Jarvis OJ部分逆向
Jarvis OJ部分逆向题解
很久没有写博客了，前天上Jarvis OJ刷了几道逆向，保持了一下感觉。都是简单题目，写个writeup记录一下。
easycrackme
int __cdecl main(int argc, const char **argv, const char **envp) { __int64 v3; // rdi char v5; // [rsp+0h] [rbp-38h] char v6; // [rsp+1h] [rbp-37h] char v7; // [rsp+2h] [rbp-36h] char v8; // [rsp+3h] [rbp-35h] char v9; // [rsp+4h] [rbp-34h] char v10; // [rsp+5h] [rbp-33h] unsigned __int8 v11; // [rsp+10h] [rbp-28h] _BYTE v12[7]; // [rsp+11h] [rbp-27h] v5 = -85; v6 = -35; v7 = 51; v8 = 84; v9 = 53; v10 = -17; printf((unsigned __int64)"Input your password:"); _isoc99_scanf((unsigned __int64)"%s"); if ( strlen((const char *)&v11) == 26 ) // 这里的strlen函数被去符号表解析了 { v3 = 0LL; if ( (v11 ^ 0xAB) == list1 ) // 输入的第一个字母:"P"，list1这里有关键数据 { while ( (v12[v3] ^ (unsigned __int8)*(&v5 + ((signed int)v3 + 1) % 6)) == byte_6B41D1[v3] ) { if ( ++v3 == 25 ) { printf((unsigned __int64)"Congratulations!"); return 0; } } } } printf((unsigned __int64)"Password Wrong!! Please try again."); return 0; }
静态分析找到代码，把byte_6841D1和list1那里的关键数据提取出来，直接逆向算法。
ch=[171,221,51,84,53,239] list1=[0x9E,0x67,0x12,0x4E,0x9D,0x98,0xAB,0,6,0x46,0x8A,0xF4,0xB4,6,0x0B,0x43,0xDC,0xD9,0xA4,0x6C,0x31,0x74,0x9C,0xD2,0xA0] print(len(list1)) temp,temp_ch=0,'' flag='' flag+='P' for i in range(25): temp=list1[i]^ch[(i+1)%6] temp_ch=chr(temp) print(temp_ch) flag+=temp_ch print(flag)
Baby's Crack
int __cdecl main(int argc, const char **argv, const char **envp) { int result; // eax char Dest; // [rsp+20h] [rbp-80h] FILE *v5; // [rsp+88h] [rbp-18h] FILE *File; // [rsp+90h] [rbp-10h] char v7; // [rsp+9Fh] [rbp-1h] const char **v8; // [rsp+B8h] [rbp+18h] v8 = argv; if ( argc <= 1 ) { printf("Usage: %s [FileName]\n", *argv, envp); printf("FileName是待加密的文件"); exit(1); } File = fopen(argv[1], "rb+"); if ( File ) { v5 = fopen("tmp", "wb+"); // v5是文件操作符 while ( feof(File) == 0 ) { v7 = fgetc(File); if ( v7 != -1 && v7 ) // -1表示读取到文件末尾EOF { if ( v7 > 47 && v7 <= 96 ) { v7 += 53; } else if ( v7 <= 46 ) { v7 += v7 % 11; } else { v7 = 61 * (v7 / 61); } fputc(v7, v5); } } fclose(v5); fclose(File); sprintf(&Dest, "del %s", v8[1]); system(&Dest); sprintf(&Dest, "ren tmp %s", v8[1]); system(&Dest); result = 0; } else { printf("无法打开文件%s\n", v8[1]); result = -1; } return result; }
这里提供了flag的加密文件flag.enc，从关键代码这里来看，我们只要在字母表中找准对应的映射就可以了。脚本如下：
# -*- coding: utf-8 -* import string with open("C://Users//wolf//Desktop//babyscrack//flag.enc",'rb+') as f: flag_info=f.read() print(flag_info) def encrypto(a): if a!='\xff' and a: if ord(a)>47 and ord(a)<=96: a=chr(ord(a)+53) elif ord(a)<=46: a=chr(ord(a)+ord(a)%11) else: a=chr(61*(ord(a)/61)) return a enc='jeihjiiklwjnk{ljj{kflghhj{ilk{k{kij{ihlgkfkhkwhhjgly' print(string.printable) flag="" for i in enc: for j in string.printable: if i==encrypto(j): flag+=j break print(flag.decode('hex'))
stheasy
这道题有一个小坑点在int8那里，表明是取后8位做抑或。
signed int __cdecl check(int a1) { int v1; // eax int v3; // edx if ( a1 ) { v1 = sub_804849C(a1); if ( v1 ) { if ( v1 == 29 ) { v3 = 0; while ( *(_BYTE *)(a1 + v3) == byte_8049AE0[(unsigned __int8)((unsigned __int8)byte_8049B15[v3] / 3u - 2)] ) { if ( ++v3 == 29 ) return 1; } } } } return 0; }
s="k2j9Gh}AgfY4ds-a6QW1#k5ER_T[cvLbV7nOm3ZeX{CMt8SZo]U" flag_info=[0x48,0x5D,0x8D,0x24,0x84,0x27,0x99,0x9F,0x54,0x18,0x1E,0x69,0x7E,0x33, 0x15,0x72,0x8D,0x33,0x24,0x63,0x21,0x54,0x0C,0x78,0x78,0x78,0x78,0x78,0x1B] print(len(flag_info)) print(len(s)) index,temp,flag,idx=0,"","",[] for i in flag_info: temp=bin(i/3-2) if len(temp)>=10: temp=temp[-8:] else: temp=temp[2:] index=int(temp,2) idx.append(index) for i in idx: flag+=s[i-1] print(flag)
1.Hello
这题有个反调试，但是不影响，静态分析就能出。start函数和dummy函数地址相减的地方注意一下，逻辑写正确即可。
int __cdecl main(int argc, const char **argv, const char **envp) { int result; // eax signed int v4; // [rsp+1Ch] [rbp-14h] int v5; // [rsp+24h] [rbp-Ch] v5 = ((unsigned __int64)((char *)start - (char *)dummy) >> 2) ^ flag_data[0]; result = anti_debug(); if ( !(result & 1) ) { v4 = 0; while ( v4 < 55 ) { flag_data[v4] -= 2; flag_data[v4] ^= v5; ++v4; ++v5; } result = printf("\nFinal output is %s\n", &flag_data[1]); } return result; }
flag_data=[0x41, 0x10, 0x11,0x11,0x1B, 0x0A, 0x64, 0x67, 0x6A, 0x68, 0x62, 0x68, 0x6E, 0x67, 0x68, 0x6B, 0x62, 0x3D, 0x65, 0x6A,0x6A, 0x3D, 0x68, 0x4, 0x5, 0x8, 0x3, 0x2,0x2, 0x55, 8, 0x5D, 0x61, 0x55, 0xA, 0x5F, 0x0D, 0x5D, 0x61, 0x32, 0x17, 0x1D, 0x19, 0x1F, 0x18, 0x20, 0x4, 0x2, 0x12, 0x16, 0x1E, 0x54,0x20,0x13,0x14] print(len(flag_data)) v5=((0xcb0-0xc90)>>2)^flag_data[0] v4,flag=0,"" while(v4<55): flag_data[v4]-=2 flag_data[v4]^=v5 flag+=chr(flag_data[v4]) v4+=1 v5+=1 print(flag)
Classical Crackme
这道题去了符号表，加了返混淆，好像还是C#写的，但是没关系，直接去找字符串常量，发现有一串字符串
一看就是base64加密的，解密之后就是flag。
findkey
这是一道python逆向的题目，直接用IDA看显示的就是字节码。在linux下用file查一下，发现应该是一个pyc，这时候用在线网站进行一步反汇编，拿到源码之后，逆向算法，exp如下所示。
lookup = [196,153,149,206,17,221,10,217,167,18,36,135,103,61,111,31,92,152,21,228,105,191, 173,41,2,245,23,144,1,246,89,178,182,119,38,85,48,226,165,241,166,214,71,90,151,3, 109,169,150,224,69,156,158,57,181,29,200,37,51,252,227,93,65,82,66,80,170,77,49,177, 81,94,202,107,25,73,148,98,129,231,212,14,84,121,174,171,64,180,233,74,140,242,75, 104,253,44,39,87,86,27,68,22,55,76,35,248,96,5,56,20,161,213,238,220,72,100,247,8, 63,249,145,243,155,222,122,32,43,186,0,102,216,126,15,42,115,138,240,147,229,204,117, 223,141,159,131,232,124,254,60,116,46,113,79,16,128,6,251,40,205,137,199,83,54,188,19, 184,201,110,255,26,91,211,132,160,168,154,185,183,244,78,33,123,28,59,12,210,218,47, 163,215,209,108,235,237,118,101,24,234,106,143,88,9,136,95,30,193,176,225,198,197,194, 239,134,162,192,11,70,58,187,50,67,236,230,13,99,190,208,207,7,53,219,203,62,114,127, 125,164,179,175,112,172,250,133,130,52,189,97,146,34,157,120,195,45,4,142,139] pwda = [188,155,11,58,251,208,204,202,150,120,206,237,114,92,126,6,42] pwdb = [53,222,230,35,67,248,226,216,17,209,32,2,181,200,171,60,108] flag,temp="",0 for i in range(0,17): temp=lookup[i+pwdb[i]]-pwda[i]&255 flag+=chr(temp) flag=flag[::-1] print(flag)
软件密码破解-1
这道题肯定用strip把符号表全部都去掉了。静态分析的时候，修复符号表当然是一种思路，但是还是不够，我修复了大概7000个函数，还是很难找到关键代码，而且在IDA中找不到程序运行过程中出现过的一些字符串。这种时候，直接用OD的中文搜索引擎去找一些特殊的字符串，找到“你赢了”，然后很快地就可以定位到关键代码段。
脚本如下。
array_1=[0x1b,0x1c,0x17,0x46,0xf4,0xfd,0x20,0x30,0xb7,0xc,0x8e,0x7e,0x78,0xDE] array_2=[0xff,0x1a,0x4e,0xe4,0x53,0xe3,0x51,0x65,0x8f,0x93,0x6B,0x64,0x57,0x28] array_2=array_2[::-1] flag,temp="",0 for i in range(14): temp=array_1[i]^array_2[i] flag+=chr(temp) print(flag)
