视频网站开发费用,杭州企业名录大全,企业网络规划与设计,网站建设团购[SCTF2019]babyre 反编译失败, 有花指令 有一个无用字节, 阻止反编译, patch成0x90 所有标红的地方nop掉之后按p重申函数main和loc_C22, F5成功
int __cdecl main(int argc, const char **argv, const char **envp)
{char v4; // [rspFh] [rbp-151h]int v5; // [rsp10h] [rb…[SCTF2019]babyre 反编译失败, 有花指令 有一个无用字节, 阻止反编译, patch成0x90 所有标红的地方nop掉之后按p重申函数main和loc_C22, F5成功
int __cdecl main(int argc, const char **argv, const char **envp)
{char v4; // [rspFh] [rbp-151h]int v5; // [rsp10h] [rbp-150h]int v6; // [rsp14h] [rbp-14Ch]char *v7; // [rsp18h] [rbp-148h]char v8[10]; // [rsp26h] [rbp-13Ah] BYREF_QWORD v9[2]; // [rsp30h] [rbp-130h] BYREFint v10; // [rsp40h] [rbp-120h]__int64 v11[3]; // [rsp50h] [rbp-110h] BYREFchar v12; // [rsp68h] [rbp-F8h]__int64 v13[3]; // [rsp70h] [rbp-F0h] BYREFchar v14; // [rsp88h] [rbp-D8h]__int64 v15[6]; // [rsp90h] [rbp-D0h] BYREF__int16 v16; // [rspC0h] [rbp-A0h]char v17[136]; // [rspD0h] [rbp-90h] BYREFunsigned __int64 v18; // [rsp158h] [rbp-8h]v18 __readfsqword(0x28u);v5 0;memset(v11, 0, sizeof(v11));v12 0;memset(v13, 0, sizeof(v13));v14 0;memset(v15, 0, sizeof(v15));v16 0;strcpy(v17,**************.****.**s..*..******.****.***********..***..**..#*..***..***.********************.**..*******..**...*..*.*.**.*);v9[0] 0LL;v9[1] 0LL;v10 0;v7 v17[22];strcpy(v8, sctf_9102);puts((const char *)(unsigned int)plz tell me the shortest password1:);scanf(%s, v15);v6 1;while ( v6 ){v4 *((_BYTE *)v15 v5);switch ( v4 ){case w:v7 - 5;break;case s:v7 5;break;case d:v7;break;case a:--v7;break;case x:v7 25;break;case y:v7 - 25;break;default:v6 0;break;}v5;if ( *v7 ! 46 *v7 ! 35 )v6 0;if ( *v7 35 ){puts(good!you find the right way!\nBut there is another challenge!);break;}}if ( v6 ){puts((const char *)(unsigned int)plz tell me the password2:);scanf(%s, v11);sub_C22(v11, v13);if ( (unsigned int)sub_F67(v13, v8) 1 ){puts(Congratulation!);puts((const char *)(unsigned int)Now,this is the last!);puts(plz tell me the password3:);scanf(%s, v9);if ( (unsigned int)sub_FFA(v9) 1 ){puts(Congratulation!Here is your flag!:);printf(sctf{%s-%s(%s)}, (const char *)v15, (const char *)v11, (const char *)v9);}else{printf(something srong...);}return 0;}else{printf(sorry,somthing wrong...);return 0;}}else{printf(sorry,ist not a right way...);return 0;}
}分成三个阶段分别验证, 第一个阶段是走迷宫, 根据地图从s到# wasd分别是上左下右, xy分别是上下一层
ddwwxxssxaxwwaasasyywwdd
二阶段
unsigned __int64 __fastcall sub_C22(const char *passwd2, __int64 tmp_str)
{int v2; // eaxint v3; // eaxint v4; // eaxint v6; // [rsp14h] [rbp-24Ch]int v7; // [rsp18h] [rbp-248h]int v8; // [rsp1Ch] [rbp-244h]int v9; // [rsp20h] [rbp-240h]int v10; // [rsp24h] [rbp-23Ch]int v11; // [rsp28h] [rbp-238h]int v12; // [rsp2Ch] [rbp-234h]const char *v13; // [rsp48h] [rbp-218h]int v14[130]; // [rsp50h] [rbp-210h] BYREFunsigned __int64 v15; // [rsp258h] [rbp-8h]v15 __readfsqword(0x28u);qmemcpy(v14, unk_1740, 0x200uLL);v7 3;v6 0;v9 0;v10 0;v11 strlen(passwd2);v13 passwd2;while ( 1 ){v12 0;if ( v9 v11 )break;
LABEL_7:if ( v9 v11 )goto LABEL_8;}do{if ( passwd2[v9] ! 25 )break;v9;v12;}while ( v9 v11 );if ( v9 ! v11 ){v9;goto LABEL_7;}
LABEL_8:v8 0;while ( v11 0 ){v7 - v14[*v13] ;v6 v14[*v13] ? | (v6 6);if ( v8 4 ){v8 0;if ( v7 ){v2 v10;*(_BYTE *)(v2 tmp_str) BYTE2(v6);}if ( v7 1 ){v3 v10;*(_BYTE *)(v3 tmp_str) BYTE1(v6);}if ( v7 2 ){v4 v10;*(_BYTE *)(v4 tmp_str) v6;}}v13;--v11;}return __readfsqword(0x28u) ^ v15;
}直接爆破
#include stdio.h
unsigned int data[128] {0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,0x7F, 0x7F, 0x7F, 0x3E, 0x7F, 0x7F, 0x7F, 0x3F,0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B,0x3C, 0x3D, 0x7F, 0x7F, 0x7F, 0x40, 0x7F, 0x7F,0x7F, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E,0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,0x17, 0x18, 0x19, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,0x7F, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20,0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30,0x31, 0x32, 0x33, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F
};int main()
{int shuju[3] { 0x736374,0x665f39,0x313032 };int i0, i1, i2, i3, i4, i5;for (i0 0; i0 3; i0){for(i132;i1128;i1)for (i2 32; i2 128; i2)for (i3 32; i3 128; i3)for (i4 32; i4 128; i4){i5 (((((data[i1] 6) | data[i2]) 6) | data[i3]) 6) | data[i4];if (i5 shuju[i0])printf(%d: %c%c%c%c\n, i01,i1, i2, i3, i4);}}return 0;
}/*
1: c2N0
2: Zl85
3: MSy
3: MTy
3: MTAyc2N0Zl85MTAy
*/三阶段是各种xor处理
__int64 __fastcall check_passwd3(char *passwd3)
{int idx_4; // [rsp18h] [rbp-158h]int i; // [rsp18h] [rbp-158h]int v4; // [rsp1Ch] [rbp-154h]unsigned int v5; // [rsp24h] [rbp-14Ch]unsigned int v6; // [rsp28h] [rbp-148h]unsigned int v7; // [rsp2Ch] [rbp-144h]int v8[16]; // [rsp30h] [rbp-140h]int v9[16]; // [rsp70h] [rbp-100h]int v10[26]; // [rspB0h] [rbp-C0h]unsigned int v11[4]; // [rsp118h] [rbp-58h]unsigned __int64 v12; // [rsp168h] [rbp-8h]v12 __readfsqword(0x28u);v8[0] 190;v8[1] 4;v8[2] 6;v8[3] 128;v8[4] 197;v8[5] 175;v8[6] 118;v8[7] 71;v8[8] 159;v8[9] 204;v8[10] 64;v8[11] 31;v8[12] 216;v8[13] 191;v8[14] 146;v8[15] 239;v5 (passwd3[6] 8) | (passwd3[5] 16) | (passwd3[4] 24) | passwd3[7];v6 (passwd3[10] 8) | (passwd3[9] 16) | (passwd3[8] 24) | passwd3[11];v7 (passwd3[14] 8) | (passwd3[13] 16) | (passwd3[12] 24) | passwd3[15];v4 0;idx_4 4;v10[0] ((__int64 (__fastcall *)(_QWORD))func_byte_swap)((passwd3[2] 8) | (passwd3[1] 16) | (*passwd3 24) | (unsigned int)passwd3[3]);v10[1] ((__int64 (__fastcall *)(_QWORD))func_byte_swap)(v5);v10[2] ((__int64 (__fastcall *)(_QWORD))func_byte_swap)(v6);v10[3] ((__int64 (__fastcall *)(_QWORD))func_byte_swap)(v7);do{v10[idx_4] xor_proce(v10[v4], v10[v4 1], v10[v4 2], v10[v4 3]);v4;idx_4;}while ( idx_4 29 );v9[0] HIBYTE(v11[0]);v9[1] BYTE2(v11[0]);v9[2] BYTE1(v11[0]);v9[3] LOBYTE(v11[0]);v9[4] HIBYTE(v11[1]);v9[5] BYTE2(v11[1]);v9[6] BYTE1(v11[1]);v9[7] LOBYTE(v11[1]);v9[8] HIBYTE(v11[2]);v9[9] BYTE2(v11[2]);v9[10] BYTE1(v11[2]);v9[11] LOBYTE(v11[2]);v9[12] HIBYTE(v11[3]);v9[13] BYTE2(v11[3]);v9[14] BYTE1(v11[3]);v9[15] LOBYTE(v11[3]);for ( i 0; i 15; i ){if ( v9[i] ! v8[i] )return 0xFFFFFFFFLL;}return 1LL;
}__int64 __fastcall sub_143B(int a1, int a2, int a3, unsigned int a4)
{return a1 ^ (unsigned int)sub_1464(a2 ^ a3 ^ a4);
}__int64 __fastcall sub_1464(unsigned int a1)
{int v2; // [rsp18h] [rbp-498h]int v3[290]; // [rsp20h] [rbp-490h] BYREFunsigned __int64 v4; // [rsp4A8h] [rbp-8h]v4 __readfsqword(0x28u);qmemcpy(v3, unk_1940, 0x480uLL);v2 (v3[BYTE2(a1)] 16) | v3[(unsigned __int8)a1] | (v3[BYTE1(a1)] 8) | (v3[HIBYTE(a1)] 24);return __ROL4__(v2, 12) ^ (unsigned int)(__ROL4__(v2, 8) ^ __ROR4__(v2, 2)) ^ __ROR4__(v2, 6);
}func_byte_swap是大小端序调换, 写逆的时候v8按大端序来储存, 这样逆回去正好对上 可以直接逆回去, 需要用到IDA的宏, 这个defs.h头文件可以在ida安装目录下plugins/hexrays_sdk/include文件夹下找到
#include stdio.h
#include defs.hunsigned int ROR4(unsigned int x, int y)
{return (x (32 - y) | x y) 0xffffffff;
}unsigned int ROL4(unsigned int x, int y)
{return (x (32 - y) | x y) 0xffffffff;
}unsigned int v3[288] {0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7,0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3,0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A,0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95,0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA,0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B,0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2,0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52,0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5,0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55,0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60,0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F,0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F,0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD,0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E,0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20,0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48,0xC6, 0xBA, 0xB1, 0xA3, 0x50, 0x33, 0xAA, 0x56,0x97, 0x91, 0x7D, 0x67, 0xDC, 0x22, 0x70, 0xB2,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};__int64 sub_1464(unsigned int a1)
{int v2; v2 (v3[BYTE2(a1)] 16) | v3[(unsigned __int8)a1] | (v3[BYTE1(a1)] 8) | (v3[HIBYTE(a1) ] 24);return ROL4(v2, 12) ^ (unsigned int)(ROL4(v2, 8) ^ ROR4(v2, 2)) ^ ROR4(v2, 6);
}int main()
{ int n 25;unsigned int v10[30] { 0 };v10[26] 0xBE040680;v10[27] 0xC5AF7647;v10[28] 0x9FCC401F;v10[29] 0xD8BF92EF;do {v10[n] v10[n 4] ^ sub_1464(v10[n 1] ^ v10[n 2] ^ v10[n 3]);--n;} while (n 0);for (int i 0; i 4; i)printf(%c%c%c%c, ((char*)v10[i])[0], ((char*)v10[i])[1], ((char*)v10[i])[2], ((char*)v10[i])[3]);return 0;
}/*
fl4g_is_s0_ug1y!
*/运行程序, 把三个阶段对应的password输入, 就得flag
[FlareOn2]very_success 栈帧不平衡, altk调整, 再F5就行
BOOL __usercall sub_401000eax(int a1ebp)
{HANDLE StdHandle; // [esp-14h] [ebp-14h]HANDLE v3; // [esp-10h] [ebp-10h]int v4[3]; // [esp-Ch] [ebp-Ch] BYREFint retaddr; // [esp0h] [ebp0h]v4[1] a1;StdHandle GetStdHandle(0xFFFFFFF6);v3 GetStdHandle(0xFFFFFFF5);WriteFile(v3, aYouCrushedThat, 0x43u, (LPDWORD)v4, 0);ReadFile(StdHandle, Buffer, 0x32u, (LPDWORD)v4, 0);if ( sub_401084((int)v4, retaddr, Buffer, v4[0]) )return WriteFile(v3, aYouAreSuccess, 0x11u, (LPDWORD)v4, 0);elsereturn WriteFile(v3, aYouAreFailure, 0x11u, (LPDWORD)v4, 0);
}int __usercall sub_401084eax(int resulteax, int a2, char *a3, int a4)
{__int16 v4; // bxint length; // ecx_BYTE *v7; // edichar v8; // alunsigned int v9; // kr00_4char v10; // alchar v11; // cf__int16 process_val; // axbool check_valid; // zf_BYTE *v14; // ediint v15; // [esp0h] [ebp-Ch]v4 0;length 37;if ( a4 37 ){v7 (_BYTE *)(a2 36); // reversed arrwhile ( 1 ){LOWORD(result) 455;v15 result;v8 *a3;v9 __readeflags();v10 v15 ^ v8;__writeeflags(v9);process_val (unsigned __int8)(__ROL1__(1, v4 3) v11 v10);v4 process_val;check_valid *v7 (unsigned __int8)process_val;v14 v7 1;if ( !check_valid )LOWORD(length) 0;result v15;if ( !length ) // invalid then breakbreak;v7 v14 - 2; // v7 v7 - 1if ( !--length )return result;}}return 0;
}动调拿到v7数组, 逆回去就行
def rol(value, count):temp((value (8-count)) 0xFF)|((value count) 0xFF)return tempv7 [0xAA, 0xEC, 0xA4, 0xBA, 0xAF, 0xAE, 0xAA, 0x8A, 0xC0, 0xA7,0xB0, 0xBC, 0x9A, 0xBA, 0xA5, 0xA5, 0xBA, 0xAF, 0xB8, 0x9D,0xB8, 0xF9, 0xAE, 0x9D, 0xAB, 0xB4, 0xBC, 0xB6, 0xB3, 0x90,0x9A, 0xA8
]
v7 v7[::-1]
v4 0
flag for i in range(len(v7)):tmp rol(1, v4 3)char (v7[i] - tmp - 1) ^ 0xC7flag chr(char)v4 v7[i]print(flag{{{}{}}}.format(flag, n.com))[2019红帽杯]Snake
Unity逆向, Unity3D编译后有两种运行模式:C#字节码模式和AOT预编译模式, 这里的游戏代码是字节码存储, 在.\Snake_Data\Managed\Assembly-CSharp.dll, 用dnSpy64位进行反编译, 发现调用外部的Interface.dll, 用IDA逆向这个dll文件
__int64 __fastcall GameObject(int a1)
{char v1; // di__int64 *v2; // rbx__int64 *v3; // raxint v4; // r8dint v5; // r9d__int64 v6; // rax_BYTE *v7; // rcx__int64 v8; // rax__int64 v9; // rax__int64 *v10; // rdx__int64 v11; // rax__int64 *v12; // rcx_BYTE *v13; // rcx__int64 v15; // raxint v16; // r8dint v17; // r9d__int64 v18; // rax__int64 v19; // rax__int64 *v20; // rdx__int64 v21; // rax__int64 *v22; // rcx_BYTE *v23; // rcxvoid *v24; // rcxvoid *v25; // rcxvoid *v26; // rcx_BYTE *v27; // rcx_BYTE *v28; // rcx__int64 v29; // rax_BYTE *v30; // rcx__int64 v31; // raxconst void *v32; // rdxbool v33; // bl_BYTE *v34; // rcx_BYTE *v35; // rcx__int64 v36; // raxconst char *v37; // rdx__int64 v38; // rax__int64 v39; // raxvoid *v40; // rcx_BYTE *v41; // rcxvoid *v42; // rcxvoid *v43; // rcxvoid *Block; // [rsp20h] [rbp-E0h] BYREF_BYTE *v45; // [rsp28h] [rbp-D8h] BYREF__m128i si128; // [rsp30h] [rbp-D0h]int v47; // [rsp40h] [rbp-C0h]int v48; // [rsp48h] [rbp-B8h]int v49; // [rsp50h] [rbp-B0h] BYREFint v50; // [rsp58h] [rbp-A8h] BYREFint v51; // [rsp60h] [rbp-A0h]int v52; // [rsp68h] [rbp-98h]int v53; // [rsp70h] [rbp-90h]__int64 *v54; // [rsp78h] [rbp-88h] BYREFvoid *Buf1[2]; // [rsp80h] [rbp-80h]unsigned __int64 v56; // [rsp90h] [rbp-70h]void *v57; // [rsp98h] [rbp-68h] BYREFvoid *v58; // [rspA0h] [rbp-60h] BYREF__m128i v59; // [rspA8h] [rbp-58h]unsigned __int64 v60; // [rspB8h] [rbp-48h]__int64 v61; // [rspC0h] [rbp-40h] BYREFvoid *v62; // [rspC8h] [rbp-38h] BYREF_BYTE v63[24]; // [rspD0h] [rbp-30h]__int64 v64; // [rspE8h] [rbp-18h] BYREF_BYTE *v65; // [rspF0h] [rbp-10h] BYREF__int128 v66; // [rspF8h] [rbp-8h]unsigned __int64 v67; // [rsp108h] [rbp8h]__int64 v68; // [rsp110h] [rbp10h] BYREFvoid *v69[2]; // [rsp118h] [rbp18h] BYREF__m128i v70; // [rsp128h] [rbp28h]char v71[8]; // [rsp138h] [rbp38h] BYREFvoid *v72[3]; // [rsp140h] [rbp40h] BYREFunsigned __int64 v73; // [rsp158h] [rbp58h]v48 0;v1 0;if ( a1 0 ){if ( (unsigned int)(a1 - 2) 97 ) // 0 - 99{LOBYTE(Block) 0;si128 _mm_load_si128((const __m128i *)xmmword_18000EB70);sub_180006D10(Block,139907262641720884635250105449327463531131227516500497307311002094885245322386805049406878643982216326493527702414689439930090794753345844178528356178539094825247389836142928474607108262267087850211322640806135698076207986818086837911361480181444157057782599277473843153161174504240064610043962720953514451563,0x135ui64);sub_180001530(v71, Block);LOBYTE(Block) 0;si128 _mm_load_si128((const __m128i *)xmmword_18000EB70);sub_180006D10(Block,79981856490856999850671700360733120831999995589421207460490185876531860518527597767905168099182891345123878966403548022646956365158864209467614850251731806682037300712511185681164865174187586907707195428804234739667769742078793162639867922056194688917569369338005327309973680573581158754297630654105882382426,0x134ui64);sub_180001530(v61, Block);v15 sub_18000A9D0(Block);sub_180001530(v68, v15);LOBYTE(Block) v71[0];sub_180006C40(v45, v72);LOBYTE(v57) v68;sub_180006C40(v58, v69);LOBYTE(v49) v61;sub_180006C40(v50, v62);sub_180006250(v64, v49, v57, Block);LOBYTE(v49) v64;sub_180006C40(v50, v65);sub_18000AAB0((unsigned int)v54,(unsigned int)v49,v16,v17,(_DWORD)Block,(_DWORD)v45,si128.m128i_i32[0],si128.m128i_i32[2],v47,v48,v49,v50,v51,v52,v53,(_DWORD)v54,Buf1[0],Buf1[1],v56);LOBYTE(Block) 0;si128 _mm_load_si128((const __m128i *)xmmword_18000EB70);sub_180006D10(Block, flag, 4ui64);v18 sub_180006C40(v57, v54);if ( (unsigned __int8)sub_18000AFA0(v18, Block) ){v19 sub_18000A7C0(std::cout, You win! flag is );std::ostream::operator(v19, sub_18000A990);v20 (__int64 *)v54;if ( v56 0x10 )v20 v54;v21 sub_180007570(std::cout, v20, Buf1[1]);}else{v21 sub_18000A7C0(std::cout, Try again);}std::ostream::operator(v21, sub_18000A990);if ( v56 0x10 ){v22 v54;if ( v56 1 0x1000 ){v22 (__int64 *)*(v54 - 1);if ( (unsigned __int64)((char *)v54 - (char *)v22 - 8) 0x1F )goto LABEL_50;}j_j_free(v22);}Buf1[1] 0i64;v56 15i64;LOBYTE(v54) 0;if ( v67 0x10 ){v23 v65;if ( v67 1 0x1000 ){v23 (_BYTE *)*((_QWORD *)v65 - 1);if ( (unsigned __int64)(v65 - v23 - 8) 0x1F )goto LABEL_50;}j_j_free(v23);}if ( v70.m128i_i64[1] 0x10ui64 ){v24 v69[0];if ( (unsigned __int64)(v70.m128i_i64[1] 1) 0x1000 ){v24 (void *)*((_QWORD *)v69[0] - 1);if ( (unsigned __int64)(v69[0] - v24 - 8) 0x1F )goto LABEL_50;}j_j_free(v24);}LOBYTE(v69[0]) 0;v70 _mm_load_si128((const __m128i *)xmmword_18000EB70);if ( *(_QWORD *)v63[16] 0x10ui64 )goto LABEL_47;v25 v62;if ( (unsigned __int64)(*(_QWORD *)v63[16] 1i64) 0x1000|| (v25 (void *)*((_QWORD *)v62 - 1), (unsigned __int64)((_BYTE *)v62 - (_BYTE *)v25 - 8) 0x1F) ){j_j_free(v25);
LABEL_47:LOBYTE(v62) 0;*(__m128i *)v63[8] _mm_load_si128((const __m128i *)xmmword_18000EB70);if ( v73 0x10 ){v26 v72[0];if ( v73 1 0x1000 ){v26 (void *)*((_QWORD *)v72[0] - 1);if ( (unsigned __int64)(v72[0] - v26 - 8) 0x1F )goto LABEL_50;}j_j_free(v26);}return 7i64;}
LABEL_50:invalid_parameter_noinfo_noreturn();}if ( (unsigned int)(a1 - 101) 0x62 )return 996i64;v68 0i64;v69[0] 0i64;v69[1] 0i64;v70.m128i_i64[0] 0i64;v59 _mm_load_si128((const __m128i *)xmmword_18000EB70);LOBYTE(v57) 0;sub_180006D10(v57,139907262641720884635250105449327463531131227516500497307311002094885245322386805049406878643982216326493527702414689439930090794753345844178528356178539094825247389836142928474607108262267087850211322640806135698076207986818086837911361480181444157057782599277473843153161174504240064610043962720953514451563,0x135ui64);sub_1800078F0(v68, v57);if ( v59.m128i_i64[1] 0x10ui64 ){v27 v57;if ( (unsigned __int64)(v59.m128i_i64[1] 1) 0x1000 ){v27 (_BYTE *)*((_QWORD *)v57 - 1);if ( (unsigned __int64)((_BYTE *)v57 - v27 - 8) 0x1F )goto LABEL_99;}j_j_free(v27);}v61 0i64;v62 0i64;*(_OWORD *)v63 0ui64;v59 _mm_load_si128((const __m128i *)xmmword_18000EB70);LOBYTE(v57) 0;sub_180006D10(v57,122107611316850260321590575768393047216806481837919054910332579385088745494833866045797079936947058335743437609060618364037361749600119005166359303873659401522100249312696661209787316369738806133852177861917757996075304470648951037632182891401322685617735478597953000103146149534977902885706852338811895661809,0x135ui64);sub_1800078F0(v61, v57);if ( v59.m128i_i64[1] 0x10ui64 ){v28 v57;if ( (unsigned __int64)(v59.m128i_i64[1] 1) 0x1000 ){v28 (_BYTE *)*((_QWORD *)v57 - 1);if ( (unsigned __int64)((_BYTE *)v57 - v28 - 8) 0x1F )goto LABEL_99;}j_j_free(v28);}v64 0i64;v65 0i64;v66 0ui64;v29 sub_18000A9D0(Block);sub_1800078F0(v64, v29);if ( si128.m128i_i64[1] 0x10ui64 ){v30 Block;if ( (unsigned __int64)(si128.m128i_i64[1] 1) 0x1000 ){v30 (_BYTE *)*((_QWORD *)Block - 1);if ( (unsigned __int64)((_BYTE *)Block - v30 - 8) 0x1F )invalid_parameter_noinfo_noreturn();}j_j_free(v30);}v54 0i64;Buf1[0] 0i64;Buf1[1] 0i64;v56 0i64;sub_180009B40(v61, v54, v64, v68);LOBYTE(v57) 0;v59 _mm_load_si128((const __m128i *)xmmword_18000EB70);sub_180006D10(v57, 7777777, 7ui64);v31 sub_1800078F0(Block, v57);v33 0;if ( (_BYTE)v54 *(_BYTE *)v31 ){v32 *(const void **)(v31 8);if ( (((Buf1[1] - Buf1[0]) ^ (*(_QWORD *)(v31 16) - (_QWORD)v32)) 0xFFFFFFFFFFFFFFFCui64) 0 !memcmp(Buf1[0], v32, Buf1[1] - Buf1[0]) ){v33 1;}}v34 v45;if ( v45 ){if ( ((si128.m128i_i64[1] - (_QWORD)v45) 0xFFFFFFFFFFFFFFFCui64) 0x1000 ){v34 (_BYTE *)*((_QWORD *)v45 - 1);if ( (unsigned __int64)(v45 - v34 - 8) 0x1F )
LABEL_79:invalid_parameter_noinfo_noreturn();}j_j_free(v34);v45 0i64;si128 0i64;}if ( v59.m128i_i64[1] 0x10ui64 ){v35 v57;if ( (unsigned __int64)(v59.m128i_i64[1] 1) 0x1000 ){v35 (_BYTE *)*((_QWORD *)v57 - 1);if ( (unsigned __int64)((_BYTE *)v57 - v35 - 8) 0x1F )goto LABEL_79;}j_j_free(v35);}if ( v33 ){v36 sub_18000A7C0(std::cout, EDG fight for S10);std::ostream::operator(v36, sub_18000A990);v37 You fight for the next snake;}else{v38 sub_18000A7C0(std::cout, EDG failed to fight for their S9);std::ostream::operator(v38, sub_18000A990);v37 But you can fight for next snake;}v39 sub_18000A7C0(std::cout, v37);std::ostream::operator(v39, sub_18000A990);v40 Buf1[0];if ( Buf1[0] ){if ( ((v56 - (unsigned __int64)Buf1[0]) 0xFFFFFFFFFFFFFFFCui64) 0x1000 ){v40 (void *)*((_QWORD *)Buf1[0] - 1);if ( (unsigned __int64)(Buf1[0] - v40 - 8) 0x1F )goto LABEL_99;}j_j_free(v40);v56 0i64;*(_OWORD *)Buf1 0i64;}v41 v65;if ( v65 ){if ( ((*((_QWORD *)v66 1) - (_QWORD)v65) 0xFFFFFFFFFFFFFFFCui64) 0x1000 ){v41 (_BYTE *)*((_QWORD *)v65 - 1);if ( (unsigned __int64)(v65 - v41 - 8) 0x1F )goto LABEL_99;}j_j_free(v41);v65 0i64;v66 0i64;}v42 v62;if ( !v62 )goto LABEL_96;if ( ((*(_QWORD *)v63[8] - (_QWORD)v62) 0xFFFFFFFFFFFFFFFCui64) 0x1000|| (v42 (void *)*((_QWORD *)v62 - 1), (unsigned __int64)((_BYTE *)v62 - (_BYTE *)v42 - 8) 0x1F) ){j_j_free(v42);v62 0i64;*(_OWORD *)v63 0i64;
LABEL_96:v43 v69[0];if ( v69[0] ){if ( ((v70.m128i_i64[0] - (unsigned __int64)v69[0]) 0xFFFFFFFFFFFFFFFCui64) 0x1000 ){v43 (void *)*((_QWORD *)v69[0] - 1);if ( (unsigned __int64)(v69[0] - v43 - 8) 0x1F )goto LABEL_99;}j_j_free(v43);}return 996i64;}
LABEL_99:invalid_parameter_noinfo_noreturn();}LOBYTE(Block) 0;si128 _mm_load_si128((const __m128i *)xmmword_18000EB70);sub_180006D10(Block, 35297982045181952350813323813224883208572049226586980, 0x35ui64);sub_180001530(v57, Block);v2 qword_180012038;v3 qword_180012038;if ( *((_QWORD *)xmmword_180012048 1) 0x10ui64 )v3 (__int64 *)qword_180012038;if ( (_QWORD)xmmword_180012048 4i64 *(_DWORD *)v3 *(_DWORD *)null ){v71[0] (char)v57;sub_180006C40(v72, v58);v6 sub_18000AAB0((unsigned int)Block,(unsigned int)v71,v4,v5,(_DWORD)Block,(_DWORD)v45,si128.m128i_i32[0],si128.m128i_i32[2],v47,v48,v49,v50,v51,v52,v53,(_DWORD)v54,Buf1[0],Buf1[1],v56);v2 (__int64 *)sub_180006A70(qword_180012038, v6);v1 1;}sub_180006C40(v54, v2);if ( (v1 1) ! 0 si128.m128i_i64[1] 0x10ui64 ){v7 Block;if ( (unsigned __int64)(si128.m128i_i64[1] 1) 0x1000 ){v7 (_BYTE *)*((_QWORD *)Block - 1);if ( (unsigned __int64)((_BYTE *)Block - v7 - 8) 0x1F )invalid_parameter_noinfo_noreturn();}j_j_free(v7);}v8 sub_18000A7C0(std::cout, If SKT win S9 champion);v9 sub_18000A7C0(v8, this is real flag);std::ostream::operator(v9, sub_18000A990);v10 (__int64 *)v54;if ( v56 0x10 )v10 v54;v11 sub_180007570(std::cout, v10, Buf1[1]);std::ostream::operator(v11, sub_18000A990);if ( v56 0x10 ){v12 v54;if ( v56 1 0x1000 ){v12 (__int64 *)*(v54 - 1);if ( (unsigned __int64)((char *)v54 - (char *)v12 - 8) 0x1F )
LABEL_22:invalid_parameter_noinfo_noreturn();}j_j_free(v12);}Buf1[1] 0i64;v56 15i64;LOBYTE(v54) 0;if ( v60 0x10 ){v13 v58;if ( v60 1 0x1000 ){v13 (_BYTE *)*((_QWORD *)v58 - 1);if ( (unsigned __int64)((_BYTE *)v58 - v13 - 8) 0x1F )goto LABEL_22;}j_j_free(v13);}return 0xFFFFFFFFi64;
}发现输入值为0-99某个数时, 会输出flag, 输入空间比较小, 可以写个dll调用程序进行爆破(但时间还是比较长, 不过可以接受, 不然就硬逆算法)
#include stdafx.h
#include stdio.h
#include stdlib.h
#include iostream
#include Windows.h
using namespace std;
typedef signed __int64(*Dllfunc)(int);int _tmain(int argc, _TCHAR* argv[])
{HMODULE module LoadLibrary(TEXT(D:\\BUUCTF\\REVERSE\\71-90\\[2019redhat]Snake\\Snake\\Snake_Data\\Plugins\\Interface.dll));//HMODULE module LoadLibrary(TEXT(Interface.dll));if (module NULL){printf(load dll library error\n);return 1;}Dllfunc dllfunc (Dllfunc)GetProcAddress(module, GameObject);if (dllfunc NULL){cout get dll function error\n;return 2;}// brute force the gameobjectfor (int i 0; i 99; i) {signed __int64 res dllfunc(i);cout i res endl;}getchar();// free dll objectFreeLibrary(module);return 0;
}[SCTF2019]Strange apk
APK逆向, JEB打开定位到入口点 关键函数应该是sctf.demo.myapplication.s但是找不到, 怀疑是动态释放文件, 用反射大师提取dex文件 这里用模拟器提取失败了, 尝试别的路径, 静态分析sctf.hello.c发现解密操作, data文件与syclover进行xor
人工SMC
from tqdm import tqdmdef get_byte(v):return v.to_bytes(1, byteorderlittle)key syclover
with open(./data, rb) as f:file_data f.read()with open(./smcdata.apk, wb) as f:for i in tqdm(range(len(file_data))):decode get_byte(file_data[i] ^ ord(key[i % 8])) f.write(decode)print(----- new apk saved -----)JEB打开新的apk包, 定位到t和c方法 前段flag是base64编码, 后段是取偶数位 整理一下就是flag的前后两段
[安洵杯 2019]game int __cdecl main(int argc, const char **argv, const char **envp)
{int v3; // eax__int64 v4; // rsiint i; // [rsp2Ch] [rbp-54h]unsigned int v7; // [rsp38h] [rbp-48h]char input[56]; // [rsp40h] [rbp-40h] BYREFint v9; // [rsp78h] [rbp-8h]int v10; // [rsp7Ch] [rbp-4h]v9 0;printf(input your flag:);gets(input, argv);v10 general_inspection((int (*)[9])sudoku);for ( i -1804515313; ; i -303742386 ){while ( 1 ){while ( i -2071121728 ){v7 blank_num((int (*)[9])sudoku);v4 mem_alloc(v7);trace(sudoku, v4, v7);check((int (*)[9])sudoku);process(input);valid_check(input);v9 0;i -303742386;}if ( i ! -1804515313 )break;v3 -2071121728;if ( v10 )v3 664169471;i v3;}if ( i -303742386 )break;printf(error);check((int (*)[9])sudoku);v9 0;}return v9;
}程序对sudoku(数独)进行处理, 然后对input进行处理, 最后是验证, 多个函数都应用了控制流平坦化, 需要deflat(不过逻辑也比较清晰, 主要就是解数独, 可以不用费劲去混淆, 找一个程序自动解或者手动解数独问题就行) 导出数据, 解数独
#include stdafx.h
#include stdio.h
#include iostream
#include vector
using namespace std;std::vectorstd::vectorchar Base {{ 1, 0, 5, 3, 2, 7, 0, 0, 8 },{ 8, 0, 9, 0, 5, 0, 0, 2, 0 },{ 0, 7, 0, 0, 1, 0, 5, 0, 3 },{ 4, 9, 0, 1, 0, 0, 3, 0, 0 },{ 0, 1, 0, 0, 7, 0, 9, 0, 6 },{ 7, 0, 3, 2, 9, 0, 4, 8, 0 },{ 0, 6, 0, 5, 4, 0, 8, 0, 9 },{ 0, 0, 4, 0, 0, 1, 0, 3, 0 },{ 0, 2, 1, 0, 3, 0, 7, 0, 4 }
};class Solution {
public:int row[9][9];int col[9][9]; int block[9][9];bool solveSudoku(vectorvectorchar board) {memset(row, 0, sizeof(int) * 81);memset(col, 0, sizeof(int) * 81);memset(block, 0, sizeof(int) * 81);for (int i 0; i 9; i){//初始化行列以及block方便后续查询for (int j 0; j 9; j){if (board[i][j] 0) continue;int num board[i][j] - 1;row[i][num] col[j][num] block[i / 3 * 3 j / 3][num] 1;}}return dfs(board, 0, 0);}bool dfs(vectorvectorchar board, int r, int c){if (r 8) {for (int i 0; i 8; i) {for (int j 0; j 8; j) {cout (int)board[i][j];}cout endl;}return true;}if (board[r][c] 0){for (int i 0; i 9; i){//枚举可以填入的数字if (row[r][i] || col[c][i] || block[r / 3 * 3 c / 3][i])continue;//不符合要求该数字已存在board[r][c] i 1;row[r][i] col[c][i] block[r / 3 * 3 c / 3][i] 1;//先判断第一行的9列然后再判断第二行的9列一直到最后一行即r8//r(c1)/9, (c1)%9的使用非常巧妙if (dfs(board, r (c 1) / 9, (c 1) % 9)) return true;board[r][c] 0;row[r][i] col[c][i] block[r / 3 * 3 c / 3][i] 0;}}else return dfs(board, r (c 1) / 9, (c 1) % 9);return false;//无解}
};int main() {Solution S;std::vectorstd::vectorchar matrix {{ 1, 0, 5, 3, 2, 7, 0, 0, 8 },{ 8, 0, 9, 0, 5, 0, 0, 2, 0 },{ 0, 7, 0, 0, 1, 0, 5, 0, 3 },{ 4, 9, 0, 1, 0, 0, 3, 0, 0 },{ 0, 1, 0, 0, 7, 0, 9, 0, 6 },{ 7, 0, 3, 2, 9, 0, 4, 8, 0 },{ 0, 6, 0, 5, 4, 0, 8, 0, 9 },{ 0, 0, 4, 0, 0, 1, 0, 3, 0 },{ 0, 2, 1, 0, 3, 0, 7, 0, 4 }};cout S.solveSudoku(matrix) endl;for (int i 0; i 9; i) {for (int j 0; j 9; j) {if (Base[i][j] 0)cout (int)matrix[i][j];}}cout endl;getchar();
}process 做了三步处理 交换奇偶位
交换前半和后半数据 反转第3,4位数据并-20 逆
s 4693641762894685722843556137219876255986flag
tmp [0 for _ in range(len(s))]
for i in range(len(s)):tmp[i] (ord(s[i]) 20) ^ 0x0C 0xFFidx1 0
idx2 len(s) // 2
while idx2 len(s):tmp[idx1], tmp[idx2] tmp[idx2], tmp[idx1]idx2 1idx1 1for i in range(0, len(s), 2):tmp[i], tmp[i 1] tmp[i 1], tmp[i]for i in range(len(tmp)):flag chr(tmp[i])print(flag{{{}}}.format(flag))
