-
-
[原创]小试金枪: jackozoo 2009热身版 !!
-
发表于: 2009-9-3 14:05
-
|
|
|---|---|
|
|
|
|
|
|
|
|
 做了些垃圾活 BYTE code = 0, bParam = 0;
DWORD dParam = 0,tesp = 0, treg = 0;
WORD wParam = 0, pos = 0;
PVOID p = 0;
FILE* fp = fopen("log.txt","a+");
if (fp == NULL) return 1;
while(pos < sizeof(VMDATA))
{
code = VMDATA[pos];
pos++;
p = (void*)(VMDATA+pos);
bParam = *(BYTE*)p;
wParam = *(WORD*)p;
dParam = *(DWORD*)p;
switch (code)
{
case 0:
fprintf(fp,"%04X [%02X] nop\r",pos-1,code);
break;
case 1:
fprintf(fp,"%04X [%02X] push byte 0x%02X\r",pos-1,code,bParam);
pos = pos + 1;
break;
case 2:
fprintf(fp,"%04X [%02X] push word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 3:
fprintf(fp,"%04X [%02X] push dword 0x%08X\r",pos-1,code,dParam);
pos = pos + 4;
break;
case 4:
fprintf(fp,"%04X [%02X] push byte %s\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 5:
fprintf(fp,"%04X [%02X] push word %s\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 6:
if (bParam == 8)
{
fprintf(fp,"%04X [%02X] push dword 0x%08X\r",pos-1,code,0);
}
else if (bParam == 4)
{
fprintf(fp,"%04X [%02X] push dword %s\r",pos-1,code,"TESP");
}
else
{
fprintf(fp,"%04X [%02X] push dword %s\r",pos-1,code,REG[bParam]);
}
pos = pos + 1;
break;
case 7:
fprintf(fp,"%04X [%02X] pop byte %s\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 8:
fprintf(fp,"%04X [%02X] pop word %s\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 9:
fprintf(fp,"%04X [%02X] pop dword %s\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 10:
fprintf(fp,"%04X [%02X] push byte [0x%08X]\r",pos-1,code,dParam);
pos = pos + 4;
break;
case 11:
fprintf(fp,"%04X [%02X] push word [0x%08X]\r",pos-1,code,dParam);
pos = pos + 4;
break;
case 12:
fprintf(fp,"%04X [%02X] push dword [0x%08X]\r",pos-1,code,dParam);
pos = pos + 4;
break;
case 13:
fprintf(fp,"%04X [%02X] pop byte [0x%08X]\r",pos-1,code,dParam);
pos = pos + 4;
break;
case 14:
fprintf(fp,"%04X [%02X] pop word [0x%08X]\r",pos-1,code,dParam);
pos = pos + 4;
break;
case 15:
fprintf(fp,"%04X [%02X] pop dword [0x%08X]\r",pos-1,code,dParam);
pos = pos + 4;
break;
case 16:
fprintf(fp,"%04X [%02X] add byte\r",pos-1,code);
break;
case 17:
fprintf(fp,"%04X [%02X] sub byte\r",pos-1,code);
break;
case 18:
fprintf(fp,"%04X [%02X] imul byte[NULL]\r",pos-1,code);
break;
case 19:
fprintf(fp,"%04X [%02X] idiv byte[NULL]\r",pos-1,code);
break;
case 20:
fprintf(fp,"%04X [%02X] and byte\r",pos-1,code);
break;
case 21:
fprintf(fp,"%04X [%02X] or byte\r",pos-1,code);
break;
case 22:
fprintf(fp,"%04X [%02X] xor byte\r",pos-1,code);
break;
case 23:
fprintf(fp,"%04X [%02X] add word\r",pos-1,code);
break;
case 24:
fprintf(fp,"%04X [%02X] sub word\r",pos-1,code);
break;
case 25:
fprintf(fp,"%04X [%02X] imul word[NULL]\r",pos-1,code);
break;
case 26:
fprintf(fp,"%04X [%02X] idiv word[NULL]\r",pos-1,code);
break;
case 27:
fprintf(fp,"%04X [%02X] and word\r",pos-1,code);
break;
case 28:
fprintf(fp,"%04X [%02X] or word\r",pos-1,code);
break;
case 29:
fprintf(fp,"%04X [%02X] xor word\r",pos-1,code);
break;
case 30:
fprintf(fp,"%04X [%02X] add dword\r",pos-1,code);
break;
case 31:
fprintf(fp,"%04X [%02X] sub dword\r",pos-1,code);
break;
case 32:
fprintf(fp,"%04X [%02X] imul dword\r",pos-1,code);
break;
case 33:
fprintf(fp,"%04X [%02X] idiv dword\r",pos-1,code);
break;
case 34:
fprintf(fp,"%04X [%02X] and dword\r",pos-1,code);
break;
case 35:
fprintf(fp,"%04X [%02X] or dword\r",pos-1,code);
break;
case 36:
fprintf(fp,"%04X [%02X] xor dword\r",pos-1,code);
break;
case 37:
fprintf(fp,"%04X [%02X] test byte\r",pos-1,code);
break;
case 38:
fprintf(fp,"%04X [%02X] test dword\r",pos-1,code);
break;
case 39:
fprintf(fp,"%04X [%02X] cmp dword\r",pos-1,code);
break;
case 40:
fprintf(fp,"%04X [%02X] jmp word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 41:
fprintf(fp,"%04X [%02X] jz word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 42:
fprintf(fp,"%04X [%02X] jnz word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 43:
fprintf(fp,"%04X [%02X] js word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 44:
fprintf(fp,"%04X [%02X] jns word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 45:
fprintf(fp,"%04X [%02X] jl word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 46:
fprintf(fp,"%04X [%02X] jle word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 47:
fprintf(fp,"%04X [%02X] jg word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 48:
fprintf(fp,"%04X [%02X] jge word 0x%04X\r",pos-1,code,wParam);
pos = pos + 2;
break;
case 49:
fprintf(fp,"%04X [%02X] ret\r",pos-1,code);
break;
case 50:
fprintf(fp,"%04X [%02X] ret\r",pos-1,code);
break;
case 51:
fprintf(fp,"%04X [%02X] push byte [%s]\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 52:
fprintf(fp,"%04X [%02X] push dword [%s]\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 53:
fprintf(fp,"%04X [%02X] pop byte [%s]\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 54:
fprintf(fp,"%04X [%02X] pop dword [%s]\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 55:
fprintf(fp,"%04X [%02X] mov TREG, %s\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 56:
fprintf(fp,"%04X [%02X] mov %s, TREG\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 57:
fprintf(fp,"%04X [%02X] pop byte to %s by cbw cwde\r",pos-1,code,REG[bParam]);
pos = pos + 1;
break;
case 58:
fprintf(fp,"%04X [%02X] mov TESP, ESP \r",pos-1,code);
break;
default:
break;
}
}
fclose(fp);
return 0;厉害的VM搞不动，本来还想试试能不能捡个偏宜解码出来看看算法，跑了半天没结果，加上楼主公布结果了，不玩了。学习海风、CCFER的方法，希望啥时候能像sessiondiy那样对CM举重若轻，静待明天好戏开场。 |
|
|
看了hawking的idb, CM基本上完全被肢解了, 连一些空标签名你都猜对了. PF.
本以为我花的时间至少和分析者的时间要达到1:1吧. 现在看来我错了, 若我不公布结果大侠们 再随便玩玩估计就还原算法了. 汗... Ok, PEDIY CM Contest is comming! Let's GO ~ 
|
|
|
|
|
|
简单破解的。
 |
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
|
