[原创] 看雪·2025 KCTF 第七题 WriteUP-CTF对抗-看雪安全社区

[原创] 看雪·2025 KCTF 第七题 WriteUP
发表于: 2025-8-29 00:45 4790
[原创] 看雪·2025 KCTF 第七题 WriteUP

DNLINYJ
2025-8-29 00:45
4790
看着是 iOT 的题要跑虚拟机，实则 IDA 都能做出来（雾
IDA 直接加载完主程序，检验逻辑直接写在 main() 里面了，但是有一些不明所以的变量
 
直接复制粘贴到 VS Code 里面改变量名就舒服多了 －O－
直接看伪代码，可以推出 act=0, con=0, abort=1, cancel=1, enable=2, start=2, run=2, stop=3, reset=4, reboot=4
于是我们可以将伪代码中 string_to_code(x) 直接换成对应的数值
用 Python 写出求解器, 符合要求的解一共有 470 个（我勒个多解大王
p_argc = &argc;
printf("key:");
if ( fgets(s, 30, &Stdin) )
{
  v3 = strcspn(s, "\n"); // 去掉换行符 用\x00代替
  s[v3] = 0; 
  idx_1 = 0;
  // string_to_code("act"); 无意义
   
  // 将 key 的前 10 个字符 转为 数字 存入 v39[25] ~ v39[34]
  // d0=v39[25], d1=v39[26], ..., d9=v39[34]
  for ( strIdx = 0; s[strIdx] && strIdx <= 9; ++strIdx ) // 只处理前 10 个字符
  {
    if ( s[strIdx] <= 48 || s[strIdx] > 57 ) // 非 '1' ~ '9'
    {
      /*
      a ~ f  转 10 ~ 15
      其他字符转 16
      */
      if ( s[strIdx] == 97 ) // a
      {
        v39[idx_1++ + 25] = 10;
      }
      else if ( s[strIdx] == 98 ) // b
      {
        v39[idx_1++ + 25] = 11;
      }
      else if ( s[strIdx] == 99 ) // c
      {
        v39[idx_1++ + 25] = 12;
      }
      else if ( s[strIdx] == 100 ) // d
      {
        v39[idx_1++ + 25] = 13;
      }
      else if ( s[strIdx] == 101 ) // e
      {
        v39[idx_1++ + 25] = 14;
      }
      else if ( s[strIdx] == 102 ) // f
      {
        v39[idx_1++ + 25] = 15;
      }
      else
      {
        if ( s[strIdx] == 48 ) // '0'
          v39[idx_1 + 25] = 0;
        else // 其他字符兜底为 16
          v39[idx_1 + 25] = 16;
        ++idx_1;
      }
    }
    else // '1' ~ '9'
    {
      v39[idx_1++ + 25] = s[strIdx] - 48; // 转数字
    }
  }
p_argc = &argc;
printf("key:");
if ( fgets(s, 30, &Stdin) )
{
  v3 = strcspn(s, "\n"); // 去掉换行符 用\x00代替
  s[v3] = 0; 
  idx_1 = 0;
  // string_to_code("act"); 无意义
   
  // 将 key 的前 10 个字符 转为 数字 存入 v39[25] ~ v39[34]
  // d0=v39[25], d1=v39[26], ..., d9=v39[34]
  for ( strIdx = 0; s[strIdx] && strIdx <= 9; ++strIdx ) // 只处理前 10 个字符
  {
    if ( s[strIdx] <= 48 || s[strIdx] > 57 ) // 非 '1' ~ '9'
    {
      /*
      a ~ f  转 10 ~ 15
      其他字符转 16
      */
      if ( s[strIdx] == 97 ) // a
      {
        v39[idx_1++ + 25] = 10;
      }
      else if ( s[strIdx] == 98 ) // b
      {
        v39[idx_1++ + 25] = 11;
      }
      else if ( s[strIdx] == 99 ) // c
      {
        v39[idx_1++ + 25] = 12;
      }
      else if ( s[strIdx] == 100 ) // d
      {
        v39[idx_1++ + 25] = 13;
      }
      else if ( s[strIdx] == 101 ) // e
      {
        v39[idx_1++ + 25] = 14;
      }
      else if ( s[strIdx] == 102 ) // f
      {
        v39[idx_1++ + 25] = 15;
      }
      else
      {
        if ( s[strIdx] == 48 ) // '0'
          v39[idx_1 + 25] = 0;
        else // 其他字符兜底为 16
          v39[idx_1 + 25] = 16;
        ++idx_1;
      }
    }
    else // '1' ~ '9'
    {
      v39[idx_1++ + 25] = s[strIdx] - 48; // 转数字
    }
  }
col = 0;
next = 0;
v42 = 0;
v43 = 0;
v44 = 0;
v45 = 0;
v46 = 0;
v47 = 0;
for ( row = 0; row <= 4; ++row )
{
  for ( col = 0; (int)col <= 4; ++col )
  {
    v4 = 0;
    if ( v4 == row && (v5 = 3, v5 == col) ) // (0,3)
    {
      v39[5 * row + col] = v39[next++ + 25]; // d0
      *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 0
    }
    else
    {
      v6 = 1;
      if ( v6 == row && (v7 = 0, v7 == col) ) // (1,0)
      {
        v39[5 * row + col] = v39[next++ + 25]; // d1
        *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 0
      }
      else
      {
        v8 = 1;
        if ( v8 == row && (v9 = 2, v9 == col) ) // (1,2)
        {
          v39[5 * row + col] = v39[next++ + 25]; // d2
          *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 1
          *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 0
        }
        else
        {
          v10 = 2;
          if ( v10 == row && (v11 = 1, v11 == col) ) // (2,1)
          {
            v39[5 * row + col] = v39[next++ + 25]; // d3
            *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 2
            *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 1
          }
          else
          {
            v12 = 2;
            if ( v12 == row && (v13 = 3, v13 == col) ) // (2,3)
            {
              v39[5 * row + col] = v39[next++ + 25]; // d4
              *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 1
              *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 0
            }
            else
            {
              v14 = 3;
              if ( v14 == row && (v15 = 0, v15 == col) ) // (3,0)
              {
                v39[5 * row + col] = v39[next++ + 25]; // d5
                *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 0
              }
              else if ( row == 3 && col == 2 ) // (3,2) 特例 row==3 && col==2（直接写死） 
              {
                v39[5 * row + 2] = v39[next++ + 25]; // d6
                *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 2
                *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 1
              }
              else
              {
                v16 = 3;
                if ( v16 == row && (v17 = 3, v17 == col) ) // (3,3)
                {
                  v39[5 * row + col] = v39[next++ + 25]; // d7
                  *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 1
                  *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 2
                }
                else
                {
                  v18 = 3;
                  if ( v18 == row && (v19 = 4, v19 == col) ) // (3,4)
                  {
                    v39[5 * row + col] = v39[next++ + 25]; // d8
                    *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 2
                  }
                  else
                  {
                    v20 = 4;
                    if ( v20 == row && (v21 = 2, v21 == col) ) // (4,2)
                    {
                      v39[5 * row + col] = v39[next++ + 25]; // d9
                      *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 2
                    }
                    else // 其他位置 全部设为 row + col
                    {
                      v39[5 * row + col] = row + col;
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
 
    /* 5x5 矩阵 v39
    [ 0, 1, 2, d0, 4 ]
    [ d1, 2, d2, 4, 5 ]
    [ 2, d3, 4, d4, 6 ]
    [ d5, 4, d6, d7, d8 ]
    [ 4, 5, d9, 7, 8 ]
    */
 
    /* v38 + 272 处存了 15 个数值 (5 行 3 列)
    v42 -> 第一行 d0 d2 d3
    v43 -> 第二行 d1 d3 d6 
    v44 -> 第三行 d2 d4 d8
    v45 -> 第四行 d4 d7 d9
    v46 -> 第五行 d5 d6 d7
    */
col = 0;
next = 0;
v42 = 0;
v43 = 0;
v44 = 0;
v45 = 0;
v46 = 0;
v47 = 0;
for ( row = 0; row <= 4; ++row )
{
  for ( col = 0; (int)col <= 4; ++col )
  {
    v4 = 0;
    if ( v4 == row && (v5 = 3, v5 == col) ) // (0,3)
    {
      v39[5 * row + col] = v39[next++ + 25]; // d0
      *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 0
    }
    else
    {
      v6 = 1;
      if ( v6 == row && (v7 = 0, v7 == col) ) // (1,0)
      {
        v39[5 * row + col] = v39[next++ + 25]; // d1
        *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 0
      }
      else
      {
        v8 = 1;
        if ( v8 == row && (v9 = 2, v9 == col) ) // (1,2)
        {
          v39[5 * row + col] = v39[next++ + 25]; // d2
          *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 1
          *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 0
        }
        else
        {
          v10 = 2;
          if ( v10 == row && (v11 = 1, v11 == col) ) // (2,1)
          {
            v39[5 * row + col] = v39[next++ + 25]; // d3
            *(_DWORD *)&v38[4 * v42++ + 272] = v39[5 * row + col]; // v42 = 2
            *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 1
          }
          else
          {
            v12 = 2;
            if ( v12 == row && (v13 = 3, v13 == col) ) // (2,3)
            {
              v39[5 * row + col] = v39[next++ + 25]; // d4
              *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 1
              *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 0
            }
            else
            {
              v14 = 3;
              if ( v14 == row && (v15 = 0, v15 == col) ) // (3,0)
              {
                v39[5 * row + col] = v39[next++ + 25]; // d5
                *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 0
              }
              else if ( row == 3 && col == 2 ) // (3,2) 特例 row==3 && col==2（直接写死） 
              {
                v39[5 * row + 2] = v39[next++ + 25]; // d6
                *(_DWORD *)&v38[4 * v43++ + 284] = v39[5 * row + col]; // v43 = 2
                *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 1
              }
              else
              {
                v16 = 3;
                if ( v16 == row && (v17 = 3, v17 == col) ) // (3,3)
                {
                  v39[5 * row + col] = v39[next++ + 25]; // d7
                  *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 1
                  *(_DWORD *)&v38[4 * v46++ + 320] = v39[5 * row + col]; // v46 = 2
                }
                else
                {
                  v18 = 3;
                  if ( v18 == row && (v19 = 4, v19 == col) ) // (3,4)
                  {
                    v39[5 * row + col] = v39[next++ + 25]; // d8
                    *(_DWORD *)&v38[4 * v44++ + 296] = v39[5 * row + col]; // v44 = 2
                  }
                  else
                  {
                    v20 = 4;
                    if ( v20 == row && (v21 = 2, v21 == col) ) // (4,2)
                    {
                      v39[5 * row + col] = v39[next++ + 25]; // d9
                      *(_DWORD *)&v38[4 * v45++ + 308] = v39[5 * row + col]; // v45 = 2
                    }
                    else // 其他位置 全部设为 row + col
                    {
                      v39[5 * row + col] = row + col;
                    }
                  }
                }
              }
            }
          }
        }
      }
    }
 
    /* 5x5 矩阵 v39
    [ 0, 1, 2, d0, 4 ]
    [ d1, 2, d2, 4, 5 ]
    [ 2, d3, 4, d4, 6 ]
    [ d5, 4, d6, d7, d8 ]
    [ 4, 5, d9, 7, 8 ]
    */
 
    /* v38 + 272 处存了 15 个数值 (5 行 3 列)
    v42 -> 第一行 d0 d2 d3
    v43 -> 第二行 d1 d3 d6 
    v44 -> 第三行 d2 d4 d8
    v45 -> 第四行 d4 d7 d9
    v46 -> 第五行 d5 d6 d7
    */
  v22 = 4;
  if ( v22 == row ) // row==4
    v47 += v39[5 * row + col];
}
if ( stat("/etc/rc.d", &buf) ) // 该目录在 QNX 下是存在的 所以不会给 v47 额外加值
  v47 += *(_DWORD *)&v38[12 * row + 272 + 4 * col]; // row = 0 ~ 4, col=0
   
// v47 最终等于 4 + 5 + 7 + 8 + d9 = 24 + d9
  v22 = 4;
  if ( v22 == row ) // row==4
    v47 += v39[5 * row + col];
}
if ( stat("/etc/rc.d", &buf) ) // 该目录在 QNX 下是存在的 所以不会给 v47 额外加值
  v47 += *(_DWORD *)&v38[12 * row + 272 + 4 * col]; // row = 0 ~ 4, col=0
   
// v47 最终等于 4 + 5 + 7 + 8 + d9 = 24 + d9
v48 = 1; // 检查成功flag
// 取 v38 + 272 的行和 应该都为 34
for ( row = 0; row <= 4; ++row ) // row 对应 v42 ~ v46
{
  v51 = 0;
  for ( col = 0; (int)col <= 2; ++col ) // 每行 3 个数值
  {
    v51 += *(_DWORD *)&v38[12 * row + 272 + 4 * col];
    v51 -= 5;
  }
  if ( v51 != 19 ) // 每一行的和-15 应该都为 19 -> 每一行的和应该都为 34
    v48 = 0;
}
/*
可得等式
d0 + d2 + d3 = 34
d1 + d3 + d6 = 34
d2 + d4 + d8 = 34
d4 + d7 + d9 = 34
d5 + d6 + d7 = 34
*/
v48 = 1; // 检查成功flag
// 取 v38 + 272 的行和 应该都为 34
for ( row = 0; row <= 4; ++row ) // row 对应 v42 ~ v46
{
  v51 = 0;
  for ( col = 0; (int)col <= 2; ++col ) // 每行 3 个数值
  {
    v51 += *(_DWORD *)&v38[12 * row + 272 + 4 * col];
    v51 -= 5;
  }
  if ( v51 != 19 ) // 每一行的和-15 应该都为 19 -> 每一行的和应该都为 34
    v48 = 0;
}
/*
可得等式
d0 + d2 + d3 = 34
d1 + d3 + d6 = 34
d2 + d4 + d8 = 34
d4 + d7 + d9 = 34
d5 + d6 + d7 = 34
*/
// d29K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2I4L8Y4S2Q4x3X3g2U0L8$3#2Q4x3V1k6V1k6i4k6W2L8r3!0H3k6i4u0K6i4K6u0r3k6r3!0U0M7#2)9J5c8U0N6Q4x3X3f1H3i4K6u0W2x3q4)9J5c8X3y4G2L8g2)9J5k6i4q4F1P5q4)9J5k6h3c8G2j5#2)9J5k6h3&6W2N6i4c8J5K9h3&6G2i4K6u0W2M7s2u0G2k6#2)9J5c8Y4c8G2M7r3W2U0i4K6u0r3M7s2u0G2j5$3g2K6M7#2)9#2k6V1c8o6e0f1c8Q4y4h3k6b7f1V1!0o6i4K6g2X3d9f1&6r3e0#2)9J5k6h3S2@1L8h3H3`.
memset(v38, 0, 0x110u);                 // 在 QNX 这两步成功 所以不会给 v47 额外 +1
v49 = open("/proc/self/as", (int)"r");      
if ( v49 == -1 )
  ++v47;
if ( devctl(v49, 0x41100801, v38, 272, 0) ) // 0x41100801 -> DCMD_PROC_INFO
  ++v47;
// b24K9s2c8@1M7s2y4Q4x3@1q4Q4x3V1k6Q4x3V1k6%4N6%4N6Q4x3X3g2I4L8Y4S2Q4x3X3g2U0L8$3#2Q4x3V1k6V1k6i4k6W2L8r3!0H3k6i4u0K6i4K6u0r3k6r3!0U0M7#2)9J5c8U0N6Q4x3X3f1H3i4K6u0W2x3q4)9J5c8X3y4G2L8g2)9J5k6i4q4F1P5q4)9J5k6h3c8G2j5#2)9J5k6h3&6W2N6i4c8J5K9h3&6G2i4K6u0W2M7s2u0G2k6#2)9J5c8Y4c8G2M7r3W2U0i4K6u0r3M7s2u0G2j5$3g2K6M7#2)9#2k6V1c8o6e0f1c8Q4y4h3k6b7f1V1!0o6i4K6g2X3d9f1&6r3e0#2)9J5k6h3S2@1L8h3H3`.
memset(v38, 0, 0x110u);                 // 在 QNX 这两步成功 所以不会给 v47 额外 +1
v49 = open("/proc/self/as", (int)"r");      
if ( v49 == -1 )
  ++v47;
if ( devctl(v49, 0x41100801, v38, 272, 0) ) // 0x41100801 -> DCMD_PROC_INFO
  ++v47;
v23 = v47;
v24 = v39[0] + v39[3] * v39[2] * v39[1] * v39[4] + (v38[8] & 0x80); // 0 + d0 * 2 * 1 * 4 = 8 * d0 | (v38[8]&0x80) 在 QNX 是 0
v25 = 4 + 1; // 5
// if ( v23 != v24 + v25 * ~4 - 9 ) 
// if ( v47 != v24 + 5 * ~4 - 9 )  // 5 * ~4 - 9 = 5*(-5) - 9 = -34
if ( v47 != v24 - 34 )  // 5 * ~4 - 9 = 5*(-5) - 9 = -34
  v48 = 0;              // v47 应为 8*d0 - 34
                        // 前文已知 v47 = 24 + d9
                        // 24 + d9 = 8*d0 - 34 -> 8*d0 - d9 = 58
                        // 又因为 d0,d9 范围均为 0 ~ 15 | 暴力求解得 (d0,d9)∈{(8,6), (9,14)}
v23 = v47;
v24 = v39[0] + v39[3] * v39[2] * v39[1] * v39[4] + (v38[8] & 0x80); // 0 + d0 * 2 * 1 * 4 = 8 * d0 | (v38[8]&0x80) 在 QNX 是 0
v25 = 4 + 1; // 5
// if ( v23 != v24 + v25 * ~4 - 9 ) 
// if ( v47 != v24 + 5 * ~4 - 9 )  // 5 * ~4 - 9 = 5*(-5) - 9 = -34
if ( v47 != v24 - 34 )  // 5 * ~4 - 9 = 5*(-5) - 9 = -34
  v48 = 0;              // v47 应为 8*d0 - 34
                        // 前文已知 v47 = 24 + d9
                        // 24 + d9 = 8*d0 - 34 -> 8*d0 - d9 = 58
                        // 又因为 d0,d9 范围均为 0 ~ 15 | 暴力求解得 (d0,d9)∈{(8,6), (9,14)}
// 末 4 位 'a'/'s' 
v50 = 123;
v26 = 2 * 4;
if ( s[v26 + 2] == 97 ) // s[10]: 'a' +45 / 's' -45
  v50 += 45;
v27 = 2 * 4;
if ( s[v27 + 2] == 115 )
  v50 -= 45;
v28 = 2 * 4;
if ( s[v28 + 3] == 97 ) // s[11]: 'a' +67 / 's' -67
  v50 += 67;
v29 = 2 * 4;
if ( s[v29 + 3] == 115 )
  v50 -= 67;
v30 = 2 * 4;
if ( s[v30 + 4] == 97 ) // s[12]: 'a'  +8 / 's'  -8
  v50 += 8;
v31 = 2 * 4;
if ( s[v31 + 4] == 115 )
  v50 -= 8;
v32 = 3 * 4;
if ( s[v32 + 1] == 97 ) // s[13]: 'a'  +9 / 's'  -9
  v50 += 9;
v33 = 3 * 4;
if ( s[v33 + 1] == 115 )
  v50 -= 9;
v34 = 4;
v35 = 1;
if ( 20 * (v34 + v35) != v50 ) // 100 != v50 -> v50 应为 100
                               // 100 = 123 + 45 - 67 + 8 -9 
                               // 即 s[10]='a', s[11]='s', s[12]='a', s[13]='s'
    v48 = 0;
// 末 4 位 'a'/'s' 
v50 = 123;
v26 = 2 * 4;
if ( s[v26 + 2] == 97 ) // s[10]: 'a' +45 / 's' -45
  v50 += 45;
v27 = 2 * 4;
if ( s[v27 + 2] == 115 )
  v50 -= 45;
v28 = 2 * 4;
if ( s[v28 + 3] == 97 ) // s[11]: 'a' +67 / 's' -67
  v50 += 67;
v29 = 2 * 4;
if ( s[v29 + 3] == 115 )
  v50 -= 67;
v30 = 2 * 4;
if ( s[v30 + 4] == 97 ) // s[12]: 'a'  +8 / 's'  -8
  v50 += 8;
v31 = 2 * 4;
if ( s[v31 + 4] == 115 )
  v50 -= 8;
v32 = 3 * 4;
if ( s[v32 + 1] == 97 ) // s[13]: 'a'  +9 / 's'  -9
  v50 += 9;
v33 = 3 * 4;
if ( s[v33 + 1] == 115 )
  v50 -= 9;
v34 = 4;
v35 = 1;
if ( 20 * (v34 + v35) != v50 ) // 100 != v50 -> v50 应为 100
                               // 100 = 123 + 45 - 67 + 8 -9 
                               // 即 s[10]='a', s[11]='s', s[12]='a', s[13]='s'
    v48 = 0;
if ( v48 == 1 && strlen(s) <= 0xE ) // key 长度 <= 14 -> key 结构为 10 个有效字符 + "asas"
  puts("ok");
else
  puts("no");
if ( v48 == 1 && strlen(s) <= 0xE ) // key 长度 <= 14 -> key 结构为 10 个有效字符 + "asas"
  puts("ok");
else
  puts("no");
8fbfdf4fa6asas OK
8ebfde5fa6asas OK
8dbfdd6fa6asas OK
8cbfdc7fa6asas OK
8bbfdb8fa6asas OK
8abfda9fa6asas OK
89bfd9afa6asas OK
88bfd8bfa6asas OK
87bfd7cfa6asas OK
86bfd6dfa6asas OK
85bfd5efa6asas OK
84bfd4ffa6asas OK
8ebfef5e96asas OK
8dbfee6e96asas OK
8cbfed7e96asas OK
8bbfec8e96asas OK
8abfeb9e96asas OK
89bfeaae96asas OK
88bfe9be96asas OK
87bfe8ce96asas OK
86bfe7de96asas OK
85bfe6ee96asas OK
84bfe5fe96asas OK
8dbfff6d86asas OK
8cbffe7d86asas OK
8bbffd8d86asas OK
8abffc9d86asas OK
89bffbad86asas OK
88bffabd86asas OK
87bff9cd86asas OK
86bff8dd86asas OK
85bff7ed86asas OK
84bff6fd86asas OK
8fcede5f96asas OK
8ecedd6f96asas OK
8dcedc7f96asas OK
8ccedb8f96asas OK
8bceda9f96asas OK
8aced9af96asas OK
89ced8bf96asas OK
88ced7cf96asas OK
87ced6df96asas OK
86ced5ef96asas OK
85ced4ff96asas OK
8fceef5e86asas OK
8eceee6e86asas OK
8dceed7e86asas OK
8cceec8e86asas OK
8bceeb9e86asas OK
8aceeaae86asas OK
89cee9be86asas OK
88cee8ce86asas OK
87cee7de86asas OK
86cee6ee86asas OK
85cee5fe86asas OK
8eceff6d76asas OK
8dcefe7d76asas OK
8ccefd8d76asas OK
8bcefc9d76asas OK
8acefbad76asas OK
89cefabd76asas OK
88cef9cd76asas OK
87cef8dd76asas OK
86cef7ed76asas OK
85cef6fd76asas OK
8fdddd6f86asas OK
8edddc7f86asas OK
8ddddb8f86asas OK
8cddda9f86asas OK
8bddd9af86asas OK
8addd8bf86asas OK
89ddd7cf86asas OK
88ddd6df86asas OK
87ddd5ef86asas OK
86ddd4ff86asas OK
8fddee6e76asas OK
8edded7e76asas OK
8dddec8e76asas OK
8cddeb9e76asas OK
8bddeaae76asas OK
8adde9be76asas OK
89dde8ce76asas OK
88dde7de76asas OK
87dde6ee76asas OK
86dde5fe76asas OK
8fddff6d66asas OK
8eddfe7d66asas OK
8dddfd8d66asas OK
8cddfc9d66asas OK
8bddfbad66asas OK
8addfabd66asas OK
89ddf9cd66asas OK
88ddf8dd66asas OK
87ddf7ed66asas OK
86ddf6fd66asas OK
8fecdc7f76asas OK
8eecdb8f76asas OK
8decda9f76asas OK
8cecd9af76asas OK
8becd8bf76asas OK
8aecd7cf76asas OK
89ecd6df76asas OK
88ecd5ef76asas OK
87ecd4ff76asas OK
8feced7e66asas OK
8eecec8e66asas OK
8deceb9e66asas OK
8ceceaae66asas OK
8bece9be66asas OK
8aece8ce66asas OK
89ece7de66asas OK
88ece6ee66asas OK
87ece5fe66asas OK
8fecfe7d56asas OK
8eecfd8d56asas OK
8decfc9d56asas OK
8cecfbad56asas OK
8becfabd56asas OK
8aecf9cd56asas OK
89ecf8dd56asas OK
88ecf7ed56asas OK
87ecf6fd56asas OK
8ffbdb8f66asas OK
8efbda9f66asas OK
8dfbd9af66asas OK
8cfbd8bf66asas OK
8bfbd7cf66asas OK
8afbd6df66asas OK
89fbd5ef66asas OK
88fbd4ff66asas OK
8ffbec8e56asas OK
8efbeb9e56asas OK
8dfbeaae56asas OK
8cfbe9be56asas OK
8bfbe8ce56asas OK
8afbe7de56asas OK
89fbe6ee56asas OK
88fbe5fe56asas OK
8ffbfd8d46asas OK
8efbfc9d46asas OK
8dfbfbad46asas OK
8cfbfabd46asas OK
8bfbf9cd46asas OK
8afbf8dd46asas OK
89fbf7ed46asas OK
88fbf6fd46asas OK
9baf9f8bfeasas OK
9aaf9e9bfeasas OK
99af9dabfeasas OK
98af9cbbfeasas OK
97af9bcbfeasas OK
96af9adbfeasas OK
95af99ebfeasas OK
94af98fbfeasas OK
9aafaf9aeeasas OK
99afaeaaeeasas OK
98afadbaeeasas OK
97afaccaeeasas OK
96afabdaeeasas OK
95afaaeaeeasas OK
94afa9faeeasas OK
99afbfa9deasas OK
98afbeb9deasas OK
97afbdc9deasas OK
96afbcd9deasas OK
95afbbe9deasas OK
94afbaf9deasas OK
98afcfb8ceasas OK
97afcec8ceasas OK
96afcdd8ceasas OK
95afcce8ceasas OK
94afcbf8ceasas OK
97afdfc7beasas OK
96afded7beasas OK
95afdde7beasas OK
94afdcf7beasas OK
96afefd6aeasas OK
95afeee6aeasas OK
94afedf6aeasas OK
95afffe59easas OK
94affef59easas OK
9dbe8f7cfeasas OK
9cbe8e8cfeasas OK
9bbe8d9cfeasas OK
9abe8cacfeasas OK
99be8bbcfeasas OK
98be8accfeasas OK
97be89dcfeasas OK
96be88ecfeasas OK
95be87fcfeasas OK
9cbe9f8beeasas OK
9bbe9e9beeasas OK
9abe9dabeeasas OK
99be9cbbeeasas OK
98be9bcbeeasas OK
97be9adbeeasas OK
96be99ebeeasas OK
95be98fbeeasas OK
9bbeaf9adeasas OK
9abeaeaadeasas OK
99beadbadeasas OK
98beaccadeasas OK
97beabdadeasas OK
96beaaeadeasas OK
95bea9fadeasas OK
9abebfa9ceasas OK
99bebeb9ceasas OK
98bebdc9ceasas OK
97bebcd9ceasas OK
96bebbe9ceasas OK
95bebaf9ceasas OK
99becfb8beasas OK
98becec8beasas OK
97becdd8beasas OK
96becce8beasas OK
95becbf8beasas OK
98bedfc7aeasas OK
97beded7aeasas OK
96bedde7aeasas OK
95bedcf7aeasas OK
97beefd69easas OK
96beeee69easas OK
95beedf69easas OK
96beffe58easas OK
95befef58easas OK
9fcd7f6dfeasas OK
9ecd7e7dfeasas OK
9dcd7d8dfeasas OK
9ccd7c9dfeasas OK
9bcd7badfeasas OK
9acd7abdfeasas OK
99cd79cdfeasas OK
98cd78ddfeasas OK
97cd77edfeasas OK
96cd76fdfeasas OK
9ecd8f7ceeasas OK
9dcd8e8ceeasas OK
9ccd8d9ceeasas OK
9bcd8caceeasas OK
9acd8bbceeasas OK
99cd8acceeasas OK
98cd89dceeasas OK
97cd88eceeasas OK
96cd87fceeasas OK
9dcd9f8bdeasas OK
9ccd9e9bdeasas OK
9bcd9dabdeasas OK
9acd9cbbdeasas OK
99cd9bcbdeasas OK
98cd9adbdeasas OK
97cd99ebdeasas OK
96cd98fbdeasas OK
9ccdaf9aceasas OK
9bcdaeaaceasas OK
9acdadbaceasas OK
99cdaccaceasas OK
98cdabdaceasas OK
97cdaaeaceasas OK
96cda9faceasas OK
9bcdbfa9beasas OK
9acdbeb9beasas OK
99cdbdc9beasas OK
98cdbcd9beasas OK
97cdbbe9beasas OK
96cdbaf9beasas OK
9acdcfb8aeasas OK
99cdcec8aeasas OK
98cdcdd8aeasas OK
97cdcce8aeasas OK
96cdcbf8aeasas OK
99cddfc79easas OK
98cdded79easas OK
97cddde79easas OK
96cddcf79easas OK
98cdefd68easas OK
97cdeee68easas OK
96cdedf68easas OK
97cdffe57easas OK
96cdfef57easas OK
9fdc6d7efeasas OK
9edc6c8efeasas OK
9ddc6b9efeasas OK
9cdc6aaefeasas OK
9bdc69befeasas OK
9adc68cefeasas OK
99dc67defeasas OK
98dc66eefeasas OK
97dc65fefeasas OK
9fdc7e7deeasas OK
9edc7d8deeasas OK
9ddc7c9deeasas OK
9cdc7badeeasas OK
9bdc7abdeeasas OK
9adc79cdeeasas OK
99dc78ddeeasas OK
98dc77edeeasas OK
97dc76fdeeasas OK
9fdc8f7cdeasas OK
9edc8e8cdeasas OK
9ddc8d9cdeasas OK
9cdc8cacdeasas OK
9bdc8bbcdeasas OK
9adc8accdeasas OK
99dc89dcdeasas OK
98dc88ecdeasas OK
97dc87fcdeasas OK
9edc9f8bceasas OK
9ddc9e9bceasas OK
9cdc9dabceasas OK
9bdc9cbbceasas OK
9adc9bcbceasas OK
99dc9adbceasas OK
98dc99ebceasas OK
97dc98fbceasas OK
9ddcaf9abeasas OK
9cdcaeaabeasas OK
9bdcadbabeasas OK
9adcaccabeasas OK
99dcabdabeasas OK
98dcaaeabeasas OK
97dca9fabeasas OK
9cdcbfa9aeasas OK
9bdcbeb9aeasas OK
9adcbdc9aeasas OK
99dcbcd9aeasas OK
98dcbbe9aeasas OK
97dcbaf9aeasas OK
9bdccfb89easas OK
9adccec89easas OK
99dccdd89easas OK
98dccce89easas OK
97dccbf89easas OK
9adcdfc78easas OK
99dcded78easas OK
98dcdde78easas OK
97dcdcf78easas OK
99dcefd67easas OK
98dceee67easas OK
97dcedf67easas OK
98dcffe56easas OK
97dcfef56easas OK
9feb5b8ffeasas OK
9eeb5a9ffeasas OK
9deb59affeasas OK
9ceb58bffeasas OK
9beb57cffeasas OK
9aeb56dffeasas OK
99eb55effeasas OK
98eb54fffeasas OK
9feb6c8eeeasas OK
9eeb6b9eeeasas OK
9deb6aaeeeasas OK
9ceb69beeeasas OK
9beb68ceeeasas OK
9aeb67deeeasas OK
99eb66eeeeasas OK
98eb65feeeasas OK
9feb7d8ddeasas OK
9eeb7c9ddeasas OK
9deb7baddeasas OK
9ceb7abddeasas OK
9beb79cddeasas OK
9aeb78dddeasas OK
99eb77eddeasas OK
98eb76fddeasas OK
9feb8e8cceasas OK
9eeb8d9cceasas OK
9deb8cacceasas OK
9ceb8bbcceasas OK
9beb8accceasas OK
9aeb89dcceasas OK
99eb88ecceasas OK
98eb87fcceasas OK
9feb9f8bbeasas OK
9eeb9e9bbeasas OK
9deb9dabbeasas OK
9ceb9cbbbeasas OK
9beb9bcbbeasas OK
9aeb9adbbeasas OK
99eb99ebbeasas OK
98eb98fbbeasas OK
9eebaf9aaeasas OK
9debaeaaaeasas OK
9cebadbaaeasas OK
9bebaccaaeasas OK
9aebabdaaeasas OK
99ebaaeaaeasas OK
98eba9faaeasas OK
9debbfa99easas OK
9cebbeb99easas OK
9bebbdc99easas OK
9aebbcd99easas OK
99ebbbe99easas OK
98ebbaf99easas OK
9cebcfb88easas OK
9bebcec88easas OK
9aebcdd88easas OK
99ebcce88easas OK
98ebcbf88easas OK
9bebdfc77easas OK
9aebded77easas OK
99ebdde77easas OK
98ebdcf77easas OK
9aebefd66easas OK
99ebeee66easas OK
98ebedf66easas OK
99ebffe55easas OK
98ebfef55easas OK
9ffa5a9feeasas OK
9efa59afeeasas OK
9dfa58bfeeasas OK
9cfa57cfeeasas OK
9bfa56dfeeasas OK
9afa55efeeasas OK
99fa54ffeeasas OK
9ffa6b9edeasas OK
9efa6aaedeasas OK
9dfa69bedeasas OK
9cfa68cedeasas OK
9bfa67dedeasas OK
9afa66eedeasas OK
99fa65fedeasas OK
9ffa7c9dceasas OK
9efa7badceasas OK
9dfa7abdceasas OK
9cfa79cdceasas OK
9bfa78ddceasas OK
9afa77edceasas OK
99fa76fdceasas OK
9ffa8d9cbeasas OK
9efa8cacbeasas OK
9dfa8bbcbeasas OK
9cfa8accbeasas OK
9bfa89dcbeasas OK
9afa88ecbeasas OK
99fa87fcbeasas OK
9ffa9e9baeasas OK
9efa9dabaeasas OK
9dfa9cbbaeasas OK
9cfa9bcbaeasas OK
9bfa9adbaeasas OK
9afa99ebaeasas OK
99fa98fbaeasas OK
9ffaaf9a9easas OK
9efaaeaa9easas OK
9dfaadba9easas OK
9cfaacca9easas OK
9bfaabda9easas OK
9afaaaea9easas OK
99faa9fa9easas OK
9efabfa98easas OK
9dfabeb98easas OK
9cfabdc98easas OK
9bfabcd98easas OK
9afabbe98easas OK
99fabaf98easas OK
9dfacfb87easas OK
9cfacec87easas OK
9bfacdd87easas OK
9afacce87easas OK
99facbf87easas OK
9cfadfc76easas OK
9bfaded76easas OK
9afadde76easas OK
99fadcf76easas OK
9bfaefd65easas OK
9afaeee65easas OK
99faedf65easas OK
9afaffe54easas OK
99fafef54easas OK
总共Key数: 470
8fbfdf4fa6asas OK
8ebfde5fa6asas OK
8dbfdd6fa6asas OK
8cbfdc7fa6asas OK
8bbfdb8fa6asas OK
8abfda9fa6asas OK
89bfd9afa6asas OK
88bfd8bfa6asas OK
87bfd7cfa6asas OK
86bfd6dfa6asas OK
85bfd5efa6asas OK
84bfd4ffa6asas OK
8ebfef5e96asas OK
8dbfee6e96asas OK
8cbfed7e96asas OK
8bbfec8e96asas OK
8abfeb9e96asas OK
89bfeaae96asas OK
88bfe9be96asas OK
87bfe8ce96asas OK
86bfe7de96asas OK
85bfe6ee96asas OK
84bfe5fe96asas OK
8dbfff6d86asas OK
8cbffe7d86asas OK
8bbffd8d86asas OK
8abffc9d86asas OK
89bffbad86asas OK
88bffabd86asas OK
87bff9cd86asas OK
86bff8dd86asas OK
85bff7ed86asas OK
84bff6fd86asas OK
8fcede5f96asas OK
8ecedd6f96asas OK
8dcedc7f96asas OK
8ccedb8f96asas OK
8bceda9f96asas OK
8aced9af96asas OK
89ced8bf96asas OK
88ced7cf96asas OK
87ced6df96asas OK
86ced5ef96asas OK
85ced4ff96asas OK
8fceef5e86asas OK
8eceee6e86asas OK
8dceed7e86asas OK
8cceec8e86asas OK
8bceeb9e86asas OK
8aceeaae86asas OK
89cee9be86asas OK
88cee8ce86asas OK
87cee7de86asas OK
86cee6ee86asas OK
85cee5fe86asas OK
8eceff6d76asas OK
8dcefe7d76asas OK
8ccefd8d76asas OK
8bcefc9d76asas OK
8acefbad76asas OK
89cefabd76asas OK
88cef9cd76asas OK
87cef8dd76asas OK
86cef7ed76asas OK
85cef6fd76asas OK
8fdddd6f86asas OK
8edddc7f86asas OK
8ddddb8f86asas OK
8cddda9f86asas OK
8bddd9af86asas OK
8addd8bf86asas OK
89ddd7cf86asas OK
88ddd6df86asas OK
87ddd5ef86asas OK
86ddd4ff86asas OK
8fddee6e76asas OK
8edded7e76asas OK
8dddec8e76asas OK
8cddeb9e76asas OK
8bddeaae76asas OK
8adde9be76asas OK
89dde8ce76asas OK
88dde7de76asas OK
87dde6ee76asas OK
86dde5fe76asas OK
8fddff6d66asas OK
8eddfe7d66asas OK
8dddfd8d66asas OK
8cddfc9d66asas OK
8bddfbad66asas OK
8addfabd66asas OK
89ddf9cd66asas OK
88ddf8dd66asas OK
87ddf7ed66asas OK
86ddf6fd66asas OK
8fecdc7f76asas OK
8eecdb8f76asas OK
8decda9f76asas OK
8cecd9af76asas OK
8becd8bf76asas OK
8aecd7cf76asas OK
89ecd6df76asas OK
88ecd5ef76asas OK

		
								
				
				登录后可查看完整内容
			
			
				
	

[培训]Windows内核深度攻防：从Hook技术到Rootkit实战！

		最后于  2025-8-29 00:55		
				被DNLINYJ编辑
				
		，原因： 		
	

	