[HGAME 2023 week2]IOT

IOT

[HGAME 2023 week2]Pirated router

binwalk解开
然后耐心的一个一个的找...

这儿有个secret_program

ghidra反编译

直接提取数据 xor 0x23
直接运行也会输出

转成chr即可

enc = [0x4b,0x44,0x42,0x4e,0x46,0x58,0x56,0x4d,0x53,0x17,0x40,0x48,0x12,0x4d,0x44,0x7c,\
    0x45,0x4a,0x51,0x4e,0x54,0x42,0x51,0x46,0x7c,0x12,0x50,0x7c,0x10,0x62,0x50,0x5a,0x5e]
for c in enc:
    print(chr(c^0x23),end='')
print()
s = "104 103 97 109 101 123 117 110 112 52 99 107 49 110 103 95 102 105 114 109 119 97 114 101 95 49 115 95 51 65 115 121 125"
s = s.split(" ")
for c in s:
    try:
       print(chr(c),end='') 
    except:
        pass

hgame{unp4ck1ng_firmware_1s_3Asy}

[HGAME 2023 week2]Pirated keyboard

一个键盘流量
找个脚本

#!/usr/bin/env python
# -*- coding:utf-8 -*-
import os
os.system("tshark -r keyboard.pcapng -T fields -e usb.capdata > usbdata.txt")
normalKeys = {"04":"a", "05":"b", "06":"c", "07":"d", "08":"e", "09":"f", "0a":"g", "0b":"h", "0c":"i", "0d":"j", "0e":"k", "0f":"l", "10":"m", "11":"n", "12":"o", "13":"p", "14":"q", "15":"r", "16":"s", "17":"t", "18":"u", "19":"v", "1a":"w", "1b":"x", "1c":"y", "1d":"z","1e":"1", "1f":"2", "20":"3", "21":"4", "22":"5", "23":"6","24":"7","25":"8","26":"9","27":"0","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"-","2e":"=","2f":"[","30":"]","31":"\\","32":"<NON>","33":";","34":"'","35":"<GA>","36":",","37":".","38":"/","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
shiftKeys = {"04":"A", "05":"B", "06":"C", "07":"D", "08":"E", "09":"F", "0a":"G", "0b":"H", "0c":"I", "0d":"J", "0e":"K", "0f":"L", "10":"M", "11":"N", "12":"O", "13":"P", "14":"Q", "15":"R", "16":"S", "17":"T", "18":"U", "19":"V", "1a":"W", "1b":"X", "1c":"Y", "1d":"Z","1e":"!", "1f":"@", "20":"#", "21":"$", "22":"%", "23":"^","24":"&","25":"*","26":"(","27":")","28":"<RET>","29":"<ESC>","2a":"<DEL>", "2b":"\t","2c":"<SPACE>","2d":"_","2e":"+","2f":"{","30":"}","31":"|","32":"<NON>","33":"\"","34":":","35":"<GA>","36":"<","37":">","38":"?","39":"<CAP>","3a":"<F1>","3b":"<F2>", "3c":"<F3>","3d":"<F4>","3e":"<F5>","3f":"<F6>","40":"<F7>","41":"<F8>","42":"<F9>","43":"<F10>","44":"<F11>","45":"<F12>"}
output = []
keys = open('usbdata.txt')
for line in keys:
    try:
        if line[0]!='0' or (line[1]!='0' and line[1]!='2') or line[3]!='0' or line[4]!='0' or line[9]!='0' or line[10]!='0' or line[12]!='0' or line[13]!='0' or line[15]!='0' or line[16]!='0' or line[18]!='0' or line[19]!='0' or line[21]!='0' or line[22]!='0' or line[6:8]=="00":
             continue
        if line[6:8] in normalKeys.keys():
            output += [[normalKeys[line[6:8]]],[shiftKeys[line[6:8]]]][line[1]=='2']
        else:
            output += ['[unknown]']
    except:
        pass
keys.close()

flag=0
print("".join(output))
for i in range(len(output)):
    try:
        a=output.index('<DEL>')
        del output[a]
        del output[a-1]
    except:
        pass
for i in range(len(output)):
    try:
        if output[i]=="<CAP>":
            flag+=1
            output.pop(i)
            if flag==2:
                flag=0
        if flag!=0:
            output[i]=output[i].upper()
    except:
        pass
print ('output :' + "".join(output))

# zihiui_NB_666}

注意项目魔改了键盘对应关系

H,I 的顺序是反着的即 H<->I

所以后半截flag是 zhihuh_NB_666}
然后前半截flag藏在这里

麻了...

所以总flag:
hgame{peng_zhihuh_NB_666}

---

---

IOT方向逆向和misc是分不开的... 所以相关的一些流量分析的misc技巧也要掌握...