逆向-beginners之C++封装

最新推荐文章于 2026-08-20 19:46:08 发布

原创最新推荐文章于 2026-08-20 19:46:08 发布 · 906 阅读

0 ·

本内容遵循CC 4.0 BY-SA版权协议

GEO检测

收录于

Assembly

文章详细描述了在C++中，通过强制类型转换和指针操作，展示了如何在封装的类中绕过数据隐藏，实现对私有变量的修改，演示了一种潜在的代码攻击手段。

#include <stdio.h>

/*
* 封装 (encapsulation)
*/

class box
{
   private:
           int color, width, height, depth;
   public:
           box(int color, int width, int height, int depth)
           {
               this->color = color;
               this->width = width;
               this->height = height;
               this->depth = depth;
           }

           void dump()
           {
               printf("this is box.color=%d, width=%d, height=%d, depth=%d\n", color, width, height, depth);
           }
};

#if 0
void hack_oop_encapsulation(class box * o)
{
o->width = 1; /* that code cant be compiled:
"error C2248:'box::width':cannot access private member declared in class 'box'" */
}
#endif

/*
* 上述代码不可能被成功编译出来。然而，只要把box的数据类型强制转换为整形数组的话，
* 就可以通过编译并且直接修改相应字段.
*
* 功能：将输入数据视为整形数组，然后将数组的第二个元素、一个整形int值修改为123
*/
void hack_oop_encapsulation2(class box * o)
{
unsigned int *ptr_to_object = reinterpret_cast<unsigned int *>(o);
ptr_to_object[1] = 123;
}

int main()
{
box b(1, 10, 20, 30);

b.dump();

hack_oop_encapsulation2(&b);

b.dump();

return 0;
}

#if 0
/*
* intel
*/
0000000000001169 <_Z23hack_oop_encapsulation2P3box>:
    1169:   f3 0f 1e fa             endbr64
    116d:   55                      push   %rbp
    116e:   48 89 e5                mov    %rsp,%rbp
    1171:   48 89 7d e8             mov    %rdi,-0x18(%rbp)
    1175:   48 8b 45 e8             mov    -0x18(%rbp),%rax
    1179:   48 89 45 f8             mov    %rax,-0x8(%rbp)
    117d:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1181:   48 83 c0 04             add    $0x4,%rax
    1185:   c7 00 7b 00 00 00       movl   $0x7b,(%rax)
    118b:   90                      nop
    118c:   5d                      pop    %rbp
    118d:   c3                      retq

000000000000118e <main>:
    118e:   f3 0f 1e fa             endbr64
    1192:   55                      push   %rbp
    1193:   48 89 e5                mov    %rsp,%rbp
    1196:   48 83 ec 20             sub    $0x20,%rsp
    119a:   64 48 8b 04 25 28 00    mov    %fs:0x28,%rax
    11a1:   00 00
    11a3:   48 89 45 f8             mov    %rax,-0x8(%rbp)
    11a7:   31 c0                   xor    %eax,%eax
    11a9:   48 8d 45 e0             lea    -0x20(%rbp),%rax
    11ad:   41 b8 1e 00 00 00       mov    $0x1e,%r8d
    11b3:   b9 14 00 00 00          mov    $0x14,%ecx
    11b8:   ba 0a 00 00 00          mov    $0xa,%edx
    11bd:   be 01 00 00 00          mov    $0x1,%esi
    11c2:   48 89 c7                mov    %rax,%rdi
    11c5:   e8 40 00 00 00          callq 120a <_ZN3boxC1Eiiii>
    11ca:   48 8d 45 e0             lea    -0x20(%rbp),%rax
    11ce:   48 89 c7                mov    %rax,%rdi
    11d1:   e8 78 00 00 00          callq 124e <_ZN3box4dumpEv>
    11d6:   48 8d 45 e0             lea    -0x20(%rbp),%rax
    11da:   48 89 c7                mov    %rax,%rdi
    11dd:   e8 87 ff ff ff          callq 1169 <_Z23hack_oop_encapsulation2P3box>
    11e2:   48 8d 45 e0             lea    -0x20(%rbp),%rax
    11e6:   48 89 c7                mov    %rax,%rdi
    11e9:   e8 60 00 00 00          callq 124e <_ZN3box4dumpEv>
    11ee:   b8 00 00 00 00          mov    $0x0,%eax
    11f3:   48 8b 55 f8             mov    -0x8(%rbp),%rdx
    11f7:   64 48 33 14 25 28 00    xor    %fs:0x28,%rdx
    11fe:   00 00
    1200:   74 05                   je     1207 <main+0x79>
    1202:   e8 59 fe ff ff          callq 1060 <__stack_chk_fail@plt>
    1207:   c9                      leaveq
    1208:   c3                      retq
    1209:   90                      nop

000000000000120a <_ZN3boxC1Eiiii>:
    120a:   f3 0f 1e fa             endbr64
    120e:   55                      push   %rbp
    120f:   48 89 e5                mov    %rsp,%rbp
    1212:   48 89 7d f8             mov    %rdi,-0x8(%rbp)
    1216:   89 75 f4                mov    %esi,-0xc(%rbp)
    1219:   89 55 f0                mov    %edx,-0x10(%rbp)
    121c:   89 4d ec                mov    %ecx,-0x14(%rbp)
    121f:   44 89 45 e8             mov    %r8d,-0x18(%rbp)
    1223:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1227:   8b 55 f4                mov    -0xc(%rbp),%edx
    122a:   89 10                   mov    %edx,(%rax)
    122c:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1230:   8b 55 f0                mov    -0x10(%rbp),%edx
    1233:   89 50 04                mov    %edx,0x4(%rax)
    1236:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    123a:   8b 55 ec                mov    -0x14(%rbp),%edx
    123d:   89 50 08                mov    %edx,0x8(%rax)
    1240:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1244:   8b 55 e8                mov    -0x18(%rbp),%edx
    1247:   89 50 0c                mov    %edx,0xc(%rax)
    124a:   90                      nop
    124b:   5d                      pop    %rbp
    124c:   c3                      retq
    124d:   90                      nop

000000000000124e <_ZN3box4dumpEv>:
    124e:   f3 0f 1e fa             endbr64
    1252:   55                      push   %rbp
    1253:   48 89 e5                mov    %rsp,%rbp
    1256:   48 83 ec 10             sub    $0x10,%rsp
    125a:   48 89 7d f8             mov    %rdi,-0x8(%rbp)
    125e:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1262:   8b 70 0c                mov    0xc(%rax),%esi
    1265:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1269:   8b 48 08                mov    0x8(%rax),%ecx
    126c:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1270:   8b 50 04                mov    0x4(%rax),%edx
    1273:   48 8b 45 f8             mov    -0x8(%rbp),%rax
    1277:   8b 00                   mov    (%rax),%eax
    1279:   41 89 f0                mov    %esi,%r8d
    127c:   89 c6                   mov    %eax,%esi
    127e:   48 8d 3d 83 0d 00 00    lea    0xd83(%rip),%rdi        # 2008 <_IO_stdin_used+0x8>
    1285:   b8 00 00 00 00          mov    $0x0,%eax
    128a:   e8 e1 fd ff ff          callq 1070 <printf@plt>
    128f:   90                      nop
    1290:   c9                      leaveq
    1291:   c3                      retq
    1292:   66 2e 0f 1f 84 00 00    nopw   %cs:0x0(%rax,%rax,1)
    1299:   00 00 00
    129c:   0f 1f 40 00             nopl   0x0(%rax)

/*
* arm
*/
000000000040062c <_Z23hack_oop_encapsulation2P3box>:
40062c:   d10083ff    sub   sp, sp, #0x20
400630:   f90007e0    str   x0, [sp, #8]
400634:   f94007e0    ldr   x0, [sp, #8]
400638:   f9000fe0    str   x0, [sp, #24]
40063c:   f9400fe0    ldr   x0, [sp, #24]
400640:   91001000    add   x0, x0, #0x4
400644:   52800f61    mov   w1, #0x7b                     // #123
400648:   b9000001    str   w1, [x0]
40064c:   d503201f    nop
400650:   910083ff    add   sp, sp, #0x20
400654:   d65f03c0    ret

0000000000400658 <main>:
400658:   a9be7bfd    stp   x29, x30, [sp, #-32]!
40065c:   910003fd    mov   x29, sp
400660:   910043a0    add   x0, x29, #0x10
400664:   528003c4    mov   w4, #0x1e                     // #30
400668:   52800283    mov   w3, #0x14                     // #20
40066c:   52800142    mov   w2, #0xa                      // #10
400670:   52800021    mov   w1, #0x1                      // #1
400674:   9400000a    bl   40069c <_ZN3boxC1Eiiii>
400678:   910043a0    add   x0, x29, #0x10
40067c:   9400001d    bl   4006f0 <_ZN3box4dumpEv>
400680:   910043a0    add   x0, x29, #0x10
400684:   97ffffea    bl   40062c <_Z23hack_oop_encapsulation2P3box>
400688:   910043a0    add   x0, x29, #0x10
40068c:   94000019    bl   4006f0 <_ZN3box4dumpEv>
400690:   52800000    mov   w0, #0x0                      // #0
400694:   a8c27bfd    ldp   x29, x30, [sp], #32
400698:   d65f03c0    ret

000000000040069c <_ZN3boxC1Eiiii>:
40069c:   d10083ff    sub   sp, sp, #0x20
4006a0:   f9000fe0    str   x0, [sp, #24]
4006a4:   b90017e1    str   w1, [sp, #20]
4006a8:   b90013e2    str   w2, [sp, #16]
4006ac:   b9000fe3    str   w3, [sp, #12]
4006b0:   b9000be4    str   w4, [sp, #8]
4006b4:   f9400fe0    ldr   x0, [sp, #24]
4006b8:   b94017e1    ldr   w1, [sp, #20]
4006bc:   b9000001    str   w1, [x0]
4006c0:   f9400fe0    ldr   x0, [sp, #24]
4006c4:   b94013e1    ldr   w1, [sp, #16]
4006c8:   b9000401    str   w1, [x0, #4]
4006cc:   f9400fe0    ldr   x0, [sp, #24]
4006d0:   b9400fe1    ldr   w1, [sp, #12]
4006d4:   b9000801    str   w1, [x0, #8]
4006d8:   f9400fe0    ldr   x0, [sp, #24]
4006dc:   b9400be1    ldr   w1, [sp, #8]
4006e0:   b9000c01    str   w1, [x0, #12]
4006e4:   d503201f    nop
4006e8:   910083ff    add   sp, sp, #0x20
4006ec:   d65f03c0    ret

00000000004006f0 <_ZN3box4dumpEv>:
4006f0:   a9be7bfd    stp   x29, x30, [sp, #-32]!
4006f4:   910003fd    mov   x29, sp
4006f8:   f9000fa0    str   x0, [x29, #24]
4006fc:   f9400fa0    ldr   x0, [x29, #24]
400700:   b9400001    ldr   w1, [x0]
400704:   f9400fa0    ldr   x0, [x29, #24]
400708:   b9400402    ldr   w2, [x0, #4]
40070c:   f9400fa0    ldr   x0, [x29, #24]
400710:   b9400803    ldr   w3, [x0, #8]
400714:   f9400fa0    ldr   x0, [x29, #24]
400718:   b9400c04    ldr   w4, [x0, #12]
40071c:   90000000    adrp   x0, 400000 <_init-0x4b8>
400720:   911fa000    add   x0, x0, #0x7e8
400724:   97ffff7f    bl   400520 <printf@plt>
400728:   d503201f    nop
40072c:   a8c27bfd    ldp   x29, x30, [sp], #32
400730:   d65f03c0    ret
400734:   00000000    .inst   0x00000000 ; undefined

#endif

标签

#汇编