SSCTF2020 RE2
SSCTF2020 RE2
有时间做了一下SSCTF 2020的re2
附件地址：
链接：https://pan.baidu.com/s/1k5SuiJIHJzgYZVbc9hX8ZA
提取码：lyco
基本方法：动调
int sub_8310A0()
{
HANDLE v0; // esi
HMODULE v1; // eax
FARPROC v2; // eax
unsigned int v3; // ebx
__int64 v4; // rdi
signed int v5; // kr08_4
unsigned int v6; // ecx
unsigned int v7; // edx
unsigned int v8; // eax
unsigned int v9; // ecx
int v10; // eax
int v11; // edx
unsigned int v12; // ecx
char v13; // al
bool v14; // cf
unsigned int v15; // ecx
const char *v16; // eax
int v17; // eax
int v18; // edx
char v19; // cl
int v20; // edx
char v21; // ch
int v22; // eax
char v23; // cl
int v24; // eax
int v25; // edx
char v26; // ch
char v27; // cl
int v28; // kr28_4
signed int v29; // ecx
unsigned int v30; // ebx
unsigned int v31; // edi
unsigned int v32; // ecx
unsigned int v33; // eax
char v35; // [esp+13h] [ebp-125h]
char v36; // [esp+13h] [ebp-125h]
unsigned int v37; // [esp+14h] [ebp-124h]
int v38; // [esp+14h] [ebp-124h]
int v39; // [esp+18h] [ebp-120h]
char *v40; // [esp+1Ch] [ebp-11Ch]
unsigned int v41; // [esp+20h] [ebp-118h]
signed int v42; // [esp+2Ch] [ebp-10Ch]
int v43; // [esp+30h] [ebp-108h]
int v44; // [esp+34h] [ebp-104h]
int v45; // [esp+38h] [ebp-100h]
int v46; // [esp+3Ch] [ebp-FCh]
int v47; // [esp+40h] [ebp-F8h]
int v48; // [esp+44h] [ebp-F4h]
__int64 v49; // [esp+48h] [ebp-F0h]
int v50; // [esp+50h] [ebp-E8h]
int v51; // [esp+54h] [ebp-E4h]
char *v52; // [esp+58h] [ebp-E0h]
int v53; // [esp+64h] [ebp-D4h]
char v54; // [esp+68h] [ebp-D0h]
char v55; // [esp+69h] [ebp-CFh]
char v56[202]; // [esp+6Ah] [ebp-CEh]
sub_832260((__m128i *)&v54, 0, 0xC8u);
v43 = 0x3B082235;
v44 = 0xFCF20A00;
v45 = 0xE2EED037;
v46 = 0xF3FEFAD6;
v47 = 0xC2101FF5;
v48 = 0xD703FBEC;
v49 = 0xE029FC16FCC9E2FCi64;
v50 = 0xFE1134F0;
LOWORD(v51) = 0x2761;
BYTE2(v51) = 39;
v0 = GetCurrentThread();
v1 = LoadLibraryA("ntdll.dll");
v2 = GetProcAddress(v1, "ZwSetInformationThread");// 反调试,直接修改EIP绕过
((void (__stdcall *)(HANDLE, signed int, _DWORD, _DWORD))v2)(v0, 17, 0, 0);
sub_831020((int)"Pls Input Your Flag:");
sub_831060("%s", &v54, 39);
v3 = (signed int)&v54 >> 31;
HIDWORD(v4) = &v54;
LODWORD(v4) = &v54;
v52 = &v54;
v40 = &v54;
v5 = strlen(&v54);
v53 = v5;
if ( v5 > 0 )
{
v6 = 0;
v37 = 0;
v41 = 0;
do
{
do
{
v7 = v37;
v8 = v41 - 7 * (v6 / 7);
v9 = v41;
*(&v54 + v41) = (*(&v54 + v41) ^ aDdxtqkl[v8]) + 65;// 进行第一次加密，即将输入与对应字符串进行取余异或加65
v10 = v41++;
v37 = (__PAIR__(v37, v9) + 1) >> 32;
v6 = v9 + 1;
}
while ( v5 - 1 != v10 );
}
while ( v7 );
v38 = 0;
HIDWORD(v4) = (signed int)&v54 >> 31;
do
{
v35 = *(_BYTE *)(v4 + 3);
v11 = (unsigned __int64)(v4 + 3) >> 32;
v12 = v4 + 3;
LODWORD(v4) = v4 + 3;
do
{
v13 = *(_BYTE *)(v4 - 1);
v14 = v12-- != 0; // 第二次加密，即分组，每组四位 将每组第四位放在第一位，前三个顺延，即1->2,2->3,3->4
LODWORD(v4) = v12;
v11 = v14 + v11 - 1;
*(_BYTE *)(v12 + 1) = v13;
}
while ( __PAIR__(HIDWORD(v4), v12) != __PAIR__(v11, (unsigned int)v40) );
LODWORD(v4) = v40;
v38 += 4;
*v40 = v35;
v40 += 4;
v4 += 4i64;
}
while ( v53 > v38 );
HIDWORD(v4) = v52;
v3 = (signed int)&v54 >> 31;
}
v15 = 0;
while ( *((_BYTE *)&v43 + v15) == ((unsigned __int8)*(&v54 + v15) ^ 0x61) )// change[0]^0x61与v43[0]
{
if ( *((_BYTE *)&v43 + v15 + 1) != ((unsigned __int8)*(&v55 + v15) ^ 0x61) )// change[1]^0x61与v43[1]
{
++v15;
break;
}
if ( *((_BYTE *)&v43 + v15 + 2) != ((unsigned __int8)v56[v15] ^ 0x61) )// change[2]^0x61与v43[2]
{
v15 += 2;
break;
}
v15 += 3;
if ( v15 >= 39 )
break;
}
v16 = "wtf?\n";
if ( v15 == 39 )
v16 = "you got it!\n";
sub_831020((int)v16);
sub_8395C1("pause");
v42 = 10;
do
{
v36 = *(_BYTE *)(HIDWORD(v4) + 3);
LODWORD(v4) = HIDWORD(v4) + 3;
v17 = __CFADD__(HIDWORD(v4), 3) + v3;
v18 = HIDWORD(v4) + 3;
do
{
v19 = *(_BYTE *)(v18 - 1);
v14 = (_DWORD)v4 != 0;
LODWORD(v4) = v4 - 1;
v18 = v4;
v17 = v14 + v17 - 1;
*(_BYTE *)(v4 + 1) = v19;
}
while ( __PAIR__(HIDWORD(v4), v3) != __PAIR__(v4, v17) );
LODWORD(v4) = HIDWORD(v4) + 3;
v20 = HIDWORD(v4) + 3;
*(_BYTE *)HIDWORD(v4) = v36;
v21 = *(_BYTE *)(HIDWORD(v4) + 3);
v22 = __CFADD__(HIDWORD(v4), 3) + v3;
do
{
v23 = *(_BYTE *)(v20 - 1);
v14 = (_DWORD)v4 != 0;
LODWORD(v4) = v4 - 1;
v20 = v4;
v22 = v14 + v22 - 1;
*(_BYTE *)(v4 + 1) = v23;
}
while ( __PAIR__(HIDWORD(v4), v3) != __PAIR__(v4, v22) );
v24 = HIDWORD(v4) + 3;
v25 = __CFADD__(HIDWORD(v4), 3) + v3;
LODWORD(v4) = HIDWORD(v4) + 3;
*(_BYTE *)HIDWORD(v4) = v21;
v26 = *(_BYTE *)(HIDWORD(v4) + 3);
do
{
do
{
v27 = *(_BYTE *)(v4 - 1);
v14 = v24-- != 0;
LODWORD(v4) = v24;
v25 = v14 + v25 - 1;
*(_BYTE *)(v24 + 1) = v27;
}
while ( HIDWORD(v4) != v24 );
}
while ( v3 != v25 );
*(_BYTE *)HIDWORD(v4) = v26;
v28 = HIDWORD(v4) + 4;
v3 = (__PAIR__(v3, HIDWORD(v4)) + 4) >> 32;
HIDWORD(v4) += 4;
--v42;
}
while ( v42 );
v29 = strlen((const char *)(v28 - 40));
if ( v29 > 0 )
{
*(_QWORD *)&v52 = 0i64;
v30 = 0;
v31 = 0;
v39 = v29 - 1;
do
{
do
{
v32 = v30;
*(_BYTE
*)(v31 + v28 - 40) = aDdxtqkl[v31 % 7] ^ (*(_BYTE *)(v31 + v28 - 40) - 65);
v33 = v31;
v30 = (__PAIR__(v30, v31++) + 1) >> 32;
}
while ( v39 != v33 );
}
while ( v32 );
}
return 0;
}
最底下的迷惑语句不需要管，找到出口就行
#include <stdio.h>
#include <string.h>
int main()
{
char s[]="dDxtQkl";
unsigned char ida_chars[] =
{
0x35, 0x22, 0x08, 0x3B, 0x00, 0x0A, 0xF2, 0xFC, 0x37, 0xD0,
0xEE, 0xE2, 0xD6, 0xFA, 0xFE, 0xF3, 0xF5, 0x1F, 0x10, 0xC2,
0xEC, 0xFB, 0x03, 0xD7, 0xFC, 0xE2, 0xC9, 0xFC, 0x16, 0xFC,
0x29, 0xE0, 0xF0, 0x34, 0x11, 0xFE,0x61,0x27,0x27
};
int i=0;
int j=0,tmp;
for(i=0;i<39;i++){
ida_chars[i]^=0x61;
}
for(i=0;i<39;i=i+4){
tmp=ida_chars[i];
ida_chars[i]=ida_chars[i+1];
ida_chars[i+1]=ida_chars[i+2];
ida_chars[i+2]=ida_chars[i+3];
ida_chars[i+3]=tmp;
}
for(i=0;i<39;i++){
printf("%c",(ida_chars[i]-65)^s[i%7]);
}
return 0;
}
