-
-
[原创]魔改RC4+隐表base64魔改逆向
-
2023-12-12 16:40
-
今天来整一道魔改RC4+隐藏表的base64魔改逆向
进入主程序比较显眼的是V10
但他不涉及咱们输入的值，而是直接传入函数使用，说明不一定是直接加密的key
跟进函数比较明显出现RC4的特征
咱们先不管，接着看接下来的函数
三个加密流程就很BASE，但是没有表只有+61，所以这是以=以后的64个数为表
想要脚本还原需要BASE流的加密过程，加密是将3字节转化为4字节。
转化例子如下，每个字节前面补00，然后往下传递，首位一定为00。
根据这个图可以进行位移来还原flag
这部分还原就是这样
最后是魔改RC4部分，咱们不需要去算法还原
这里有异或操作。RC4每次异或都是固定的值咱们可以直接动调获取EDX的值得到异或的值
可以用idc写脚本记录
1 2 3 4 5 6 7 8 9 | #include<idc.idc>static main(){auto i;for(i=0;i<88;i++){Message("0x%X,",GetRegValue("EDX"));RunTo(0x004008D7);GetDebuggerEvent(WFNE_SUSP,-1);}} |
最后脚本就是这样
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 | #include <stdio.h>#include <string.h>int main() { int enc[] = { 0x5a, 0x60, 0x54, 0x7A, 0x7A, 0x54, 0x72, 0x44, 0x7C, 0x66, 0x51, 0x50, 0x5B, 0x5F, 0x56, 0x56, 0x4C, 0x7C, 0x79, 0x6E, 0x65, 0x55, 0x52, 0x79, 0x55, 0x6D, 0x46, 0x6B, 0x6C, 0x56, 0x4A, 0x67, 0x4C, 0x61, 0x73, 0x4A, 0x72, 0x6F, 0x5A, 0x70, 0x48, 0x52, 0x78, 0x49, 0x55, 0x6C, 0x48, 0x5C, 0x76, 0x5A, 0x45, 0x3D}; int key[] = { 0x10,0x59,0x9C,0x92,0x6,0x22,0xCF,0xA5,0x72,0x1E,0x45,0x6A,0x6,0xCB,0x8,0xC3,0xE4,0x49,0x5A,0x63,0xC,0xDF,0xF6,0x5F,0x8,0x28,0xBD ,0xE2,0x10,0x15,0x1F,0x6E,0xAA,0x5A,0xCA,0xEC,0x80,0xAF,0x9B,0x16,0xBB,0x3D,0x13,0x2F,0x6A,0xA4,0xC7,0x2E,0xBC,0x4B,0x60,0x9A,0xAF,0xE9,0xCE,0xDA,0x67,0x39,0xBA,0x3B,0x85,0xEB,0xD2,0x6B,0xAB,0x6,0x6B,0x10,0x57,0x2C,0x88,0x70,0xF7,0x4F,0xAA,0x7F,0x12,0x47,0xD6,0xDE,0x74,0xB2,0x1D,0xA4,0xD7,0x76,0x9A,0xE0 }; char flag[255]; int cout = 0; for (int i = 0; i < 52; i += 4) { flag[cout] = ((enc[i] - 61) & 0x3f) << 2 | (((enc[i + 1] - 61) & 0x30) >> 4); flag[cout + 1] = (((enc[i + 1] - 61) & 0xf) << 4) | (((enc[i + 2] - 61) & 0x3C) >> 2); flag[cout + 2] = (((enc[i + 2] - 61) & 0x3) << 6) | ((enc[i + 3]-61) & 0x3f); cout += 3; } for (int i = 0; i < 39; i++) { flag[i] = flag[i] ^ key[i]; } printf("%s", flag); return 0;} |
阿里云助力开发者！2核2G 3M带宽不限流量！6.18限时价，开 发者可享99元/年，续费同价！
