攻防世界 reverse 进阶 12 ReverseMe-120
程序流程很清晰
1 int __cdecl main(int argc, const char **argv, const char **envp) 2 { 3 unsigned int v3; // edx 4 unsigned int i; // ecx 5 __m128i v5; // xmm1 6 unsigned int v6; // esi 7 const __m128i *v7; // eax 8 __m128i v8; // xmm0 9 int v9; // eax 10 char sc; // [esp+0h] [ebp-CCh] 11 char str; // [esp+1h] [ebp-CBh] 12 char s_; // [esp+64h] [ebp-68h] 13 char v14; // [esp+65h] [ebp-67h] 14 unsigned int de_s_len; // [esp+C8h] [ebp-4h] 15 16 printf("please input your flah:"); 17 sc = 0; 18 memset(&str, 0, 0x63u); 19 scanf("%s", &sc); 20 s_ = 0; 21 memset(&v14, 0, 0x63u); 22 sub_401000(&de_s_len, &s_, (unsigned __int8 *)&sc, strlen(&sc));// base64解码 23 v3 = de_s_len; // 解码后长度 24 i = 0; 25 if ( de_s_len ) 26 { 27 if ( de_s_len >= 0x10 ) 28 { 29 v5 = _mm_load_si128((const __m128i *)&xmmword_414F20); 30 v6 = de_s_len - (de_s_len & 0xF); 31 v7 = (const __m128i *)&s_; 32 do 33 { 34 v8 = _mm_loadu_si128(v7); 35 i += 16; 36 ++v7; 37 _mm_storeu_si128((__m128i *)&v7[-1], _mm_xor_si128(v8, v5)); 38 } 39 while ( i < v6 ); 40 } 41 for ( ; i < v3; ++i ) 42 *(&s_ + i) ^= 0x25u; // 异或 43 } 44 v9 = strcmp(&s_, "you_know_how_to_remove_junk_code"); 45 if ( v9 ) 46 v9 = -(v9 < 0) | 1; 47 if ( v9 ) 48 printf("wrong\n"); 49 else 50 printf("correct\n"); 51 system("pause"); 52 return 0; 53 }
关键比较
strcmp(&s_, "you_know_how_to_remove_junk_code")向上跟踪，发现sub_401000(&de_s_len, &s_, (unsigned __int8 *)&sc, strlen(&sc));
进入函数分析可以发现是base64解码
1 signed int __usercall sub_401000@<eax>(unsigned int *a1@<edx>, _BYTE *a2@<ecx>, unsigned __int8 *sc, unsigned int size) 2 { 3 int j; // ebx 4 unsigned int k; // eax 5 int v6; // ecx 6 unsigned __int8 *v7; // edi 7 int v8; // edx 8 bool v9; // zf 9 unsigned __int8 v10; // cl 10 char v11; // cl 11 _BYTE *v12; // esi 12 unsigned int v13; // ecx 13 int v14; // ebx 14 unsigned __int8 v15; // cl 15 char v16; // dl 16 _BYTE *v18; // [esp+Ch] [ebp-Ch] 17 unsigned int *v19; // [esp+10h] [ebp-8h] 18 int v20; // [esp+14h] [ebp-4h] 19 unsigned int v21; // [esp+14h] [ebp-4h] 20 int sizea; // [esp+24h] [ebp+Ch] 21 22 j = 0; 23 v18 = a2; 24 k = 0; 25 v6 = 0; 26 v19 = a1; 27 v20 = 0; 28 if ( !size ) 29 return 0; 30 v7 = sc; 31 do 32 { 33 v8 = 0; 34 v9 = k == size; 35 if ( k < size ) 36 { 37 do 38 { 39 if ( sc[k] != ' ' ) 40 break; 41 ++k; // 不含空格 42 ++v8; 43 } 44 while ( k < size ); 45 v9 = k == size; 46 } 47 if ( v9 ) 48 break; 49 if ( size - k >= 2 && sc[k] == '\r' && sc[k + 1] == '\n' || (v10 = sc[k], v10 == '\n') ) 50 { 51 v6 = v20; 52 } 53 else 54 { 55 if ( v8 ) 56 return 0xFFFFFFD4; 57 if ( v10 == '=' && (unsigned int)++j > 2 ) 58 return 0xFFFFFFD4; 59 if ( v10 > 0x7Fu ) 60 return 0xFFFFFFD4; 61 v11 = byte_414E40[v10]; 62 if ( v11 == 0x7F || (unsigned __int8)v11 < '@' && j ) 63 return 0xFFFFFFD4; 64 v6 = v20++ + 1; 65 } 66 ++k; 67 } 68 while ( k < size ); 69 if ( !v6 ) 70 return 0; 71 v12 = v18; 72 v13 = ((unsigned int)(6 * v6 + 7) >> 3) - j; 73 if ( v18 && *v19 >= v13 ) 74 { 75 v21 = 3; 76 v14 = 0; 77 for ( sizea = 0; k; --k ) 78 { 79 v15 = *v7; 80 if ( *v7 != '\r' && v15 != '\n' && v15 != ' ' ) 81 { 82 v16 = byte_414E40[v15]; // 关键处理 83 v21 -= v16 == '@'; 84 v14 = v16 & 0x3F | (v14 << 6); 85 if ( ++sizea == 4 ) 86 { 87 sizea = 0; 88 if ( v21 ) 89 *v12++ = BYTE2(v14); 90 if ( v21 > 1 ) 91 *v12++ = BYTE1(v14); 92 if ( v21 > 2 ) 93 *v12++ = v14; 94 } 95 } 96 ++v7; 97 } 98 *v19 = v12 - v18; 99 return 0; 100 } 101 *v19 = v13; 102 return -42; 103 }
识别base64解码函数是这题主要的考点，之后的操作就很简单
流程：
base64解码-->异或-->strcmp(&s_, "you_know_how_to_remove_junk_code")
1 import base64 2 3 s = 'you_know_how_to_remove_junk_code' 4 tmp = '' 5 for i in range(len(s)): 6 tmp += chr(ord(s[i]) ^ 0x25) 7 print(base64.b64encode(tmp.encode('utf-8')))
XEpQek5LSlJ6TUpSelFKeldASEpTQHpPUEtOekZKQUA=
