找到arm版本的daemon的l_pubkey_verify位置,但是不知道如何做patch。
465bcc: 940015c4 bl 46b2dc <ioctl@plt+0x6747c>
465bd0: 17ffff79 b 4659b4 <ioctl@plt+0x61b54>
465bd4: a9af7bfd stp x29, x30, [sp, #-272]!
465bd8: 910003fd mov x29, sp
465bdc: f9414c08 ldr x8, [x0, #664]
465be0: a9046bf9 stp x25, x26, [sp, #64]
465be4: f94e7908 ldr x8, [x8, #7408]
465be8: aa0103f9 mov x25, x1
465bec: f9431908 ldr x8, [x8, #1584]
465bf0: 52800281 mov w1, #0x14 // #20
465bf4: 6b1f011f cmp w8, wzr
465bf8: a90153f3 stp x19, x20, [sp, #16]
465bfc: a9025bf5 stp x21, x22, [sp, #32]
465c00: a90363f7 stp x23, x24, [sp, #48]
465c04: 1a871113 csel w19, w8, w7, ne // ne = any
465c08: f9002bfb str x27, [sp, #80]
465c0c: aa0003f5 mov x21, x0
465c10: 2a0203f8 mov w24, w2
465c14: aa0303f6 mov x22, x3
465c18: 2a0403f4 mov w20, w4
465c1c: aa0503f7 mov x23, x5
465c20: aa0603fa mov x26, x6
465c24: 94001e49 bl 46d548 <ioctl@plt+0x696e8>
如果是x86,都是xor eax,eax(33 c0 c3)来patch掉了。但是arm的指令应该如何做,将这个
465bd4: a9af7bfd stp x29, x30, [sp, #-272]!
465bd8: 910003fd mov x29, sp
如何patch后实现类似效果?
[培训]科锐逆向工程师培训第53期2025年7月8日开班!