反匯編容易反編譯難

最近受同學所托，將5個內嵌了MASM語法格式的匯編代碼之C函數翻譯成純C函數，以支持多種CPU指令集（比如x86/x64, arm, sparc, ...）。整個過程充滿了艱辛，但也充滿了樂趣。作為一個既喜歡C又喜歡匯編的程序員，在廢寢忘食之余深深地體會到，“反匯編（disassemble）容易，反編譯（decompile）難”。逆向工程實在是太不容易啦！下面給出一個簡單點兒的例子予以說明。[P.S. 一肚子的Asm, C和gdb，終於派上了用場:-）]

o void add16(word *, word *, word n)

typedef unsigned char           byte;  /* 1 byte */
typedef unsigned short          word;  /* 2 bytes */
typedef unsigned int            dword; /* 4 bytes */
typedef unsigned long long      qword; /* 8 bytes */

void add16(word *a, word *b, word n)
{
        word *dstp = a;
        word *srcp = b;
        word count = n;

        __asm {
                xor  ecx, ecx
                mov  cx, count
                mov  esi, srcp
                mov  edi, dstp
                xor  ebx, ebx

        LOOP01:
                xor  eax, eax
                mov  ax, [esi]
                add  eax, ebx
                xor  edx, edx
                mov  dx, [edi]
                add  eax, edx

                mov  [edi], ax
                shr  eax, 16
                mov  ebx, eax

                add  esi, 2
                add  edi, 2
                loop LOOP01

                add  [edi], bx
        }
}

作為一個對x86匯編熟悉N(>=12) 年的程序員，翻譯上面的內嵌代碼，花了足足5個小時。 5小時的艱苦歷程如下：

第1步： 將匯編代碼摘取出來，用NASM實現 （本人不喜歡Windows編程，所以在Linux上用NASM）

第2步： 給每一行匯編代碼加注釋，加完注釋后的匯編源文件foo.asm如下:

BITS 32

SECTION .data

count:                  equ 0x5
dstp:                   dw  0x1234, 0x3456, 0xffff, 0x789a, 0x9abc, 0x0000
srcp:                   dw  0xabcd, 0xffff, 0xffff, 0x0123, 0x2345, 0x0000

SECTION .text

global _start

_start:
        xor  ecx, ecx           ; ecx = 0
        mov  cx, count          ; ecx = count
        mov  esi, srcp          ; esi = srcp
        mov  edi, dstp          ; edi = dstp
        xor  ebx, ebx           ; ebx = 0 /* carry */

    LOOP01:
        xor  eax, eax           ; eax = 0
        mov  ax, [esi]          ;  ax = *esi = *srcp
        add  eax, ebx           ; eax += ebx    /* eax += carry */
        xor  edx, edx           ; edx = 0
        mov  dx, [edi]          ;  dx = *edi = *dstp
        add  eax, edx           ; eax += edx;   /* eax += *dstp */

        mov  [edi], ax          ; *edi = ax, i.e. *dstp = ax
        shr  eax, 16            ; eax >>= 16
        mov  ebx, eax           ; ebx = eax     /* next carry */

        add  esi, 2             ; esi += 2      /* srcp++ */
        add  edi, 2             ; edi += 2      /* dstp++ */
        loop LOOP01             ; jmp back to LOOP01 until ecx == 0

        add  [edi], bx          ; *edi += bx

_exit:
        mov eax, 1              ; syscall num of exit
        mov ebx, 0              ; error code
        int 0x80

第3步： 編譯foo.asm，用gdb調試

$ nasm -f elf32 -g -F stabs foo.asm 
$ ld -o foo foo.o

用gdb單步調試的過程比較冗長，這里貼出最簡版調試過程，

$ gdb foo
GNU gdb (Ubuntu 7.7.1-0ubuntu5~14.04.2) 7.7.1
...<snip>....................................
(gdb)   set disassembly-flavor intel
(gdb) #
(gdb)
(gdb)   disas _start
Dump of assembler code for function _start:
   0x08048080 <+0>:     xor    ecx,ecx
   0x08048082 <+2>:     mov    cx,0x5
   0x08048086 <+6>:     mov    esi,0x80490cc
   0x0804808b <+11>:    mov    edi,0x80490c0
   0x08048090 <+16>:    xor    ebx,ebx
End of assembler dump.
(gdb) #
(gdb)
(gdb)   disas LOOP01
Dump of assembler code for function LOOP01:
   0x08048092 <+0>:     xor    eax,eax
   0x08048094 <+2>:     mov    ax,WORD PTR [esi]
   0x08048097 <+5>:     add    eax,ebx
   0x08048099 <+7>:     xor    edx,edx
   0x0804809b <+9>:     mov    dx,WORD PTR [edi]
   0x0804809e <+12>:    add    eax,edx
   0x080480a0 <+14>:    mov    WORD PTR [edi],ax
   0x080480a3 <+17>:    shr    eax,0x10
   0x080480a6 <+20>:    mov    ebx,eax
   0x080480a8 <+22>:    add    esi,0x2
   0x080480ab <+25>:    add    edi,0x2
   0x080480ae <+28>:    loop   0x8048092 <LOOP01>
   0x080480b0 <+30>:    add    WORD PTR [edi],bx
End of assembler dump.
(gdb) #
(gdb)
(gdb)   disas _exit
Dump of assembler code for function _exit:
   0x080480b3 <+0>:     mov    eax,0x1
   0x080480b8 <+5>:     mov    ebx,0x0
   0x080480bd <+10>:    int    0x80
End of assembler dump.
(gdb) #
(gdb)
(gdb)
(gdb)
(gdb)
(gdb)
(gdb) set disassembly-flavor intel
(gdb) display /i $eip
(gdb) #
(gdb)
(gdb) b _start
Breakpoint 1 at 0x8048080
(gdb) b _exit
Breakpoint 2 at 0x80480b3
(gdb) info b
Num     Type           Disp Enb Address    What
1       breakpoint     keep y   0x08048080 <_start>
2       breakpoint     keep y   0x080480b3 <_exit>
(gdb) #
(gdb)
(gdb) r
Starting program: /var/tmp/sandbox/fanli/raw/05/cnblog/foo

Breakpoint 1, 0x08048080 in _start ()
1: x/i $eip
=> 0x8048080 <_start>:  xor    ecx,ecx
(gdb) #
(gdb)
(gdb) ni
0x08048082 in _start ()
1: x/i $eip
=> 0x8048082 <_start+2>:        mov    cx,0x5
(gdb)
0x08048086 in _start ()
1: x/i $eip
=> 0x8048086 <_start+6>:        mov    esi,0x80490cc
(gdb)
0x0804808b in _start ()
1: x/i $eip
=> 0x804808b <_start+11>:       mov    edi,0x80490c0
(gdb)
0x08048090 in _start ()
1: x/i $eip
=> 0x8048090 <_start+16>:       xor    ebx,ebx
(gdb) info r ecx edi esi
ecx            0x5      5
edi            0x80490c0        134516928
esi            0x80490cc        134516940
(gdb) x /5hx 0x80490c0
0x80490c0 <dstp>:       0x1234  0x3456  0xffff  0x789a  0x9abc
(gdb) x /5hx 0x80490cc
0x80490cc <srcp>:       0xabcd  0xffff  0xffff  0x0123  0x2345
(gdb) #
(gdb)
(gdb) c
Continuing.

Breakpoint 2, 0x080480b3 in _exit ()
1: x/i $eip
=> 0x80480b3 <_exit>:   mov    eax,0x1
(gdb) #
(gdb)
(gdb) x /5hx 0x80490c0
0x80490c0 <dstp>:       0xbe01  0x3455  0xffff  0x79be  0xbe01
(gdb) x /5hx 0x80490cc
0x80490cc <srcp>:       0xabcd  0xffff  0xffff  0x0123  0x2345
(gdb) #
(gdb)
(gdb) ni
0x080480b8 in _exit ()
1: x/i $eip
=> 0x80480b8 <_exit+5>: mov    ebx,0x0
(gdb)
0x080480bd in _exit ()
1: x/i $eip
=> 0x80480bd <_exit+10>:        int    0x80
(gdb)
[Inferior 1 (process 21920) exited normally]
(gdb)

從上面的調試過程可以看出，

        a: 0x1234  0x3456  0xffff  0x789a  0x9abc
        b: 0xabcd  0xffff  0xffff  0x0123  0x2345
After a = a + b is done,
        a: 0xbe01 0x3455 0xffff 0x79be 0xbe01

That is,
        (1) a = 0x9abc789affff34561234
        (2) b = 0x23450123ffffffffabcd
        (3) a += b
        (4) a = 0xbe0179beffff3455be01

第4步：用Python驗證一下上面的計算結果，

$ python
Python 2.7.6 (default, Oct 26 2016, 20:32:47)
...<snip>....................................
>>> a = 0x9abc789affff34561234
>>> b = 0x23450123ffffffffabcd
>>> a += b
>>> print "    a = 0x%x" % a
    a = 0xbe0179beffff3455be01

第5步： 將foo.asm翻譯成foo2.c

#include <stdio.h>

typedef unsigned char       byte;       /* 1 byte */
typedef unsigned short      word;       /* 2 bytes */
typedef unsigned int        dword;      /* 4 bytes */
typedef unsigned long long  qword;      /* 8 bytes */

void add16(word *a, word *b, word n)
{
        word *dstp = a;
        word *srcp = b;
        word count = n;

        word carry = 0;
        for (word i = 0; i < count; i++) {
                word p = *dstp;
                word q = *srcp;

                dword n = (dword)p + (dword)carry + (dword)q;

                *dstp = n & 0xFFFF;      // *dstp :  low 16 bits of n
                carry = (word)(n >> 16); // carry : high 16 bits of n

                srcp++;
                dstp++;
        }

        *dstp += carry;
}

static void dump(word a[], word n)
{
        printf("\t%p: ", a);
        for (word i = 0; i < n; i++)
                printf("0x%04x ", a[i]);
        printf("\n");
}

int main(int argc, char *argv[])
{
        word src[] = {0xabcd, 0xffff, 0xffff, 0x0123, 0x2345, 0x0000};
        word dst[] = {0x1234, 0x3456, 0xffff, 0x789a, 0x9abc, 0x0000};
        word n   = 0x5;

        dump(dst, sizeof(dst)/sizeof(word));
        printf("+\n");
        dump(src, sizeof(src)/sizeof(word));

        add16(dst, src, n);

        printf("=\n");
        dump(dst, sizeof(dst)/sizeof(word));

        return 0;
}

o add16()截圖

第6步： 編譯foo2.c並運行

$ gcc -g -Wall -m32 -std=c99 -o foo2 foo2.c

$ ./foo2
        0xbf9c1bc4: 0x1234 0x3456 0xffff 0x789a 0x9abc 0x0000
+
        0xbf9c1bb8: 0xabcd 0xffff 0xffff 0x0123 0x2345 0x0000
=
        0xbf9c1bc4: 0xbe01 0x3455 0xffff 0x79be 0xbe01 0x0000

與foo.asm對應的運算結果做比較，

0xbf9c1bc4: 0xbe01 0x3455 0xffff 0x79be 0xbe01 0x0000

二者運算的結果完全一致，由此可見，add16()其實就是做大數加法。

• a = {a[0], a[1], ..., a[N]}， a[i] 為一個word, 占兩個字節
• b = {b[0], b[1], ..., b[N]},  b[i]為一個word, 占兩個字節
• a + b = {a[0]+b[0], a[1]+b[1], ..., a[N]+b[N]}
• a[i] + b[i] 可能發生進位（carry), 將carry加到a[i+1]的位置上即可

P.S. 在翻譯過程中，我參考了下面兩個與轉移指令有關的文檔。 （如果有興趣，請閱讀）

1. 匯編語言轉移指令規則匯總
2. 常用匯編指令與標志位關系

結束語： 上面給出的例子foo.asm只有一重循環，所以翻譯成C代碼相對簡單。但是，如果有多重循環和多次跳轉, 那么翻譯起來就困難許多。例如：

BITS 32

SECTION .data

adp:            dd      0x12345678, 0x9abcdef0, 0xffffffff, 0x9abcdefa, \
                        0x00000000
adp_size:       equ     $ - adp
bdp:            dd      0xbfffc061, 0xfedcba99, 0x76543211, 0xfedcba99, \
                        0x00000000
bdp_size:       equ     $ - bdp
cdp:            dd      0x00000000, 0x00000000, 0x00000000, 0x00000000, \
                        0x00000000, 0x00000000, 0x00000000, 0x00000000, \
                        0x00000000, 0x00000000
cdp_size:       equ     $ - cdp

SECTION .text

global _start

_start:
        mov  ecx, cdp           ; 001 ecx = cdp,  cdp[] = adp[] * bdp[]
        add  ecx, cdp_size      ; 002 ecx += cdp_size

        xor  edi, edi           ; 003 edi = 0

  LOOP1:                        ; 004
        mov  ebx, adp           ; 005 ebx = adp
        add  ebx, edi           ; 006 ebx += edi
        mov  eax, [ebx]         ; 007 eax = *ebx
        cmp  eax, 0             ; 008 if (eax == 0)
        je   NEXT3              ; 009     goto NEXT3
        xor  esi, esi           ; 010 esi = 0
        push eax                ; 011 save eax to stack (eax was *ebx = [adp+edi])

  LOOP2:                        ; 012
        mov  ebx, bdp           ; 013 ebx = bdp
        add  ebx, esi           ; 014 ebx += esi
        mov  eax, [ebx]         ; 015 eax = *ebx
        cmp  eax, 0             ; 016 if (eax == 0)
        je   NEXT2              ; 017     goto NEXT2
        pop  edx                ; 018 get edx from stack, which was pushed @ 011
        push edx                ; 019 save edx back to stack
        mul  edx                ; 020 edxeax = eax * edx
        mov  ebx, cdp           ; 021 ebx = cdp
        add  ebx, esi           ; 022 ebx += esi;
        add  ebx, edi           ; 023 ebx += edi;
        push ebx                ; 024 push ebx to stack
        add  [ebx], eax         ; 025 *ebx += eax;

  LOOP3:                        ; 026
        jnc  NEXT1              ; 027 == jae (>=)
        add  ebx, 4             ; 028 ebx += 4
        cmp  ebx, ecx           ; 029 if (ebx >= ecx) ; ecx = cdp + cdp_size
        jae  NEXT1              ; 030     goto NEXT1
        add  dword [ebx], 1     ; 031 *ebx += 1
        jmp  LOOP3              ; 032 go back to LOOP3

        NEXT1:                  ; 033 only used by LOOP3
            pop  ebx            ; 034 get ebx from stack
            add  ebx, 4         ; 035 ebx += 4
            add  [ebx], edx     ; 036 *ebx += edx

    LOOP4:                      ; 037
        jnc  NEXT2              ; 038 jnc (=jae)
        add  ebx, 4             ; 039 ebx += 4
        cmp  ebx, ecx           ; 040 if (ebx >= ecx)
        jae  NEXT2              ; 041     goto NEXT2
        add  dword [ebx], 1     ; 042 *ebx += 1
        jmp  LOOP4              ; 043 go back to LOOP4

        NEXT2:                  ; 044
            add  esi, 4         ; 045 esi += 4
            cmp  esi, bdp_size  ; 046 if (esi < bdp_size)
            jb   LOOP2          ; 047     go back to LOOP2
            pop  eax            ; 048 get eax from stack

    NEXT3:                      ; 049
        add  edi, 4             ; 050 edi += 4
        cmp  edi, adp_size      ; 051 if (edi < adp_size)
        jb   LOOP1              ; 052     go back to LOOP1

_exit:
        mov eax, 1              ; syscall num of exit
        mov ebx, 0              ; error code
        int 0x80

上面的代碼一共包括4個LOOP，3個NEXT和10個跳轉指令（e.g. jmp, jb, jae, jnc, je)，翻譯成C代碼難度非常大。究其本質，實為做大數乘法。有關其翻譯實現后的C代碼，請參考前文。 反匯編（將C代碼翻譯成匯編代碼）有現成的工具可用（e.g. gdb, objdump), 所以很容易。反編譯（將匯編代碼翻譯成C代碼），國外有收費的軟件可以用（e.g. Hex-Rays Decompiler），但是也不能保證100%的正確性。所以，反匯編容易，反編譯難，逆向工程很不容易。 (p.s. 有一個學信息工程專業的（但從來沒做過程序員的）同學在微信群里用略帶不屑的語氣說“匯編是一種很古老的語言”，我真的很無語Orz...再高級的語言寫的代碼，也要變成機器碼才能運行不是，似乎匯編是無法繞過的...)