Reverse入门[不断记录]
12 分钟
前言
心血来潮，想接触点Reverse，感受下Reverse，于是从CTF的简单题目中慢慢入门
提示：以下是本篇文章正文内容，下面案例可供参考
一、[SWPUCTF 2021 新生赛]re1
1、工具：IDA
直接使用IDA将exe反编译，得到一堆代码。
使用Ctrl+X，查看编译流程，然后使用F5，查看代码。
int __cdecl main(int argc, const char **argv, const char **envp)
{
char Str2[1008]; // [rsp+20h] [rbp-60h] BYREF
char Str1[1000]; // [rsp+410h] [rbp+390h] BYREF
int i; // [rsp+7FCh] [rbp+77Ch]
_main();
strcpy(Str2, "{34sy_r3v3rs3}");
printf("please put your flag:");
scanf("%s", Str1);
for ( i = 0; i <= 665; ++i )
{
if ( Str1[i] == 101 )
Str1[i] = 51;
}
for ( i = 0; i <= 665; ++i )
{
if ( Str1[i] == 97 )
Str1[i] = 52;
}
if ( strcmp(Str1, Str2) )
printf("you are wrong,see again!");
else
printf("you are right!");
system("pause");
return 0;
}将输入的字符，ascii为101的变成51，97的变成52，然后与str2对比，一致则成功。
s = '{34sy_r3v3rs3}'
r = ''
for i in s:
if ord(i) ==51:
r += chr(101)
elif ord(i) == 52:
r += chr(97)
else:
r += i
print(r)
得到flag
二、[SWPUCTF 2021 新生赛]re2
int __cdecl main(int argc, const char **argv, const char **envp)
{
char Str2[64]; // [rsp+20h] [rbp-90h] BYREF
char Str[68]; // [rsp+60h] [rbp-50h] BYREF
int v7; // [rsp+A8h] [rbp-8h]
int i; // [rsp+ACh] [rbp-4h]
_main();
strcpy(Str2, "ylqq]aycqyp{");
printf(Format);
gets(Str);
v7 = strlen(Str);
for ( i = 0; i < v7; ++i )
{
if ( (Str[i] <= 96 || Str[i] > 98) && (Str[i] <= 64 || Str[i] > 66) )
Str[i] -= 2;
else
Str[i] += 24;
}
if ( strcmp(Str, Str2) )
printf(asc_404024);
else
printf(aBingo);
system("pause");
return 0;
}s = 'ylqq]aycqyp{'
l = []
for i in s:
l.append(ord(i))
# print(l)
l = [121, 108, 113, 113, 93, 97, 121, 99, 113, 121, 112, 123]
r = ''
for i in l:
if (i <= 94 or i > 96) and (i <= 62 or i > 64):
r += chr(i + 2)
else:
r += chr(i - 24)
print(r)得到的结果进行caser，并且猜一下，得到{nss_caesar}
三、[GFCTF 2021]wordy[花指令]
- 花指令实质就是一串垃圾指令，它与程序本身的功能无关，并不影响程序本身的逻辑。在软件保护中，花指令被作为一种手段来增加静态分析的难度，花指令也可以被用在病毒或木马上，通过加入花指令改变程序的特征码，躲避杀软的扫描，从而达到免杀的目的。
- 花指令是让反编译器无法反编译起到混淆租用的指令，一般最常见的就是在机器码中加入 E8，E8 加入后会将汇编代码改变为 CALL，而后续的机器码代表的东西是没有意义的，不是一个函数，所以 CALL 之后反编译器无法识别。
存在大量jmp跳转，导致程序无法正常编译，尝试将跳转nop掉，即将其转换成空指令。
startaddr = 0x1135
endaddr = 0x3100
for i in range(startaddr,endaddr):
if get_wide_byte(i) == 0xEB:
if get_wide_byte(i+1) == 0xFF:
patch_byte(i,0x90)
print("[+] Addr {} is patched".format(hex(i)))
起始地址是main函数的0x1135到结束，通过遍历byte，判断是否和EB FF，即jmp的机械码，是则改成90，即nop。
看到flag为GFCTF{u_are2wordy}
四、[NSSRound#3 Team]jump_by_jump[花指令]
- 先找主函数入口，即main
可以看到0041188C处有call，并且爆红，可以判断为花指令，因此要消除即变成nop，选中41188C，按快捷键D，将其转换为数据。
然后将0E8h改成0x90即nop机器码
快捷键C，将数据再次转换成指令，并将下面黄色的部分依次使用C转换成指令。
最后往上选中main入口，快捷键P生成函数，然后F5，获得函数代码。
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
int i; // [esp+D0h] [ebp-2Ch]
char v5[28]; // [esp+DCh] [ebp-20h] BYREF
strcpy(v5, "NSSCTF{Jump_b9_jump!}");
for ( i = 0; i < 21; ++i )
v5[i] = (v5[i] + v5[(i * i + 123) % 21]) % 128;
sub_4110CD("%s", (char)v5);
return 0;
}发现flag根本没被加密，直接开始Shift+F12就可以看到字符串。
五、[NSSRound#3 Team]jump_by_jump_revenge[花指令]
跟上面一样，将爆红那里改成空指令，P+F5得到伪代码。
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
int i; // [esp+D0h] [ebp-40h]
char Str1[36]; // [esp+E8h] [ebp-28h] BYREF
sub_411037("%s", (char)Str1);
for ( i = 0; i < 29; ++i )
Str1[i] = (Str1[i] + Str1[(i * i + 123) % 21]) % 96 + 32;
if ( !j_strcmp(Str1, "~4G~M:=WV7iX,zlViGmu4?hJ0H-Q*") )
puts("right!");
else
puts("nope!");
return 0;
}将flag打乱了，并且进行了变换，逆向解密。
a = ['~', '4', 'G', '~', 'M', ':', '=', 'W', 'V', '7', 'i', 'X', ',', 'z', 'l', 'V', 'i', 'G', 'm', 'u', '4', '?', 'h',
'J', '0', 'H', '-', 'Q', '*']
for i in range(28, -1, -1):
k = (i * i + 123) % 21
for j in range(5):
x = (ord(a[i]) - 32 + j * 96 - ord(a[k]))
if 33 <= x <= 126:
a[i] = chr(x)
break
print("".join(a))六、[WUSTCTF 2020]level2[UPX脱壳]
- 脱壳，就是说把程序的外壳给脱掉，从而能够看到真正的程序，在程序运行时，首先是壳取得控制权并对程序进行压缩，从而隐藏程序真正的OEP(原始的程序入口点)，一般丢进IDX后，函数特别少，是加壳了。
- 程序的脱壳一般总体是三个步骤：
- 找到OEP，程序运行壳代码执行完后会跳转到真正的OEP
- 抓到内存文件，将新得到的源文件保存，可从头到后复制
- 对PE文件进行修复
萌新，手动脱壳不是很现实，一些脱壳工具链接：
UPX脱壳工具
六、[HUBUCTF 2022 新生赛]simple_RE
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v4; // [rsp+24h] [rbp-44h] BYREF
void *Buf1; // [rsp+28h] [rbp-40h] BYREF
char v6[56]; // [rsp+30h] [rbp-38h] BYREF
sub_401770(argc, argv, envp);
printf("please input the flag:");
scanf("%s", v6);
Buf1 = 0i64;
sub_401570(v6, &Buf1, &v4);
if ( !memcmp(Buf1, a5mc58bphliax7j, v4) )
printf("\nsuccess!");
else
printf("\nfailed!");
if ( Buf1 )
free(Buf1);
return 0;
}输入的v6经过sub_401570()函数加密与a5mc58bphliax7j比较，一致则成功，a5mc58bphliax7j的值为5Mc58bPHLiAx7J8ocJIlaVUxaJvMcoYMaoPMaOfg15c475tscHfM/8==，有点像是base64。
但是下面好像还有一串字符串，不知道干什么的，看了下加密函数。
好像加密跟下面的字符串有关，正常的base64也解密不出来，可能是base64换表。
七、[SWPUCTF 2021 新生赛]easyapp
发现PK头，直接改成zip后缀，解压得到一个apk安卓，反编译，得：
Encode类：
package com.example.ilililililil;
public class Encoder
{
private int key = 123456789;
public String encode(String paramString)
{
StringBuilder localStringBuilder = new StringBuilder();
paramString = paramString.toCharArray();
int i = paramString.length;
for (int j = 0; j < i; j++)
localStringBuilder.append((char)(paramString[j] ^ this.key));
return localStringBuilder.toString();
}
}public /* synthetic */ void lambda$onCreate$0$MainActivity(final EditText editText, View v) {
System.out.println(encoder.encode(editText.getText().toString()));
if (encoder.encode(editText.getText().toString()).equals("棿棢棢棲棥棷棊棐棁棚棨棨棵棢棌")) {
Toast.makeText(this, "YES", 0).show();
} else {
Toast.makeText(this, "NO", 0).show();
}
}MainActivity类：
package com.example.ilililililil;
import java.lang.reflect.Field;
public class MainActlvity
{
public MainActlvity()
{
try
{
Field localField = Encoder.class.getDeclaredField("key");
localField.setAccessible(true);
localField.set(MainActivity.encoder, Integer.valueOf(987654321));
}
catch (NoSuchFieldException localNoSuchFieldException)
{
}
catch (IllegalAccessException localIllegalAccessException)
{
}
localIllegalAccessException.printStackTrace();
}
}可以知道key变成了987654321
所以exp为：
code = '棿棢棢棲棥棷棊棐棁棚棨棨棵棢棌'
key = 987654321
flag = ""
for i in code:
flag += chr((ord(i) ^ key) % 128)
print(flag)得到flag NSSCTF{apkYYDS}
八、[鹏城杯 2022]baby_re[apk反编译+JNI]
反编译得到关键代码：
private static final void onCreate$lambda-0(MainActivity paramMainActivity, int[] paramArrayOfInt, View paramView)
{
Intrinsics.checkNotNullParameter(paramMainActivity, "this$0");
Intrinsics.checkNotNullParameter(paramArrayOfInt, "$c");
paramView = ((EditText)paramMainActivity._$_findCachedViewById(R.id.input)).getText().toString().chars().toArray();
Intrinsics.checkNotNullExpressionValue(paramView, "flag.toArray()");
if (Arrays.equals(paramMainActivity.baby_xor(paramView), paramArrayOfInt))
Toast.makeText((Context)paramMainActivity, (CharSequence)"Success", 1).show();
else
Toast.makeText((Context)paramMainActivity, (CharSequence)"Failed", 0).show();
}
protected void onCreate(Bundle paramBundle)
{
super.onCreate(paramBundle);
ActivityMainBinding localActivityMainBinding = ActivityMainBinding.inflate(getLayoutInflater());
Intrinsics.checkNotNullExpressionValue(localActivityMainBinding, "inflate(layoutInflater)");
this.binding = localActivityMainBinding;
paramBundle = localActivityMainBinding;
if (localActivityMainBinding == null)
{
Intrinsics.throwUninitializedPropertyAccessException("binding");
paramBundle = null;
}
setContentView((View)paramBundle.getRoot());
((Button)_$_findCachedViewById(R.id.btn)).setOnClickListener(new MainActivity..ExternalSyntheticLambda0(this, new int[] { 119, 9, 40, 44, 106, 83, 126, 123, 33, 87, 113, 123, 112, 93, 125, 127, 41, 82, 44, 127, 39, 3, 126, 125, 119, 87, 47, 125, 33, 6, 44, 127, 112, 0, 126, 123, 115, 24 }));
}flag转成了数组，进行baby_xor异或，要等于{ 119, 9, 40, 44, 106, 83, 126, 123, 33, 87, 113, 123, 112, 93, 125, 127, 41, 82, 44, 127, 39, 3, 126, 125, 119, 87, 47, 125, 33, 6, 44, 127, 112, 0, 126, 123, 115, 24 }，在反编译的函数中找不到baby_xor，它还给了so文件，放入IDA，会发现存在babyxor函数。
__int64 __fastcall Java_com_example_createso_MainActivity_baby_1xor(__int64 a1, __int64 a2, __int64 a3)
{
int i; // [rsp+14h] [rbp-2Ch]
__int64 v5; // [rsp+18h] [rbp-28h]
unsigned int v6; // [rsp+24h] [rbp-1Ch]
v6 = _JNIEnv::GetArrayLength(a1, a3);
v5 = _JNIEnv::GetIntArrayElements(a1, a3, 0LL);
for ( i = 0; i < (int)v6; ++i )
*(_DWORD *)(v5 + 4LL * i) ^= key[i % 4];
_JNIEnv::SetIntArrayRegion(a1, a3, 0LL, v6, v5);
return a3;
}
_DWORD *hide_key(void)
{
_DWORD *result; // rax
result = key;
key[0] ^= 0x47u;
key[1] ^= 0x32u;
key[2] ^= 0x11u;
key[3] ^= 0x12u;
return result;
}这里就是先将key异或变一下，然后与key[i%4]做异或。
发现key的初始值 0x56 0x57 0x58 0x59
from Crypto.Util.number import long_to_bytes
l = [119, 9, 40, 44, 106, 83, 126, 123, 33, 87, 113, 123, 112, 93, 125, 127, 41, 82, 44, 127, 39, 3, 126, 125, 119, 87,
47, 125, 33, 6, 44, 127, 112, 0, 126, 123, 115, 24]
key = [0x56, 0x57, 0x58, 0x59]
key[0] ^= 0x47
key[1] ^= 0x32
key[2] ^= 0x11
key[3] ^= 0x12
flag = ''
for i in range(len(l)):
flag += chr(l[i] ^ key[i % 4])
print(flag)
得到flag
九、[GWCTF 2019]babyvm[VMre]
主函数获取输入：
主要功能在sub_CD1：
函数定义了操作码的功能，可看成是操作码表，202060地址存放操作码，可理解成密文，qword_2022A8存放输入的字符串，其余九是操作码代表的功能，要通过语句推断功能代表的语句，还原程序流程。
0XF1
多个分支，并且都是赋值，推断是mov操作，根据0xE1等分直情况不同，进行不同的表达式，0XE1：mov R0 flag 0XE2：mov R1 flag以此类推
0xF2
xor操作，R0=R0^R1
0xF5
读取长度为21的flag
0xF4
0xF7
mul乘法操作，R0=R0*R3
0xF8
swap交换指令操作,swap R0 R1
0xF6
线性运算 R0=R2+2R1+3R0
知道所有的操作码的含义后，获取密文操作码，从0x202060到0x20229结束，然后翻译操作码
import binascii
from pwn import *
fd = open("babyvm", "rb")
arr = []
offset = 0x2060
while offset <= 0x229e:
fd.seek(offset)
fr = fd.read(1)
arr.append(int(binascii.b2a_hex(fr).decode('utf-8'),16))
offset += 1
# print(arr, len(arr))
result = ""
i = 0
while i < 575:
if arr[i] == 0xf1:
if arr[i + 1] == 0xE1:
result += "{0} mov R0 flag[{1}]\n".format(i, arr[i + 2])
elif arr[i + 1] == 0xE2:
result += "{0} mov R1 flag[{1}]\n".format(i, arr[i + 2])
elif arr[i + 1] == 0xE3:
result += "{0} mov R2 flag[{1}]\n".format(i, arr[i + 2])
elif arr[i + 1] == 0xE4:
result += "{0} mov flag[{1}] R0\n".format(i, arr[i + 2])
elif arr[i + 1] == 0xE5:
result += "{0} mov R3 flag[{1}]\n".format(i, arr[i + 2])
elif arr[i + 1] == 0xE7:
result += "{0} mov flag[{1}] R1\n".format(i, arr[i + 2])
i = i + 6
elif arr[i] == 0xf2:
result += "{0} xor R0 R1\n".format(i)
i += 1
elif arr[i] == 0xf5:
result += "{0} read flag 21\n".format(i)
i += 1
elif arr[i] == 0xf4:
i += 1
elif arr[i] == 0xf7:
result += "{0} mul R0 R3\n".format(i)
i += 1
elif arr[i] == 0xf8:
result += "{0} swap R0 R1\n".format(i)
i += 1
elif arr[i] == 0xf6:
result += "{0} mov R0 R2+2*R1+3*R0\n".format(i)
i += 1
else:
i += 1
with open("babyvm.txt", "a+") as tr:
tr.write(result)
tr.close()得到：
0 read flag 21
1 mov R0 flag[0]
7 xor R0 R1
8 mov flag[32] R0
14 mov R0 flag[1]
20 xor R0 R1
21 mov flag[33] R0
27 mov R0 flag[2]
33 xor R0 R1
34 mov flag[34] R0
40 mov R0 flag[3]
46 xor R0 R1
47 mov flag[35] R0
53 mov R0 flag[4]
59 xor R0 R1
60 mov flag[36] R0
66 mov R0 flag[5]
72 xor R0 R1
73 mov flag[37] R0
79 mov R0 flag[6]
85 xor R0 R1
86 mov flag[38] R0
92 mov R0 flag[7]
98 xor R0 R1
99 mov flag[39] R0
105 mov R0 flag[8]
111 xor R0 R1
112 mov flag[40] R0
118 mov R0 flag[9]
124 xor R0 R1
125 mov flag[41] R0
131 mov R0 flag[10]
137 xor R0 R1
138 mov flag[42] R0
144 mov R0 flag[11]
150 xor R0 R1
151 mov flag[43] R0
157 mov R0 flag[12]
163 xor R0 R1
164 mov flag[44] R0
170 mov R0 flag[13]
176 xor R0 R1
177 mov flag[45] R0
183 mov R0 flag[14]
189 xor R0 R1
190 mov flag[46] R0
196 mov R0 flag[15]
202 xor R0 R1
203 mov flag[47] R0
209 mov R0 flag[16]
215 xor R0 R1
216 mov flag[48] R0
222 mov R0 flag[17]
228 xor R0 R1
229 mov flag[49] R0
235 mov R0 flag[18]
241 xor R0 R1
242 mov flag[50] R0
248 mov R0 flag[19]
254 xor R0 R1
255 mov flag[51] R0
288 read flag 21
289 mov R0 flag[0]
295 mov R1 flag[1]
301 xor R0 R1
302 mov flag[0] R0
308 mov R0 flag[1]
314 mov R1 flag[2]
320 xor R0 R1
321 mov flag[1] R0
327 mov R0 flag[2]
333 mov R1 flag[3]
339 xor R0 R1
340 mov flag[2] R0
346 mov R0 flag[3]
352 mov R1 flag[4]
358 xor R0 R1
359 mov flag[3] R0
365 mov R0 flag[4]
371 mov R1 flag[5]
377 xor R0 R1
378 mov flag[4] R0
384 mov R0 flag[5]
390 mov R1 flag[6]
396 xor R0 R1
397 mov flag[5] R0
403 mov R0 flag[6]
409 mov R1 flag[7]
415 mov R2 flag[8]
421 mov R3 flag[12]
427 mov R0 R2+2*R1+3*R0
428 mul R0 R3
429 mov flag[6] R0
435 mov R0 flag[7]
441 mov R1 flag[8]
447 mov R2 flag[9]
453 mov R3 flag[12]
459 mov R0 R2+2*R1+3*R0
460 mul R0 R3
461 mov flag[7] R0
467 mov R0 flag[8]
473 mov R1 flag[9]
479 mov R2 flag[10]
485 mov R3 flag[12]
491 mov R0 R2+2*R1+3*R0
492 mul R0 R3
493 mov flag[8] R0
499 mov R0 flag[13]
505 mov R1 flag[19]
511 swap R0 R1
512 mov flag[13] R0
518 mov flag[19] R1
524 mov R0 flag[14]
530 mov R1 flag[18]
536 swap R0 R1
537 mov flag[14] R0
543 mov flag[18] R1
549 mov R0 flag[15]
555 mov R1 flag[17]
561 swap R0 R1
562 mov flag[15] R0
568 mov flag[17] R1
有两端read flag操作，但是第一段flag[34]等等，flag长度只有21，所有第二段是正确的，分析第二段
288 read flag 21
289 mov R0 flag[0]
295 mov R1 flag[1]
301 xor R0 R1
302 mov flag[0] R0 //flag[0]=flag[0]^flag[1]
308 mov R0 flag[1]
314 mov R1 flag[2]
320 xor R0 R1
321 mov flag[1] R0 //flag[1]=flag[1]^flag[2]
327 mov R0 flag[2]
333 mov R1 flag[3]
339 xor R0 R1
340 mov flag[2] R0 ////flag[2]=flag[2]^flag[3]
346 mov R0 flag[3]
352 mov R1 flag[4]
358 xor R0 R1
359 mov flag[3] R0 //flag[3]=flag[3]^flag[4]
365 mov R0 flag[4]
371 mov R1 flag[5]
377 xor R0 R1
378 mov flag[4] R0 //flag[4]=flag[4]^flag[5]
384 mov R0 flag[5]
390 mov R1 flag[6]
396 xor R0 R1
397 mov flag[5] R0 //flag[5]=flag[5]^flag[6]
403 mov R0 flag[6]
409 mov R1 flag[7]
415 mov R2 flag[8]
421 mov R3 flag[12]
427 mov R0 R2+2*R1+3*R0
428 mul R0 R3 //flag[6]=FLAG[8]+2*FLAG[7]+3*FLAG[6]*FLAG[12]
429 mov flag[6] R0
435 mov R0 flag[7]
441 mov R1 flag[8]
447 mov R2 flag[9]
453 mov R3 flag[12]
459 mov R0 R2+2*R1+3*R0
460 mul R0 R3 //flag[7]=flag[9]+2*flag[8]+3*flag[7]*flag[12]
461 mov flag[7] R0
467 mov R0 flag[8]
473 mov R1 flag[9]
479 mov R2 flag[10]
485 mov R3 flag[12]
491 mov R0 R2+2*R1+3*R0
492 mul R0 R3
493 mov flag[8] R0 //flag[8]=(flag[10]+2*flag[9]+3*flag[8])*flag[12]
499 mov R0 flag[13]
505 mov R1 flag[19]
511 swap R0 R1 //swap(flag[13],flag[19])
512 mov flag[13] R0
518 mov flag[19] R1
524 mov R0 flag[14]
530 mov R1 flag[18]
536 swap R0 R1 //swap(flag[14],flag[18])
537 mov flag[14] R0
543 mov flag[18] R1
549 mov R0 flag[15]
555 mov R1 flag[17]
561 swap R0 R1 //swap(flag[15],flag[17])
562 mov flag[15] R0
568 mov flag[17] R1
程序的操作大致为：
flag=''
for i in range(6)：:
flag[i]=flag[i]^flag[i+1]
flag[6]=(flag[8]+2*flag[7]+3*flag[6])*flag[12]
flag[7]=(flag[9]+2*flag[8]+3*flag[7])*flag[12]
flag[8]=(flag[10]+2*flag[9]+3*flag[8])*flag[12]
swap(flag[13],flag[19])
swap(flag[14],flag[18])
swap(flag[15],flag[17])
题目真正的check
还原脚本
from pwn import *
re = []
fd = open("babyvm", "rb")
offset = 0x2020
while offset < 0x2034:
fd.seek(offset)
fr = fd.read(1)
re.append(int(binascii.b2a_hex(fr).decode('utf-8'),16))
offset += 1
# print(re,len(re))
flag = []
for i in range(20):
flag.append(0)
flag[11] = re[11]
flag[12] = re[12]
flag[13] = re[19]
flag[14] = re[18]
flag[15] = re[17]
flag[16] = re[16]
flag[17] = re[15]
flag[18] = re[14]
flag[19] = re[13]
flag[9] = re[9]
flag[10] = re[10]
for i in range(128):
if re[8] == ((i * 3 + flag[9] * 2 + flag[10]) * flag[12]) & 0xff:
flag[8] = i
for j in range(128):
if re[7] == ((j * 3 + flag[8] * 2 + flag[9]) * flag[12]) & 0xff:
flag[7] = j
for k in range(128):
if re[6] == ((k * 3 + flag[7] * 2 + flag[8]) * flag[12]) & 0xff:
flag[6] = k
flag[5] = re[5] ^ flag[6]
flag[4] = re[4] ^ flag[5]
flag[3] = re[3] ^ flag[4]
flag[2] = re[2] ^ flag[3]
flag[1] = re[1] ^ flag[2]
flag[0] = re[0] ^ flag[1]
FLAG = ""
for i in flag:
FLAG += chr(i)
print(FLAG)得到flag
总结一下VMre的解法步骤：
1.根据函数获取操作码表，操作码表中对应的操作，还原程序流程。
2.根据程序流程获得程序的算法。
3.获取flag存放位置并获得加密数据，根据算法还原。
十、[NISACTF 2022]鸣神的国土
.file "test.c"
.text
.section .rodata
.LC0:
.string "%s"
.LC1:
.string "YES,you get the flag"
.LC2:
.string "NO,error"
.text
.globl main
.type main, @function
main:
.LFB6:
.cfi_startproc
endbr64
pushq %rbp
.cfi_def_cfa_offset 16
.cfi_offset 6, -16
movq %rsp, %rbp
.cfi_def_cfa_register 6
pushq %rbx
subq $216, %rsp
.cfi_offset 3, -24
movq %fs:40, %rax
movq %rax, -24(%rbp)
xorl %eax, %eax
movabsq $7158324656262427505, %rax
movabsq $7163901470557426799, %rdx
movq %rax, -208(%rbp)
movq %rdx, -200(%rbp)
movabsq $3619001219890117209, %rax
movabsq $5780770822738496110, %rdx
movq %rax, -192(%rbp)
movq %rdx, -184(%rbp)
movabsq $3838605427404404553, %rax
movabsq $4427116830602054234, %rdx
movq %rax, -176(%rbp)
movq %rdx, -168(%rbp)
movb $0, -160(%rbp)
movl $0, -212(%rbp)
leaq -80(%rbp), %rax
movq %rax, %rsi
leaq .LC0(%rip), %rdi
movl $0, %eax
call __isoc99_scanf@PLT
movl $0, -220(%rbp)
jmp .L2
.L15:
movl -220(%rbp), %eax
cltq
movzbl -80(%rbp,%rax), %eax
cmpb $64, %al
jle .L3
movl -220(%rbp), %eax
cltq
movzbl -80(%rbp,%rax), %eax
cmpb $90, %al
jle .L4
.L3:
movl -220(%rbp), %eax
cltq
movzbl -80(%rbp,%rax), %eax
cmpb $96, %al
jle .L5
movl -220(%rbp), %eax
cltq
movzbl -80(%rbp,%rax), %eax
cmpb $122, %al
jle .L6
.L5:
movl -220(%rbp), %eax
cltq
movzbl -80(%rbp,%rax), %edx
movl -220(%rbp), %eax
cltq
movb %dl, -144(%rbp,%rax)
jmp .L11
.L6:
movl $97, -216(%rbp)
jmp .L8
.L10:
movl -220(%rbp), %eax
cltq
movzbl -80(%rbp,%rax), %eax
movsbl %al, %eax
leal -84(%rax), %edx
movslq %edx, %rax
imulq $1321528399, %rax, %rax
shrq $32, %rax
movl %eax, %ecx
sarl $3, %ecx
movl %edx, %eax
sarl $31, %eax
subl %eax, %ecx
movl %ecx, %eax
imull $26, %eax, %eax
subl %eax, %edx
movl %edx, %eax
addl $97, %eax
cmpl %eax, -216(%rbp)
jne .L9
movl -216(%rbp), %eax
movl %eax, %edx
movl -220(%rbp), %eax
cltq
movb %dl, -144(%rbp,%rax)
.L9:
addl $1, -216(%rbp)
.L8:
cmpl $122, -216(%rbp)
jle .L10
jmp .L11
.L4:
movl $65, -216(%rbp)
jmp .L12
.L14:
movl -220(%rbp), %eax
cltq
movzbl -80(%rbp,%rax), %eax
movsbl %al, %eax
leal -52(%rax), %edx
movslq %edx, %rax
imulq $1321528399, %rax, %rax
shrq $32, %rax
movl %eax, %ecx
sarl $3, %ecx
movl %edx, %eax
sarl $31, %eax
subl %eax, %ecx
movl %ecx, %eax
imull $26, %eax, %eax
subl %eax, %edx
movl %edx, %eax
addl $65, %eax
cmpl %eax, -216(%rbp)
jne .L13
movl -216(%rbp), %eax
movl %eax, %edx
movl -220(%rbp), %eax
cltq
movb %dl, -144(%rbp,%rax)
.L13:
addl $1, -216(%rbp)
.L12:
cmpl $90, -216(%rbp)
jle .L14
.L11:
addl $1, -220(%rbp)
.L2:
movl -220(%rbp), %eax
movslq %eax, %rbx
leaq -80(%rbp), %rax
movq %rax, %rdi
call strlen@PLT
cmpq %rax, %rbx
jb .L15
movl $0, -220(%rbp)
jmp .L16
.L18:
movl -220(%rbp), %eax
cltq
movzbl -208(%rbp,%rax), %edx
movl -220(%rbp), %eax
cltq
movzbl -144(%rbp,%rax), %eax
cmpb %al, %dl
jne .L17
addl $1, -212(%rbp)
.L17:
addl $1, -220(%rbp)
.L16:
movl -220(%rbp), %eax
movslq %eax, %rbx
leaq -80(%rbp), %rax
movq %rax, %rdi
call strlen@PLT
cmpq %rax, %rbx
jb .L18
movl -212(%rbp), %eax
movslq %eax, %rbx
leaq -208(%rbp), %rax
movq %rax, %rdi
call strlen@PLT
cmpq %rax, %rbx
jne .L19
leaq .LC1(%rip), %rdi
call puts@PLT
jmp .L20
.L19:
leaq .LC2(%rip), %rdi
call puts@PLT
.L20:
movl $0, %eax
movq -24(%rbp), %rsi
xorq %fs:40, %rsi
je .L22
call __stack_chk_fail@PLT
.L22:
addq $216, %rsp
popq %rbx
popq %rbp
.cfi_def_cfa 7, 8
ret
.cfi_endproc
.LFE6:
.size main, .-main
.ident "GCC: (Ubuntu 9.3.0-17ubuntu1~20.04) 9.3.0"
.section .note.GNU-stack,"",@progbits
.section .note.gnu.property,"a"
.align 8
.long 1f - 0f
.long 4f - 1f
.long 5
0:
.string "GNU"
1:
.align 8
.long 0xc0000002
.long 3f - 2f
2:
.long 0x3
3:
.align 8
4:
直接给GNU代码，可以使用as命令将汇编代码编译为二进制代码，让再用gcc编译成程序。
int __cdecl main(int argc, const char **argv, const char **envp)
{
int i; // [rsp+4h] [rbp-DCh]
int l; // [rsp+4h] [rbp-DCh]
int k; // [rsp+8h] [rbp-D8h]
int j; // [rsp+8h] [rbp-D8h]
int v8; // [rsp+Ch] [rbp-D4h]
char v9[128]; // [rsp+10h] [rbp-D0h] BYREF
char s[56]; // [rsp+90h] [rbp-50h] BYREF
unsigned __int64 v11; // [rsp+C8h] [rbp-18h]
v11 = __readfsqword(0x28u);
strcpy(v9, "q3q3YzWcoTyvnJkcYzAioF92nJEyol9PIwSeLwE5ZJ03MGp=");
v8 = 0;
__isoc99_scanf(&unk_2004, s);
for ( i = 0; i < strlen(s); ++i )
{
if ( s[i] > 64 && s[i] <= 90 )
{
for ( j = 65; j <= 90; ++j )
{
if ( j == (s[i] - 52) % 26 + 65 )
v9[i + 64] = j;
}
}
else if ( s[i] > 96 && s[i] <= 122 )
{
for ( k = 97; k <= 122; ++k )
{
if ( k == (s[i] - 84) % 26 + 97 )
v9[i + 64] = k;
}
}
else
{
v9[i + 64] = s[i];
}
}
for ( l = 0; l < strlen(s); ++l )
{
if ( v9[l] == v9[l + 64] )
++v8;
}
if ( v8 == strlen(v9) )
puts("YES,you get the flag");
else
puts("NO,error");
return 0;
}
十一、[广东强网杯 2021 个人组]goodpy
1 0 LOAD_CONST 0 (-1)
3 LOAD_CONST 1 (None)
6 IMPORT_NAME 0 (os)
9 STORE_NAME 0 (os)
4 12 LOAD_CONST 2 (0)
15 STORE_NAME 1 (a)
5 18 LOAD_NAME 2 (input)
21 CALL_FUNCTION 0
24 STORE_NAME 3 (flag)
6 27 SETUP_LOOP 36 (to 66)
30 LOAD_NAME 4 (range)
33 LOAD_NAME 5 (len)
36 LOAD_NAME 3 (flag)
39 CALL_FUNCTION 1
42 CALL_FUNCTION 1
45 GET_ITER
>> 46 FOR_ITER 16 (to 65)
49 STORE_NAME 6 (i)
7 52 LOAD_NAME 1 (a)
55 LOAD_CONST 3 (1)
58 INPLACE_ADD
59 STORE_NAME 1 (a)
62 JUMP_ABSOLUTE 46
>> 65 POP_BLOCK
9 >> 66 LOAD_NAME 1 (a)
69 LOAD_CONST 4 (32)
72 COMPARE_OP 3 (!=)
75 POP_JUMP_IF_FALSE 93
10 78 LOAD_CONST 5 ('error')
81 PRINT_ITEM
82 PRINT_NEWLINE
11 83 LOAD_NAME 7 (exit)
86 CALL_FUNCTION 0
89 POP_TOP
90 JUMP_FORWARD 0 (to 93)
13 >> 93 LOAD_NAME 3 (flag)
96 LOAD_CONST 2 (0)
99 BINARY_SUBSCR
100 LOAD_CONST 6 ('f')
103 COMPARE_OP 3 (!=)
106 POP_JUMP_IF_TRUE 189
109 LOAD_NAME 3 (flag)
112 LOAD_CONST 3 (1)
115 BINARY_SUBSCR
116 LOAD_CONST 7 ('l')
119 COMPARE_OP 3 (!=)
122 POP_JUMP_IF_TRUE 189
125 LOAD_NAME 3 (flag)
128 LOAD_CONST 8 (2)
131 BINARY_SUBSCR
132 LOAD_CONST 9 ('a')
135 COMPARE_OP 3 (!=)
138 POP_JUMP_IF_TRUE 189
141 LOAD_NAME 3 (flag)
144 LOAD_CONST 10 (3)
147 BINARY_SUBSCR
148 LOAD_CONST 11 ('g')
151 COMPARE_OP 3 (!=)
154 POP_JUMP_IF_TRUE 189
157 LOAD_NAME 3 (flag)
160 LOAD_CONST 12 (4)
163 BINARY_SUBSCR
164 LOAD_CONST 13 ('{')
167 COMPARE_OP 3 (!=)
170 POP_JUMP_IF_TRUE 189
173 LOAD_NAME 3 (flag)
176 LOAD_CONST 14 (31)
179 BINARY_SUBSCR
180 LOAD_CONST 15 ('}')
183 COMPARE_OP 3 (!=)
186 POP_JUMP_IF_FALSE 204
14 >> 189 LOAD_CONST 5 ('error')
192 PRINT_ITEM
193 PRINT_NEWLINE
15 194 LOAD_NAME 7 (exit)
197 CALL_FUNCTION 0
200 POP_TOP
201 JUMP_FORWARD 0 (to 204)
17 >> 204 BUILD_LIST 0
207 STORE_NAME 8 (tmp)
19 210 SETUP_LOOP 37 (to 250)
213 LOAD_NAME 4 (range)
216 LOAD_NAME 1 (a)
219 CALL_FUNCTION 1
222 GET_ITER
>> 223 FOR_ITER 23 (to 249)
226 STORE_NAME 6 (i)
20 229 LOAD_NAME 8 (tmp)
232 LOAD_ATTR 9 (append)
235 LOAD_NAME 3 (flag)
238 LOAD_NAME 6 (i)
241 BINARY_SUBSCR
242 CALL_FUNCTION 1
245 POP_TOP
246 JUMP_ABSOLUTE 223
>> 249 POP_BLOCK
22 >> 250 SETUP_LOOP 44 (to 297)
253 LOAD_NAME 4 (range)
256 LOAD_NAME 1 (a)
259 CALL_FUNCTION 1
262 GET_ITER
>> 263 FOR_ITER 30 (to 296)
266 STORE_NAME 6 (i)
23 269 LOAD_NAME 10 (ord)
272 LOAD_NAME 8 (tmp)
275 LOAD_NAME 6 (i)
278 BINARY_SUBSCR
279 CALL_FUNCTION 1
282 LOAD_CONST 16 (9)
285 BINARY_SUBTRACT
286 LOAD_NAME 8 (tmp)
289 LOAD_NAME 6 (i)
292 STORE_SUBSCR
293 JUMP_ABSOLUTE 263
>> 296 POP_BLOCK
25 >> 297 SETUP_LOOP 38 (to 338)
300 LOAD_NAME 4 (range)
303 LOAD_NAME 1 (a)
306 CALL_FUNCTION 1
309 GET_ITER
>> 310 FOR_ITER 24 (to 337)
313 STORE_NAME 6 (i)
26 316 LOAD_NAME 8 (tmp)
319 LOAD_NAME 6 (i)
322 BINARY_SUBSCR
323 LOAD_CONST 17 (51)
326 BINARY_XOR
327 LOAD_NAME 8 (tmp)
330 LOAD_NAME 6 (i)
333 STORE_SUBSCR
334 JUMP_ABSOLUTE 310
>> 337 POP_BLOCK
28 >> 338 SETUP_LOOP 38 (to 379)
341 LOAD_NAME 4 (range)
344 LOAD_NAME 1 (a)
347 CALL_FUNCTION 1
350 GET_ITER
>> 351 FOR_ITER 24 (to 378)
354 STORE_NAME 6 (i)
29 357 LOAD_NAME 8 (tmp)
360 LOAD_NAME 6 (i)
363 BINARY_SUBSCR
364 LOAD_CONST 18 (8)
367 BINARY_ADD
368 LOAD_NAME 8 (tmp)
371 LOAD_NAME 6 (i)
374 STORE_SUBSCR
375 JUMP_ABSOLUTE 351
>> 378 POP_BLOCK
31 >> 379 LOAD_NAME 8 (tmp)
382 LOAD_NAME 1 (a)
385 LOAD_CONST 10 (3)
388 BINARY_SUBTRACT
389 BINARY_SUBSCR
390 STORE_NAME 11 (tmp1)
32 393 LOAD_NAME 8 (tmp)
396 LOAD_NAME 1 (a)
399 LOAD_CONST 8 (2)
402 BINARY_SUBTRACT
403 BINARY_SUBSCR
404 STORE_NAME 12 (tmp2)
33 407 LOAD_NAME 8 (tmp)
410 LOAD_NAME 1 (a)
413 LOAD_CONST 3 (1)
416 BINARY_SUBTRACT
417 BINARY_SUBSCR
418 STORE_NAME 13 (tmp3)
35 421 SETUP_LOOP 58 (to 482)
424 LOAD_NAME 4 (range)
427 LOAD_NAME 1 (a)
430 LOAD_CONST 10 (3)
433 BINARY_SUBTRACT
434 CALL_FUNCTION 1
437 GET_ITER
>> 438 FOR_ITER 40 (to 481)
441 STORE_NAME 6 (i)
36 444 LOAD_NAME 8 (tmp)
447 LOAD_NAME 1 (a)
450 LOAD_CONST 3 (1)
453 BINARY_SUBTRACT
454 LOAD_NAME 6 (i)
457 BINARY_SUBTRACT
458 LOAD_CONST 10 (3)
461 BINARY_SUBTRACT
462 BINARY_SUBSCR
463 LOAD_NAME 8 (tmp)
466 LOAD_NAME 1 (a)
469 LOAD_CONST 3 (1)
472 BINARY_SUBTRACT
473 LOAD_NAME 6 (i)
476 BINARY_SUBTRACT
477 STORE_SUBSCR
478 JUMP_ABSOLUTE 438
>> 481 POP_BLOCK
38 >> 482 LOAD_NAME 13 (tmp3)
485 LOAD_NAME 8 (tmp)
488 LOAD_CONST 2 (0)
491 STORE_SUBSCR
39 492 LOAD_NAME 12 (tmp2)
495 LOAD_NAME 8 (tmp)
498 LOAD_CONST 3 (1)
501 STORE_SUBSCR
40 502 LOAD_NAME 11 (tmp1)
505 LOAD_NAME 8 (tmp)
508 LOAD_CONST 8 (2)
511 STORE_SUBSCR
42 512 SETUP_LOOP 58 (to 573)
515 LOAD_NAME 4 (range)
518 LOAD_NAME 1 (a)
521 CALL_FUNCTION 1
524 GET_ITER
>> 525 FOR_ITER 44 (to 572)
528 STORE_NAME 6 (i)
43 531 LOAD_NAME 6 (i)
534 LOAD_CONST 19 (7)
537 BINARY_MODULO
538 LOAD_CONST 3 (1)
541 COMPARE_OP 2 (==)
544 POP_JUMP_IF_FALSE 553
44 547 JUMP_ABSOLUTE 525
550 JUMP_FORWARD 0 (to 553)
45 >> 553 LOAD_NAME 8 (tmp)
556 LOAD_NAME 6 (i)
559 DUP_TOPX 2
562 BINARY_SUBSCR
563 LOAD_CONST 20 (119)
566 INPLACE_XOR
567 ROT_THREE
568 STORE_SUBSCR
569 JUMP_ABSOLUTE 525
>> 572 POP_BLOCK
48 >> 573 LOAD_NAME 14 (open)
576 LOAD_CONST 21 ('out')
579 LOAD_CONST 22 ('w')
582 CALL_FUNCTION 2
585 SETUP_WITH 26 (to 614)
588 STORE_NAME 15 (f)
49 591 LOAD_NAME 15 (f)
594 LOAD_ATTR 16 (write)
597 LOAD_NAME 17 (str)
600 LOAD_NAME 8 (tmp)
603 CALL_FUNCTION 1
606 CALL_FUNCTION 1
609 POP_TOP
610 POP_BLOCK
611 LOAD_CONST 1 (None)
>> 614 WITH_CLEANUP
615 END_FINALLY
616 LOAD_CONST 1 (None)
619 RETURN_VALUE
python字节码，直接手撕，结构为 源码行号 | 指令在函数中的偏移 | 指令符号 | 指令参数 | 实际参数值。
参考文章：python字节码
字节码
a = [56, 17, 99, 1, 47, 4, 2, 62, 75, 102, 8, 242, 16, 242, 97, 97, 100, 107, 16, 9, 10, 3, 117, 20, 80, 87, 242, 2, 6, 119, 7, 17]
flag = ''
for i in range(len(a)):
if i%7==1:
flag += (chr(((a[i]-8)^51)+9))
else:
flag += (chr((((a[i]^119)-8)^51)+9))
print(flag)十二、[GXYCTF 2019]luck_guy
unsigned __int64 get_flag()
{
unsigned int v0; // eax
int i; // [rsp+4h] [rbp-3Ch]
int j; // [rsp+8h] [rbp-38h]
__int64 s; // [rsp+10h] [rbp-30h] BYREF
char v5; // [rsp+18h] [rbp-28h]
unsigned __int64 v6; // [rsp+38h] [rbp-8h]
v6 = __readfsqword(0x28u);
v0 = time(0LL);
srand(v0);
for ( i = 0; i <= 4; ++i )
{
switch ( rand() % 200 )
{
case 1:
puts("OK, it's flag:");
memset(&s, 0, 0x28uLL);
strcat((char *)&s, f1);
strcat((char *)&s, &f2);
printf("%s", (const char *)&s);
break;
case 2:
printf("Solar not like you");
break;
case 3:
printf("Solar want a girlfriend");
break;
case 4:
s = 0x7F666F6067756369LL;
v5 = 0;
strcat(&f2, (const char *)&s);
break;
case 5:
for ( j = 0; j <= 7; ++j )
{
if ( j % 2 == 1 )
*(&f2 + j) -= 2;
else
--*(&f2 + j);
}
break;
default:
puts("emmm,you can't find flag 23333");
break;
}
}
return __readfsqword(0x28u) ^ v6;
}
flag拼接了f1和f2，f1直接给出，f2与s拼接，并做了case5的处理，注意0x7F666F6067756369LL是小端，逆序的，所以解密的时候要反过来
s = [0x7F, 0x66, 0x6F, 0x60, 0x67, 0x75, 0x63, 0x69][::-1]
flag = 'GXY{do_not_'
for i in range(8):
if i % 2 == 1:
s[i]-=2
else:
s[i]-=1
flag += chr(s[i])
print(flag)
十三、[HNCTF 2022 Week1]Little Endian
int __cdecl main(int argc, const char **argv, const char **envp)
{
char v4[36]; // [rsp+20h] [rbp-30h] BYREF
int i; // [rsp+44h] [rbp-Ch]
char *v6; // [rsp+48h] [rbp-8h]
_main();
puts("please input your flag");
scanf("%s", v4);
v6 = v4;
for ( i = 0; i <= 5; ++i )
{
if ( *(_DWORD *)v6 != (enc[i] ^ 0x12345678) )
{
printf("Data3rr0r!");
exit(0);
}
v6 += 4;
}
printf("you are right!");
return 0;
}直接从题目可以知道小端存储，即最低位的字节数据存在最低地址上，而次低位的字节数据按次序排列在次低的地址上，所以反着来就好。
enc = [1365706038, 1582239788, 2118132241, 2087782731, 2085961500, 1868183574]
flag = ''
l = []
for i in range(len(enc)):
flag = enc[i] ^ 0x12345678
l.append(hex(flag).replace('0x',''))
print(l)
for k in l:
i=len(k)-2
while i >= 0:
num = k[i:i + 2]
print(chr(int(num, 16)), end="")
i = i - 2
十四、[MoeCTF 2021]Realezpy
# uncompyle6 version 3.8.0
# Python bytecode 3.8.0 (3413)
# Decompiled from: Python 3.9.8 (tags/v3.9.8:bb3fdcf, Nov 5 2021, 20:48:33) [MSC v.1929 64 bit (AMD64)]
# Embedded file name: Ezpython.py
# Compiled at: 2021-07-28 10:01:40
# Size of source mod 2**32: 931 bytes
import time
c = [119, 121, 111, 109, 100, 112, 123, 74, 105, 100, 114, 48, 120, 95, 49, 99, 95, 99, 121, 48, 121, 48, 121, 48, 121, 48, 95, 111, 107, 99, 105, 125]
def decrypt(a):
result=[]
for i in range(len(a)):
if ord('a') <= a[i] <= ord('z'):
result.append((a[i] - 114 - ord('a')) % 26 + ord('a'))
elif ord('A') <= a[i] <= ord('Z'):
result.append((a[i] - 514 - ord('A')) % 26 + ord('A'))
else:
result.append(a[i])
else:
return result
result=decrypt(c)
flag=''
for i in result:
flag+=chr(i)
print(flag)十五、[HGAME 2023 week1]encode
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v4[100]; // [esp+0h] [ebp-1CCh] BYREF
char v5[52]; // [esp+190h] [ebp-3Ch] BYREF
int j; // [esp+1C4h] [ebp-8h]
int i; // [esp+1C8h] [ebp-4h]
memset(v5, 0, 0x32u);
memset(v4, 0, sizeof(v4));
sub_4011A0(a50s, (char)v5);
for ( i = 0; i < 50; ++i )
{
v4[2 * i] = v5[i] & 0xF;
v4[2 * i + 1] = (v5[i] >> 4) & 0xF;
}
for ( j = 0; j < 100; ++j )
{
if ( v4[j] != dword_403000[j] )
{
sub_401160(Format, v4[0]);
return 0;
}
}
sub_401160(aYesYouAreRight, v4[0]);
return 0;
}就是将输入的字符串一个字节切割成两部分，即每部分4个字节，然后对比，完全正确则正确。
c = [8, 6, 7, 6, 1, 6, 13, 6, 5, 6, 11, 7, 5, 6, 14, 6, 3, 6, 15, 6, 4, 6, 5, 6, 15, 5, 9, 6, 3, 7, 15, 5, 5, 6, 1, 6,
3, 7, 9, 7, 15, 5, 6, 6, 15, 6, 2, 7, 15, 5, 1, 6, 15, 5, 2, 7, 5, 6, 6, 7, 5, 6, 2, 7, 3, 7, 5, 6, 15, 5, 5, 6,
14, 6, 7, 6, 9, 6, 14, 6, 5, 6, 5, 6, 2, 7, 13, 7, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
flag = ''
for i in range(50):
t = (c[i * 2 + 1] << 4) + c[i * 2]
flag += chr(t)
print(flag)
十六、[GFCTF 2021]easy_low
直接对APK进行反编译：
package com.example.ndktest;
import android.content.Context;
import android.content.Intent;
import android.os.Bundle;
import android.view.View;
import android.view.View.OnClickListener;
import android.widget.Button;
import android.widget.EditText;
import android.widget.TextView;
import android.widget.Toast;
import androidx.appcompat.app.AppCompatActivity;
public class MainActivity extends AppCompatActivity
{
public EditText editText1;
private EditText editText2;
private TextView textView1;
public byte[] encode(String paramString, byte[] paramArrayOfByte)
{
byte[] arrayOfByte1 = paramString.getBytes();
byte[] arrayOfByte2 = new byte[16];
int i = 0;
int k;
for (int j = 0; ; j++)
{
k = i;
if (j >= 16)
break;
arrayOfByte2[j] = (byte)((arrayOfByte1[j] + paramArrayOfByte[j]) % 61);
}
while (k < 16)
{
arrayOfByte2[k] = (byte)(arrayOfByte2[k] * 2 - k);
k++;
}
if (new String(arrayOfByte2).equals(paramString))
return arrayOfByte2;
return paramString.getBytes();
}
protected void onCreate(Bundle paramBundle)
{
super.onCreate(paramBundle);
setContentView(2131427356);
this.textView1 = ((TextView)findViewById(2131231101));
this.editText1 = ((EditText)findViewById(2131230872));
this.editText2 = ((EditText)findViewById(2131230873));
((Button)findViewById(2131230807)).setOnClickListener(new View.OnClickListener()
{
public void onClick(View paramView)
{
String str1 = MainActivity.this.editText1.getText().toString();
String str2 = MainActivity.this.editText2.getText().toString();
if (str1.length() != 16)
{
MainActivity.this.toShow();
}
else if (str2.length() != 16)
{
MainActivity.this.toShow();
}
else
{
paramView = MainActivity.this.encode(str1, new byte[] { 23, 22, 26, 26, 25, 25, 25, 26, 27, 28, 30, 30, 29, 30, 32, 32 });
for (int i = 0; i < paramView.length; i++)
paramView[i] = (byte)(paramView[i] ^ 0x22);
Object localObject = new String(paramView).toCharArray();
paramView = "";
StringBuilder localStringBuilder;
for (i = 0; i < 10; i++)
{
localStringBuilder = new StringBuilder();
localStringBuilder.append(paramView);
localStringBuilder.append(localObject[i]);
paramView = localStringBuilder.toString();
}
localObject = new StringBuilder();
((StringBuilder)localObject).append(paramView);
((StringBuilder)localObject).append("_");
((StringBuilder)localObject).append(new String(new byte[] { 64, 48, 48, 49, 49 }));
if ((str2.equals(((StringBuilder)localObject).toString())) || (new O().v.equals("")))
{
paramView = new Intent(MainActivity.this, o0.class);
localObject = MainActivity.this;
localStringBuilder = new StringBuilder();
localStringBuilder.append("Welcome ");
localStringBuilder.append(str1);
localStringBuilder.append(" !");
Toast.makeText((Context)localObject, localStringBuilder.toString(), 0).show();
paramView.putExtra("TOKEN", str2);
MainActivity.this.startActivity(paramView);
}
}
}
});
}
public void toShow()
{
Toast.makeText(this, "Wrong! Please Retry!", 0).show();
}
}根据逻辑可以求出用户名和密码，然后将密码通过Intent传到了o0类
paramArrayOfByte = [23, 22, 26, 26, 25, 25, 25, 26, 27, 28, 30, 30, 29, 30, 32, 32]
paramArrayOfByte2 = []
username = ''
def check(a, b):
if ((a + paramArrayOfByte[b]) % 61) * 2 - b == a:
return True
else:
return False
for i in range(16):
for j in range(128):
if check(j, i):
username += chr(j)
print(username)
password = ''
paramview = ""
for k in username:
password += chr(ord(k) ^ 0x22)
for g in range(10):
r = ''
r += paramview
r += password[g]
paramview = r
localObject=""
localObject+=paramview
localObject+='_'
a=[64, 48, 48, 49, 49 ]
for l in a:
localObject+=chr(l)
print(localObject)
账号密码分别为LOHILMNMLKHILKHI、nmjknoloni_@0011
然后发现这里o0类又把密码传到了b类
b类调用了f类的一个oho方法，这个方法找不到，应该在so文件中，通过它加密后，如果返回true则表示获取flag成功，传入的参数是密码、用户名和其它一个界面中EditText输入的内容，获取oho方法
int __cdecl Java_com_example_ndktest_f_oho(int a1, int a2, char *s, char *a4, char *dest)
{
char *v5; // edi
size_t v6; // esi
int v7; // esi
unsigned int i; // eax
char v9; // cc
int j; // esi
char *v11; // eax
size_t v13; // [esp+14h] [ebp-7548h]
char src[10000]; // [esp+18h] [ebp-7544h] BYREF
_BYTE v15[10000]; // [esp+2728h] [ebp-4E34h] BYREF
_BYTE v16[10000]; // [esp+4E38h] [ebp-2724h] BYREF
unsigned int v17; // [esp+7548h] [ebp-14h]
v17 = __readgsdword(0x14u);
__strcpy_chk(v16, s, 10000);
v5 = v15;
__strcpy_chk(v15, a4, 10000);
v13 = strlen(s);
v6 = v13 + strlen(a4);
v13 = v6 >> 1;
if ( v13 + strlen(dest) != 24 )
return 0;
v7 = v6 >> 2;
if ( v7 )
{
for ( i = 0; i < v7; i += 2 )
src[i] = v16[i];
v9 = v7 <= 1;
for ( j = v7 - 1; !v9; j -= 2 )
{
src[j] = *v5;
v5 += 2;
v9 = (j - 2 < 0) ^ __OFADD__(-2, j) | (j == 2);
}
}
v11 = strcat(dest, src);
return encode(v11, src);
}从源码中可以得知flag的长度是24，然后下面的逻辑就是将密码每次两位拼到src中，用户名则是倒置过来，每两位拼接到src中，最后将src和第三方输入的内容拼接，执行encode方法
char __cdecl encode(char *s, char *a2)
{
char *v2; // ebx
__m128i v3; // xmm0
__m128i v4; // xmm0
int v5; // edi
_DWORD *v6; // eax
size_t i; // esi
char v8; // cl
int v9; // eax
int v10; // edi
_DWORD *v12; // [esp+Ch] [ebp-40h]
__m128i v13; // [esp+10h] [ebp-3Ch]
int v14; // [esp+20h] [ebp-2Ch]
int v15; // [esp+24h] [ebp-28h]
unsigned int v16; // [esp+38h] [ebp-14h]
v2 = s;
v16 = __readgsdword(0x14u);
v3 = _mm_cvtsi32_si128(*(_DWORD *)(a2 + 1));
v4 = _mm_unpacklo_epi8(v3, v3);
v13 = _mm_srai_epi32(_mm_unpacklo_epi16(v4, v4), 0x18u);
v14 = a2[5];
v15 = a2[6];
v5 = 0;
v6 = &unk_7EC;
for ( i = 0; ; i += 4 )
{
v12 = v6;
if ( i >= strlen(v2) )
break;
v2 = s;
v8 = v13.m128i_i8[i];
v9 = __ROL4__(__ROR4__((s[i + 1] << 16) | ((unsigned __int8)s[i] << 24) | (s[i + 2] << 8) | s[i + 3], v8), 16);
v10 = v5 ^ 0xFFFF;
if ( !i )
v10 = 0xFFFF;
v5 = v9 ^ v10 ^ (1 << v8);
v6 = v12 + 1;
if ( v5 != *v12 )
return 0;
}
return 1;
}这里encode看不太懂，贴个官方WP
#include <bits/stdc++.h>
using namespace std;
int main() {
char key1[]={"nNjLnHlL"};
int count=1;
int key[7];//nNjLnHlL
for (int i = 0; i < 6; ++i) {
key[i] = key1[count];
count++;
}
unsigned int ks[6]={0x5d950ef2,0x86cca2de,0xc039bbf4,0xc5948102,0xaed55e9c,0x89f14377};
unsigned int k=0,bk=0;
unsigned int p[4];
for(int i=5;i>=0;i--)
if(i>0) ks[i]^=ks[i-1];
for(int i=0;i<24;i+=4){
k=ks[i/4];
k=(1<<key[i/4])^k;
k=((k>>16)) | ((~(k<<16))&0xffff0000);
k=((k<<key[i/4])) | (k>>(32-key[i/4]));
for(int j=0; j<4; j++) printf("%c", *((char*)&k+3-j));
}
return 0;
}得到flag WelCOme_To_mAkaBakA!BrO!
十七、[HGAME 2022 week1]easyasm
直接就是一段汇编
dseg:0000 ; Segment type: Pure data
dseg:0000 dseg segment para public 'DATA' use16
dseg:0000 assume cs:dseg
dseg:0000 aHgameFillInYou db 'hgame{Fill_in_your_flag}',0
dseg:0019 db 0
dseg:001A db 0
dseg:001B db 0
dseg:001C db 0
dseg:001D db 0
dseg:001E db 0
dseg:001F db 0
dseg:0020 db 0
dseg:0021 db 0
dseg:0022 db 0
dseg:0023 db 0
dseg:0024 db 0
dseg:0025 db 0
dseg:0026 db 0
dseg:0027 db 0
dseg:0028 db 0
dseg:0029 db 0
dseg:002A db 0
dseg:002B db 0
dseg:002C db 0
dseg:002D db 0
dseg:002E db 0
dseg:002F db 0
dseg:002F dseg ends
dseg:002F
seg001:0000 ; ===========================================================================
seg001:0000
seg001:0000 ; Segment type: Regular
seg001:0000 seg001 segment byte public 'UNK' use16
seg001:0000 assume cs:seg001
seg001:0000 assume es:nothing, ss:nothing, ds:dseg, fs:nothing, gs:nothing
seg001:0000 db 91h
seg001:0001 db 61h ; a
seg001:0002 db 1
seg001:0003 db 0C1h
seg001:0004 db 41h ; A
seg001:0005 db 0A0h
seg001:0006 db 60h ; `
seg001:0007 db 41h ; A
seg001:0008 db 0D1h
seg001:0009 db 21h ; !
seg001:000A db 14h
seg001:000B db 0C1h
seg001:000C db 41h ; A
seg001:000D db 0E2h
seg001:000E db 50h ; P
seg001:000F db 0E1h
seg001:0010 db 0E2h
seg001:0011 db 54h ; T
seg001:0012 db 20h
seg001:0013 db 0C1h
seg001:0014 db 0E2h
seg001:0015 db 60h ; `
seg001:0016 db 14h
seg001:0017 db 30h ; 0
seg001:0018 db 0D1h
seg001:0019 db 51h ; Q
seg001:001A db 0C0h
seg001:001B db 17h
seg001:001C db 0
seg001:001D db 0
seg001:001E db 0
seg001:001F db 0
seg001:001F seg001 ends
seg001:001F
seg002:0000 ; ===========================================================================
seg002:0000
seg002:0000 ; Segment type: Uninitialized
seg002:0000 seg002 segment byte stack 'STACK' use16
seg002:0000 assume cs:seg002
seg002:0000 assume es:nothing, ss:nothing, ds:dseg, fs:nothing, gs:nothing
seg002:0000 db 80h dup(0)
seg002:0000 seg002 ends
seg002:0000
seg003:0000 ; ===========================================================================
seg003:0000
seg003:0000 ; Segment type: Pure code
seg003:0000 seg003 segment byte public 'CODE' use16
seg003:0000 assume cs:seg003
seg003:0000 assume es:nothing, ss:seg002, ds:nothing, fs:nothing, gs:nothing
seg003:0000
seg003:0000 ; =============== S U B R O U T I N E =======================================
seg003:0000
seg003:0000 ; Attributes: noreturn
seg003:0000
seg003:0000 public start
seg003:0000 start proc near
seg003:0000 mov ax, seg dseg
seg003:0003 mov ds, ax
seg003:0005 assume ds:dseg
seg003:0005 mov ax, seg seg001
seg003:0008 mov es, ax
seg003:000A assume es:seg001
seg003:000A mov si, 0
seg003:000D
seg003:000D loc_100DD: ; CODE XREF: start+38↓j
seg003:000D cmp si, 1Ch
seg003:0010 jz short loc_10135
seg003:0012 xor ax, ax
seg003:0014 mov al, [si]
seg003:0016 shl al, 1
seg003:0018 shl al, 1
seg003:001A shl al, 1
seg003:001C shl al, 1
seg003:001E push ax
seg003:001F xor ax, ax
seg003:0021 mov al, [si]
seg003:0023 shr al, 1
seg003:0025 shr al, 1
seg003:0027 shr al, 1
seg003:0029 shr al, 1
seg003:002B pop bx
seg003:002C add ax, bx
seg003:002E xor ax, 17h
seg003:0031 add si, 1
seg003:0034 cmp al, es:[si-1]
seg003:0038 jz short loc_100DD
seg003:003A mov ax, 0B800h
seg003:003D mov es, ax
seg003:003F assume es:nothing
seg003:003F mov byte ptr es:0, 77h ; 'w'
seg003:0045 mov byte ptr es:2, 72h ; 'r'
seg003:004B mov byte ptr es:4, 6Fh ; 'o'
seg003:0051 mov byte ptr es:6, 6Eh ; 'n'
seg003:0057 mov byte ptr es:8, 67h ; 'g'
seg003:005D mov byte ptr es:0Ah, 21h ; '!'
seg003:0063
seg003:0063 loc_10133: ; CODE XREF: start:loc_10133↓j
seg003:0063 jmp short loc_10133
seg003:0065 ; ---------------------------------------------------------------------------
seg003:0065
seg003:0065 loc_10135: ; CODE XREF: start+10↑j
seg003:0065 mov ax, 0B800h
seg003:0068 mov es, ax
seg003:006A mov byte ptr es:0, 72h ; 'r'
seg003:0070 mov byte ptr es:2, 69h ; 'i'
seg003:0076 mov byte ptr es:4, 67h ; 'g'
seg003:007C mov byte ptr es:6, 68h ; 'h'
seg003:0082 mov byte ptr es:8, 74h ; 't'
seg003:0088 mov byte ptr es:0Ah, 21h ; '!'
seg003:008E
seg003:008E loc_1015E: ; CODE XREF: start:loc_1015E↓j
seg003:008E jmp short loc_1015E
seg003:008E start endp
seg003:008E
seg003:008E seg003 ends
seg003:008E
seg003:008E
seg003:008E end start
seg001是一串列表串，然后按dsg的英文意思应该是你填入的字符串，整个流程就是将ax清零，然后从数据段中拿出数据，向左偏移4，压入栈中，再清零ax，再从数据段中拿出数据，再向右偏移4，将栈中的数据拿出给bx，ax+bx，再拿ax与17进行异或，最后进行比较。
l = [0x91, 0x61, 0x01, 0xC1, 0x41, 0xA0, 0x60, 0x41, 0xD1, 0x21, 0x14, 0xC1, 0x41, 0xE2, 0x50, 0xE1, 0xE2, 0x54, 0x20,
0xC1, 0xE2, 0x60, 0x14, 0x30, 0xD1, 0x52, 0xC0, 0x17]
flag = ''
for i in l:
temp = i ^ 0x17
flag += chr((temp >> 4) + ((temp << 4)%128))
print(flag) ~ ~ The End ~ ~
文章标题：Reverse入门[不断记录]
文章链接：https://aiwin.fun/index.php/archives/2288/
最后编辑：2024 年 1 月 4 日 16:57 By Aiwin
许可协议： 署名-非商业性使用-相同方式共享 4.0 国际 (CC BY-NC-SA 4.0)