rpc-server-analysis

Étoiles26

Forks3

Mis à jour13 mars 2026 à 06:46

RPC 程序漏洞挖掘

Installation

Installer avec Codex ou Claude Copiez ce prompt, collez-le dans Codex, Claude ou un autre assistant, puis laissez-le vérifier la page du skill et l'installer pour vous.

Exécuter dans Manus

Source

magiclf-ai

magiclf-ai/IVAgent

Ouvrir le dépôt GitHub Voir les dépôts du créateur

Téléchargement

Exécuter dans Manus

Métiers associésSOC

Basé sur la classification professionnelle SOC

Analystes en sécurité de l'informationProfessions informatiques et mathématiques·SOC 15-1212

SKILL.md

readonly

name	rpc-server-analysis
description	RPC 程序漏洞挖掘
engine	ida
target_type	binary
strategy_hints	{"max_depth":"建议调用链深度为 3-5 层","concurrency":"可根据函数数量动态决定并发度"}
taint_sources	["payload (攻击者控制的消息数据)","payload_len (数据长度)"]
tags	["rpc","binary","message_handler"]

分析步骤

从二进制中分析 handle_type_xxx (由于是 c++ 程序，实际搜索应该为 .*handle_type.*) 命名的函数，他们会处理用户输入，挖掘其中的漏洞

// ============================================
void dispatch_message(const RpcMessage* msg) {
    size_t payload_len = msg->header.data_len;
    const uint8_t* payload = msg->payload;

    switch (msg->header.msg_type) {
        case MSG_TYPE_1:  handle_type_1(payload, payload_len); break;
        case MSG_TYPE_2:  handle_type_2(payload, payload_len); break;
        case MSG_TYPE_3:  handle_type_3(payload, payload_len); break;
        case MSG_TYPE_4:  handle_type_4(payload, payload_len); break;
        case MSG_TYPE_5:  handle_type_5(payload, payload_len); break;
        case MSG_TYPE_6:  handle_type_6(payload, payload_len); break;
        case MSG_TYPE_7:  handle_type_7(payload, payload_len); break;
        case MSG_TYPE_8:  handle_type_8(payload, payload_len); break;
        case MSG_TYPE_9:  handle_type_9(payload, payload_len); break;
        case MSG_TYPE_10: handle_type_10(payload, payload_len); break;
        case MSG_TYPE_11: handle_type_11(payload, payload_len); break;
        case MSG_TYPE_12: handle_type_12(payload, payload_len); break;
        case MSG_TYPE_13: handle_type_13(payload, payload_len); break;
        case MSG_TYPE_14: handle_type_14(payload, payload_len); break;
        case MSG_TYPE_15: handle_type_15(payload, payload_len); break;
        case MSG_TYPE_16: handle_type_16(payload, payload_len); break;
        case MSG_TYPE_17: handle_type_17(payload, payload_len); break;
        case MSG_TYPE_18: handle_type_18(payload, payload_len); break;
        case MSG_TYPE_19: handle_type_19(payload, payload_len); break;
        case MSG_TYPE_20: handle_type_20(payload, payload_len); break;
        default:
            printf("Unknown message type: %u\n", msg->header.msg_type);
            break;
    }
}

Plus depuis ce dépôt

même dépôt

test-and-eval

magiclf-ai/IVAgent

IVAgent 测试与评估工作流。修改代码后运行回归测试、LLM 语义评测和日志分析。当用户要求测试、验证、评估或回归检查时使用。

2026-03-1726

autonomous-binary-pseudocode-eval

magiclf-ai/IVAgent

系统测试通用 workflow：对 IDA 伪代码视图执行自主漏洞挖掘

2026-03-1726

testcase-baseband-nas-tft-overflow-01

magiclf-ai/IVAgent

系统测试 workflow: baseband_nas_tft_overflow_01

2026-03-1726

testcase-baseband-rlc-reassembly-01

magiclf-ai/IVAgent

系统测试 workflow: baseband_rlc_reassembly_01

2026-03-1726

testcase-bluetooth-gatt-underflow-01

magiclf-ai/IVAgent

系统测试 workflow: bluetooth_gatt_underflow_01

2026-03-1726

testcase-bt-l2cap-fragment-uaf-01

magiclf-ai/IVAgent

系统测试 workflow: bt_l2cap_fragment_uaf_01

2026-03-1726

// ============================================ void dispatch_message(const RpcMessage* msg) { size_t payload_len = msg->header.data_len; const uint8_t* payload = msg->payload; switch (msg->header.msg_type) { case MSG_TYPE_1: handle_type_1(payload, payload_len); break; case MSG_TYPE_2: handle_type_2(payload, payload_len); break; case MSG_TYPE_3: handle_type_3(payload, payload_len); break; case MSG_TYPE_4: handle_type_4(payload, payload_len); break; case MSG_TYPE_5: handle_type_5(payload, payload_len); break; case MSG_TYPE_6: handle_type_6(payload, payload_len); break; case MSG_TYPE_7: handle_type_7(payload, payload_len); break; case MSG_TYPE_8: handle_type_8(payload, payload_len); break; case MSG_TYPE_9: handle_type_9(payload, payload_len); break; case MSG_TYPE_10: handle_type_10(payload, payload_len); break; case MSG_TYPE_11: handle_type_11(payload, payload_len); break; case MSG_TYPE_12: handle_type_12(payload, payload_len); break; case MSG_TYPE_13: handle_type_13(payload, payload_len); break; case MSG_TYPE_14: handle_type_14(payload, payload_len); break; case MSG_TYPE_15: handle_type_15(payload, payload_len); break; case MSG_TYPE_16: handle_type_16(payload, payload_len); break; case MSG_TYPE_17: handle_type_17(payload, payload_len); break; case MSG_TYPE_18: handle_type_18(payload, payload_len); break; case MSG_TYPE_19: handle_type_19(payload, payload_len); break; case MSG_TYPE_20: handle_type_20(payload, payload_len); break; default: printf("Unknown message type: %u\n", msg->header.msg_type); break; } }