看雪CTF2019Q2-第4题达芬奇密码-CTF对抗-看雪-安全社区|安全招聘|kanxue.com

看雪CTF2019Q2-第4题达芬奇密码

2019-6-18 23:19 2864

看雪CTF2019Q2-第4题达芬奇密码

风间仁

2019-6-18 23:19

2864

sn长度为16

.rdata:005456C0                 dd WM_COMMAND
.rdata:005456C4                 dd 0
.rdata:005456C8                 dd 1
.rdata:005456CC                 dd 1
.rdata:005456D0                 dd 39h
.rdata:005456D4                 dd offset sub_401EA0

.text:00401F16                 cmp     eax, 10h
.text:00401F19                 jnz     loc_401FDA

sn长度正确时写入check函数

.text:00401F7B                 mov     ecx, 0CCh
.text:00401F80                 mov     esi, offset byte_5647B8
.text:00401F85                 mov     edi, offset sub_4010E0
.text:00401F8A                 rep movsd

x, y = sn ^ xor_key (x与y都为64位)

.text:00401101                 mov     [esp+98h+xor_key], 16h
.text:00401106                 mov     [esp+98h+xor_key+1], 96h
.text:0040110B                 mov     [esp+98h+xor_key+2], 8Ch
.text:00401110                 mov     [esp+98h+xor_key+3], 0E3h
.text:00401115                 mov     [esp+98h+xor_key+5], 98h
.text:0040111A                 mov     [esp+98h+xor_key+6], 6Eh
.text:0040111F                 mov     [esp+98h+xor_key+7], 64h
.text:00401124                 mov     [esp+98h+xor_key+8], 84h
.text:00401129                 mov     [esp+98h+xor_key+9], 8
.text:0040112E                 mov     [esp+98h+xor_key+0Ah], 0DCh
.text:00401133                 mov     [esp+98h+xor_key+0Ch], 0BEh
.text:00401138                 mov     [esp+98h+xor_key+0Dh], 4Dh
.text:0040113D                 mov     [esp+98h+xor_key+0Eh], 48h
.text:00401142                 mov     [esp+98h+xor_key+0Fh], 4Fh
.text:00401147                 mov     dword ptr [esp+98h+xor_key+10h], eax
.text:0040114B                 mov     [esp+98h+var_7C], eax
.text:0040114F                 mov     [esp+98h+var_78], eax
.text:00401153                 mov     [esp+98h+var_74], eax
.text:00401157                 mov     dword ptr [esp+98h+t_x], eax
.text:0040115B                 mov     dword ptr [esp+98h+t_x+4], eax
.text:0040115F                 mov     dword ptr [esp+98h+t_y], eax
.text:00401163                 mov     dword ptr [esp+98h+t_y+4], eax
.text:00401167                 sub     esi, ecx
.text:00401169                 lea     esp, [esp+0]
.text:00401170                 lea     ecx, [esp+eax+98h+xor_key]
.text:00401174                 mov     dl, [esi+ecx]
.text:00401177                 xor     dl, [ecx]
.text:00401179                 mov     cl, [edi+eax+8]
.text:0040117D                 xor     cl, [esp+eax+98h+xor_key+8]
.text:00401181                 mov     [esp+eax+98h+t_x], dl
.text:00401185                 mov     [esp+eax+98h+t_y], cl
.text:00401189                 inc     eax
.text:0040118A                 cmp     eax, 8
.text:0040118D                 jl      short loc_401170

x与y的每个字节都不为0, 且 x > 0x0100000000000000

.text:0040120F                 mov     eax, 7
.text:00401214                 cmp     [esp+eax+98h+t_x], 0
.text:00401219                 jnz     short loc_401221
.text:0040121B                 dec     ecx
.text:0040121C                 sub     eax, 1
.text:0040121F                 jns     short loc_401214
.text:00401221                 cmp     ecx, 8
.text:00401224                 jnz     loc_4013FE
.text:0040122A                 mov     eax, 7
.text:0040122F                 nop
.text:00401230                 cmp     [esp+eax+98h+t_y], 0
.text:00401235                 jnz     short loc_40123D
.text:00401237                 dec     ecx
.text:00401238                 sub     eax, 1
.text:0040123B                 jns     short loc_401230
.text:0040123D                 cmp     ecx, 8
.text:00401240                 jnz     loc_4013FE
.text:00401246                 test    [esp+98h+t_x+7], 0F0h
.text:0040124B                 jnz     loc_4013FE

x^2 - 7y^2 = 8

.text:00401251                 push    ebx
...
.text:004013F1                 mov     eax, 1

wolframalpha解方程得到: x=385044246406735194, y = 145533045678356702

x^2-7y^2=8,72057594037927936<x < 1152921504606846976,72057594037927936<y<x

得到sn: L3mZ2k9aZ0a36DMM

[培训]《安卓高级研修班(网课)》月薪三万计划，掌握调试、分析还原ollvm、vmp的方法，定制art虚拟机自动化脱壳的方法

收藏・0

免费・1

打赏

看雪CTF2019Q2-第4题 达芬奇密码

看雪CTF2019Q2-第4题达芬奇密码