使用 IDA 修补 EXE
假设有一个包含 sprintf() 的有问题的程序，我想将其更改为 snprintf，这样它就不会出现缓冲区溢出。我该如何在 IDA 中做到这一点？
Say there is a buggy program that contains a sprintf() and i want to change it to a snprintf so it doesn't have a buffer overflow.. how do I do that in IDA??
如果你对这篇内容有疑问，欢迎到本站社区发帖提问 参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。
绑定邮箱获取回复消息
由于您还没有绑定你的真实邮箱，如果其他用户或者作者回复了您的评论，将不能在第一时间通知您！
发布评论
评论（1）
您确实不想使用 IDA pro 中的信息进行此类更改。
尽管IDA的反汇编质量相对较高，但其质量还不足以支持可执行文件重写。将对 sprintf 的调用转换为对 snprintf 的调用需要将新参数推入堆栈。这需要引入一条新指令，这会影响可执行映像中遵循该指令的所有内容的 EA。更新这些有效地址需要极高质量的反汇编。特别是，您需要能够：
艾达无法（可靠地）向您提供该信息。另外，如果可执行文件静态链接到 crt，它可能不包含 snpritnf，这将使手动执行重写变得非常困难。
有一些潜在的解决方法。如果进行调用的函数中（或之后）有足够的可用填充，则您可能只需重写单个函数即可摆脱困境。或者，如果您有权访问目标文件，并且这些目标文件是使用 /GY 开关编译的（假设您使用的是 Visual Studio），那么您也许能够编辑该目标文件。然而，编辑目标文件可能仍然需要大量修改。
但是，如果您有权访问目标文件，那么您可能也有权访问源代码。更改来源可能是您最好的选择。
You really don't want to make that kind of change using information from IDA pro.
Although IDA's disassembly is relatively high quality, it's not high quality enough to support executable rewriting. Converting a call to sprintf to a call to snprintf requires pushing a new argument on to the stack. That requires the introduction of a new instruction, which impacts the EA of everything that follows it in the executable image. Updating those effective addresses requires extremely high quality disassembly. In particular, you need to be able to:
Ida can't (reliably) give you that information. Also, if the executable is statically linked against the crt, it may not contain snpritnf, which would make performing the rewriting by hand VERY difficult.
There are a few potential workarounds. If there is sufficient padding available in (or after) the function making the call, you might be able to get away with only rewriting a single function. Alternatively, if you have access to object files, and those object files were compiled with the /GY switch (assuming you are using Visual Studio) then you may be able to edit the object file. However, editing the object file may still require substantial fix ups.
Presumably, however, if you have access to the object files you probably also have access to the source. Changing the source is probably your best bet.