Reverse 高校网络信息安全运维挑战赛
1 signed int sub_403CC0() 2 { 3 unsigned int v0; // eax 4 int key_lens; // eax 5 FILE *v2; // eax 6 FILE *v3; // eax 7 signed int result; // eax 8 int data; // [esp+10h] [ebp-44h] 9 int v6; // [esp+14h] [ebp-40h] 10 int v7; // [esp+18h] [ebp-3Ch] 11 int v8; // [esp+1Ch] [ebp-38h] 12 int v9; // [esp+20h] [ebp-34h] 13 int v10; // [esp+24h] [ebp-30h] 14 int v11; // [esp+28h] [ebp-2Ch] 15 int v12; // [esp+2Ch] [ebp-28h] 16 int mykey[8]; // [esp+30h] [ebp-24h] 17 18 sub_401AD0(); 19 data = 'F2A1'; // 1A2F943C4D8C5B6EA3C9BCAD7E 20 v6 = 'C349'; 21 v0 = 0; 22 v7 = 'C8D4'; 23 v8 = 'E6B5'; 24 v9 = '9C3A'; 25 v10 = 'DACB'; 26 v11 = 'E7'; 27 v12 = 0; 28 do 29 { 30 mykey[v0] = 0; 31 ++v0; 32 } 33 while ( v0 < 8 ); 34 puts("input your key:"); 35 scanf("%s", mykey); 36 key_lens = strlen((const char *)mykey); 37 if ( key_lens <= 19 ) 38 { 39 printf("too short!"); 40 result = -1; 41 } 42 else if ( key_lens > 30 ) 43 { 44 printf("too long!"); 45 result = -1; 46 } 47 else 48 { 49 if ( check_4014A0((char *)mykey, (char *)&data, key_lens) ) 50 printf("congratulations, your input is the flag ^_^"); 51 else 52 printf("try agian"); 53 v2 = (FILE *)((char *)iob[1] - 1); 54 iob[1] = v2; 55 if ( (signed int)v2 < 0 ) 56 { 57 filbuf(iob[0]); 58 v2 = iob[1]; 59 } 60 else 61 { 62 ++iob[0]; 63 } 64 v3 = (FILE *)((char *)v2 - 1); 65 iob[1] = v3; 66 if ( (signed int)v3 < 0 ) 67 filbuf(iob[0]); 68 else 69 ++iob[0]; 70 result = 0; 71 } 72 return result; 73 }signed int sub_403CC0() 74 { 75 unsigned int v0; // eax 76 int key_lens; // eax 77 FILE *v2; // eax 78 FILE *v3; // eax 79 signed int result; // eax 80 int data; // [esp+10h] [ebp-44h] 81 int v6; // [esp+14h] [ebp-40h] 82 int v7; // [esp+18h] [ebp-3Ch] 83 int v8; // [esp+1Ch] [ebp-38h] 84 int v9; // [esp+20h] [ebp-34h] 85 int v10; // [esp+24h] [ebp-30h] 86 int v11; // [esp+28h] [ebp-2Ch] 87 int v12; // [esp+2Ch] [ebp-28h] 88 int mykey[8]; // [esp+30h] [ebp-24h] 89 90 sub_401AD0(); 91 data = 'F2A1'; // 1A2F943C4D8C5B6EA3C9BCAD7E 92 v6 = 'C349'; 93 v0 = 0; 94 v7 = 'C8D4'; 95 v8 = 'E6B5'; 96 v9 = '9C3A'; 97 v10 = 'DACB'; 98 v11 = 'E7'; 99 v12 = 0; 100 do 101 { 102 mykey[v0] = 0; 103 ++v0; 104 } 105 while ( v0 < 8 ); 106 puts("input your key:"); 107 scanf("%s", mykey); 108 key_lens = strlen((const char *)mykey); 109 if ( key_lens <= 19 ) 110 { 111 printf("too short!"); 112 result = -1; 113 } 114 else if ( key_lens > 30 ) 115 { 116 printf("too long!"); 117 result = -1; 118 } 119 else 120 { 121 if ( check_4014A0((char *)mykey, (char *)&data, key_lens) ) 122 printf("congratulations, your input is the flag ^_^"); 123 else 124 printf("try agian"); 125 v2 = (FILE *)((char *)iob[1] - 1); 126 iob[1] = v2; 127 if ( (signed int)v2 < 0 ) 128 { 129 filbuf(iob[0]); 130 v2 = iob[1]; 131 } 132 else 133 { 134 ++iob[0]; 135 } 136 v3 = (FILE *)((char *)v2 - 1); 137 iob[1] = v3; 138 if ( (signed int)v3 < 0 ) 139 filbuf(iob[0]); 140 else 141 ++iob[0]; 142 result = 0; 143 } 144 return result; 145 }
关键函数check_4014A0((char *)mykey, (char *)&data, key_lens)
1 signed int __cdecl check_4014A0(char *mykey, char *data, int key_lens) 2 { 3 unsigned int v3; // ebx 4 int j; // eax 5 int k; // ebx 6 char v7; // dl 7 int i; // eax 8 char v9; // [esp+Ah] [ebp-4Ah] 9 char v10; // [esp+Bh] [ebp-49h] 10 char v11; // [esp+Ch] [ebp-48h] 11 char v12; // [esp+Dh] [ebp-47h] 12 char v13; // [esp+Eh] [ebp-46h] 13 char v14; // [esp+Fh] [ebp-45h] 14 char v15; // [esp+10h] [ebp-44h] 15 char v16; // [esp+11h] [ebp-43h] 16 char v17; // [esp+12h] [ebp-42h] 17 char v18; // [esp+13h] [ebp-41h] 18 char v19; // [esp+14h] [ebp-40h] 19 char v20; // [esp+15h] [ebp-3Fh] 20 char v21; // [esp+16h] [ebp-3Eh] 21 char v22; // [esp+17h] [ebp-3Dh] 22 char v23; // [esp+18h] [ebp-3Ch] 23 char v24; // [esp+19h] [ebp-3Bh] 24 char v25; // [esp+1Ah] [ebp-3Ah] 25 char v26; // [esp+1Bh] [ebp-39h] 26 char v27; // [esp+1Ch] [ebp-38h] 27 char v28; // [esp+1Dh] [ebp-37h] 28 char v29; // [esp+1Eh] [ebp-36h] 29 char v30; // [esp+1Fh] [ebp-35h] 30 char v31; // [esp+20h] [ebp-34h] 31 char v32; // [esp+21h] [ebp-33h] 32 char v33; // [esp+22h] [ebp-32h] 33 int v34; // [esp+24h] [ebp-30h] 34 char v35[44]; // [esp+28h] [ebp-2Ch] 35 36 v3 = 0; 37 v34 = 0; 38 do 39 { 40 *(_DWORD *)(&v11 + v3) = 0; 41 v3 += 4; // 置零初始化 42 } 43 while ( v3 < ((&v9 - &v11 + 30) & 0xFFFFFFFC) );// <28 44 v9 = 0xF; //encryptArray 45 v10 = 0x87u; 46 v11 = 0x62; 47 v12 = 0x14; 48 v13 = 1; 49 v14 = 0xC6u; 50 v15 = 0xF0u; 51 v16 = 33; 52 v17 = 48; 53 v18 = 17; 54 v19 = 80; 55 v20 = 0xD0u; 56 v21 = 0x82u; 57 v22 = 35; 58 v23 = 0xAEu; 59 v24 = 35; 60 v25 = 0xEEu; 61 v26 = 0xA9u; 62 v27 = 0xB4u; 63 v28 = 82; 64 v29 = 120; 65 v30 = 87; 66 v31 = 12; 67 v32 = 0x86u; 68 v33 = 0x8Bu; // 0F 87 62 14 01 C6 F0 21 30 11 50 D0 82 23 AE 23 EE A9 B4 52 78 57 0C 86 8B 69 // 70 // 71 if ( key_lens == 25 ) 72 { 73 j = 0; 74 do 75 { 76 v35[j] = __ROL1__(mykey[j], 2); // 循环左移2位 77 ++j; 78 } 79 while ( j != 25 ); 80 k = 0; 81 do 82 { 83 v35[k] ^= numb_401460(data, k); // data：(ASCII "1A2F943C4D8C5B6EA3C9BCAD7E") 84 // numb函数根据data、k生成一系列数， 85 // 86 ++k; 87 } 88 while ( k != 25 ); 89 v7 = 15; 90 for ( i = 0; v35[i] == v7; v7 = *(&v9 + i) )//关键比较，v35存储内容：（key循环左移2位 异或 numb数据） 结果与encryptArray比较 91 { 92 if ( ++i == 25 ) 93 return 1; 94 } 95 } 96 return 0; 97 }
numb_401460(data, k)函数：
int __cdecl sub_401460(char *data, int index) { char a; // al char b; // cl int x; // eax int y; // edx 1A2F943C4D8C5B6EA3C9BCAD7E a = data[index]; b = data[index + 1]; if ( (unsigned __int8)(a - 0x30) > 9u ) a -= 0x37; x = a & 0xF; y = (b - 0x37) & 0xF; if ( (unsigned __int8)(b - 0x30) <= 9u ) y = b & 0xF; return y | 16 * x;
‘wp:
1 encryptArray=[0x0F, 0x87, 0x62, 0x14, 0x01, 0xC6, 0xF0, 0x21, 0x30, 0x11, 0x50, 0xD0, 0x82, 0x23, 0xAE, 0x23,0xEE, 0xA9, 0xB4, 0x52, 0x78, 0x57, 0x0C, 0x86, 0x8B] 2 data='1A2F943C4D8C5B6EA3C9BCAD7E' 3 numbs=[] 4 # numbs=[0x1a, 0xa2, 0x2f, 0xf9, 0x94, 0x43, 0x3c, 0xc4, 0x4d, 0xd8, 0x8c, 0xc5, 0x5b, 0xb6, 0x6e, 0xea, 0xa3, 0x3c, 0xc9, 0x9b, 0xbc, 0xca, 0xad, 0xd7, 0x7e] 5 6 # def ROLN_(val,N,n): 7 # 假如将一个无符号的数据val，长度为N，需要循环移动n位。可以利用下面的公式： 8 # 循环左移：(val >> (N - n) | (val << n)) 9 # 循环右移：(val << (32 - n) | (val >> n)) 10 def ROL_2(val):#8字节数循环左移2位 11 return ((val>>6)&0xff)|((val<<2)&0xff) 12 def ROR_2(val):#8字节数循环右移2位 13 return ((val<<6)&0xff)|((val>>2)&0xff) 14 def numb(data,index): 15 a = ord(data[index]); 16 b = ord(data[index + 1]); 17 if ((a - 0x30) > 9): 18 a -= 0x37; 19 x = a & 0xF; 20 y = (b - 0x37) & 0xF; 21 if ((b - 0x30) <= 9): 22 y = b & 0xF; 23 return y | 16 * x; 24 25 for i in range(25): 26 numbs.append(numb(data,i)) 27 print('numbs=[',','.join(map(hex,numbs)),']') 28 29 key=[] 30 for i in range(25): 31 x=encryptArray[i]^numbs[i] 32 x=ROR_2(x) 33 key.append(chr(x)) 34 print(''.join(key))
EIS{ea3y_r7Eve0rSe_r1ghT}
在攻防世界中提交失败0.0，Orz