2019看雪CTF 晋级赛Q2第四题wp
上次参加2019看雪CTF 晋级赛Q2卡在了这道题上，虽然逆出算法，但是方程不会解，哈哈哈哈，果然数学知识很重要呀，现在记录一下。
首先根据关键信息，根据错误提示字符串定位到这里：
1 int __thiscall guanjian_401EA0(CWnd *this) 2 { 3 CWnd *v1; // esi 4 int index; // eax 5 WCHAR String; // [esp+Ch] [ebp-310h] 6 char v5; // [esp+Eh] [ebp-30Eh] 7 char ptr; // [esp+20Ch] [ebp-110h] 8 char v7; // [esp+20Dh] [ebp-10Fh] 9 DWORD v8; // [esp+30Ch] [ebp-10h] 10 CWnd *v9; // [esp+310h] [ebp-Ch] 11 int v10; // [esp+314h] [ebp-8h] 12 DWORD flOldProtect; // [esp+318h] [ebp-4h] 13 14 v1 = this; 15 v9 = this; 16 String = 0; 17 memset(&v5, 0, 0x1FEu); 18 ptr = 0; 19 memset(&v7, 0, 0xFFu); 20 CWnd::GetDlgItemTextW(v1, 1000, &String, 20); 21 if ( wcslen(&String) == 16 ) 22 { 23 index = 0; 24 while ( !(*(&String + index) & 0xFF00) ) 25 { 26 *(&ptr + index) = *((_BYTE *)&String + 2 * index); 27 if ( ++index >= 16 ) 28 { 29 v8 = 64; 30 flOldProtect = 0; 31 VirtualProtect(sub_9D10E0, 0xD17u, 0x40u, &flOldProtect);// BOOL VirtualProtect( 32 // LPVOID lpAddress, 33 // DWORD dwSize, 34 // DWORD flNewProtect, 35 // PDWORD lpflOldProtect 36 // lpAddress，要改变属性的内存起始地址。 37 // 38 // dwSize，要改变属性的内存区域大小。 39 // 40 // flNewProtect，内存新的属性类型，设置为PAGE_EXECUTE_READWRITE（0x40）时该内存页为可读可写可执行。 41 // 42 // pflOldProtect，内存原始属性类型保存地址。 43 // 44 // 45 GetLastError(); 46 qmemcpy(sub_9D10E0, byte_B347B8, 0x330u); 47 VirtualProtect(sub_9D10E0, 0xD17u, flOldProtect, &v8); 48 if ( !GetLastError() ) 49 { 50 v10 = 0; 51 v10 = sub_9D10E0(); 52 if ( v10 == 1 ) 53 return CWnd::MessageBoxW(v9, L"Congratulations! You are right!", 0, 0); 54 } 55 v1 = v9; 56 return CWnd::MessageBoxW(v1, L"Wrong!", 0, 0); 57 } 58 } 59 } 60 return CWnd::MessageBoxW(v1, L"Wrong!", 0, 0); 61 }
注意到运行时先修改sub_9D10E0()代码段，然后再运行sub_9D10E0()，我们动态调试，dump出修改完成的sub_9D10E0()代码段
1 int __cdecl sub_9D10E0(char *input) 2 { 3 signed int i; // eax 4 char v2; // cl 5 signed int v3; // ecx 6 signed int v4; // eax 7 signed int low_index; // eax 8 signed int j; // esi 9 signed int k; // ecx 10 __int16 v8; // dx 11 char *buffer_ptr_; // edi 12 __int16 v10; // ax 13 signed int temp_1; // eax 14 signed int m_1; // ecx 15 unsigned __int16 t_3; // bx 16 signed int j_1; // esi 17 signed int k_1; // ecx 18 __int16 v16; // dx 19 char *buffer_ptr; // edi 20 __int16 t_4; // ax 21 signed int t; // eax 22 signed int m; // ecx 23 unsigned __int16 temp; // bx 24 unsigned int t_1; // eax 25 signed int i_2; // ecx 26 unsigned __int16 temp_2; // dx 27 char f; // dl 28 signed int i_1; // eax 29 __int16 t_2; // si 30 int index; // eax 31 char s_xor[17]; // [esp+8h] [ebp-90h] 32 int v31; // [esp+1Ch] [ebp-7Ch] 33 int v32; // [esp+20h] [ebp-78h] 34 int v33; // [esp+24h] [ebp-74h] 35 char x[8]; // [esp+28h] [ebp-70h] 36 char buffer[16]; // [esp+30h] [ebp-68h] 37 char y[8]; // [esp+40h] [ebp-58h] 38 char yy7_result[17]; // [esp+48h] [ebp-50h] 39 char result[17]; // [esp+5Ch] [ebp-3Ch] 40 char xx_result[17]; // [esp+70h] [ebp-28h] 41 char yy_result[17]; // [esp+84h] [ebp-14h] 42 43 s_xor[4] = 0x81u; 44 s_xor[11] = 0x81u; 45 i = 0; 46 s_xor[0] = 0x16; 47 s_xor[1] = -106; 48 s_xor[2] = -116; 49 s_xor[3] = -29; 50 s_xor[5] = -104; 51 s_xor[6] = 110; 52 s_xor[7] = 100; 53 s_xor[8] = 0x84u; 54 s_xor[9] = 8; 55 s_xor[10] = -36; 56 s_xor[12] = 0xBEu; 57 s_xor[13] = 77; 58 s_xor[14] = 72; 59 s_xor[15] = 79; 60 *(_DWORD *)&s_xor[16] = 0; 61 v31 = 0; 62 v32 = 0; 63 v33 = 0; 64 *(_DWORD *)x = 0; 65 *(_DWORD *)&x[4] = 0; 66 *(_DWORD *)y = 0; 67 *(_DWORD *)&y[4] = 0; 68 do 69 { // 先将输入分成两部分，记为x,y，然后进行异或操作， 70 v2 = s_xor[i + 8] ^ input[i + 8]; // 从输入的第9位开始处理，索引8-15 71 // 异或 72 x[i] = s_xor[i] ^ s_xor[i + input - s_xor]; // 输入的前8位 73 // 异或 74 y[i++] = v2; 75 } 76 while ( i < 8 ); 77 *(_DWORD *)s_xor = 0; 78 *(_DWORD *)xx_result = 0; 79 *(_DWORD *)&xx_result[4] = 0; 80 *(_DWORD *)&xx_result[8] = 0; 81 *(_DWORD *)&xx_result[12] = 0; 82 xx_result[16] = 0; 83 *(_DWORD *)yy_result = 0; 84 *(_DWORD *)&yy_result[4] = 0; 85 *(_DWORD *)&yy_result[8] = 0; 86 *(_DWORD *)&yy_result[12] = 0; 87 yy_result[16] = 0; 88 *(_DWORD *)yy7_result = 0; 89 *(_DWORD *)&yy7_result[4] = 0; 90 *(_DWORD *)&yy7_result[8] = 0; 91 *(_DWORD *)&yy7_result[12] = 0; 92 yy7_result[16] = 0; 93 *(_DWORD *)result = 0; 94 *(_DWORD *)&result[4] = 0; 95 *(_DWORD *)&result[8] = 0; 96 *(_DWORD *)&result[12] = 0; 97 result[16] = 0; 98 *(_DWORD *)&s_xor[4] = 0; 99 *(_DWORD *)&s_xor[8] = 0; 100 *(_DWORD *)&s_xor[12] = 0; 101 s_xor[16] = 0; 102 v3 = 8; 103 s_xor[0] = 8; 104 v4 = 7; 105 do 106 { 107 if ( x[v4] ) // x[7]!=0 108 break; 109 --v3; 110 --v4; 111 } 112 while ( v4 >= 0 ); 113 if ( v3 == 8 ) 114 { 115 low_index = 7; 116 do 117 { 118 if ( y[low_index] ) // y[7]!=0 119 break; 120 --v3; 121 --low_index; 122 } 123 while ( low_index >= 0 ); // 输入为16位 124 if ( v3 == 8 && !(x[7] & 0xF0) ) // 第8位<0x10 125 { 126 j = 0; 127 do 128 { 129 *(_DWORD *)buffer = 0; 130 *(_DWORD *)&buffer[4] = 0; 131 *(_DWORD *)&buffer[8] = 0; 132 *(_DWORD *)&buffer[12] = 0; 133 k = 0; 134 v8 = (unsigned __int8)x[j]; 135 buffer_ptr_ = &buffer[j]; 136 do 137 { 138 v10 = (unsigned __int8)buffer[j + 8] + v8 * (unsigned __int8)x[k]; 139 buffer_ptr_[k] = buffer[j + 8] + v8 * x[k]; 140 ++k; 141 buffer[j + 8] = HIBYTE(v10); 142 } 143 while ( k < 8 ); 144 LOBYTE(temp_1) = 0; 145 m_1 = 0; 146 do 147 { 148 t_3 = (char)temp_1 + (unsigned __int8)xx_result[m_1 + j] + (unsigned __int8)buffer_ptr_[m_1]; 149 xx_result[m_1++ + j] = t_3; 150 temp_1 = (signed int)t_3 >> 8; 151 } 152 while ( m_1 < 9 ); 153 ++j; // 先按字节乘，再加进位，和手算乘法原理一致 154 } 155 while ( j < 8 ); // 通过两层循环其实是为了计算大数相乘，这里算出x^2 156 j_1 = 0; 157 do 158 { 159 *(_DWORD *)buffer = 0; 160 *(_DWORD *)&buffer[4] = 0; 161 *(_DWORD *)&buffer[8] = 0; 162 *(_DWORD *)&buffer[12] = 0; 163 k_1 = 0; 164 v16 = (unsigned __int8)y[j_1]; 165 buffer_ptr = &buffer[j_1]; 166 do 167 { 168 t_4 = (unsigned __int8)buffer[j_1 + 8] + v16 * (unsigned __int8)y[k_1]; 169 buffer_ptr[k_1] = buffer[j_1 + 8] + v16 * y[k_1]; 170 ++k_1; 171 buffer[j_1 + 8] = HIBYTE(t_4); 172 } 173 while ( k_1 < 8 ); 174 LOBYTE(t) = 0; 175 m = 0; 176 do 177 { 178 temp = (char)t + (unsigned __int8)yy_result[m + j_1] + (unsigned __int8)buffer_ptr[m]; 179 yy_result[m++ + j_1] = temp; 180 t = (signed int)temp >> 8; 181 } 182 while ( m < 9 ); 183 ++j_1; // 这里计算出y^2 184 } 185 while ( j_1 < 8 ); 186 LOBYTE(t_1) = yy7_result[16]; 187 i_2 = 0; 188 do 189 { // 这里计算7*y^2 190 temp_2 = (unsigned __int8)t_1 + 7 * (unsigned __int8)yy_result[i_2]; 191 yy7_result[i_2++] = temp_2; 192 t_1 = (unsigned int)temp_2 >> 8; 193 } 194 while ( i_2 < 17 ); 195 yy7_result[16] = HIBYTE(temp_2); 196 f = 0; 197 i_1 = 0; 198 do 199 { 200 t_2 = (unsigned __int8)xx_result[i_1] - (unsigned __int8)yy7_result[i_1] - f; 201 result[i_1] = t_2; 202 if ( t_2 < 0 ) 203 f = 1; 204 ++i_1; 205 } 206 while ( i_1 < 17 ); 207 if ( !f ) 208 { 209 index = 0; 210 while ( result[index] == s_xor[index] ) // 这里相当于验证x^2-7*y^2==8 211 { 212 if ( ++index >= 17 ) 213 return 1; 214 } 215 } 216 } 217 } 218 return 0; 219 }
到这里思路已经很明确了，16位输入，分成两部分进行异或操作，验证x^2-7*y^2=8
限定条件为
0x100000000000000<x < 0x1000000000000000,（x为8字节，且第8字节<0x10）
0x100000000000000<y<x （y为8字节，）
在进行一步异或即可得到原输入
x^2-7*y^2=8为非标准佩尔方程，求解使用了wolframalpha
https://www.wolframalpha.com/input/?i=x%5E2-7y%5E2%3D8,72057594037927936%3Cx+%3C+1152921504606846976,72057594037927936%3Cy%3Cx
1 x=385044246406735194 2 y=145533045678356702 3 4 s_xor1=0x646e9881e38c9616 5 s_xor2=0x4f484dbe81dc0884 6 7 t1=hex(x^s_xor1)[2:] 8 t2=hex(y^s_xor2)[2:] 9 10 m1=[] 11 m2=[] 12 for i in range(0,16,2): 13 m1.append(int(t1[i:i+2],16)) 14 m2.append(int(t2[i:i+2],16)) 15 a=''.join(map(chr,m1)) 16 b=''.join(map(chr,m2)) 17 print(a[-1::-1]+b[-1::-1]) 18 # L3mZ2k9aZ0a36DMM
链接：https://pan.baidu.com/s/1ZpzCus2BdlSujkVRBQZZxQ
提取码：qrlz
复制这段内容后打开百度网盘手机App，操作更方便哦
