sn长度为35
.text:004032F9 push WM_GETTEXT ; Msg
.text:004032FB push eax ; hWnd
.text:004032FC mov byte ptr [esp+45Ch+var_320], 0
.text:00403304 call ds:SendMessageA
.text:0040330A cmp eax, 23h
sn格式为每隔8位以L连接
.text:00403335 movsx edx, byte_428EE0[eax]
.text:0040333C cmp [esp+edx+44Ch+sn], 'L'
.text:00403344 jnz loc_4034E3
.text:0040334A cmp eax, 3
.text:0040334D jnz short loc_40339A
sn去除连接符后(32字节)base32解码(20字节, 记为BYTE ary1[20])
.text:004033A4 push ecx
.text:004033A5 lea edx, [esp+450h+var_30C]
.text:004033AC push edx
.text:004033AD lea eax, [esp+454h+var_2D0]
.text:004033B4 push eax
.text:004033B5 lea ecx, [esp+458h+var_434]
.text:004033B9 push ecx
.text:004033BA call base32_decode
计算cnbragon@pediyctf2016的keccak digest(记为DWORD ary2[8])
.text:004033C7 lea edx, [esp+44Ch+var_20C]
.text:004033CE push edx
.text:004033CF lea eax, [esp+450h+String]
.text:004033D6 push eax ; lpString
.text:004033D7 call ds:lstrlenA
.text:004033DD push eax
.text:004033DE lea edi, [esp+454h+String]
.text:004033E5 call keccak_digest
计算及验证
.text:004033F5
key[0] = rnd[0] + rnd[7];
key[1] = rnd[1] + rnd[6];
key[2] = rnd[2] + rnd[5];
v1 = rnd[7] * rnd[0] * rnd[6] * rnd[1] * rnd[5] * rnd[2] * rnd[4] * rnd[3];
key[3] = rnd[3] + rnd[4];
if ( ary1[4] == v1 )
{
v7 = camellia_set_key((int *)v11, key);
camellia_decrypt(ary1, v13, (int)v7);
...
}
计算sn
// cryptopp565
void test()
{
char sn[256] = { 0 };
unsigned int ary2[8] = { 0 };
word32 key[4] = { 0 };
word32 ary1[5] = { 0 };
Keccak_256 keccak;
keccak.CalculateDigest((byte *)ary2, (const byte *)"cnbragon@pediyctf2016", 21);
key[0] = ary2[0] + ary2[7];
key[1] = ary2[1] + ary2[6];
key[2] = ary2[2] + ary2[5];
key[3] = ary2[3] + ary2[4];
ary1[0] = ary2[4];
ary1[1] = ary2[5];
ary1[2] = ary2[6];
ary1[3] = ary2[7];
ary1[4] = ary2[0] * ary2[1] * ary2[2] * ary2[3] * ary2[4] * ary2[5] * ary2[6] * ary2[7];
FixedRoundsCipherFactory<CamelliaEncryption, CamelliaDecryption> cg(16);
apbt transE = cg.NewEncryption((byte *)key);
transE->ProcessBlock((byte *)ary1, (byte *)ary1);
Base32Encoder encoder;
encoder.IsolatedInitialize(MakeParameters(Name::EncodingLookupArray(), (const byte *)"ABCDEFGHJKMNPQRSTVWXYZ1234567890"));
encoder.Put((byte *)ary1, sizeof(ary1));
encoder.MessageEnd();
encoder.Get((byte *)sn, encoder.MaxRetrievable());
printf("%.8sL%.8sL%.8sL%.8s\n", sn, sn + 8, sn + 16, sn + 24);
// 981C2H7QLAZZ009EJL79BT2BSCLVTAFQQDB
}
[注意]传递专业知识、拓宽行业人脉——看雪讲师团队等你加入！
