西湖论剑 2023
西湖论剑 2023
搞了一天出了俩逆向，还有一个没交上…
1. Dual personality
类似天堂之门，
将cs段寄存器设为0x33，切换到64位模式；设为0x23，切换回32位模式。
32位、64位模式切换。有反调试，静态分析即可。
import struct
target = bytes.fromhex('AA4F0FE2E44199542C2B847EBC8F8B78D373885EAE47857031B309CE13F50DCA')
key0 = [4, 0x77, 0x82, 0x4a]
key1 = [0xc, 0x22, 0x38, 0x0E]
key2 = (0x5df966ae - 0x21524111) & 0xffffffff
flag = [target[_] ^ key0[_ % 4] for _ in range(32)]
for i in range(4):
v, = struct.unpack('<Q', bytes(flag[i * 8: (i + 1) * 8]))
nv = (v >> key1[i]) | (v << (64 - key1[i])) & 0xffffffffffffffff
vv = struct.pack('<Q', nv)
for j in range(8):
flag[i * 8 + j] = vv[j]
for i in range(8):
v, = struct.unpack('<L', bytes(flag[i * 4: (i + 1) * 4]))
nv = (v - key2) & 0xffffffff
key2 ^= v
vv = struct.pack('<L', nv)
for j in range(4):
flag[i * 4 + j] = vv[j]
print(''.join(chr(c) for c in flag))
2. Easy VT
总结一句话，逆向出 flag 很简单，但是在比赛已经结束的情况下，让我去测试这个 flag 是正确的，可以说是难死我了。
根据上述参考材料，关键在于这里。
int sub_401C90()
{
int len; // [esp+4h] [ebp-Ch]
int cmd; // [esp+8h] [ebp-8h]
cmd = vmread_from(0x4402); // vmexit 事件，指令
len = vmread_from(0x440C); // 指令长度
FREG__ = vmread_from(0x6820);
ESP__ = vmread_from(0x681C);
dword_4040C0 = vmread_from(0x681E);
switch ( cmd )
{
case 10:
sub_401180();
break;
case 18: // vmcall
sub_401250();
break;
case 19:
sub_4012B0(); // vm_clear
break;
case 20: // launch
sub_401450();
break;
case 21: // vm_ptrld
sub_4017B0();
break;
case 22: // vm_ptrst
set_real_value();
break;
case 23: // vmread
sub_401970();
break;
case 24: // vmresume
tea();
break;
case 25: // wmwrite 指令
sub_401A90();
break;
case 26: // vmx_off 指令
final_check();
break;
case 27: // vmx_on 指令
sub_401610();
break;
case 28:
sub_4011D0();
break;
default:
break;
}
vmwrite_to(0x681E, len + dword_4040C0);
vmwrite_to(0x681C, ESP__);
return vmwrite_to(0x6820, FREG__);
}
根据下图中指令的顺序，可以得出正确的分支执行顺序
发现是 rc4(标准) + tea(变种)，中间还有v0 和 v1的来回交换。脚本如下
import ctypes
from Crypto.Cipher import ARC4
import struct
flag = [0x94, 0x39, 0x07, 0x5C, 0xB3, 0x5C, 0x80, 0x0D, 0x86, 0xA5, 0xDD, 0x87, 0x8E, 0xFB, 0x17, 0x03, 0x29, 0xEF,
0x20, 0x65, 0xAF, 0x87, 0x49, 0x5A, 0xA4, 0xC2, 0x2D, 0xEB, 0x0E, 0x47, 0xCF, 0x38]
tea_key = [0x00102030, 0x40506070, 0x8090A0B0, 0xC0D0E0F0]
key3 = tea_key[1]
key2 = tea_key[3]
key1 = tea_key[2]
key0 = tea_key[0]
def tea_dec(v0, v1):
value_0 = ctypes.c_uint32(v0)
value_1 = ctypes.c_uint32(v1)
delta = ctypes.c_uint32(0xC95D6ABF)
sum_ = ctypes.c_uint32(0x20000000 - delta.value * 32)
for i in range(32):
sum_.value += delta.value
value_1.value -= (key0 + (value_0.value >> 5)) ^ (sum_.value + value_0.value) ^ (key1 + 16 * value_0.value)
value_0.value += (key2 + (value_1.value >> 5)) ^ (sum_.value + value_1.value) ^ (key3 + 16 * value_1.value)
return value_0.value, value_1.value
def rc4_dec(v):
rc4_key = b'04e52c7e31022b0b'
rc4 = ARC4.new(rc4_key)
return rc4.decrypt(v)
for i in range(4):
v0, v1 = struct.unpack('<LL', bytes(flag[i * 8: (i + 1) * 8]))
nv0, nv1 = tea_dec(v0, v1)
v = struct.pack('<LL', nv1, nv0)
nv0, nv1 = struct.unpack('<LL', rc4_dec(v))
v = struct.pack('<LL', nv1, nv0)
for j in range(8):
flag[i * 8 + j] = v[j]
print(''.join(chr(i) for i in flag))
关键：咋跑起来？
win11 、 win7 驱动后跑不起来，应该是签名的问题反正死活折腾不上去。最后无奈装了 xp，安装了一系列的 dll，补齐环境之后，发现驱动是跑起来了， Guest.exe 又不兼容了，我 ******。但是还好，我写个兼容的就是了
#include <stdio.h>
int main() {
char buff[100];
gets(buff);
int EAX;
for (int i = 0;; ++i) {
if (i >= 4) {
printf("Good, the flag is DASCTF{your input}\n");
return 0;
}
__asm__ __volatile__("mov eax, %1;"
"mov ecx, %2;"
"mov esi, [eax+ecx*8];"
"mov edi, [eax+ecx*8+4];"
"vmxon qword ptr [esp];"
"vmclear qword ptr [esp];"
"vmptrld qword ptr [esp];"
"vmwrite eax, ecx;"
"vmlaunch;"
"vmread ecx, eax;"
"vmcall;"
"vmptrst qword ptr [esp];"
"vmresume;"
"vmxoff;"
"mov %0, eax":"=r"(EAX):"r"(&buff), "r"(i));
if (!EAX)
break;
}
printf("Wrong flag\n");
return 0;
}
最后，经过一天的折腾终于….
3. Berkeley
bpf 逆向，参考 bpf,ebpf一些原理以及逆向基于libbpf-bootstrap编写的bpf文件
状态不太好，先是忽略了 BitVec 是有符号数，然后是迟迟没有想到去爆破。
cipher = [0xf3, 0x27, 0x47, 0x1b, 0x8f, 0x09, 0xfb, 0x17, 0x70, 0x48, 0xb0, 0x53, 0x32, 0xdb, 0xc0, 0xb8, 0x63, 0x2d,
0x40, 0x4b, 0xf5, 0x16, 0xf0, 0x35, 0xe7, 0xdf, 0xea, 0xa2, 0x9c, 0x41, 0xb3, 0x25, 0xd7, 0x0c, 0x33, 0x9c,
0x7b, 0x5a, 0xcd, 0x13, 0xbb, 0xee, 0x3e, 0x0e, 0xf2, 0xcf, 0x35, 0xda, 0xaf, 0xa2, 0x66, 0x7d, 0x38, 0x37,
0x67, 0x1e, 0x1f, 0x6b, 0x7b, 0x30, 0x0b, 0x7a, 0x02, 0xa9, 0xc8, 0x61, 0x27, 0x41, 0xdb, 0x01, 0x22, 0x31,
0x6f, 0xb6, 0xd4, 0x1b, 0x04, 0xd3, 0x94, 0xb8, 0x46, 0xc7, 0x24, 0xcf, 0xbd, 0xaf, 0x0b, 0xdc, 0x2e, 0xbb,
0xb2, 0x71, 0xf4, 0x99, 0x57, 0x36, 0xd1, 0x95, 0x52, 0x92, 0xba, 0x6d, 0xf3, 0x30, 0x50, 0x59, 0x9b, 0xea,
0x2f, 0x83, 0xdc, 0xf0, 0xde, 0x57, 0xa1, 0xac, 0xd2, 0x51, 0xa2, 0x1d, 0x59, 0xa8, 0x00, 0xb6, 0xe2, 0x65,
0x41, 0x0c, 0x4f, 0xeb, 0xf0, 0x2e, 0x58, 0x2a, 0x1f, 0xf4, 0x95, 0x72, 0x88, 0x7c, 0xa9, 0x0e, 0xcb, 0x3c,
0x42, 0xb9, 0xf3, 0x49, 0x9b, 0x52, 0x98, 0x12, 0xa3, 0x17, 0x51, 0xc0, 0x59, 0x40, 0x0a, 0xbc, 0xe8, 0x4c,
0x04, 0xfb, 0x13, 0x0a, 0x17, 0x3f, 0xe6, 0x36, 0x97, 0xdf, 0xb3, 0xe2, 0x42, 0x7f, 0xf8, 0xcc, 0x0e, 0xd1,
0x77, 0xc4, 0xa8, 0x46, 0x48, 0xe3, 0xf1, 0x0a, 0xef, 0x94, 0x56, 0x54, 0x5b, 0xca, 0xbd, 0xdd, 0x7f, 0x56,
0x47, 0xc2, 0x99, 0xfa, 0x89, 0xcc, 0xe1, 0xb9, 0x3a, 0x78, 0xe2, 0x37, 0x58, 0x01, 0x1b, 0xc3, 0x4b, 0xe6,
0x8c, 0xf3, 0xe5, 0xb6, 0x71, 0x9e, 0x63, 0xaf, 0x11, 0xce, 0x87, 0xf6, 0x6e, 0xde, 0xc8, 0xb1, 0xd0, 0x7a,
0x15, 0x6c, 0x10, 0x08, 0x99, 0x7b, 0x22, 0x55, 0x10, 0x7a, 0x82, 0x73, 0xfc, 0x62, 0xcb, 0x34, 0xa7, 0xb7,
0x62, 0xfa, 0x6b, 0x9f]
key = [0xc1, 0xd1, 0x02, 0x61, 0xd6, 0xf7, 0x13, 0xa2, 0x9b, 0x20, 0xd0, 0x4a, 0x8f, 0x7f, 0xee, 0xb9, 0x00, 0x63, 0x34,
0xb0, 0x33, 0xb7, 0x8a, 0x8b, 0x94, 0x60, 0x2e, 0x8e, 0x21, 0xff, 0x90, 0x82, 0xd5, 0x87, 0x96, 0x78, 0x22, 0xb6,
0x48, 0x6c, 0x45, 0xc7, 0x5a, 0x16, 0x80, 0xfd, 0xe4, 0x8c, 0xbf, 0x01, 0x1f, 0x4b, 0x79, 0x24, 0xa0, 0xb4, 0x23,
0x4d, 0x3b, 0xc5, 0x5d, 0x6f, 0x0d, 0xc9, 0xd4, 0xca, 0x55, 0xe0, 0x39, 0xad, 0x2b, 0xcd, 0x2c, 0xec, 0xc2, 0x6b,
0x30, 0xe6, 0x0c, 0xa8, 0x9a, 0x2f, 0xf6, 0xe8, 0xbb, 0x32, 0x57, 0xfb, 0x0b, 0x9d, 0xf2, 0x3f, 0xb5, 0xf9, 0x59,
0xe5, 0x10, 0xcf, 0x51, 0x41, 0xe9, 0x50, 0xdf, 0x26, 0x74, 0x58, 0xcb, 0x64, 0x54, 0x73, 0xab, 0xf4, 0xb2, 0x9f,
0x18, 0xf8, 0x4e, 0xfe, 0x08, 0x1d, 0x4f, 0x49, 0xd3, 0xac, 0x38, 0x12, 0x77, 0x11, 0x69, 0x07, 0x1c, 0x99, 0xb3,
0xe7, 0x3d, 0x05, 0xd8, 0xfc, 0x70, 0x46, 0x93, 0x09, 0x65, 0x89, 0xb1, 0xc6, 0x52, 0xfa, 0xd2, 0x0e, 0xa9, 0x17,
0xe3, 0x91, 0xa1, 0x68, 0x5b, 0x2a, 0xf0, 0xc3, 0x42, 0xcc, 0x29, 0xde, 0xdc, 0x85, 0x98, 0x31, 0x5c, 0xbc, 0x2d,
0xef, 0x5e, 0x7e, 0xaf, 0x67, 0x62, 0xa7, 0x56, 0x88, 0xa4, 0x43, 0x40, 0xe1, 0x37, 0x9e, 0x36, 0x76, 0x71, 0x84,
0xbd, 0x06, 0x8d, 0x47, 0x7d, 0x53, 0xd7, 0xc8, 0xce, 0x15, 0x92, 0x95, 0x4c, 0x28, 0x6d, 0x75, 0xeb, 0x7c, 0xf3,
0xbe, 0xaa, 0xb8, 0xed, 0x03, 0x3c, 0x27, 0x3e, 0x19, 0xdd, 0xa6, 0x66, 0x25, 0x1e, 0xc4, 0x6e, 0xc0, 0xe2, 0xdb,
0x3a, 0xd9, 0x81, 0xa5, 0x1b, 0xf5, 0x04, 0xae, 0xba, 0xea, 0x97, 0x83, 0x35, 0x44, 0xa3, 0x7a, 0x1a, 0xf1, 0x86,
0xda, 0x7b, 0x14, 0x72, 0x9c, 0x6a, 0x0f, 0x5f, 0x0a]
cst32 = [0x80, 0x40, 0x20, 0x10, 0x08, 0x04, 0x02, 0x01]
for i in range(256):
cipher[i] = key.index(cipher[i]) ^ key[i]
print(cipher)
import z3
for i in range(32):
c = z3.BitVec(f'x{i}', 8)
s = z3.Solver()
s.add(c & 0x80 == 0) # 万恶之源 s.add(c < 128) 不可以, 要用 s.add(c > 0)，因为 BitVec 是有符号数
for j in range(8):
s.add((~((cst32[j] + c) ^ c)) & 0xff == key.index(cipher[i * 8 + j]))
if s.check() == z3.sat:
print(chr(s.model()[c].as_long()), end='')
补充一些关于 bpf 逆向分析的细节
暂时没发现咋调试 bpf，但是可以通过 bpftool 查看执行后的某些值的变化，比如下面的这些
举个在解决这个题中非常有用的例子 execs ，
我们可以通过在 check_flag 函数下断点的方式来获取到在执行完 LBB0_1 之后的输出的值，即代码中偏移为 0x120 的部分，
通过这种方法，可以输入 0-9a-f，建立输入和输出的映射关系，使用下面的脚本解决
# from idaapi import *
#
#
# buf = get_bytes(0x30060, 8472)
# f = open(r'D:\dump.bin', 'wb')
# f.write(buf)
# f.close()
import string
cipher = [0xf3, 0x27, 0x47, 0x1b, 0x8f, 0x09, 0xfb, 0x17, 0x70, 0x48, 0xb0, 0x53, 0x32, 0xdb, 0xc0, 0xb8, 0x63, 0x2d,
0x40, 0x4b, 0xf5, 0x16, 0xf0, 0x35, 0xe7, 0xdf, 0xea, 0xa2, 0x9c, 0x41, 0xb3, 0x25, 0xd7, 0x0c, 0x33, 0x9c,
0x7b, 0x5a, 0xcd, 0x13, 0xbb, 0xee, 0x3e, 0x0e, 0xf2, 0xcf, 0x35, 0xda, 0xaf, 0xa2, 0x66, 0x7d, 0x38, 0x37,
0x67, 0x1e, 0x1f, 0x6b, 0x7b, 0x30, 0x0b, 0x7a, 0x02, 0xa9, 0xc8, 0x61, 0x27, 0x41, 0xdb, 0x01, 0x22, 0x31,
0x6f, 0xb6, 0xd4, 0x1b, 0x04, 0xd3, 0x94, 0xb8, 0x46, 0xc7, 0x24, 0xcf, 0xbd, 0xaf, 0x0b, 0xdc, 0x2e, 0xbb,
0xb2, 0x71, 0xf4, 0x99, 0x57, 0x36, 0xd1, 0x95, 0x52, 0x92, 0xba, 0x6d, 0xf3, 0x30, 0x50, 0x59, 0x9b, 0xea,
0x2f, 0x83, 0xdc, 0xf0, 0xde, 0x57, 0xa1, 0xac, 0xd2, 0x51, 0xa2, 0x1d, 0x59, 0xa8, 0x00, 0xb6, 0xe2, 0x65,
0x41, 0x0c, 0x4f, 0xeb, 0xf0, 0x2e, 0x58, 0x2a, 0x1f, 0xf4, 0x95, 0x72, 0x88, 0x7c, 0xa9, 0x0e, 0xcb, 0x3c,
0x42, 0xb9, 0xf3, 0x49, 0x9b, 0x52, 0x98, 0x12, 0xa3, 0x17, 0x51, 0xc0, 0x59, 0x40, 0x0a, 0xbc, 0xe8, 0x4c,
0x04, 0xfb, 0x13, 0x0a, 0x17, 0x3f, 0xe6, 0x36, 0x97, 0xdf, 0xb3, 0xe2, 0x42, 0x7f, 0xf8, 0xcc, 0x0e, 0xd1,
0x77, 0xc4, 0xa8, 0x46, 0x48, 0xe3, 0xf1, 0x0a, 0xef, 0x94, 0x56, 0x54, 0x5b, 0xca, 0xbd, 0xdd, 0x7f, 0x56,
0x47, 0xc2, 0x99, 0xfa, 0x89, 0xcc, 0xe1, 0xb9, 0x3a, 0x78, 0xe2, 0x37, 0x58, 0x01, 0x1b, 0xc3, 0x4b, 0xe6,
0x8c, 0xf3, 0xe5, 0xb6, 0x71, 0x9e, 0x63, 0xaf, 0x11, 0xce, 0x87, 0xf6, 0x6e, 0xde, 0xc8, 0xb1, 0xd0, 0x7a,
0x15, 0x6c, 0x10, 0x08, 0x99, 0x7b, 0x22, 0x55, 0x10, 0x7a, 0x82, 0x73, 0xfc, 0x62, 0xcb, 0x34, 0xa7, 0xb7,
0x62, 0xfa, 0x6b, 0x9f]
key = [0xc1, 0xd1, 0x02, 0x61, 0xd6, 0xf7, 0x13, 0xa2, 0x9b, 0x20, 0xd0, 0x4a, 0x8f, 0x7f, 0xee, 0xb9, 0x00, 0x63, 0x34,
0xb0, 0x33, 0xb7, 0x8a, 0x8b, 0x94, 0x60, 0x2e, 0x8e, 0x21, 0xff, 0x90, 0x82, 0xd5, 0x87, 0x96, 0x78, 0x22, 0xb6,
0x48, 0x6c, 0x45, 0xc7, 0x5a, 0x16, 0x80, 0xfd, 0xe4, 0x8c, 0xbf, 0x01, 0x1f, 0x4b, 0x79, 0x24, 0xa0, 0xb4, 0x23,
0x4d, 0x3b, 0xc5, 0x5d, 0x6f, 0x0d, 0xc9, 0xd4, 0xca, 0x55, 0xe0, 0x39, 0xad, 0x2b, 0xcd, 0x2c, 0xec, 0xc2, 0x6b,
0x30, 0xe6, 0x0c, 0xa8, 0x9a, 0x2f, 0xf6, 0xe8, 0xbb, 0x32, 0x57, 0xfb, 0x0b, 0x9d, 0xf2, 0x3f, 0xb5, 0xf9, 0x59,
0xe5, 0x10, 0xcf, 0x51, 0x41, 0xe9, 0x50, 0xdf, 0x26, 0x74, 0x58, 0xcb, 0x64, 0x54, 0x73, 0xab, 0xf4, 0xb2, 0x9f,
0x18, 0xf8, 0x4e, 0xfe, 0x08, 0x1d, 0x4f, 0x49, 0xd3, 0xac, 0x38, 0x12, 0x77, 0x11, 0x69, 0x07, 0x1c, 0x99, 0xb3,
0xe7, 0x3d, 0x05, 0xd8, 0xfc, 0x70, 0x46, 0x93, 0x09, 0x65, 0x89, 0xb1, 0xc6, 0x52, 0xfa, 0xd2, 0x0e, 0xa9, 0x17,
0xe3, 0x91, 0xa1, 0x68, 0x5b, 0x2a, 0xf0, 0xc3, 0x42, 0xcc, 0x29, 0xde, 0xdc, 0x85, 0x98, 0x31, 0x5c, 0xbc, 0x2d,
0xef, 0x5e, 0x7e, 0xaf, 0x67, 0x62, 0xa7, 0x56, 0x88, 0xa4, 0x43, 0x40, 0xe1, 0x37, 0x9e, 0x36, 0x76, 0x71, 0x84,
0xbd, 0x06, 0x8d, 0x47, 0x7d, 0x53, 0xd7, 0xc8, 0xce, 0x15, 0x92, 0x95, 0x4c, 0x28, 0x6d, 0x75, 0xeb, 0x7c, 0xf3,
0xbe, 0xaa, 0xb8, 0xed, 0x03, 0x3c, 0x27, 0x3e, 0x19, 0xdd, 0xa6, 0x66, 0x25, 0x1e, 0xc4, 0x6e, 0xc0, 0xe2, 0xdb,
0x3a, 0xd9, 0x81, 0xa5, 0x1b, 0xf5, 0x04, 0xae, 0xba, 0xea, 0x97, 0x83, 0x35, 0x44, 0xa3, 0x7a, 0x1a, 0xf1, 0x86,
0xda, 0x7b, 0x14, 0x72, 0x9c, 0x6a, 0x0f, 0x5f, 0x0a]
map = [17, 6, 195, 137, 218, 156, 15, 95, 17, 6, 195, 137, 218, 156, 15, 106, 17, 6, 195, 137, 218, 156, 20, 95, 17, 6,
195, 137, 218, 156, 20, 123, 17, 6, 195, 137, 218, 122, 15, 95, 17, 6, 195, 137, 218, 122, 15, 106, 17, 6, 195,
137, 218, 122, 68, 95, 17, 6, 195, 137, 218, 122, 68, 53, 17, 6, 195, 137, 5, 156, 15, 95, 17, 6, 195, 137, 5,
156, 15, 106, 17, 201, 130, 131, 218, 156, 15, 106, 17, 201, 130, 131, 218, 156, 20, 95, 17, 201, 130, 131, 218,
156, 20, 123, 17, 201, 130, 131, 218, 122, 15, 95, 17, 201, 130, 131, 218, 122, 15, 106, 17, 201, 130, 131, 218,
122, 68, 95, 17, 201, 130, 131, 218, 122, 68, 53, 17, 201, 130, 131, 165, 156, 15, 95, 17, 201, 130, 131, 165,
156, 15, 106, 17, 201, 130, 131, 165, 156, 20, 95, 17, 201, 130, 131, 165, 156, 20, 123, 17, 201, 130, 131, 165,
219, 15, 95, 17, 201, 130, 131, 165, 219, 15, 106, 17, 201, 130, 131, 165, 219, 192, 95, 17, 201, 130, 131, 165,
219, 192, 110, 17, 201, 130, 185, 218, 156, 15, 95, 17, 201, 130, 185, 218, 156, 15, 106, 17, 201, 130, 185, 218,
156, 20, 95, 17, 201, 130, 185, 218, 156, 20, 123, 17, 201, 130, 185, 218, 122, 15, 95, 17, 201, 130, 185, 218,
122, 15, 106, 17, 201, 130, 185, 218, 122, 68, 95]
for i in range(256):
cipher[i] = key.index(cipher[i]) ^ key[i]
for i in range(32):
v = cipher[i * 8: (i + 1) * 8]
for j in range(32):
if v == map[j * 8: (j + 1) * 8]:
print(string.printable[j], end='')
