[{"_1":2,"_3":-5,"_4":-5},"loaderData",{"_5":6,"_7":8,"_9":10,"_11":12,"_13":14},"actionData","errors","root",{"_290":291,"_292":147},"routes/_root/_root",{"_287":-7,"_39":288,"_122":-7,"_289":-7},"routes/_root.tags.$tagCanonical+/_root",{"_35":142,"_56":143,"_144":16,"_145":146},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/_root",{"_52":53,"_54":55,"_56":57},"routes/_root.tags.$tagCanonical+/challenges.$challengeCanonical+/writeups",{"_15":16,"_17":16,"_18":19,"_20":21,"_22":23},"solved",false,"hasWriteup","writeups",[24,25],"name","Let's analyze system calls","canonicalName","lets-analyze-system-calls",{"_26":46,"_28":47,"_30":48,"_32":16,"_33":16,"_34":16,"_35":36,"_37":49,"_39":40,"_41":16,"_42":50},{"_26":27,"_28":29,"_30":31,"_32":16,"_33":16,"_34":16,"_35":36,"_37":38,"_39":40,"_41":16,"_42":43},"author",{"_20":44,"_45":-5},"writeupElementId","8043904f","writeupId","8043904f-0936-4c71-910d-11be9ee1bc2c","canEdit","canLike","likedByViewer","title","Writeup for Let's analyze system calls","url","https://github.com/baumroll0928-spec/myRepository/tree/main/Daily_AlpacaHack/m202608/d27-28_Lets_analyze_system_calls","language","ja","isOfficial","createdAt",["D",1787978538194],"baumroll1234","gravatarHash",{"_20":51,"_45":-5},"5cd915fe","5cd915fe-30a9-494b-ade6-c512eb0513ca","https://qiita.com/mizore_fuyu/items/adf4f180456fcf0a85f8",["D",1787959441446],"mizore-fuyu","challenge",{"_20":21,"_22":23,"_61":62,"_63":64,"_65":66,"_67":68,"_69":70,"_71":72,"_73":74,"_75":76,"_77":16,"_78":-7,"_79":80,"_81":-7,"_82":-7,"_34":16,"_83":84,"_85":86,"_87":16,"_88":-7,"_89":16,"_90":-7,"_91":-7,"_92":93,"_94":-7,"_95":-7,"_96":-7,"_97":98,"_99":16,"_100":98,"_33":98,"_101":16,"_102":-7,"_103":104,"_105":106,"_107":108,"_109":110},"availablePages",[58,59,60],"canonicalUrl","https://alpacahack.com/tags/linux/challenges/lets-analyze-system-calls","Description","Solves","Writeups","solves",55,"difficulty",30,"flagFormat","Alpaca{[\\x20-\\x7E]+}","categories",[139],"attachments",[135],"remote",{"_132":133,"_134":98},"description","Let's analyze x86-64 Linux system calls!\n\n

Beginner Hint 1: The Calling Convention for System Calls and GCC's Extended Inline Assembly

\n\n- The calling convention for system calls on x86-64 Linux is described in the `A.2.1 Calling Conventions` section of the `System V Application Binary Interface AMD64 Architecture Processor Supplement` which is available at , and .\n - To execute a system call, we need to specify a system call number to the `rax` register, and up to six arguments to the `rdi`, `rsi`, `rdx`, `r10`, `r8`, and `r9` registers sequentially, and then execute a `syscall` instruction.\n - The result of the system call execution is stored in the `rax` register.\n- GCC's extended inline assembly syntax is described at and \n - The extended inline assembly used for the first `syscall` instruction in this challenge specifies the following:\n - A `OutputOperands` parameter is unspecified.\n - A `InputOperands` parameter set `318` in the `rax` register, `&result_1` in the `rdi` register, `sizeof(result_1)` in the `rsi` register, and `0` in the `rdx` register, before executing the extended inline assembly.\n - A `Clobbers` parameter specifies that the `rcx` register, `r11` register, and memory will be modified during the execution of the extended inline assembly.\n - Note that a `syscall` instruction itself modifies the `rcx` and `r11` registers.\n - The extended inline assembly used for the second `syscall` instruction in this challenge specifies the following:\n - A `OutputOperands` parameter specifies that a content of the `rax` register are assigned to `result_2` after the extended inline assembly executes.\n - A `InputOperands` parameter set `102` in the `rax` register before executing the extended inline assembly.\n - A `Clobbers` parameter specifies that the `rcx` register, `r11` register will be modified during the execution of the extended inline assembly.\n\n

\n\n

Beginner Hint 2: Approach to Solving the Challenge

\n\n- There are several ways to approach this challenge.\n- One ways is to look up the system call numbers for x86-64 Linux and check the arguments and return values for the corresponding system call.\n- Another way is to use a decompiler.\n - Some decompilers can perfectly decompile syscall calls from the start, while others produce poor decompiled results initially but can be perfectly decompiled with additional operations.\n\n

\n","descriptionJa","x86-64版Linuxのシステムコールを解析してみましょう！\n\n

初心者向けヒント1: システムコールの呼び出し規約とgccの拡張インラインアセンブラ

\n\n- x86-64版Linuxにおけるシステムコールの呼び出し規約は、からダウンロードできる `System V Application Binary Interface AMD64 Architecture Processor Supplement` 資料中の `A.2.1 Calling Conventions` や、に記述があります。\n - システムコールを実行するには、システムコール番号を `rax` レジスタに、最大6個までの引数を順に `rdi`, `rsi`, `rdx`, `r10`, `r8`, `r9` レジスタに格納してから `syscall` 命令を実行します。\n - システムコール実行結果は `rax` レジスタに格納されます。\n- gccの拡張インラインアセンブラ構文は、やに記述があります。\n - 本問題で使用している1つ目の `syscall` 命令用の拡張インラインアセンブラでは、次のことを指定しています。\n - `OutputOperands` パラメーターは未指定です。\n - `InputOperands` パラメーターで、拡張インラインアセンブラを実行する前に、`rax` レジスタに `318` を、`rdi` レジスタに `&result_1` を、`rsi` レジスタに `sizeof(result_1)` を、`rdx` レジスタに `0` を設定しています。\n - `Clobbers` パラメーターで、拡張インラインアセンブラの実行中に `rcx` レジスタと `r11` レジスタ、メモリが変更されることを指定しています。\n - なお、`syscall` 命令そのものが `rcx` レジスタと `r11` レジスタを変更します。\n - 本問題で使用している2つ目の `syscall` 命令用の拡張インラインアセンブラでは、次のことを指定しています。\n - `OutputOperands` パラメーターで、拡張インラインアセンブラの実行後に、`rax` レジスタの内容を`result_2` へ設定しています。\n - `InputOperands` パラメーターで、拡張インラインアセンブラを実行する前に、`rax` レジスタに `102` を設定しています。\n - `Clobbers` パラメーターで、拡張インラインアセンブラの実行中に `rcx` レジスタと `r11` レジスタが変更されることを指定しています。\n\n

\n\n

初心者向けヒント2: 問題へのアプローチ

\n\n- 本問題を解くアプローチはいくつかあります。\n- 1つの方法は、x86-64版Linuxのシステムコール番号を調査して、対応するシステムコールの引数や戻り値を確認する方法です。\n- 別の方法は、逆コンパイラを使用する方法です。\n - 逆コンパイラによって、システムコール呼び出しを最初から完璧に逆コンパイルできるものもあれば、初期状態では逆コンパイル結果が貧弱なものの追加操作で完璧に逆コンパイルできるものもあります。\n\n

\n","descriptionRequiresSignIn","changeLog","authors",[129],"solvedAt","solvedAtInContext","ctfChallenges",[],"tags",[124,125],"submitAsCtfChallenge","ctfCanonical","ctfEnded","point","solvesCtfChallenge","classification","medium","isMirror","ctfParticipants","ctfMode","isDailyChallenge",true,"canCheckFlagWithoutSubmission","canCreateInstance","showcaseMode","dailyProgramCanonicalForAction","reviewProgramCanonicalForAction","daily-alpacahack","dailyChallengeSlot",{"_111":112,"_92":93,"_113":114,"_115":116,"_117":118,"_119":120},"nextDailyCanonical","springing","httpsProxyHostname","lets-analyze-system-calls.chal.alp4ca.com","program",{"_22":104,"_20":121,"_122":123},"scheduledDate",["D",1787756400000],"releaseAt",["D",1787756400000],"status","PUBLISHED","plannedTopic","System Call","Daily AlpacaHack","timeZone","Asia/Tokyo",{"_20":127,"_22":128},{"_20":126,"_22":126},"x86-64","Linux","linux",{"_20":130,"_45":131},"tan90909090","b798cd37a3b189532822b9d09f02f5b994cf23f40bb5edd06829140c9528af5b","instances",[],"canSpawn",{"_136":137,"_37":138},"fileName","lets-analyze-system-calls.tar.gz","https://alpacahack-prod.s3.ap-northeast-1.amazonaws.com/6a2e3a9e-adc4-485d-a93c-20dfe4603f53/lets-analyze-system-calls.tar.gz",{"_20":140,"_22":141},"Rev","rev","Tag: Linux","https://alpacahack.com/tags/linux","isLoggedIn","tag",{"_20":127,"_22":128,"_73":147,"_75":148,"_79":149,"_150":151,"_152":153,"_154":155},"","Linux は、サーバーや組み込み機器などで広く使われる Unix 系のオペレーティングシステムです。\n\nCTF では、プロセス、ファイルシステム、権限、システムコールなどの OS 機能に関する問題で扱われます。\n",[285],"updatedAt",["D",1781727574244],"challenges",[162,163,164,165,166,167,168,169,170],"relatedTags",[156,157],{"_20":160,"_22":161},{"_20":158,"_22":159},"Shell","shell","File Permission","file-permission",{"_20":272,"_22":273,"_61":274,"_85":275,"_79":276,"_67":277,"_81":-7},{"_20":260,"_22":260,"_61":261,"_85":262,"_79":263,"_67":264,"_81":-7},{"_20":251,"_22":252,"_61":253,"_85":254,"_79":255,"_67":256,"_81":-7},{"_20":236,"_22":237,"_61":238,"_85":239,"_79":240,"_67":241,"_81":-7},{"_20":224,"_22":225,"_61":211,"_85":226,"_79":227,"_67":228,"_81":-7},{"_20":209,"_22":210,"_61":211,"_85":212,"_79":213,"_67":214,"_81":-7},{"_20":21,"_22":23,"_61":62,"_85":202,"_79":203,"_67":204,"_81":-7},{"_20":182,"_22":183,"_61":184,"_85":185,"_79":186,"_67":187,"_81":-7},{"_20":171,"_22":172,"_61":173,"_85":174,"_79":175,"_67":176,"_81":-7},"New Directory","new-directory",31,[181],[180],[177],{"_20":178,"_22":179},"Misc","misc",{"_20":130,"_45":131},{"_20":127,"_22":128},"Haec Horrenda","haec-horrenda",33,[191,192,193,194,195],[189],[188],{"_20":178,"_22":179},{"_20":190,"_45":-5},"rsk0315",{"_20":200,"_22":201},{"_20":198,"_22":199},{"_20":196,"_22":197},{"_20":158,"_22":159},{"_20":127,"_22":128},"Zsh","zsh","Bash","bash","POSIX Utility","posix-utility",[207,208],[206],[205],{"_20":140,"_22":141},{"_20":130,"_45":131},{"_20":127,"_22":128},{"_20":126,"_22":126},"permission denied 2","permission-denied-2",85,[219,220,221],[216],[215],{"_20":178,"_22":179},{"_20":217,"_45":218},"minaminao","8923101afaa06c6be81216763685dbd0cac8ff24fbd6646250f67608d4924b02",{"_20":222,"_22":223},{"_20":160,"_22":161},{"_20":127,"_22":128},"Local Privilege Escalation","local-privilege-escalation","permission denied","permission-denied",[231,232,233],[230],[229],{"_20":178,"_22":179},{"_20":217,"_45":218},{"_20":234,"_22":235},{"_20":127,"_22":128},{"_20":160,"_22":161},"Race Condition","race-condition","permission denied 3","permission-denied-3",121,[244,245,246],[243],[242],{"_20":178,"_22":179},{"_20":217,"_45":218},{"_20":249,"_22":250},{"_20":247,"_22":248},{"_20":127,"_22":128},"File Descriptor","file-descriptor","Process Filesystem","procfs","strange filename","strange-filename",187,[259],[258],[257],{"_20":178,"_22":179},{"_20":130,"_45":131},{"_20":127,"_22":128},"cat3",247,[267,268,269],[266],[265],{"_20":178,"_22":179},{"_20":217,"_45":218},{"_20":270,"_22":271},{"_20":127,"_22":128},{"_20":158,"_22":159},"Jail","jail","🐈","cat",380,[284],[281],[278],{"_20":279,"_22":280},"Web","web",{"_20":282,"_45":283},"ark","167e139e6b5704c655704c007bc3fd8f4bee6636ad40ec2ef61e5563e7219536",{"_20":127,"_22":128},{"_20":286,"_45":-5},"alpakun","user","en","timeZoneAbbr","clientConfig",{"_293":294,"_295":98,"_296":297,"_298":297,"_299":300,"_301":302,"_303":16,"_304":147},"cspNonce","firebaseOptions",{"_305":306,"_307":308,"_309":310,"_311":312,"_313":314,"_315":300},"isVercel","env","production","envName","gaTrackingId","G-FJX5L5Y9FE","turnstileSiteKey","0x4AAAAAAAfYTP7SUci3nVKW","isSpawnerUnderMaintenance","spawnerMaintenanceNotice","apiKey","AIzaSyDGInmUCFubPOqJWQCw3LBB-XZGj9LX4l4","appId","1:691353492123:web:4ae258ec8c620e63f0443e","projectId","alpacahack","authDomain","alpacahack.firebaseapp.com","messagingSenderId","691353492123","measurementId"]