-
-
[原创] buuctf 红帽杯 easyRE
-
发表于: 2020-2-14 14:55
-
又是一个elf文件，虚拟机运行之后没有任何字符串提醒：
64位程序：
逆向查看，根据关键字符串定位到函数：
关键函数如图：
signed __int64 sub_4009C6()
{
__int64 v0; // rax
signed __int64 result; // rax
unsigned __int64 v2; // rax
__int64 v3; // rax
const __m128i *v4; // ST10_8
const __m128i *v5; // ST18_8
const __m128i *v6; // ST20_8
const __m128i *v7; // ST28_8
const __m128i *v8; // ST30_8
const __m128i *v9; // ST38_8
const __m128i *v10; // ST40_8
const __m128i *v11; // ST48_8
const __m128i *v12; // ST50_8
__int64 v13; // ST58_8
int i; // [rsp+Ch] [rbp-114h]
char v15; // [rsp+60h] [rbp-C0h]
char v16; // [rsp+61h] [rbp-BFh]
char v17; // [rsp+62h] [rbp-BEh]
char v18; // [rsp+63h] [rbp-BDh]
char v19; // [rsp+64h] [rbp-BCh]
char v20; // [rsp+65h] [rbp-BBh]
char v21; // [rsp+66h] [rbp-BAh]
char v22; // [rsp+67h] [rbp-B9h]
char v23; // [rsp+68h] [rbp-B8h]
char v24; // [rsp+69h] [rbp-B7h]
char v25; // [rsp+6Ah] [rbp-B6h]
char v26; // [rsp+6Bh] [rbp-B5h]
char v27; // [rsp+6Ch] [rbp-B4h]
char v28; // [rsp+6Dh] [rbp-B3h]
char v29; // [rsp+6Eh] [rbp-B2h]
char v30; // [rsp+6Fh] [rbp-B1h]
char v31; // [rsp+70h] [rbp-B0h]
char v32; // [rsp+71h] [rbp-AFh]
char v33; // [rsp+72h] [rbp-AEh]
char v34; // [rsp+73h] [rbp-ADh]
char v35; // [rsp+74h] [rbp-ACh]
char v36; // [rsp+75h] [rbp-ABh]
char v37; // [rsp+76h] [rbp-AAh]
char v38; // [rsp+77h] [rbp-A9h]
char v39; // [rsp+78h] [rbp-A8h]
char v40; // [rsp+79h] [rbp-A7h]
char v41; // [rsp+7Ah] [rbp-A6h]
char v42; // [rsp+7Bh] [rbp-A5h]
char v43; // [rsp+7Ch] [rbp-A4h]
char v44; // [rsp+7Dh] [rbp-A3h]
char v45; // [rsp+7Eh] [rbp-A2h]
char v46; // [rsp+7Fh] [rbp-A1h]
char v47; // [rsp+80h] [rbp-A0h]
char v48; // [rsp+81h] [rbp-9Fh]
char v49; // [rsp+82h] [rbp-9Eh]
char v50; // [rsp+83h] [rbp-9Dh]
char v51[32]; // [rsp+90h] [rbp-90h]
int v52; // [rsp+B0h] [rbp-70h]
char v53; // [rsp+B4h] [rbp-6Ch]
char v54; // [rsp+C0h] [rbp-60h]
char v55; // [rsp+E7h] [rbp-39h]
char v56; // [rsp+100h] [rbp-20h]
unsigned __int64 v57; // [rsp+108h] [rbp-18h]
v57 = __readfsqword(0x28u);
v15 = 73;
v16 = 111;
v17 = 100;
v18 = 108;
v19 = 62;
v20 = 81;
v21 = 110;
v22 = 98;
v23 = 40;
v24 = 111;
v25 = 99;
v26 = 121;
v27 = 127;
v28 = 121;
v29 = 46;
v30 = 105;
v31 = 127;
v32 = 100;
v33 = 96;
v34 = 51;
v35 = 119;
v36 = 125;
v37 = 119;
v38 = 101;
v39 = 107;
v40 = 57;
v41 = 123;
v42 = 105;
v43 = 121;
v44 = 61;
v45 = 126;
v46 = 121;
v47 = 76;
v48 = 64;
v49 = 69;
v50 = 67;
memset(v51, 0, sizeof(v51));
v52 = 0;
v53 = 0;
sub_4406E0(0LL, v51);
v53 = 0;
LODWORD(v0) = sub_424BA0(v51);
if ( v0 == 36 )
{
for ( i = 0; ; ++i )
{
LODWORD(v2) = sub_424BA0(v51);
if ( i >= v2 )
break;
if ( (v51[i] ^ i) != *(&v15 + i) ) //计算1位置
{
result = 0xFFFFFFFELL;
goto LABEL_13;
}
}
sub_410CC0("continue!");
memset(&v54, 0, 0x40uLL);
v56 = 0;
sub_4406E0(0LL, &v54);
v55 = 0;
LODWORD(v3) = sub_424BA0(&v54);
if ( v3 == 39 )
{
v4 = sub_400E44(&v54);
v5 = sub_400E44(v4);
v6 = sub_400E44(v5);
v7 = sub_400E44(v6);
v8 = sub_400E44(v7);
v9 = sub_400E44(v8);
v10 = sub_400E44(v9);
v11 = sub_400E44(v10);
v12 = sub_400E44(v11);
v13 = sub_400E44(v12);
if ( !sub_400360(v13, off_6CC090) )
{
sub_410CC0("You found me!!!");
sub_410CC0("bye bye~");
}
result = 0LL;
}
else
{
result = 0xFFFFFFFDLL;
}
}
else
{
result = 0xFFFFFFFFLL;
}
LABEL_13:
if ( __readfsqword(0x28u) != v57 )
sub_444020();
return result;
}signed __int64 sub_4009C6()
{
__int64 v0; // rax
signed __int64 result; // rax
unsigned __int64 v2; // rax
__int64 v3; // rax
const __m128i *v4; // ST10_8
const __m128i *v5; // ST18_8
const __m128i *v6; // ST20_8
const __m128i *v7; // ST28_8
const __m128i *v8; // ST30_8
const __m128i *v9; // ST38_8
const __m128i *v10; // ST40_8
const __m128i *v11; // ST48_8
const __m128i *v12; // ST50_8
__int64 v13; // ST58_8
int i; // [rsp+Ch] [rbp-114h]
char v15; // [rsp+60h] [rbp-C0h]
char v16; // [rsp+61h] [rbp-BFh]
char v17; // [rsp+62h] [rbp-BEh]
char v18; // [rsp+63h] [rbp-BDh]
char v19; // [rsp+64h] [rbp-BCh]
char v20; // [rsp+65h] [rbp-BBh]
char v21; // [rsp+66h] [rbp-BAh]
char v22; // [rsp+67h] [rbp-B9h]
char v23; // [rsp+68h] [rbp-B8h]
char v24; // [rsp+69h] [rbp-B7h]
char v25; // [rsp+6Ah] [rbp-B6h]
char v26; // [rsp+6Bh] [rbp-B5h]
char v27; // [rsp+6Ch] [rbp-B4h]
char v28; // [rsp+6Dh] [rbp-B3h]
char v29; // [rsp+6Eh] [rbp-B2h]
char v30; // [rsp+6Fh] [rbp-B1h]
char v31; // [rsp+70h] [rbp-B0h]
char v32; // [rsp+71h] [rbp-AFh]
char v33; // [rsp+72h] [rbp-AEh]
char v34; // [rsp+73h] [rbp-ADh]
char v35; // [rsp+74h] [rbp-ACh]
char v36; // [rsp+75h] [rbp-ABh]
char v37; // [rsp+76h] [rbp-AAh]
char v38; // [rsp+77h] [rbp-A9h]
char v39; // [rsp+78h] [rbp-A8h]
char v40; // [rsp+79h] [rbp-A7h]
char v41; // [rsp+7Ah] [rbp-A6h]
char v42; // [rsp+7Bh] [rbp-A5h]
char v43; // [rsp+7Ch] [rbp-A4h]
char v44; // [rsp+7Dh] [rbp-A3h]
char v45; // [rsp+7Eh] [rbp-A2h]
char v46; // [rsp+7Fh] [rbp-A1h]
char v47; // [rsp+80h] [rbp-A0h]
char v48; // [rsp+81h] [rbp-9Fh]
char v49; // [rsp+82h] [rbp-9Eh]
char v50; // [rsp+83h] [rbp-9Dh]
char v51[32]; // [rsp+90h] [rbp-90h]
int v52; // [rsp+B0h] [rbp-70h]
char v53; // [rsp+B4h] [rbp-6Ch]
char v54; // [rsp+C0h] [rbp-60h]
char v55; // [rsp+E7h] [rbp-39h]
char v56; // [rsp+100h] [rbp-20h]
unsigned __int64 v57; // [rsp+108h] [rbp-18h]
v57 = __readfsqword(0x28u);
v15 = 73;
v16 = 111;
v17 = 100;
v18 = 108;
v19 = 62;
v20 = 81;
v21 = 110;
v22 = 98;
v23 = 40;
v24 = 111;
v25 = 99;
v26 = 121;
v27 = 127;
v28 = 121;
v29 = 46;
v30 = 105;
v31 = 127;
v32 = 100;
v33 = 96;
v34 = 51;
v35 = 119;
v36 = 125;
v37 = 119;
v38 = 101;
v39 = 107;
v40 = 57;
v41 = 123;
v42 = 105;
v43 = 121;
v44 = 61;
v45 = 126;
v46 = 121;
v47 = 76;
v48 = 64;
v49 = 69;
v50 = 67;
memset(v51, 0, sizeof(v51));
v52 = 0;
v53 = 0;
sub_4406E0(0LL, v51);
v53 = 0;
LODWORD(v0) = sub_424BA0(v51);
if ( v0 == 36 )
{
for ( i = 0; ; ++i )
{
LODWORD(v2) = sub_424BA0(v51);
if ( i >= v2 )
break;
if ( (v51[i] ^ i) != *(&v15 + i) ) //计算1位置
{
result = 0xFFFFFFFELL;
goto LABEL_13;
}
}
sub_410CC0("continue!");
memset(&v54, 0, 0x40uLL);
v56 = 0;
sub_4406E0(0LL, &v54);
v55 = 0;
LODWORD(v3) = sub_424BA0(&v54);
if ( v3 == 39 )
{
v4 = sub_400E44(&v54);
v5 = sub_400E44(v4);
v6 = sub_400E44(v5);
v7 = sub_400E44(v6);
v8 = sub_400E44(v7);
v9 = sub_400E44(v8);
v10 = sub_400E44(v9);
v11 = sub_400E44(v10);
v12 = sub_400E44(v11);
v13 = sub_400E44(v12);
if ( !sub_400360(v13, off_6CC090) )
{
sub_410CC0("You found me!!!");
sub_410CC0("bye bye~");
}
result = 0LL;
}
else
{
result = 0xFFFFFFFDLL;
}
}
else
{
result = 0xFFFFFFFFLL;
}
LABEL_13:
if ( __readfsqword(0x28u) != v57 )
sub_444020();
return result;
}v15是一个已知数组，在计算1位置有一个按位置异或的循环，先把他解出来：
#include<iostream>
#include<string>
using namespace std;
int main()
{
char table1[36] = { 73,111,100,108,62,81,110,98,40,111,99,121,127,121,46,105,127,100,96,51,119,125,119,101,107,57,
123,105,121,61,126,121,76,64,69,67};
for (int i = 0; i < 36; i++)
{
table1[i] = table1[i] ^ i;
cout << table1[i];
}
return 0;
}结果：
#include<iostream>
#include<string>
using namespace std;
int main()
{
char table1[36] = { 73,111,100,108,62,81,110,98,40,111,99,121,127,121,46,105,127,100,96,51,119,125,119,101,107,57,
123,105,121,61,126,121,76,64,69,67};
for (int i = 0; i < 36; i++)
{
table1[i] = table1[i] ^ i;
cout << table1[i];
}
return 0;
}结果：
前四个字母是flag。
然后一个循环盲猜是flag之后的值，十次sub_400E44(base63)之后和off_6CC090字符串比较。
脚本解值：
import base64
def fun1(str2):
return str(base64.b64decode(str2.encode('utf-8')),'utf-8')
key = "Vm0wd2VHUXhTWGhpUm1SWVYwZDRWVll3Wkc5WFJsbDNXa1pPVlUxV2NIcFhhMk0xVmpKS1NHVkdXbFpOYmtKVVZtcEtTMUl5VGtsaVJtUk9ZV3hhZVZadGVHdFRNVTVYVW01T2FGSnRVbGhhVjNoaFZWWmtWMXBFVWxSTmJFcElWbTAxVDJGV1NuTlhia0pXWWxob1dGUnJXbXRXTVZaeVdrWm9hVlpyV1hwV1IzaGhXVmRHVjFOdVVsWmlhMHBZV1ZSR1lWZEdVbFZTYlhSWFRWWndNRlZ0TVc5VWJGcFZWbXR3VjJKSFVYZFdha1pXWlZaT2NtRkhhRk5pVjJoWVYxZDBhMVV3TlhOalJscFlZbGhTY1ZsclduZGxiR1J5VmxSR1ZXSlZjRWhaTUZKaFZqSktWVkZZYUZkV1JWcFlWV3BHYTFkWFRrZFRiV3hvVFVoQ1dsWXhaRFJpTWtsM1RVaG9hbEpYYUhOVmJUVkRZekZhY1ZKcmRGTk5Wa3A2VjJ0U1ExWlhTbFpqUldoYVRVWndkbFpxUmtwbGJVWklZVVprYUdFeGNHOVhXSEJIWkRGS2RGSnJhR2hTYXpWdlZGVm9RMlJzV25STldHUlZUVlpXTlZadE5VOVdiVXBJVld4c1dtSllUWGhXTUZwell6RmFkRkpzVWxOaVNFSktWa1phVTFFeFduUlRhMlJxVWxad1YxWnRlRXRXTVZaSFVsUnNVVlZVTURrPQ=="
for i in range(10):
key = fun1(key)
print (key)
https://bbs.pediy.com/thread-254172.htm 神tm是一个网址，提交不对。
[招生]科锐逆向工程师培训(2024年11月15日实地，远程教学同时开班, 第51期)
|
|
|---|---|
