-
-
[原创] 07wp
-
发表于: 2024-8-28 22:08 515
-
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 | # swap_code 就是401020开头的697个字节,如果加了软件断点就会不同 # 要求挖空部分 预处理 + swap bit 之后和KCTF...相等 # 剩下部分预处理之后和原来的main_code相等 # 最后一位是异或和,一定等于ret(c3) const_xor_key = [ 121 , 84 , 0 , 56 , 68 , 247 , 12 , 73 , 235 , 148 , 10 , 165 , 203 , 16 , 33 , 110 , 47 , 25 , 18 , 24 , 65 , 179 , 174 , 19 , 130 , 0 , 239 , 9 , 121 , 251 , 5 , 107 , 45 , 153 , 74 , 43 , 50 , 52 , 205 , 77 , 86 , 237 , 140 , 233 , 234 , 50 , 28 , 82 , 62 , 15 , 216 , 206 , 62 , 151 , 183 , 163 , 99 , 115 , 216 , 0 , 211 , 207 , 197 , 135 , 65 , 182 , 119 ] swap_code = bytes.fromhex( '83ec4ca10030400033c48944244853555657bb18344000' ) main_code = bytes.fromhex( '6810214000FF15DC3F40006800384000FF15D83F40006820214000FF15DC3F400068' '18344000FF15D83F400068D03F4000FF15D43F400083C414FF15A020400033C0C3' ) def xor_sum(_s): res = 0 for c in _s: res ^ = c return res def swap_bits(_b, _x, rev = False ): _x & = 7 if rev: hi = _b >> _x lo = _b << ( 8 - _x) else : lo = _b >> ( 8 - _x) hi = _b << _x hi & = 0xff lo & = 0xff return hi | lo user = b 'KCTF' # KCTF u_index = (xor_sum(user) & 0xf ) * 2 goal = list (main_code[:u_index] + b 'KCTF-2024-CRACK-SUCCESS' + main_code[u_index + 23 :]) for i in range (u_index, u_index + 23 ): goal[i] = swap_bits(goal[i], swap_code[i - u_index], True ) for i in range ( 67 ): goal[i] ^ = 0xc3 ^ const_xor_key[i] goal[ 66 ] = xor_sum(goal[: 66 ]) ^ 203 ^ 0xc3 print ( "Serial:" , bytes(goal). hex ()) # key = list(bytes.fromhex(bytes(goal).hex())) # # k_xor_sum = xor_sum(key) ^ 203 # # for i in range(67): # key[i] ^= k_xor_sum ^ const_xor_key[i] # # # for i in range(u_index, u_index + 23): # key[i] = swap_bits(key[i], swap_code[i - u_index]) # # print(bytes(key)) |
[培训]内核驱动高级班,冲击BAT一流互联网大厂工作,每周日13:00-18:00直播授课
赞赏
他的文章
看原图
赞赏
雪币:
留言: