可执行文件，它不适合像往常/预期的那样进行反汇编或反编译。

file并ldd给出与平常不同的输出：

$ file exe_file
exe_file: ELF 64-bit LSB shared object, x86-64, version 1 (GNU/Linux), statically linked, stripped

$ ldd exe_file
    not a dynamic executable

strings也暗示了一些事情是关闭的：

$strings exe_file
UPX!
.....
PROT_EXEC|PROT_WRITE failed.
$Info: This file is packed with the UPX executable packer http://upx.sf.net $
$Id: UPX 3.91 Copyright (C) 1996-2013 the UPX Team. All Rights Reserved. $

还：

$ ls -la exe_file
-rwxr-xr-x 1 root root 59896 Jan 22 15:26 exe_file

怎么了？

linux reverse-engineering