-
-
[看雪CTF2016]第一题分析
-
发表于:
2016-11-1 19:13
3523
-
password: 1215pb8
第3位开始的4个字符
.text:004019F1 mov dword ptr [ebp+var_10], 350031h
.text:004019F8 mov dword ptr [ebp+var_10+4], 420050h
前2位
.text:00401810 mov ax, [ecx]
.text:00401813 cmp ax, [esi+ecx]
.text:00401817 jnz short loc_40185B
.text:00401819 add edx, 6
.text:0040181C add ecx, 2
.text:0040181F cmp edx, 39h
.text:00401822 jle short loc_401810
最后1位
.text:00401832 mov eax, [ebp+var_4C]
.text:00401835 movzx ecx, word ptr [edi+0Ch]
.text:00401839 add ecx, [eax]
.text:0040183B mov eax, [ebp+var_50]
.text:0040183E movzx eax, word ptr [eax]
.text:00401841 cmp eax, ecx
.text:00401843 jnz short loc_40185B
根据弹框提示，找到成功条件: wParam==40B
.text:004024FE movups xmm0, ds:xmmword_41DB98
.text:00402505 mov ax, ds:word_41DBC8
.text:0040250B push 96h
.text:00402510 movups xmmword ptr [ebp+var_11C], xmm0
.text:00402517 mov [ebp+var_EC], ax
.text:0040251E lea eax, [ebp+var_EA]
.text:00402524 movups xmm0, ds:xmmword_41DBA8
.text:0040252B push 0
.text:0040252D push eax
.text:0040252E movups [ebp+var_10C], xmm0
.text:00402535 movups xmm0, ds:xmmword_41DBB8
.text:0040253C movups [ebp+var_FC], xmm0
.text:00402543 call ZeroMemory
.text:00402548 add esp, 0Ch
.text:0040254B lea eax, [ebp+var_11C]
.text:00402551 push 0 ; uType
.text:00402553 push offset aSuccessed ; "Successed"
.text:00402558 push eax ; lpText
.text:00402559 push ebx ; hWnd
.text:0040255A call ds:MessageBoxW
搜索常数 40B, 找到发送消息的地方
.text:00401A32 push 40Bh
.text:00401A37 jmp short loc_401A40
.text:00401A39 ; ---------------------------------------------------------------------------
.text:00401A39
.text:00401A39 loc_401A39: ; CODE XREF: xx_401870+16Ej
.text:00401A39 ; xx_401870+17Dj ...
.text:00401A39 push 0 ; lParam
.text:00401A3B
.text:00401A3B loc_401A3B: ; CODE XREF: xx_401870+1C0j
.text:00401A3B push 40Ah ; wParam
.text:00401A40
.text:00401A40 loc_401A40: ; CODE XREF: xx_401870+1C7j
.text:00401A40 push 111h ; Msg
.text:00401A45 push dword ptr [ebx+4] ; hWnd
.text:00401A48 call ds:PostMessageW
然后往回溯, 静态看不懂时直接调试
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
