码迷,mamicode.com
首页 > 其他好文 > 详细

2019 RoarCTF--polyre

时间:2019-10-22 12:32:52      阅读:75      评论:0      收藏:0      [点我收藏+]

标签:左移   cti   破解   spl   文件   rand   tps   range   lse   

测试文件:https://www.wocloud.com.cn/webclient/share/sindex.action?id=i9K_Br6TgE4ImHzH9IwB7mKcRy5TUdZ8U6_uiWwxDovNjPaT6IJAgRhtvqTOsW3w

 

1.准备

技术图片

获取信息

  • 64位文件

 

2.文件处理

2.1 控制流平坦化

IDA打开后可以看到

技术图片

 

技术图片
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  signed int v3; // ecx
  signed int v4; // ecx
  signed int v5; // ecx
  signed int v6; // ecx
  signed int v7; // ecx
  signed int v8; // ecx
  signed int v9; // ecx
  signed int v10; // ecx
  signed int v11; // ecx
  signed int v12; // ecx
  signed int v13; // ecx
  signed int v14; // ecx
  signed int v15; // ecx
  signed int v16; // ecx
  signed int v17; // ecx
  signed int v18; // ecx
  signed int v19; // ecx
  signed int v20; // ecx
  signed int v21; // ecx
  signed int v22; // esi
  signed int v23; // ecx
  signed int v24; // ecx
  signed int v25; // ecx
  signed int v26; // ecx
  signed int v28; // [rsp+1DCh] [rbp-114h]
  unsigned __int64 v29; // [rsp+1E0h] [rbp-110h]
  int v30; // [rsp+1E8h] [rbp-108h]
  int v31; // [rsp+1ECh] [rbp-104h]
  char s1[48]; // [rsp+1F0h] [rbp-100h]
  char s[60]; // [rsp+220h] [rbp-D0h]
  unsigned int v34; // [rsp+25Ch] [rbp-94h]
  char *v35; // [rsp+260h] [rbp-90h]
  int v36; // [rsp+26Ch] [rbp-84h]
  bool v37; // [rsp+272h] [rbp-7Eh]
  unsigned __int8 v38; // [rsp+273h] [rbp-7Dh]
  int v39; // [rsp+274h] [rbp-7Ch]
  char *v40; // [rsp+278h] [rbp-78h]
  int v41; // [rsp+284h] [rbp-6Ch]
  int v42; // [rsp+288h] [rbp-68h]
  bool v43; // [rsp+28Fh] [rbp-61h]
  char *v44; // [rsp+290h] [rbp-60h]
  int v45; // [rsp+298h] [rbp-58h]
  bool v46; // [rsp+29Fh] [rbp-51h]
  __int64 v47; // [rsp+2A0h] [rbp-50h]
  bool v48; // [rsp+2AFh] [rbp-41h]
  unsigned __int64 v49; // [rsp+2B0h] [rbp-40h]
  unsigned __int64 v50; // [rsp+2B8h] [rbp-38h]
  unsigned __int64 v51; // [rsp+2C0h] [rbp-30h]
  unsigned __int64 v52; // [rsp+2C8h] [rbp-28h]
  int v53; // [rsp+2D0h] [rbp-20h]
  int v54; // [rsp+2D4h] [rbp-1Ch]
  char *v55; // [rsp+2D8h] [rbp-18h]
  int v56; // [rsp+2E0h] [rbp-10h]
  int v57; // [rsp+2E4h] [rbp-Ch]
  bool v58; // [rsp+2EBh] [rbp-5h]
  unsigned int v59; // [rsp+2ECh] [rbp-4h]

  v34 = 0;
  v28 = 2013758019;
  while ( 1 )
  {
    while ( 1 )
    {
      while ( 1 )
      {
        while ( 1 )
        {
          while ( 1 )
          {
            while ( 1 )
            {
              while ( 1 )
              {
                while ( 1 )
                {
                  while ( 1 )
                  {
                    while ( 1 )
                    {
                      while ( 1 )
                      {
                        while ( 1 )
                        {
                          while ( 1 )
                          {
                            while ( 1 )
                            {
                              while ( 1 )
                              {
                                while ( 1 )
                                {
                                  while ( 1 )
                                  {
                                    while ( 1 )
                                    {
                                      while ( 1 )
                                      {
                                        while ( 1 )
                                        {
                                          while ( 1 )
                                          {
                                            while ( 1 )
                                            {
                                              while ( 1 )
                                              {
                                                while ( 1 )
                                                {
                                                  while ( 1 )
                                                  {
                                                    while ( 1 )
                                                    {
                                                      while ( 1 )
                                                      {
                                                        while ( 1 )
                                                        {
                                                          while ( 1 )
                                                          {
                                                            while ( 1 )
                                                            {
                                                              while ( 1 )
                                                              {
                                                                while ( 1 )
                                                                {
                                                                  while ( 1 )
                                                                  {
                                                                    while ( 1 )
                                                                    {
                                                                      while ( 1 )
                                                                      {
                                                                        while ( 1 )
                                                                        {
                                                                          while ( 1 )
                                                                          {
                                                                            while ( 1 )
                                                                            {
                                                                              while ( 1 )
                                                                              {
                                                                                while ( 1 )
                                                                                {
                                                                                  while ( 1 )
                                                                                  {
                                                                                    while ( 1 )
                                                                                    {
                                                                                      while ( 1 )
                                                                                      {
                                                                                        while ( 1 )
                                                                                        {
                                                                                          while ( 1 )
                                                                                          {
                                                                                            while ( 1 )
                                                                                            {
                                                                                              while ( 1 )
                                                                                              {
                                                                                                while ( 1 )
                                                                                                {
                                                                                                  while ( 1 )
                                                                                                  {
                                                                                                    while ( 1 )
                                                                                                    {
                                                                                                      while ( 1 )
                                                                                                      {
                                                                                                        while ( 1 )
                                                                                                        {
                                                                                                          while ( 1 )
                                                                                                          {
                                                                                                            while ( 1 )
                                                                                                            {
                                                                                                              while ( 1 )
                                                                                                              {
                                                                                                                while ( 1 )
                                                                                                                {
                                                                                                                  while ( 1 )
                                                                                                                  {
                                                                                                                    while ( 1 )
                                                                                                                    {
                                                                                                                      while ( 1 )
                                                                                                                      {
                                                                                                                        while ( 1 )
                                                                                                                        {
                                                                                                                          while ( 1 )
                                                                                                                          {
                                                                                                                            while ( 1 )
                                                                                                                            {
                                                                                                                              while ( 1 )
                                                                                                                              {
                                                                                                                                while ( 1 )
                                                                                                                                {
                                                                                                                                  while ( 1 )
                                                                                                                                  {
                                                                                                                                    while ( 1 )
                                                                                                                                    {
                                                                                                                                      while ( 1 )
                                                                                                                                      {
                                                                                                                                        while ( 1 )
                                                                                                                                        {
                                                                                                                                          while ( 1 )
                                                                                                                                          {
                                                                                                                                            while ( 1 )
                                                                                                                                            {
                                                                                                                                              while ( 1 )
                                                                                                                                              {
                                                                                                                                                while ( 1 )
                                                                                                                                                {
                                                                                                                                                  while ( 1 )
                                                                                                                                                  {
                                                                                                                                                    while ( 1 )
                                                                                                                                                    {
                                                                                                                                                      while ( 1 )
                                                                                                                                                      {
                                                                                                                                                        while ( 1 )
                                                                                                                                                        {
                                                                                                                                                          while ( 1 )
                                                                                                                                                          {
                                                                                                                                                            while ( 1 )
                                                                                                                                                            {
                                                                                                                                                              while ( 1 )
                                                                                                                                                              {
                                                                                                                                                                while ( 1 )
                                                                                                                                                                {
                                                                                                                                                                  while ( 1 )
                                                                                                                                                                  {
                                                                                                                                                                    while ( 1 )
                                                                                                                                                                    {
                                                                                                                                                                      while ( 1 )
                                                                                                                                                                      {
                                                                                                                                                                        while ( 1 )
                                                                                                                                                                        {
                                                                                                                                                                          while ( 1 )
                                                                                                                                                                          {
                                                                                                                                                                            while ( 1 )
                                                                                                                                                                            {
                                                                                                                                                                              while ( 1 )
                                                                                                                                                                              {
                                                                                                                                                                                while ( 1 )
                                                                                                                                                                                {
                                                                                                                                                                                  while ( 1 )
                                                                                                                                                                                  {
                                                                                                                                                                                    while ( 1 )
                                                                                                                                                                                    {
                                                                                                                                                                                      while ( v28 == -2119479925 )
                                                                                                                                                                                      {
                                                                                                                                                                                        v30 = 0;
                                                                                                                                                                                        v28 = 1768345936;
                                                                                                                                                                                      }
                                                                                                                                                                                      if ( v28 != -2087982142 )
                                                                                                                                                                                        break;
                                                                                                                                                                                      v28 = -477867459;
                                                                                                                                                                                    }
                                                                                                                                                                                    if ( v28 != -2048748379 )
                                                                                                                                                                                      break;
                                                                                                                                                                                    v28 = 283854908;
                                                                                                                                                                                  }
                                                                                                                                                                                  if ( v28 != -1971893440 )
                                                                                                                                                                                    break;
                                                                                                                                                                                  v28 = -981997032;
                                                                                                                                                                                }
                                                                                                                                                                                if ( v28 != -1876979972 )
                                                                                                                                                                                  break;
                                                                                                                                                                                v28 = 1278104886;
                                                                                                                                                                              }
                                                                                                                                                                              if ( v28 != -1843952179 )
                                                                                                                                                                                break;
                                                                                                                                                                              a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                                                                              v21 = -1358401961;
                                                                                                                                                                              if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                                                                                v21 = -759088748;
                                                                                                                                                                              v28 = v21;
                                                                                                                                                                            }
                                                                                                                                                                            if ( v28 != -1841026192 )
                                                                                                                                                                              break;
                                                                                                                                                                            v28 = -981997032;
                                                                                                                                                                          }
                                                                                                                                                                          if ( v28 != -1835257763 )
                                                                                                                                                                            break;
                                                                                                                                                                          v31 = 0;
                                                                                                                                                                          v28 = -194920207;
                                                                                                                                                                        }
                                                                                                                                                                        if ( v28 != -1834653726 )
                                                                                                                                                                          break;
                                                                                                                                                                        v42 = v30;
                                                                                                                                                                        a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                                                                        v13 = 762694599;
                                                                                                                                                                        if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                                                                          v13 = 1591698962;
                                                                                                                                                                        v28 = v13;
                                                                                                                                                                      }
                                                                                                                                                                      if ( v28 != -1799275846 )
                                                                                                                                                                        break;
                                                                                                                                                                      v28 = 1988968584;
                                                                                                                                                                    }
                                                                                                                                                                    if ( v28 != -1780989165 )
                                                                                                                                                                      break;
                                                                                                                                                                    v29 = *(_QWORD *)&v44[8 * v30];
                                                                                                                                                                    v28 = -1835257763;
                                                                                                                                                                  }
                                                                                                                                                                  if ( v28 != -1732387288 )
                                                                                                                                                                    break;
                                                                                                                                                                  a3 = (char **)2110558301;
                                                                                                                                                                  if ( v58 )
                                                                                                                                                                    a3 = (char **)3153606742LL;
                                                                                                                                                                  v28 = (signed int)a3;
                                                                                                                                                                }
                                                                                                                                                                if ( v28 != -1682981725 )
                                                                                                                                                                  break;
                                                                                                                                                                a3 = (char **)873723531;
                                                                                                                                                                if ( v43 )
                                                                                                                                                                  a3 = (char **)1558414728;
                                                                                                                                                                v28 = (signed int)a3;
                                                                                                                                                              }
                                                                                                                                                              if ( v28 != -1679168360 )
                                                                                                                                                                break;
                                                                                                                                                              a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                                                              v8 = -1608245220;
                                                                                                                                                              if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                                                                v8 = -1039797642;
                                                                                                                                                              v28 = v8;
                                                                                                                                                            }
                                                                                                                                                            if ( v28 != -1658420490 )
                                                                                                                                                              break;
                                                                                                                                                            v28 = 738697886;
                                                                                                                                                          }
                                                                                                                                                          if ( v28 != -1608245220 )
                                                                                                                                                            break;
                                                                                                                                                          v28 = -1039797642;
                                                                                                                                                        }
                                                                                                                                                        if ( v28 != -1593453884 )
                                                                                                                                                          break;
                                                                                                                                                        v29 = v49;
                                                                                                                                                        v28 = -210664208;
                                                                                                                                                      }
                                                                                                                                                      if ( v28 != -1588745861 )
                                                                                                                                                        break;
                                                                                                                                                      v49 = 2 * v29;
                                                                                                                                                      v28 = -1099829591;
                                                                                                                                                    }
                                                                                                                                                    if ( v28 != -1578333348 )
                                                                                                                                                      break;
                                                                                                                                                    a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                                                    v7 = -1015938266;
                                                                                                                                                    if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                                                      v7 = 977391758;
                                                                                                                                                    v28 = v7;
                                                                                                                                                  }
                                                                                                                                                  if ( v28 != -1453272720 )
                                                                                                                                                    break;
                                                                                                                                                  v51 = v29;
                                                                                                                                                  v28 = 1416478473;
                                                                                                                                                }
                                                                                                                                                if ( v28 != -1395524712 )
                                                                                                                                                  break;
                                                                                                                                                v57 = memcmp(s1, &unk_402170, 0x30uLL);
                                                                                                                                                v24 = 2127761645;
                                                                                                                                                if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                                                  v24 = -2048748379;
                                                                                                                                                v28 = v24;
                                                                                                                                              }
                                                                                                                                              if ( v28 != -1358463792 )
                                                                                                                                                break;
                                                                                                                                              v28 = 165194735;
                                                                                                                                            }
                                                                                                                                            if ( v28 != -1358401961 )
                                                                                                                                              break;
                                                                                                                                            *(_QWORD *)v55 = v29;
                                                                                                                                            v28 = -759088748;
                                                                                                                                          }
                                                                                                                                          if ( v28 != -1243245941 )
                                                                                                                                            break;
                                                                                                                                          v28 = 1852460924;
                                                                                                                                        }
                                                                                                                                        if ( v28 != -1241653263 )
                                                                                                                                          break;
                                                                                                                                        v31 = v41;
                                                                                                                                        a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                                        v11 = 1958488484;
                                                                                                                                        if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                                          v11 = 397199458;
                                                                                                                                        v28 = v11;
                                                                                                                                      }
                                                                                                                                      if ( v28 != -1146236158 )
                                                                                                                                        break;
                                                                                                                                      a3 = (char **)3169640671LL;
                                                                                                                                      if ( v46 )
                                                                                                                                        a3 = (char **)174114970;
                                                                                                                                      v28 = (signed int)a3;
                                                                                                                                    }
                                                                                                                                    if ( v28 != -1141360554 )
                                                                                                                                      break;
                                                                                                                                    v28 = -1971893440;
                                                                                                                                    puts("Wrong!");
                                                                                                                                  }
                                                                                                                                  if ( v28 != -1125326625 )
                                                                                                                                    break;
                                                                                                                                  v54 = 8 * v30;
                                                                                                                                  v28 = 1241066884;
                                                                                                                                }
                                                                                                                                if ( v28 != -1104384261 )
                                                                                                                                  break;
                                                                                                                                v40 = &s[v31];
                                                                                                                                v28 = -199559592;
                                                                                                                              }
                                                                                                                              if ( v28 != -1099829591 )
                                                                                                                                break;
                                                                                                                              a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                              v17 = -1593453884;
                                                                                                                              if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                                v17 = -210664208;
                                                                                                                              v28 = v17;
                                                                                                                            }
                                                                                                                            if ( v28 != -1039797642 )
                                                                                                                              break;
                                                                                                                            v39 = v38;
                                                                                                                            a3 = (char **)2686722076LL;
                                                                                                                            if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                              a3 = (char **)2417987324LL;
                                                                                                                            v28 = (signed int)a3;
                                                                                                                          }
                                                                                                                          if ( v28 != -1015938266 )
                                                                                                                            break;
                                                                                                                          v28 = -1578333348;
                                                                                                                        }
                                                                                                                        if ( v28 != -1008576722 )
                                                                                                                          break;
                                                                                                                        a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                        v16 = -2087982142;
                                                                                                                        if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                          v16 = -477867459;
                                                                                                                        v28 = v16;
                                                                                                                      }
                                                                                                                      if ( v28 != -1002050507 )
                                                                                                                        break;
                                                                                                                      v29 = v52;
                                                                                                                      v28 = 1471710476;
                                                                                                                    }
                                                                                                                    if ( v28 != -987629196 )
                                                                                                                      break;
                                                                                                                    v53 = v31;
                                                                                                                    v28 = 183264728;
                                                                                                                  }
                                                                                                                  if ( v28 != -981997032 )
                                                                                                                    break;
                                                                                                                  v59 = v34;
                                                                                                                  v28 = 1934644251;
                                                                                                                }
                                                                                                                if ( v28 != -853256898 )
                                                                                                                  break;
                                                                                                                a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                                v10 = 1958488484;
                                                                                                                if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                  v10 = -1241653263;
                                                                                                                v28 = v10;
                                                                                                              }
                                                                                                              if ( v28 != -759088748 )
                                                                                                                break;
                                                                                                              *(_QWORD *)v55 = v29;
                                                                                                              a3 = (char **)140103415;
                                                                                                              v22 = -1358401961;
                                                                                                              if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                                v22 = 140103415;
                                                                                                              v28 = v22;
                                                                                                            }
                                                                                                            if ( v28 != -744786104 )
                                                                                                              break;
                                                                                                            v38 = s[v31];
                                                                                                            v28 = -1679168360;
                                                                                                          }
                                                                                                          if ( v28 != -718028952 )
                                                                                                            break;
                                                                                                          v28 = -213314773;
                                                                                                        }
                                                                                                        if ( v28 != -506887986 )
                                                                                                          break;
                                                                                                        v31 = 0;
                                                                                                        v28 = -469992559;
                                                                                                        __isoc99_scanf("%s", v35, a3);
                                                                                                      }
                                                                                                      if ( v28 != -490420216 )
                                                                                                        break;
                                                                                                      a3 = (char **)2841694576LL;
                                                                                                      if ( v48 )
                                                                                                        a3 = (char **)2706221435LL;
                                                                                                      v28 = (signed int)a3;
                                                                                                    }
                                                                                                    if ( v28 != -484679360 )
                                                                                                      break;
                                                                                                    a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                                                    v14 = 550812935;
                                                                                                    if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                      v14 = 253474089;
                                                                                                    v28 = v14;
                                                                                                  }
                                                                                                  if ( v28 != -477867459 )
                                                                                                    break;
                                                                                                  v46 = v45 < 64;
                                                                                                  a3 = (char **)2206985154LL;
                                                                                                  if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                    a3 = (char **)1590869113;
                                                                                                  v28 = (signed int)a3;
                                                                                                }
                                                                                                if ( v28 != -469992559 )
                                                                                                  break;
                                                                                                __isoc99_scanf(
                                                                                                  "%s",
                                                                                                  v35,
                                                                                                  a3);
                                                                                                v31 = 0;
                                                                                                a3 = (char **)3788079310LL;
                                                                                                if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                                                  a3 = (char **)1091618206;
                                                                                                v28 = (signed int)a3;
                                                                                              }
                                                                                              if ( v28 != -351376304 )
                                                                                                break;
                                                                                              v28 = -1682981725;
                                                                                            }
                                                                                            if ( v28 != -309679135 )
                                                                                              break;
                                                                                            v28 = 385821084;
                                                                                          }
                                                                                          if ( v28 != -213314773 )
                                                                                            break;
                                                                                          v41 = v31 + 1;
                                                                                          v28 = -853256898;
                                                                                        }
                                                                                        if ( v28 != -210664208 )
                                                                                          break;
                                                                                        v29 = v49;
                                                                                        v50 = v49;
                                                                                        a3 = (char **)2701513412LL;
                                                                                        if ( dword_603058 < 10
                                                                                          || (((_BYTE)dword_603054 - 1)
                                                                                            * (_BYTE)dword_603054 & 1) == 0 )
                                                                                        {
                                                                                          a3 = (char **)481625179;
                                                                                        }
                                                                                        v28 = (signed int)a3;
                                                                                      }
                                                                                      if ( v28 != -199559592 )
                                                                                        break;
                                                                                      *v40 = 0;
                                                                                      v28 = 2024088016;
                                                                                    }
                                                                                    if ( v28 != -197416524 )
                                                                                      break;
                                                                                    v30 = v56;
                                                                                    v28 = 1478643244;
                                                                                  }
                                                                                  if ( v28 != -194920207 )
                                                                                    break;
                                                                                  v45 = v31;
                                                                                  v28 = -1008576722;
                                                                                }
                                                                                if ( v28 != -172688243 )
                                                                                  break;
                                                                                v28 = -1780989165;
                                                                              }
                                                                              if ( v28 != 30189008 )
                                                                                break;
                                                                              v44 = s;
                                                                              a3 = (char **)325614949;
                                                                              if ( dword_603058 < 10
                                                                                || (((_BYTE)dword_603054 - 1)
                                                                                  * (_BYTE)dword_603054 & 1) == 0 )
                                                                              {
                                                                                a3 = (char **)4122279053LL;
                                                                              }
                                                                              v28 = (signed int)a3;
                                                                            }
                                                                            if ( v28 != 35266435 )
                                                                              break;
                                                                            v28 = -1002050507;
                                                                          }
                                                                          if ( v28 != 111496758 )
                                                                            break;
                                                                          v31 = v53 + 1;
                                                                          v28 = 1585728989;
                                                                        }
                                                                        if ( v28 != 140103415 )
                                                                          break;
                                                                        v28 = 1783499399;
                                                                      }
                                                                      if ( v28 != 165194735 )
                                                                        break;
                                                                      v52 = 2 * v51;
                                                                      a3 = (char **)2936503504LL;
                                                                      if ( dword_603058 < 10
                                                                        || (((_BYTE)dword_603054 - 1)
                                                                          * (_BYTE)dword_603054 & 1) == 0 )
                                                                      {
                                                                        a3 = (char **)35266435;
                                                                      }
                                                                      v28 = (signed int)a3;
                                                                    }
                                                                    if ( v28 != 165636912 )
                                                                      break;
                                                                    a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                    v12 = 762694599;
                                                                    if ( dword_603058 < 10
                                                                      || (((_BYTE)dword_603054 - 1)
                                                                        * (_BYTE)dword_603054 & 1) == 0 )
                                                                    {
                                                                      v12 = -1834653726;
                                                                    }
                                                                    v28 = v12;
                                                                  }
                                                                  if ( v28 != 174114970 )
                                                                    break;
                                                                  v47 = v29;
                                                                  v28 = 2008447103;
                                                                }
                                                                if ( v28 != 183264728 )
                                                                  break;
                                                                a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                                v19 = 111496758;
                                                                if ( dword_603058 < 10
                                                                  || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                                {
                                                                  v19 = 1585728989;
                                                                }
                                                                v28 = v19;
                                                              }
                                                              if ( v28 != 189818242 )
                                                                break;
                                                              a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                              v6 = -1015938266;
                                                              if ( dword_603058 < 10
                                                                || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                              {
                                                                v6 = -1578333348;
                                                              }
                                                              v28 = v6;
                                                            }
                                                            if ( v28 != 253474089 )
                                                              break;
                                                            v43 = v42 < 6;
                                                            a3 = (char **)550812935;
                                                            if ( dword_603058 < 10
                                                              || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                            {
                                                              a3 = (char **)3943590992LL;
                                                            }
                                                            v28 = (signed int)a3;
                                                          }
                                                          if ( v28 != 283854908 )
                                                            break;
                                                          v58 = v57 != 0;
                                                          v28 = 2103827861;
                                                        }
                                                        if ( v28 != 325614949 )
                                                          break;
                                                        v28 = 30189008;
                                                      }
                                                      if ( v28 != 385821084 )
                                                        break;
                                                      a3 = (char **)(unsigned int)(dword_603054 - 1);
                                                      v26 = -309679135;
                                                      if ( dword_603058 < 10
                                                        || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                                      {
                                                        v26 = -1732387288;
                                                      }
                                                      v28 = v26;
                                                    }
                                                    if ( v28 != 397199458 )
                                                      break;
                                                    v28 = -1243245941;
                                                  }
                                                  if ( v28 != 481625179 )
                                                    break;
                                                  v28 = 1771563692;
                                                }
                                                if ( v28 != 550812935 )
                                                  break;
                                                v28 = 253474089;
                                              }
                                              if ( v28 != 738697886 )
                                                break;
                                              v37 = v36 < 64;
                                              v28 = 189818242;
                                            }
                                            if ( v28 != 762694599 )
                                              break;
                                            v28 = -1834653726;
                                          }
                                          if ( v28 != 873723531 )
                                            break;
                                          a3 = (char **)(unsigned int)(dword_603054 - 1);
                                          v23 = 2127761645;
                                          if ( dword_603058 < 10
                                            || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                          {
                                            v23 = -1395524712;
                                          }
                                          v28 = v23;
                                        }
                                        if ( v28 != 895115152 )
                                          break;
                                        a3 = (char **)(unsigned int)(dword_603054 - 1);
                                        v3 = -506887986;
                                        if ( dword_603058 < 10
                                          || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                                        {
                                          v3 = -469992559;
                                        }
                                        v28 = v3;
                                      }
                                      if ( v28 != 977391758 )
                                        break;
                                      a3 = (char **)2175487371LL;
                                      if ( v37 )
                                        a3 = (char **)3550181192LL;
                                      v28 = (signed int)a3;
                                    }
                                    if ( v28 != 998079252 )
                                      break;
                                    v28 = -194920207;
                                  }
                                  if ( v28 != 1091618206 )
                                    break;
                                  v28 = 1852460924;
                                }
                                if ( v28 != 1241066884 )
                                  break;
                                a3 = (char **)&s1[v54];
                                v55 = &s1[v54];
                                v28 = -1843952179;
                              }
                              if ( v28 != 1278104886 )
                                break;
                              v9 = -718028952;
                              if ( v39 == 10 )
                                v9 = -1104384261;
                              v28 = v9;
                            }
                            if ( v28 != 1416478473 )
                              break;
                            a3 = (char **)(unsigned int)(dword_603054 - 1);
                            v18 = -1358463792;
                            if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                              v18 = 165194735;
                            v28 = v18;
                          }
                          if ( v28 != 1471710476 )
                            break;
                          v28 = -987629196;
                        }
                        if ( v28 != 1478643244 )
                          break;
                        v28 = 165636912;
                      }
                      if ( v28 != 1558414728 )
                        break;
                      a3 = (char **)(unsigned int)(dword_603054 - 1);
                      v15 = 325614949;
                      if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                        v15 = 30189008;
                      v28 = v15;
                    }
                    if ( v28 != 1585728989 )
                      break;
                    v31 = v53 + 1;
                    a3 = (char **)(unsigned int)(dword_603054 - 1);
                    v20 = 111496758;
                    if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
                      v20 = 1636541262;
                    v28 = v20;
                  }
                  if ( v28 != 1590869113 )
                    break;
                  v28 = -1146236158;
                }
                if ( v28 != 1591698962 )
                  break;
                v28 = -484679360;
              }
              if ( v28 != 1636541262 )
                break;
              v28 = 998079252;
            }
            if ( v28 != 1768345936 )
              break;
            v28 = 165636912;
          }
          if ( v28 != 1771563692 )
            break;
          v29 = v50 ^ 0xB0004B7679FA26B3LL;
          v28 = 1471710476;
        }
        if ( v28 != 1783499399 )
          break;
        v56 = v30 + 1;
        v28 = -197416524;
      }
      if ( v28 != 1852460924 )
        break;
      a3 = (char **)(unsigned int)(dword_603054 - 1);
      v4 = -1799275846;
      if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
        v4 = 1988968584;
      v28 = v4;
    }
    if ( v28 == 1934644251 )
      break;
    switch ( v28 )
    {
      case 1958488484:
        v31 = v41;
        v28 = -1241653263;
        break;
      case 1988968584:
        v36 = v31;
        a3 = (char **)(unsigned int)(dword_603054 - 1);
        v5 = -1799275846;
        if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
          v5 = -1658420490;
        v28 = v5;
        break;
      case 2008447103:
        v48 = v47 < 0;
        v28 = -490420216;
        break;
      case 2013758019:
        memset(s, 0, 0x30uLL);
        memset(s1, 0, 0x30uLL);
        printf("Input:", 0LL);
        a3 = (char **)s;
        v35 = s;
        v28 = 895115152;
        break;
      case 2024088016:
        v28 = -2119479925;
        break;
      case 2103827861:
        a3 = (char **)(unsigned int)(dword_603054 - 1);
        v25 = -309679135;
        if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
          v25 = 385821084;
        v28 = v25;
        break;
      case 2110558301:
        v28 = -1841026192;
        puts("Correct!");
        break;
      case 2127761645:
        v28 = -1395524712;
        break;
    }
  }
  return v59;
}
polyre伪C代码

得到的代码是一个多重循环,我们需要对代码进行控制流平坦化

参考教程:https://security.tencent.com/index.php/blog/msg/112

使用deflat.py执行控制流平坦化脚本命令:

python deflat.py polyre 0x400620

 技术图片

 

2.2 处理虚假控制流程

得到的文件使用IDA打开,反汇编代码

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  signed __int64 v4; // [rsp+1E0h] [rbp-110h]
  int i; // [rsp+1E8h] [rbp-108h]
  int v6; // [rsp+1ECh] [rbp-104h]
  int v7; // [rsp+1ECh] [rbp-104h]
  char s1[48]; // [rsp+1F0h] [rbp-100h]
  char s[60]; // [rsp+220h] [rbp-D0h]
  unsigned int v10; // [rsp+25Ch] [rbp-94h]
  char *v11; // [rsp+260h] [rbp-90h]
  int v12; // [rsp+26Ch] [rbp-84h]
  bool v13; // [rsp+272h] [rbp-7Eh]
  unsigned __int8 v14; // [rsp+273h] [rbp-7Dh]
  int v15; // [rsp+274h] [rbp-7Ch]
  char *v16; // [rsp+278h] [rbp-78h]
  int v17; // [rsp+284h] [rbp-6Ch]
  int v18; // [rsp+288h] [rbp-68h]
  bool v19; // [rsp+28Fh] [rbp-61h]
  char *v20; // [rsp+290h] [rbp-60h]
  int v21; // [rsp+298h] [rbp-58h]
  bool v22; // [rsp+29Fh] [rbp-51h]
  __int64 v23; // [rsp+2A0h] [rbp-50h]
  bool v24; // [rsp+2AFh] [rbp-41h]
  __int64 v25; // [rsp+2B0h] [rbp-40h]
  __int64 v26; // [rsp+2B8h] [rbp-38h]
  __int64 v27; // [rsp+2C0h] [rbp-30h]
  __int64 v28; // [rsp+2C8h] [rbp-28h]
  int v29; // [rsp+2D0h] [rbp-20h]
  int v30; // [rsp+2D4h] [rbp-1Ch]
  char *v31; // [rsp+2D8h] [rbp-18h]
  int v32; // [rsp+2E0h] [rbp-10h]
  int v33; // [rsp+2E4h] [rbp-Ch]
  bool v34; // [rsp+2EBh] [rbp-5h]

  v10 = 0;
  memset(s, 0, 0x30uLL);
  memset(s1, 0, 0x30uLL);
  printf("Input:", 0LL);
  v11 = s;
  if ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 )
    goto LABEL_43;
  while ( 1 )
  {
    __isoc99_scanf("%s", v11);
    v6 = 0;
    if ( dword_603058 < 10 || (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) == 0 )
      break;
LABEL_43:
    __isoc99_scanf("%s", v11);
  }
  while ( 1 )
  {
    do
      v12 = v6;
    while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
    v13 = v12 < 64;
    while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 )
      ;
    if ( !v13 )
      break;
    v14 = s[v6];
    do
      v15 = v14;
    while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
    if ( v15 == 10 )
    {
      v16 = &s[v6];
      *v16 = 0;
      break;
    }
    v17 = v6 + 1;
    do
      v6 = v17;
    while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
  }
  for ( i = 0; ; ++i )
  {
    do
      v18 = i;
    while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
    do
      v19 = v18 < 6;
    while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
    if ( !v19 )
      break;
    do
      v20 = s;
    while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
    v4 = *(_QWORD *)&v20[8 * i];
    v7 = 0;
    while ( 1 )
    {
      v21 = v7;
      do
        v22 = v21 < 64;
      while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
      if ( !v22 )
        break;
      v23 = v4;
      v24 = v4 < 0;
      if ( v4 >= 0 )
      {
        v27 = v4;
        do
          v28 = 2 * v27;
        while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
        v4 = v28;
      }
      else
      {
        v25 = 2 * v4;
        do
          v26 = v25;
        while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
        v4 = v26 ^ 0xB0004B7679FA26B3LL;
      }
      v29 = v7;
      do
        v7 = v29 + 1;
      while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
    }
    v30 = 8 * i;
    v31 = &s1[8 * i];
    if ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 )
LABEL_55:
      *(_QWORD *)v31 = v4;
    *(_QWORD *)v31 = v4;
    if ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 )
      goto LABEL_55;
    v32 = i + 1;
  }
  do
    v33 = memcmp(s1, &unk_402170, 0x30uLL);
  while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 );
  v34 = v33 != 0;
  while ( dword_603058 >= 10 && (((_BYTE)dword_603054 - 1) * (_BYTE)dword_603054 & 1) != 0 )
    ;
  if ( v34 )
    puts("Wrong!");
  else
    puts("Correct!");
  return v10;
}

观察代码,此时开启了虚假控制流程,代码中的条件都是永真条件(while;do...while),因此可以在观察时忽略或删除while语句和do...while语句。

也可以写脚本来处理虚假控制流程,这里提供一个官方WP中给出的脚本,在IDA中的script中执行即可。

def patch_nop(start,end):
    for i in range(start,end):
        PatchByte(i, 0x90)

def next_instr(addr):
    return addr+ItemSize(addr)
    
st = 0x0000000000401117
end = 0x0000000000402144

addr = st
while(addr<end):
    next = next_instr(addr)
    if "ds:dword_603054" in GetDisasm(addr):
        while(True):
            addr = next
            next = next_instr(addr)
            if "jnz" in GetDisasm(addr):
                dest = GetOperandValue(addr, 0)
                PatchByte(addr, 0xe9)
                PatchByte(addr+5, 0x90) 
                offset = dest - (addr + 5)
                PatchDword(addr + 1, offset)
                print("patch bcf: 0x%x"%addr)
                addr = next
                break
    else:
        addr = next

 

最终,我们得到控制流平坦化后的代码

  1 __int64 __fastcall main(__int64 a1, char **a2, char **a3)
  2 {
  3   signed __int64 v4; // [rsp+1E0h] [rbp-110h]
  4   signed int j; // [rsp+1E8h] [rbp-108h]
  5   signed int i; // [rsp+1ECh] [rbp-104h]
  6   signed int k; // [rsp+1ECh] [rbp-104h]
  7   char s1[48]; // [rsp+1F0h] [rbp-100h]
  8   char s[60]; // [rsp+220h] [rbp-D0h]
  9   unsigned int v10; // [rsp+25Ch] [rbp-94h]
 10   char *v11; // [rsp+260h] [rbp-90h]
 11   int v12; // [rsp+26Ch] [rbp-84h]
 12   bool v13; // [rsp+272h] [rbp-7Eh]
 13   unsigned __int8 v14; // [rsp+273h] [rbp-7Dh]
 14   int v15; // [rsp+274h] [rbp-7Ch]
 15   char *v16; // [rsp+278h] [rbp-78h]
 16   int v17; // [rsp+284h] [rbp-6Ch]
 17   int v18; // [rsp+288h] [rbp-68h]
 18   bool v19; // [rsp+28Fh] [rbp-61h]
 19   char *v20; // [rsp+290h] [rbp-60h]
 20   int v21; // [rsp+298h] [rbp-58h]
 21   bool v22; // [rsp+29Fh] [rbp-51h]
 22   __int64 v23; // [rsp+2A0h] [rbp-50h]
 23   bool v24; // [rsp+2AFh] [rbp-41h]
 24   __int64 v25; // [rsp+2B0h] [rbp-40h]
 25   __int64 v26; // [rsp+2B8h] [rbp-38h]
 26   __int64 v27; // [rsp+2C0h] [rbp-30h]
 27   __int64 v28; // [rsp+2C8h] [rbp-28h]
 28   int v29; // [rsp+2D0h] [rbp-20h]
 29   int v30; // [rsp+2D4h] [rbp-1Ch]
 30   char *v31; // [rsp+2D8h] [rbp-18h]
 31   int v32; // [rsp+2E0h] [rbp-10h]
 32   int v33; // [rsp+2E4h] [rbp-Ch]
 33   bool v34; // [rsp+2EBh] [rbp-5h]
 34 
 35   v10 = 0;
 36   memset(s, 0, 48uLL);
 37   memset(s1, 0, 48uLL);
 38   printf("Input:", 0LL);
 39   v11 = s;
 40   __isoc99_scanf("%s", s);
 41   for ( i = 0; ; ++i )
 42   {
 43     v12 = i;
 44     v13 = i < 64;
 45     if ( i >= 64 )                              // 结束条件,i
 46       break;                                    // v14=int(s[i])
 47     v14 = s[i];                                 // v15=int(s[i])
 48     v15 = v14;
 49     if ( v14 == 10 )                            // s[i]==10时,s[i]=0即将末尾的换行符‘\n‘替换为‘\0‘
 50     {
 51       v16 = &s[i];
 52       *v16 = 0;
 53       break;
 54     }
 55     v17 = i + 1;
 56   }
 57   for ( j = 0; ; ++j )                          // 第一层循环,j
 58   {
 59     v18 = j;
 60     v19 = j < 6;
 61     if ( j >= 6 )                               // 结束条件,j取值
 62       break;
 63     v20 = s;
 64     v4 = *(_QWORD *)&s[8 * j];                  // 每四字(QWORD)取一个值,相当于取一个四字的最高位字节,v4=int(s[j*8]),可以确定输入的长度为48
 65     for ( k = 0; ; ++k )                        // 第二层循环,k
 66     {
 67       v21 = k;
 68       v22 = k < 64;
 69       if ( k >= 64 )                            // 结束条件,k取值
 70         break;
 71       v23 = v4;
 72       v24 = v4 < 0;
 73       if ( v4 >= 0 )                            // 若v4>=0,左移1位,v4=v4*2
 74       {
 75         v27 = v4;
 76         v28 = 2 * v4;
 77         v4 *= 2LL;
 78       }
 79       else                                      // 否则v4=2*v4^0xB0004B7679FA26B3
 80       {
 81         v25 = 2 * v4;
 82         v26 = 2 * v4;
 83         v4 = 2 * v4 ^ 0xB0004B7679FA26B3LL;
 84       }
 85       v29 = k;
 86     }
 87     v30 = 8 * j;
 88     v31 = &s1[8 * j];                           // 将v4的值赋值给s1[8*j]
 89     *(_QWORD *)v31 = v4;
 90     v32 = j + 1;
 91   }
 92   v33 = memcmp(s1, &unk_402170, 0x30uLL);       // 96 62 53 43 6D F2 8F BC  16 EE 30 05 78 00 01 52
 93                                                 // EC 08 5F 93 EA B5 C0 4D  50 F4 53 D8 AF 90 2B 34
 94                                                 // 81 36 2C AA BC 0E 25 8B  E4 8A C6 A2 81 9F 75 55
 95   v34 = v33 != 0;
 96   if ( v33 != 0 )
 97     puts("Wrong!");
 98   else
 99     puts("Correct!");
100   return v10;
101 }

 

3.代码分析

仔细观察代码,实际上这部分代码是使用CRC32的查表法,对数据进行加密。

3.1 CRC64

要理解代码,推荐结合相关CRC算法的说明进行理解

CRC32算法实现:python与C:https://blog.csdn.net/zyj_zhouyongjun183/article/details/78882625

CRC校验码原理、实例、手动计算:https://www.cnblogs.com/bugutian/p/6221783.html

CRC技术的实现与破解:https://bbs.pediy.com/thread-17195.htm

 

3.2 加密原理

加密原理实际上就是CRC32算法---输入一组长度48的字符串,每8个字节分为1组,共6组。对每一组取首位,判断正负。正值,左移一位;负值,左移一位,再异或0xB0004B7679FA26B3。重复判断操作64次,得到查表法所用的表。

 

因此我们只需要将整个加密过程逆向操作得到查表法的表,再进行CRC64计算,就能得到flag

 

4.脚本获取

secret = [0xBC8FF26D43536296, 0x520100780530EE16, 0x4DC0B5EA935F08EC,
          0x342B90AFD853F450, 0x8B250EBCAA2C3681, 0x55759F81A2C68AE4]
key = 0xB0004B7679FA26B3

flag = ""

# 产生CRC32查表法所用的表
for s in secret:
    for i in range(64):
        sign = s & 1
        # 判断是否为负
        if sign == 1:
            s ^= key
        s //= 2
        # 防止负值除2,溢出为正值
        if sign == 1:
            s |= 0x8000000000000000
    # 输出表
    print(hex(s))
    # 计算CRC64
    j = 0
    while j < 8:
        flag += chr(s&0xFF)
        s >>= 8
        j += 1
print(flag)

 

6.get flag!

查表法的表:

0x6666367b67616c66
0x63362d3039333932
0x2d363563342d3032
0x3539612d30376162
0x6631643365383537
0x7d38

 

flag:

flag{6ff29390-6c20-4c56-ba70-a95758e3d1f8}      

2019 RoarCTF--polyre

标签:左移   cti   破解   spl   文件   rand   tps   range   lse   

原文地址:https://www.cnblogs.com/Mayfly-nymph/p/11718845.html

(0)
(0)
   
举报
评论 一句话评论(0
登录后才能评论!
© 2014 mamicode.com 版权所有  联系我们:gaon5@hotmail.com
迷上了代码!