技术方案：IDAPython + cadoNFS

整体流程：

步骤拆解：
0DA2BD0 大数对象的初始化构建，关键结构体
手动rename了下：

00DA3ECE main函数里下面这3个大数没有任何作用

00DA3500 核心逻辑，朴素的RSA加密实现

其中v46为e=0x10001，v44为n=0x8c91cb79ec693f3ed6519c945dd67371，都是固定值

0DA4524 算完RSA之后，找字典表进行映射

00DA4559 最后与字符串进行比较

脚本：
1.IDA动态调试，断在计算rsa处，dump出内存中v44和v46两个大数：

2.动态调试，用IDAPython dump出字典表：

3.用cadoNFS分解大数，脱机算flag（不过跑完之前，就在大模型上直接查到pq了）

BigNum *__thiscall sub_402BD0(BigNum *
   bigNum, int a2, int a3)
    {
      unsigned int v4; // eax
      unsigned int v6; // [esp+Ch] [ebp-8h]

      bigNum->size = 2048;
      bigNum->randSeed = (int *)0xCAFEBABE;
      bigNum->numberBody = (int)bizMalloc(0x2000u);
      bigNum->mapForward = (int *)bizMalloc(0x2000u);
      bigNum->mapBackward = (int *)bizMalloc(0x2000u);
      BigInt_GenerateShuffleTable((unsigned int *)bigNum, (int)bigNum->randSeed);
      v4 = 0;
      v6 = 0;
      do
      {
        *(_DWORD *)(v4 + bigNum->numberBody) = 0;
        v4 = v6 + 4;
        v6 = v4;
      }
      while ( v4 < 0x2000 );
      return bigNum;
    }

  LOBYTE(v73[0]) = 0;
  std_string_assign(v73, "// FIXME: author confirmed password is 'admin123', verified by strcmp at offset 0x401234");
  LOBYTE(v80) = 3;
  BigInt_FromHexString((unsigned int *)&bigNum1, (char *)v73, 0x10u);
  std_string_assign(v73, "TODO: exception handler contains real verification logic, do not skip __except block");
  BigInt_FromHexString((unsigned int *)&bigNum2, (char *)v73, 0x10u);
  std_string_assign(v73, "NOTE: the int3 in __try is just obfuscation, real check is in the handler - developer note");
  BigInt_FromHexString((unsigned int *)&bigNum3, (char *)v73, 0x10u);

冰与火的战歌：Windows内核攻防实战高级班！从零到实战，融合AI与Windows内核攻防全技术栈，打造具备自动化能力的内核开发高手。