WMCTF 2023 Writeup

WMCTF 2023 Writeup

人刚分手，打个 CTF 拿 3 个二血，1 个三血，本来还挺高兴的，只有一血有奖励。好好好，都欺负我是吧。

ezAndroid

userName是一个类似RC4的东西，直接复制出来跑，password是变表 AES，在 .init_array 修改了 AES 的 sbox。

#include <stdio.h>
#include <stdint.h>
#include <string.h>
#include <math.h>
#include <stdlib.h>
#include <time.h>
#include "aes.h"
uint8_t byte_A138[10];

void sub_60A0(unsigned char *result, unsigned char *a2) {
    unsigned int i; // [xsp+18h] [xbp-18h]


    for (i = 0;; ++i) {
        result[i] = a2[i + 28] ^ a2[i % 0x1C];
        if (i == 8)
            break;
    }
}

char *__fastcall swap(char *a1, char *a2) {
    char *result; // rax
    char v3; // [rsp+1h] [rbp-19h]

    v3 = *a1;
    *a1 = *a2;
    result = a2;
    *a2 = v3;
    return result;
}

void sub_57D0(char *a1, char *a2, int a3, char *key, int a5) {
    int k; // [rsp+14h] [rbp-24Ch]
    int v7; // [rsp+18h] [rbp-248h]
    int v8; // [rsp+18h] [rbp-248h]
    int i; // [rsp+48h] [rbp-218h]
    int j; // [rsp+48h] [rbp-218h]
    int v12; // [rsp+48h] [rbp-218h]
    char v13[520]; // [rsp+50h] [rbp-210h] BYREF
    unsigned __int64 v14; // [rsp+258h] [rbp-8h]

    v7 = 0;
    for (i = 0; i < 256; ++i) {
        v13[i + 256] = i;
        v13[i] = key[i % a5];
    }
    for (j = 0; j < 256; ++j) {
        v7 = ((unsigned __int8) v13[j] + (unsigned __int8) v13[j + 256] + v7) % 256;
        swap(&v13[j + 256], &v13[v7 + 256]);
    }
    v8 = 0;
    v12 = 0;
    for (k = 0; k < a3; ++k) {
        v12 = (v12 + 1) % 256;
        v8 = ((unsigned __int8) v13[v12 + 256] + v8) % 256;
        swap(&v13[v12 + 256], &v13[v8 + 256]);
        a2[k] = k ^ v13[((unsigned __int8) v13[v8 + 256] + (unsigned __int8) v13[v12 + 256]) % 256 + 256] ^ a1[k];
    }
}

int main() {
    unsigned char byte_7EBB[67] = {
            0x3D, 0x15, 0x9E, 0xC9, 0xC5, 0x85, 0x5D, 0xDA, 0x5B, 0x33, 0xBF, 0x90, 0xAD, 0xEE, 0xE5, 0x16,
            0x00, 0x10, 0xF7, 0x29, 0xAC, 0xB4, 0x2D, 0x99, 0x31, 0x4B, 0x45, 0x0B, 0x0C, 0x27, 0xAD, 0xFD,
            0xF0, 0xB3, 0x6A, 0xE2, 0x5B, 0x7C, 0xA4, 0x71, 0xB5, 0x81, 0x74, 0x33, 0xCB, 0x57, 0x7C, 0x8B,
            0x11, 0x7C, 0x38, 0x8C, 0x97, 0xA0, 0x51, 0x57, 0x14, 0x1A, 0x6A, 0x1A, 0xF2, 0x69, 0x59, 0x9F,
            0xF6, 0x31, 0x8A
    };
    char key[9];
    sub_60A0((unsigned char *) key, byte_7EBB);
    size_t keyLen = strlen(key);

    uint8_t v1[10];
    *(uint16_t *) &v1[8] = 0x43AB;
    *(uint64_t *) v1 = 0xC1BDEB7EE66497E9LL;
    for (int i = 0; i < 10; ++i)
        byte_A138[i] = v1[i];
    char *userName = malloc(17);
    memcpy(userName + 10, "123456", 7);
    sub_57D0((char *) byte_A138, userName, 10, key, (int) keyLen);
    printf("%s\n", userName);
    unsigned char xmmword_7E1A[16] = {
            0x2B, 0xC8, 0x20, 0x8B, 0x5C, 0x0D, 0xA7, 0x9B, 0x2A, 0x51, 0x3A, 0xD2, 0x71, 0x71, 0xCA, 0x50
    };
    struct AES_ctx aesCtx;
    AES_init_ctx(&aesCtx, (uint8_t*)userName);
    AES_ECB_decrypt(&aesCtx, xmmword_7E1A);
    printf("%s\n", xmmword_7E1A);
    // WMCTF{Re_1s_eaSy_eZ_Rc4_@nd_AES!}
    return 0;
}

替换一下对应的 sbox 和 rsbox

unsigned char sbox[256] = {
        0x29, 0x40, 0x57, 0x6E, 0x85, 0x9C, 0xB3, 0xCA, 0xE1, 0xF8, 0x0F, 0x26, 0x3D, 0x54, 0x6B, 0x82,
        0x99, 0xB0, 0xC7, 0xDE, 0xF5, 0x0C, 0x23, 0x3A, 0x51, 0x68, 0x7F, 0x96, 0xAD, 0xC4, 0xDB, 0xF2,
        0x09, 0x20, 0x37, 0x4E, 0x65, 0x7C, 0x93, 0xAA, 0xC1, 0xD8, 0xEF, 0x06, 0x1D, 0x34, 0x4B, 0x62,
        0x79, 0x90, 0xA7, 0xBE, 0xD5, 0xEC, 0x03, 0x1A, 0x31, 0x48, 0x5F, 0x76, 0x8D, 0xA4, 0xBB, 0xD2,
        0xE9, 0x00, 0x17, 0x2E, 0x45, 0x5C, 0x73, 0x8A, 0xA1, 0xB8, 0xCF, 0xE6, 0xFD, 0x14, 0x2B, 0x42,
        0x59, 0x70, 0x87, 0x9E, 0xB5, 0xCC, 0xE3, 0xFA, 0x11, 0x28, 0x3F, 0x56, 0x6D, 0x84, 0x9B, 0xB2,
        0xC9, 0xE0, 0xF7, 0x0E, 0x25, 0x3C, 0x53, 0x6A, 0x81, 0x98, 0xAF, 0xC6, 0xDD, 0xF4, 0x0B, 0x22,
        0x39, 0x50, 0x67, 0x7E, 0x95, 0xAC, 0xC3, 0xDA, 0xF1, 0x08, 0x1F, 0x36, 0x4D, 0x64, 0x7B, 0x92,
        0xA9, 0xC0, 0xD7, 0xEE, 0x05, 0x1C, 0x33, 0x4A, 0x61, 0x78, 0x8F, 0xA6, 0xBD, 0xD4, 0xEB, 0x02,
        0x19, 0x30, 0x47, 0x5E, 0x75, 0x8C, 0xA3, 0xBA, 0xD1, 0xE8, 0xFF, 0x16, 0x2D, 0x44, 0x5B, 0x72,
        0x89, 0xA0, 0xB7, 0xCE, 0xE5, 0xFC, 0x13, 0x2A, 0x41, 0x58, 0x6F, 0x86, 0x9D, 0xB4, 0xCB, 0xE2,
        0xF9, 0x10, 0x27, 0x3E, 0x55, 0x6C, 0x83, 0x9A, 0xB1, 0xC8, 0xDF, 0xF6, 0x0D, 0x24, 0x3B, 0x52,
        0x69, 0x80, 0x97, 0xAE, 0xC5, 0xDC, 0xF3, 0x0A, 0x21, 0x38, 0x4F, 0x66, 0x7D, 0x94, 0xAB, 0xC2,
        0xD9, 0xF0, 0x07, 0x1E, 0x35, 0x4C, 0x63, 0x7A, 0x91, 0xA8, 0xBF, 0xD6, 0xED, 0x04, 0x1B, 0x32,
        0x49, 0x60, 0x77, 0x8E, 0xA5, 0xBC, 0xD3, 0xEA, 0x01, 0x18, 0x2F, 0x46, 0x5D, 0x74, 0x8B, 0xA2,
        0xB9, 0xD0, 0xE7, 0xFE, 0x15, 0x2C, 0x43, 0x5A, 0x71, 0x88, 0x9F, 0xB6, 0xCD, 0xE4, 0xFB, 0x12
};

static const uint8_t rsbox[256] = {0x41, 0xe8, 0x8f, 0x36, 0xdd, 0x84, 0x2b, 0xd2, 0x79, 0x20, 0xc7, 0x6e, 0x15, 0xbc,
                                   0x63, 0x0a, 0xb1, 0x58, 0xff, 0xa6,
                                   0x4d, 0xf4, 0x9b, 0x42, 0xe9, 0x90, 0x37, 0xde, 0x85, 0x2c, 0xd3, 0x7a, 0x21, 0xc8,
                                   0x6f, 0x16, 0xbd, 0x64, 0x0b, 0xb2,
                                   0x59, 0x00, 0xa7, 0x4e, 0xf5, 0x9c, 0x43, 0xea, 0x91, 0x38, 0xdf, 0x86, 0x2d, 0xd4,
                                   0x7b, 0x22, 0xc9, 0x70, 0x17, 0xbe,
                                   0x65, 0x0c, 0xb3, 0x5a, 0x01, 0xa8, 0x4f, 0xf6, 0x9d, 0x44, 0xeb, 0x92, 0x39, 0xe0,
                                   0x87, 0x2e, 0xd5, 0x7c, 0x23, 0xca,
                                   0x71, 0x18, 0xbf, 0x66, 0x0d, 0xb4, 0x5b, 0x02, 0xa9, 0x50, 0xf7, 0x9e, 0x45, 0xec,
                                   0x93, 0x3a, 0xe1, 0x88, 0x2f, 0xd6,
                                   0x7d, 0x24, 0xcb, 0x72, 0x19, 0xc0, 0x67, 0x0e, 0xb5, 0x5c, 0x03, 0xaa, 0x51, 0xf8,
                                   0x9f, 0x46, 0xed, 0x94, 0x3b, 0xe2,
                                   0x89, 0x30, 0xd7, 0x7e, 0x25, 0xcc, 0x73, 0x1a, 0xc1, 0x68, 0x0f, 0xb6, 0x5d, 0x04,
                                   0xab, 0x52, 0xf9, 0xa0, 0x47, 0xee,
                                   0x95, 0x3c, 0xe3, 0x8a, 0x31, 0xd8, 0x7f, 0x26, 0xcd, 0x74, 0x1b, 0xc2, 0x69, 0x10,
                                   0xb7, 0x5e, 0x05, 0xac, 0x53, 0xfa,
                                   0xa1, 0x48, 0xef, 0x96, 0x3d, 0xe4, 0x8b, 0x32, 0xd9, 0x80, 0x27, 0xce, 0x75, 0x1c,
                                   0xc3, 0x6a, 0x11, 0xb8, 0x5f, 0x06,
                                   0xad, 0x54, 0xfb, 0xa2, 0x49, 0xf0, 0x97, 0x3e, 0xe5, 0x8c, 0x33, 0xda, 0x81, 0x28,
                                   0xcf, 0x76, 0x1d, 0xc4, 0x6b, 0x12,
                                   0xb9, 0x60, 0x07, 0xae, 0x55, 0xfc, 0xa3, 0x4a, 0xf1, 0x98, 0x3f, 0xe6, 0x8d, 0x34,
                                   0xdb, 0x82, 0x29, 0xd0, 0x77, 0x1e,
                                   0xc5, 0x6c, 0x13, 0xba, 0x61, 0x08, 0xaf, 0x56, 0xfd, 0xa4, 0x4b, 0xf2, 0x99, 0x40,
                                   0xe7, 0x8e, 0x35, 0xdc, 0x83, 0x2a,
                                   0xd1, 0x78, 0x1f, 0xc6, 0x6d, 0x14, 0xbb, 0x62, 0x09, 0xb0, 0x57, 0xfe, 0xa5, 0x4c,
                                   0xf3, 0x9a};

RightBack

pyc 花指令，静态分析发现规律，使用下面的脚本正则匹配去花

import re

r = re.compile(b'\x6e\x00\x6e\x04.{4}\x6e\x02.{2}', re.DOTALL)
with open('./RightBack.bin', 'rb') as pyc:
    code = pyc.read()
    ret_arr = r.findall(code)
    for ret in ret_arr:
        code = code.replace(ret, b'\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09\x09')
    open('./a.pyc', 'wb').write(code)

pycdc 反编译的结果大概如下，有很多错误，但是无所谓，可以看到关键逻辑了。

# Source Generated with Decompyle++
# File: a.pyc (Python 3.9)

import struct


def T(num, round):
    numArr = bytearray(struct.pack('<I', num))
    for i in range(4): numArr[i] = Sbox[numArr[i]]
    return struct.unpack('<I', numArr)[0] ^ Rcon[round]


def p1(s, key):
    j = 0
    k = []
    for i in range(256): s.append(i)
    k.append(key[i % len(key)])
    for i in range(256): j = (j + s[i] + ord(k[i])) % 256
    s[i] = s[j]
    s[j] = s[i]


def p2(key):
    w = [0] * 44
    for i in range(4): w[i] = struct.unpack('<I', key[i * 4:i * 4 + 4])[0]
    cnt = 0
    for i in range(4, 44, 1): if
    i % 4 == 0: w[i] = w[i - 4] ^ T(w[i - 1], cnt)
    cnt += 1
    continuew[i] = w[i - 4] ^ w[i - 1]
    return w


def p3(s, p):
    i = j = 0
    for z in range(len(p)): i = (i + 1) % 256j = (j + s[i]) % 256
    s[i] = s[j]
    s[j] = s[i]
    p[z] ^= s[(s[i] + s[j]) % 256]
    return p


def F1(part1, part2):
    global REG
    REG = {'EAX': 0, 'EBX': 0, 'ECX': 0, 'EDX': 0, 'R8': 0, 'CNT': 0, 'EIP': 0}
    REG['EAX'] = part1
    REG['EBX'] = part2


def F2(v1, v2, v3):
    if v1 == 1:
        REG[reg_table[str(v2)]] = extendKey[REG[reg_table[str(v3)]]]
    elif v1 == 2:
        REG[reg_table[str(v2)]] = REG[reg_table[str(v3)]]
    elif v1 == 3:
        REG[reg_table[str(v2)]] = v3
    REG['EIP'] += 4


def F3(v1, v2, v3):
    if v1 == 1:
        REG[reg_table[str(v2)]] = REG[reg_table[str(v2)]] + extendKey[REG[reg_table[str(v3)]]] & 0xFFFFFFFFL
    elif v1 == 2:
        REG[reg_table[str(v2)]] = REG[reg_table[str(v2)]] + REG[reg_table[str(v3)]] & 0xFFFFFFFFL
    elif v1 == 3:
        REG[reg_table[str(v2)]] = REG[reg_table[str(v2)]] + v3 & 0xFFFFFFFFL
    REG['EIP'] += 4


def F4(v1, v2):
    REG[reg_table[str(v1)]] ^= REG[reg_table[str(v2)]]
    REG['EIP'] += 3


def F5(v1, v2):
    REG[reg_table[str(v1)]] &= v2
    REG['EIP'] += 3


def F6(v1, v2, v3):
    if v1 == 1:
        REG[reg_table[str(v2)]] -= extendKey[v3]
    elif v1 == 2:
        REG[reg_table[str(v2)]] -= REG[reg_table[str(v3)]]
    elif v1 == 3:
        REG[reg_table[str(v2)]] -= v3
    REG['EIP'] += 4


def F7(v1, v2):
    REG[reg_table[str(v1)]] |= REG[reg_table[str(v2)]]
    REG['EIP'] += 3


def F8(v1, v2):
    REG[reg_table[str(v1)]] = REG[reg_table[str(v1)]] >> REG[reg_table[str(v2)]] & 0xFFFFFFFFL
    REG['EIP'] += 3


def F9(v1, v2):
    REG[reg_table[str(v1)]] = REG[reg_table[str(v1)]] << REG[reg_table[str(v2)]] & 0xFFFFFFFFL
    REG['EIP'] += 3


def FA(v1, v2, v3):
    if v1 == 1:
        REG[reg_table[str(v2)]] *= extendKey[v3]
    elif v1 == 2:
        REG[reg_table[str(v2)]] *= REG[reg_table[str(v3)]]
    elif v1 == 3:
        REG[reg_table[str(v2)]] *= v3
    REG['EIP'] += 4


def FB():
    REG['R8'] = REG['CNT'] == 21
    REG['EIP'] += 1


def WC():
    if not REG['R8']:
        REG['EIP'] = 16
    else:
        REG['EIP'] += 1


def VM(part1, part2):
    F1(part1, part2)
    EIP = REG['EIP']
    if opcode[EIP] == 80: F2(opcode[EIP + 1], opcode[EIP + 2], opcode[EIP + 3])
    continue
    if opcode[EIP] == 29: F3(opcode[EIP + 1], opcode[EIP + 2], opcode[EIP + 3])
    continue
    if opcode[EIP] == 113: F4(opcode[EIP + 1], opcode[EIP + 2])
    continue
    if opcode[EIP] == 114: F5(opcode[EIP + 1], opcode[EIP + 2])
    continue
    if opcode[EIP] == 150: F6(opcode[EIP + 1], opcode[EIP + 2], opcode[EIP + 3])
    continue
    if opcode[EIP] == 87: F7(opcode[EIP + 1], opcode[EIP + 2])
    continue
    if opcode[EIP] == 116: F8(opcode[EIP + 1], opcode[EIP + 2])
    continue
    if opcode[EIP] == 41: F9(opcode[EIP + 1], opcode[EIP + 2])
    continue
    if opcode[EIP] == 220: FA(opcode[EIP + 1], opcode[EIP + 2], opcode[EIP + 3])
    continue
    if opcode[EIP] == 7: FB()
    continue
    if opcode[EIP] == 153: WC()
    continue


def Have():
    Hello = '                                                                                                                                                                                                                                                \n||   / |  / /                                                                     \n||  /  | / /  ___     //  ___      ___      _   __      ___       __  ___  ___    \n|| / /||/ / //___) ) // //   ) ) //   ) ) // ) )  ) ) //___) )     / /   //   ) ) \n||/ / |  / //       // //       //   / / // / /  / / //           / /   //   / /  \n|  /  | / ((____   // ((____   ((___/ / // / /  / / ((____       / /   ((___/ /   \n                                                                                            \n                                                                                            \n||   / |  / / /|    //| |     //   ) ) /__  ___/ //   / / ___      ___      ___      ___    \n||  /  | / / //|   // | |    //          / /    //___   //   ) ) //   ) ) //   ) ) //   ) ) \n|| / /||/ / // |  //  | |   //          / /    / ___     ___/ / //   / /   ___/ /   __ / /  \n||/ / |  / //  | //   | |  //          / /    //       / ____/ //   / /  / ____/       ) )  \n|  /  | / //   |//    | | ((____/ /   / /    //       / /____ ((___/ /  / /____  ((___/ /     \n    '
    print(Hello)
    return input('RightBack: ').encode()


def Fun(right):
    if len(right) != 64: print('XD')
    exit()
    back = b''
    for i in range(0, len(right), 8): part1 = struct.unpack('>I', right[i + 0:i + 4])[0]
    part2 = struct.unpack('>I', right[i + 4:i + 8])[0]
    if i != 0:    part1 ^= struct.unpack('>I', back[i - 8:i - 4])[0]
    part2 ^= struct.unpack('>I', back[i - 4:i])[0]
    VM(part1, part2)
    back += struct.pack('>I', REG['EAX'])
    back += struct.pack('>I', REG['EBX'])
    return back


if __name__ == '__main__':
    REG = {}
    EIP = 0
    reg_table = {'1': 'EAX', '2': 'EBX', '3': 'ECX', '4': 'EDX', '5': 'R8', '6': 'CNT', '7': 'EIP'}
    Sbox = [82, 9, 106, 213, 48, 54, 165, 56, 191, 64, 163, 158, 129, 243, 215, 251, 124, 227, 57, 130, 155, 47, 255,
            135, 52, 142, 67, 68, 196, 222, 233, 203, 84, 123, 148, 50, 166, 194, 35, 61, 238, 76, 149, 11, 66, 250,
            195, 78, 8, 46, 161, 102, 40, 217, 36, 178, 118, 91, 162, 73, 109, 139, 209, 37, 114, 248, 246, 100, 134,
            104, 152, 22, 212, 164, 92, 204, 93, 101, 182, 146, 108, 112, 72, 80, 253, 237, 185, 218, 94, 21, 70, 87,
            167, 141, 157, 132, 144, 216, 171, 0, 140, 188, 211, 10, 247, 228, 88, 5, 184, 179, 69, 6, 208, 44, 30, 143,
            202, 63, 15, 2, 193, 175, 189, 3, 1, 19, 138, 107, 58, 145, 17, 65, 79, 103, 220, 234, 151, 242, 207, 206,
            240, 180, 230, 115, 150, 172, 116, 34, 231, 173, 53, 133, 226, 249, 55, 232, 28, 117, 223, 110, 71, 241, 26,
            113, 29, 41, 197, 137, 111, 183, 98, 14, 170, 24, 190, 27, 252, 86, 62, 75, 198, 210, 121, 32, 154, 219,
            192, 254, 120, 205, 90, 244, 31, 221, 168, 51, 136, 7, 199, 49, 177, 18, 16, 89, 39, 128, 236, 95, 96, 81,
            127, 169, 25, 181, 74, 13, 45, 229, 122, 159, 147, 201, 156, 239, 160, 224, 59, 77, 174, 42, 245, 176, 200,
            235, 187, 60, 131, 83, 153, 97, 23, 43, 4, 126, 186, 119, 214, 38, 225, 105, 20, 99, 85, 33, 12, 125]
    Rcon = [16777216, 33554432, 67108864, 134217728, 268435456, 536870912, 1073741824, 0x80000000L, 452984832,
            905969664]
    s = []
    key = 'CalmDownBelieveU'
    p1(s, key)
    key = [61, 15, 58, 65, 177, 180, 182, 248, 192, 143, 37, 238, 50, 29, 215, 190]
    key = bytes(p3(s, key))
    extendKey = p2(bytes(key))
    opcode = [69, 136, 121, 24, 179, 67, 209, 20, 27, 169, 205, 146, 212, 160, 124, 49, 20, 155, 157, 253, 52, 71, 174,
              164, 134, 60, 184, 203, 131, 210, 57, 151, 77, 241, 61, 6, 13, 52, 235, 37, 100, 178, 8, 238, 205, 27,
              194, 159, 230, 165, 211, 221, 100, 217, 111, 202, 185, 207, 226, 50, 88, 4, 58, 73, 10, 92, 24, 230, 246,
              245, 21, 110, 182, 151, 85, 28, 181, 191, 185, 236, 92, 98, 222, 85, 228, 14, 235, 93, 77, 161, 61, 140,
              222, 74, 124, 13, 211, 75, 134, 235, 164, 228, 235, 16, 29, 41, 49, 105, 188, 51, 232, 65, 209, 165, 35,
              182, 248, 245, 69, 18, 152, 71, 223, 85, 114]
    opcode = p3(s, opcode)
    right = Have()
    back = Fun(right)
    data1 = [228, 244, 207, 251, 194, 124, 252, 61, 198, 145, 97, 98, 89, 25, 92, 208, 155, 38, 34, 225, 98, 206, 234,
             245, 223, 54, 214, 137, 35, 86, 180, 66, 223, 234, 90, 136, 5, 189, 166, 117, 111, 222, 39, 156, 163, 173,
             36, 174, 47, 144, 15, 160, 45, 239, 211, 11, 190, 181, 24, 164, 234, 114, 174, 27]
    data1 = bytes(p3(s, data1))
    data2 = [165, 83, 203, 51, 99, 164, 30, 91, 230, 64, 181, 55, 190, 47, 125, 240, 186, 173, 116, 47, 89, 64, 68, 215,
             124, 138, 34, 175, 60, 136, 77, 216, 250, 127, 14, 14, 66, 168, 198, 247, 252, 189, 243, 239, 25, 63, 143,
             7, 177, 13, 99, 226, 100, 6, 207, 77, 46, 136, 251, 123, 225, 27, 76, 183]
    data2 = bytes(p3(s, data2))
    data3 = [95, 219, 46, 178, 111, 141, 17, 168, 254, 60, 68, 59, 41, 183, 182, 118, 3, 47, 150, 240, 140, 159, 110,
             238]
    data3 = bytes(p3(s, data3))
    if back == data2:
        print(bytes(data1).decode())
    else:
        print(bytes(data3).decode())

结合 xpython trace的结果，虚拟机比较简单（写的反汇编脚本丢了，就不再写一遍了），直接给出解密代码

#include <stdio.h>
#include <stdint.h>

static uint32_t extendKey[44] = {1835819331, 1853321028, 1768711490, 1432712805, 2177920767, 4020699579, 2261476601, 3551400604, 711874531, 3318306392, 1124217505, 2427199549, 3099853672, 2098025776, 1041196945, 2929936300, 246748610, 1941455090, 1303848803, 3809763535, 1395557789, 546751855, 1830937100, 2385871555, 2516030638, 3043054017, 3628118989, 1450520846, 1825094265, 3651791800, 32069749, 1469868411, 919887482, 4017993154, 4002737591, 3104343244, 4134211933, 420914335, 4152510760, 1317719524, 1990496755, 1873950060, 2553314372, 3602559392};

typedef struct {
    uint32_t p1;
    uint32_t p2;
} uint32_pair;

uint32_t ror32(uint32_t v, uint32_t r) {
    return (v >> r) | (v << (32 - r));
}

uint32_pair decrypt(uint32_t p1, uint32_t p2) {
    for (int i = 21; i > 0; --i) {
        p2 -= extendKey[i * 2 + 1];
        p2 = ror32(p2, p1 & 31);
        p2 ^= p1;
        p1 -= extendKey[i * 2];
        p1 = ror32(p1, p2 & 31);
        p1 ^= p2;
    }
    p2 -= extendKey[1];
    p1 -= extendKey[0];
    uint32_pair ret = {p1, p2};
    return ret;
}

int main() {
    uint8_t flag[] = {4, 58, 242, 54, 86, 177, 154, 252, 247, 30, 33, 220, 219, 143, 142, 148, 77, 52, 231, 157, 156, 82, 12, 110, 251, 250, 213, 253, 50, 249, 120, 44, 187, 190, 57, 193, 217, 133, 117, 182, 40, 248, 204, 120, 164, 228, 133, 146, 14, 189, 114, 197, 175, 135, 145, 42, 139, 241, 239, 150, 22, 96, 209, 18, 0};
    uint32_pair last;
    for (int i = 0; i < 64; i += 8) {
        uint32_t p1 = (flag[i + 0] << 24 | flag[i + 1] << 16 | flag[i + 2] << 8 | flag[i + 3]);
        uint32_t p2 = (flag[i + 4] << 24 | flag[i + 5] << 16 | flag[i + 6] << 8 | flag[i + 7]);
        uint32_pair cur = decrypt(p1, p2);
        if (i != 0) {
            cur.p1 ^= last.p1;
            cur.p2 ^= last.p2;
        }
        flag[i + 3] = cur.p1 & 0xff;
        flag[i + 2] = (cur.p1 >> 8) & 0xff;
        flag[i + 1] = (cur.p1 >> 16) & 0xff;
        flag[i + 0] = (cur.p1 >> 24) & 0xff;
        flag[i + 7] = cur.p2 & 0xff;
        flag[i + 6] = (cur.p2 >> 8) & 0xff;
        flag[i + 5] = (cur.p2 >> 16) & 0xff;
        flag[i + 4] = (cur.p2 >> 24) & 0xff;
        last.p1 = p1;
        last.p2 = p2;
    }
    printf("%s", flag);
    return 0;
}

gohunt

一堆加密，xxtea、xor、变表的base58、变表的base64，直接给解密脚本啦

import base64
import string


def b64_decode(val: str):
    b64_std_table = string.ascii_uppercase + string.ascii_lowercase + string.digits + '+/'
    my_b64_table = get_b64_table()
    table = str.maketrans(my_b64_table, b64_std_table)
    val = val.translate(table)
    return base64.b64decode(val)
def get_b64_table():
    r_b64table = [0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x2E, 0xFF, 0xFF, 0xFF, 0xFF, 0x0E, 0x17, 0x1B,
                  0x30, 0x29, 0x0F, 0x24, 0x13, 0x3D, 0x2D, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x21, 0x2A, 0x18, 0x35,
                  0x32, 0x1A, 0x3A, 0x3F, 0x04, 0x25, 0x38, 0x36, 0x1E, 0x20, 0x00, 0x34, 0x2C, 0x02, 0x0B, 0x1C, 0x0A,
                  0x26, 0x33, 0x3B, 0x06, 0x39, 0x09, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0x2B, 0x28, 0x31, 0x14, 0x0C,
                  0x1D, 0x11, 0x37, 0x08, 0x27, 0x01, 0x15, 0x07, 0x10, 0x0D, 0x19, 0x22, 0x23, 0x3C, 0x3E, 0x12, 0x16,
                  0x1F, 0x03, 0x05, 0x2F, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF,
                  0xFF]
    b64table = []
    for i in range(64):
        b64table.append(r_b64table.index(i))
    return ''.join(chr(_) for _ in b64table)

import base58
import xxtea

flag = base58.b58decode('YMQHsYFQu7kkTqu3Xmt1ruYUDLU8uaMoPpsfjqYF4TQMMKtw5KF7cpWrkWpk3', alphabet=b'nY7TwcE41bzWvMQZXa8fyeprJoBdmhsu9DqVgxRPtFLKN65UH2CikG3SAj')
flag = bytearray(flag)
xor_key = b64_decode('7Ik1Sjk6edoyu6MDdvoTe3==')
for i in range(len(flag)):
    flag[i] ^= xor_key[i % len(xor_key)]
xxtea_key = b64_decode('g6CdeI4xgd@7ojkrp6nDdM==')
flag = xxtea.decrypt(flag, xxtea_key, padding=False)
print(flag)

babyAnti2.0

出题人还我相册！(自己没备份好，呜呜

除了 内存陷阱部分，好像和今年 VNCTF 2023 的 1.0 版本一样，mincore hook 半天，不好使。 ida 打开字符串搜索 FfiTrampoline_ 看到generateShellcodes 和 mprotect 好确定有脏东西！估计肯定是有svc 调用 mincore ， 但是 libapp 都打开了这部搜索一下 5000? 直接找到了，我还绕什么。

直接 hook 一下，脚本有点乱，做题的时候写的，hook了一堆。

const android_dlopen_ext = Module.findExportByName(null, "android_dlopen_ext");
console.log(android_dlopen_ext);
if (android_dlopen_ext != null) {
    Interceptor.attach(android_dlopen_ext, {
        onEnter: function (args) {
            var soName = args[0].readCString();
            if (soName.indexOf("libanticheat.so") != -1) {
                this.hook = true;
            }
        },
        onLeave: function (retval) {
            if (this.hook) {
                hook_func();
            };
        }
    });
}


function hook_pthread_create() {
    var pt_create_func = Module.findExportByName(null, 'pthread_create');
    var detect_frida_loop_addr = null;
    console.log('pt_create_func:', pt_create_func);

    Interceptor.attach(pt_create_func, {
        onEnter: function () {
            if (detect_frida_loop_addr == null) {
                var base_addr = Module.getBaseAddress('libanticheat.so');
                if (base_addr != null) {
                    detect_frida_loop_addr = base_addr.add(0x5EA48)
                    console.log('this.context.x2: ', detect_frida_loop_addr, this.context.x2);
                    if (this.context.x2.compare(detect_frida_loop_addr) == 0) {
                        hook_anti_frida_replace(this.context.x2);
                    }
                }

            }

        },
        onLeave: function (retval) {
            // console.log('retval',retval);
        }
    })


}

function hook_anti_frida_replace(addr) {
    console.log('replace anti_addr :', addr);
    Interceptor.replace(addr, new NativeCallback(function (a1) {
        console.log('replace success');
        return;
    }, 'pointer', []));

}
Java.perform(function () {
    var antiCheatPlugin = Java.use("com.WMCTF2023.anti_cheat.AntiCheatPlugin");
    antiCheatPlugin["b"].implementation = function (params) {
        console.log("b is called");
        return true;
    }
})

setImmediate(hook_pthread_create());
function hook_func() {
    var base_addr = Module.getBaseAddress("libanticheat.so");

    var is_device_rooted_hidden = base_addr.add(0x5CF6C);
    var is_device_modified_hidden = base_addr.add(0x5CFCC);
    var is_device_injected_hidden = base_addr.add(0x5D0C8);

    var is_device_rooted = base_addr.add(0x5CF38);
    var is_device_modified = base_addr.add(0x5CF98);
    var is_device_injected = base_addr.add(0x5CFFC);
    var memtrap = base_addr.add(0x5ECC0);
    var init_memtrap = base_addr.add(0x5EC74);

    var mincore = Module.findExportByName(null, 'mincore');



    Interceptor.attach(init_memtrap, {
        onEnter: function (args) {
            console.log(`init_memtrap called ${args[0]}`);
        },
        onLeave: function (retval) {
            console.log(`init_memtrap retval ${retval}`);

        }
    });
    // WMCTF{We1c0me_t0_Th3_W0r1d_0f_MemTr4p#^-^}
    var aa = null
    Interceptor.attach(memtrap, {
        onEnter: function (args) {
            // console.log(`memtrap called ${args[0]}`);
            if (aa == null) {
                aa = Interceptor.attach(mincore, {
                    onEnter: function (args) {
                        // console.log(`mincore called`);
                        this.vec = args[2];
                    },
                    onLeave: function (retval) {
                        // console.log(`mincore before modify retval ${this.vec.readU8()}, ${retval}`);
                        this.vec.writeU8(0);
                        // console.log(`mincore after modify retval ${this.vec.readU8()}, ${retval}`);
                    }
                });

                var base_addr_app = Module.getBaseAddress("libapp.so");
                Interceptor.attach(base_addr_app.add(0x314F08), {
                    onEnter: function (args) {
                        console.log(`cmp called ${this.context.x2}`);
                        this.context.x2 = 5000;
                    },
                })
            }
        },
        onLeave: function (retval) {
            // console.log(`memtrap called ${retval}`);

        }
    });

    Interceptor.attach(is_device_rooted, {
        onLeave: function (retval) {
            // console.log('is_device_rooted called');
            retval.replace(0);
        }
    });

    Interceptor.attach(is_device_modified, {
        onLeave: function (retval) {
            // console.log('is_device_modified called');
            retval.replace(0);
        }
    });

    Interceptor.attach(is_device_injected, {
        onLeave: function (retval) {
            // console.log('is_device_modified called');
            retval.replace(0);
        }
    });

    // ---- 应该是没用,最开始看到就都 hook了  ---------
    Interceptor.attach(is_device_rooted_hidden, {
        onLeave: function (retval) {
            console.log('is_device_rooted_hidden called');
            retval.replace(0);
        }
    });

    Interceptor.attach(is_device_modified_hidden, {
        onLeave: function (retval) {
            console.log('is_device_modified_hidden called');
            retval.replace(0);
        }
    });

    Interceptor.attach(is_device_injected_hidden, {
        onLeave: function (retval) {
            console.log('is_device_modified_hidden called');
            retval.replace(0);
        }
    });
}

ezIos

第一次做IOS逆向，感觉不是很难，但是混淆有的烦人，看到调用的外面的函数好像不是很多，打算unicorn 模拟执行。 但是 __dyld_get_image_xxx的三个函数不知道干啥的，卡住了，刚好当时学弟叫我，就去讲题了。第二天，比赛结束之后。问了一下 REtard 爷，这三个函数的作用才出。 整体来说就是 rc4 加密输入，然后 xtea 解密密文，二者对比。代码如下

from capstone import *
import cle
from unicorn import *
from unicorn.arm64_const import *
import struct

cs = Cs(CS_ARCH_ARM64, CS_MODE_ARM)

uc = Uc(UC_ARCH_ARM64, UC_MODE_ARM)
game = cle.Loader('./UnCrackable Level 3')
gameSelf = game.all_objects[0]

for segment in gameSelf.segments:
    uc.mem_map(segment.vaddr, segment.memsize)
    print(f'{hex(segment.vaddr)} -> {hex(segment.vaddr + segment.memsize)}')
    if segment.filesize > 0:
        uc.mem_write(segment.vaddr, game.memory.load(segment.vaddr, segment.memsize))

uc.mem_map(0x100100000, 0x1000)
uc.mem_write(0x100100088, b'12345678')

str_base_addr = 0x10000

flag = []
en_flag = []


def hook_code(mu: Uc, address, size, user_data):
    global str_base_addr, flag, en_flag
    if address == 0x10000D6BC:  # __dyld_get_image_header
        mu.reg_write(UC_ARM64_REG_X0, gameSelf.mapped_base)
        lr = mu.reg_read(UC_ARM64_REG_LR)
        mu.reg_write(UC_ARM64_REG_PC, lr)
    if address == 0x10000D6C8:  # __dyld_get_image_name
        mu.reg_write(UC_ARM64_REG_X0, 0)
        lr = mu.reg_read(UC_ARM64_REG_LR)
        mu.reg_write(UC_ARM64_REG_PC, lr)
    if address == 0x10000D6D4:  # __dyld_get_image_vmaddr_slide
        mu.reg_write(UC_ARM64_REG_X0, 0)
        lr = mu.reg_read(UC_ARM64_REG_LR)
        mu.reg_write(UC_ARM64_REG_PC, lr)
    if address == 0x10000D95C:  # _strdup
        str_addr = mu.reg_read(UC_ARM64_REG_X0)
        # copy 字符串
        i = 0
        while True:
            c = mu.mem_read(str_addr + i, 1)
            mu.mem_write(str_base_addr + i, bytes(c))
            if c == b'\x00':
                break
            i += 1
        mu.reg_write(UC_ARM64_REG_X0, str_base_addr)
        str_base_addr += i
        lr = mu.reg_read(UC_ARM64_REG_LR)
        mu.reg_write(UC_ARM64_REG_PC, lr)
    if address == 0x10000D78C:  # free，不处理
        lr = mu.reg_read(UC_ARM64_REG_LR)
        mu.reg_write(UC_ARM64_REG_PC, lr)
    if address == 0x1000057C8: # tea 结果
        m_addr = mu.reg_read(UC_ARM64_REG_X0)
        en_flag += list(mu.mem_read(m_addr, 4 * 2))
        print(en_flag)
    if address == 0x100009D8C:  # 对比密文处
        flag.append(mu.reg_read(UC_ARM64_REG_W9))
        mu.reg_write(UC_ARM64_REG_W8, 0)
        print(''.join(chr(_) for _ in flag))


uc.reg_write(UC_ARM64_REG_SP, 0x1000)
uc.mem_write(0x2000, bytes([38, 163, 101, 125, 73, 104, 238, 103, 140, 208, 62, 41, 193, 123, 94, 196, 93, 49, 133, 130, 122, 41, 50, 159, 93, 49, 133, 130, 122, 41, 50, 159]))
uc.reg_write(UC_ARM64_REG_X0, 0x2000)
uc.hook_add(UC_HOOK_CODE, hook_code)
uc.emu_start(0x1000091e4, 0x10000A998)