新手一枚，如有错误（不足）请指正，谢谢！！
<mark>个人博客：点击进入</mark>
题目链接：[SCTF2019]babyre
题目下载：点击下载
修复代码可以F5
这道题不能F5，修改了好久，才显示出伪代码。
修复完的伪代码显示如下
__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
__int64 result; // rax
char v4; // [rsp+Fh] [rbp-151h]
int v5; // [rsp+10h] [rbp-150h]
signed int succ_flag; // [rsp+14h] [rbp-14Ch]
char *local; // [rsp+18h] [rbp-148h]
char v8[10]; // [rsp+26h] [rbp-13Ah]
__int64 input3; // [rsp+30h] [rbp-130h]
__int64 v10; // [rsp+38h] [rbp-128h]
int v11; // [rsp+40h] [rbp-120h]
__int64 input2; // [rsp+50h] [rbp-110h]
__int64 v13; // [rsp+58h] [rbp-108h]
__int64 v14; // [rsp+60h] [rbp-100h]
char v15; // [rsp+68h] [rbp-F8h]
__int64 v16; // [rsp+70h] [rbp-F0h]
__int64 v17; // [rsp+78h] [rbp-E8h]
__int64 v18; // [rsp+80h] [rbp-E0h]
char v19; // [rsp+88h] [rbp-D8h]
__int64 input1; // [rsp+90h] [rbp-D0h]
__int64 v21; // [rsp+98h] [rbp-C8h]
__int64 v22; // [rsp+A0h] [rbp-C0h]
__int64 v23; // [rsp+A8h] [rbp-B8h]
__int64 v24; // [rsp+B0h] [rbp-B0h]
__int64 v25; // [rsp+B8h] [rbp-A8h]
__int16 v26; // [rsp+C0h] [rbp-A0h]
char map[125]; // [rsp+D0h] [rbp-90h]
unsigned __int64 v28; // [rsp+158h] [rbp-8h]
v28 = __readfsqword(0x28u);
v5 = 0;
input2 = 0LL;
v13 = 0LL;
v14 = 0LL;
v15 = 0;
v16 = 0LL;
v17 = 0LL;
v18 = 0LL;
v19 = 0;
input1 = 0LL;
v21 = 0LL;
v22 = 0LL;
v23 = 0LL;
v24 = 0LL;
v25 = 0LL;
v26 = 0;
strcpy(
map,
"**************.****.**s..*..******.****.***********..***..**..#*..***..***.********************.**..*******..**...*..*.*.**.*");
input3 = 0LL;
v10 = 0LL;
v11 = 0;
local = &map[22];
strcpy(v8, "sctf_9102");
puts((const char *)(unsigned int)"plz tell me the shortest password1:");
scanf("%s", &input1);
succ_flag = 1;
while ( succ_flag )
{
v4 = *((_BYTE *)&input1 + v5);
switch ( v4 )
{
case 'w':
local -= 5;
break;
case 's':
local += 5;
break;
case 'd':
++local;
break;
case 'a':
--local;
break;
case 'x':
local += 25;
break;
case 'y':
local -= 25;
break;
default:
succ_flag = 0;
break;
}
++v5;
if ( *local != '.' && *local != '#' )
succ_flag = 0;
if ( *local == '#' )
{
puts("good!you find the right way!\nBut there is another challenge!");
break;
}
}
if ( succ_flag )
{
puts((const char *)(unsigned int)"plz tell me the password2:");
scanf("%s", &input2);
sub_C22((const char *)&input2, (__int64)&v16);
if ( (unsigned int)sub_F67(&v16, v8) == 1 )
{
puts("Congratulation!");
puts((const char *)(unsigned int)"Now,this is the last!");
puts("plz tell me the password3:");
scanf("%s", &input3);
if ( (unsigned int)sub_FFA((char *)&input3) == 1 )
{
puts("Congratulation!Here is your flag!:");
printf("sctf{%s-%s(%s)}", &input1, &input2, &input3);
}
else
{
printf("something srong...");
}
result = 0LL;
}
else
{
printf("sorry,somthing wrong...", v8);
result = 0LL;
}
}
else
{
printf("sorry,is't not a right way...");
result = 0LL;
}
return result;
}
以下步骤为试验多次的情况下找出的最佳步骤
先shift+F12查找到字符串，然后定位到main函数。
类似于上图这样的跳转。将方框的三条指令都nop掉。
可以通过alt+T来快速寻找
修改之后
然后将所有类似矛盾的都修改掉
下图的jb和jnb也nop掉。下图的E13的in字节改为90，花指令
发现一处call loc
这里代码为call loc_c22，但是C22不是一个函数，需要给他修改类型。
双击快速定位到loc_C22，摁Y键修改类型。将其改为一个独立的函数
将test还原为数据，(键盘‘d’键)
之后选中这些未声明的代码，摁P键声明为函数。
先选中798~C21声明一段main函数，然后将C22~F66声明为函数
然后再对伪代码的变量类型修改一下就能出来最开始的代码。
实际修改过程中我是定位伪代码中的JUMPOUT，然后去汇编代码查看有什么冲突导致IDA无法反汇编。
看最后flag
发现最后的flag与输入的三部分有关，先看第一部分。
解题
第一部分
strcpy(
map,
"**************.****.**s..*..******.****.***********..***..**..#*..***..***.********************.**..*******..**...*..*.*.**.*");
input3 = 0LL;
v10 = 0LL;
v11 = 0;
local = &map[22];
strcpy(v8, "sctf_9102");
puts((const char *)(unsigned int)"plz tell me the shortest password1:");
scanf("%s", &input1);
succ_flag = 1;
while ( succ_flag )
{
v4 = *((_BYTE *)&input1 + v5);
switch ( v4 )
{
case 'w':
local -= 5;
break;
case 's':
local += 5;
break;
case 'd':
++local;
break;
case 'a':
--local;
break;
case 'x':
local += 25;
break;
case 'y':
local -= 25;
break;
default:
succ_flag = 0;
break;
}
++v5;
if ( *local != '.' && *local != '#' )
succ_flag = 0;
if ( *local == '#' )
{
puts("good!you find the right way!\nBut there is another challenge!");
break;
}
可以看出是个迷宫题了。三维迷宫。
平面来看，w控制上，s控制下，a控制左，d控制右
x控制去上一层，y控制去下一层。
*是墙，.是路径，#是终点,s是起点。
得出input1为ddwwxxssxaxwwaasasyywwdd
第二部分
sub_C22()函数将input2加密后与v8进行比较
查看sub_C22()函数
unsigned __int64 __fastcall sub_C22(const char *a1, __int64 a2)
{
bool v2; // al
int v3; // eax
int v4; // eax
int v5; // eax
int v7; // [rsp+14h] [rbp-24Ch]
signed int v8; // [rsp+18h] [rbp-248h]
int v9; // [rsp+1Ch] [rbp-244h]
int v10; // [rsp+20h] [rbp-240h]
int v11; // [rsp+24h] [rbp-23Ch]
int v12; // [rsp+28h] [rbp-238h]
int v13; // [rsp+2Ch] [rbp-234h]
char *v14; // [rsp+48h] [rbp-218h]
int v15[130]; // [rsp+50h] [rbp-210h]
unsigned __int64 v16; // [rsp+258h] [rbp-8h]
v16 = __readfsqword(0x28u);
qmemcpy(v15, dword_1740, 512uLL);
v8 = 3;
v7 = 0;
v10 = 0;
v11 = 0;
v12 = strlen(a1);
v14 = (char *)a1;
while ( 1 )
{
v13 = 0;
if ( v10 < v12 )
break;
LABEL_13:
if ( v10 >= v12 )
goto LABEL_14;
}
do
{
if ( a1[v10] != 25 )
break;
++v10;
++v13;
}
while ( v10 < v12 );
if ( v10 != v12 )
{
if ( v12 - v10 > 1 )
{
v2 = v10 == 19 && a1[20] == 16;
a1[v2];
}
++v10;
goto LABEL_13;
}
LABEL_14:
v9 = 0;
while ( v12 > 0 )
{
v8 -= v15[*v14] == 0x40; // v8初始为3
v7 = v15[*v14] & 0x3F | (v7 << 6); // 3F的二进制为111111
// 也就是将v7左移6位，空缺由v15[*v14]的低六位补上。
if ( ++v9 == 4 ) // 每次存4位进入一次if条件代码块
{ // 将其改为三位，赋值给a2
v9 = 0;
if ( v8 ) // v11为计数器
{
v3 = v11++;
*(_BYTE *)(v3 + a2) = BYTE2(v7); // BYTE2(V7)=((BYTE*)&(V7)+2)
}
if ( v8 > 1 )
{
v4 = v11++;
*(_BYTE *)(v4 + a2) = BYTE1(v7); // BYTE1(V7)=((BYTE*)&(V7)+1)
}
if ( v8 > 2 )
{
v5 = v11++;
*(_BYTE *)(v5 + a2) = v7;
}
}
++v14;
--v12;
}
return __readfsqword(0x28u) ^ v16;
}
看着挺长，发现实际操作的代码就这些。
也就是将input2的每四位改成三位给v16，然后v16再与v8="sctf_9102"进行比较
v8有9位，可知input2有16位。
提取出数据，写爆破脚本。
#include <stdio.h>
unsigned int data[128] = {
0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
0x7F, 0x7F, 0x7F, 0x3E, 0x7F, 0x7F, 0x7F, 0x3F,
0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B,
0x3C, 0x3D, 0x7F, 0x7F, 0x7F, 0x40, 0x7F, 0x7F,
0x7F, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E,
0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,
0x17, 0x18, 0x19, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
0x7F, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20,
0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30,
0x31, 0x32, 0x33, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F
};
int main()
{
int shuju[3] = { 0x736374,0x665f39,0x313032 };
int i0, i1, i2, i3, i4, i5;
for (i0 = 0; i0 < 3; i0++)
{
for(i1=32;i1<128;i1++)
for (i2 = 32; i2 < 128; i2++)
for (i3 = 32; i3 < 128; i3++)
for (i4 = 32; i4 < 128; i4++)
{
i5 = (((((data[i1] << 6) | data[i2]) << 6) | data[i3]) << 6) | data[i4];
if (i5 == shuju[i0])
printf("第%d组：%c%c%c%c\n", i0+1,i1, i2, i3, i4);
}
}
return 0;
}
得到输出
第1组：c2N0
第2组：Zl85
第3组：MS=y
第3组：MT=y
第3组：MTAy
动态调试一下，发现第三个应该是MTAy
所以input2应该为c2N0Zl85MTAy
第三部分
只要输入的字符串能让sub_FFA()返回1就好了
查看sub_FFA()函数
signed __int64 __fastcall sub_FFA(char *a1)
{
int v1; // ST24_4
int v2; // ST28_4
int v3; // ST2C_4
signed int v5; // [rsp+18h] [rbp-158h]
signed int i; // [rsp+18h] [rbp-158h]
int v7; // [rsp+1Ch] [rbp-154h]
int v8[16]; // [rsp+30h] [rbp-140h]
unsigned int v9[16]; // [rsp+70h] [rbp-100h]
int v10[30]; // [rsp+B0h] [rbp-C0h]
unsigned __int64 v11; // [rsp+168h] [rbp-8h]
v11 = __readfsqword(0x28u);
v8[0] = 190;
v8[1] = 4;
v8[2] = 6;
v8[3] = 128;
v8[4] = 197;
v8[5] = 175;
v8[6] = 118;
v8[7] = 71;
v8[8] = 159;
v8[9] = 204;
v8[10] = 64;
v8[11] = 31;
v8[12] = 216;
v8[13] = 191;
v8[14] = 146;
v8[15] = 239;
v1 = (a1[6] << 8) | (a1[5] << 16) | (a1[4] << 24) | a1[7];
v2 = (a1[10] << 8) | (a1[9] << 16) | (a1[8] << 24) | a1[11];
v3 = (a1[14] << 8) | (a1[13] << 16) | (a1[12] << 24) | a1[15];// 将4个字符存储在int里，大端序存放
v7 = 0;
v5 = 4;
v10[0] = sub_78A((a1[2] << 8) | (a1[1] << 16) | (*a1 << 24) | (unsigned int)a1[3]);
v10[1] = sub_78A(v1);
v10[2] = sub_78A(v2);
v10[3] = sub_78A(v3);
do
{
v10[v5] = sub_143B(v10[v7], v10[v7 + 1], v10[v7 + 2], v10[v7 + 3]);// 加密函数
++v7;
++v5;
}
while ( v5 <= 29 );
v9[0] = (unsigned int)v10[26] >> 24;
v9[1] = BYTE2(v10[26]);
v9[2] = BYTE1(v10[26]);
v9[3] = LOBYTE(v10[26]);
v9[4] = (unsigned int)v10[27] >> 24;
v9[5] = BYTE2(v10[27]);
v9[6] = BYTE1(v10[27]);
v9[7] = LOBYTE(v10[27]);
v9[8] = (unsigned int)v10[28] >> 24;
v9[9] = BYTE2(v10[28]);
v9[10] = BYTE1(v10[28]);
v9[11] = LOBYTE(v10[28]);
v9[12] = (unsigned int)v10[29] >> 24;
v9[13] = BYTE2(v10[29]);
v9[14] = BYTE1(v10[29]);
v9[15] = LOBYTE(v10[29]);
for ( i = 0; i <= 15; ++i )
{
if ( v9[i] != v8[i] )
return 0xFFFFFFFFLL;
}
return 1LL;
}
其中sub_143B()函数
sub1464()函数
第三步的加密是可逆的，直接使用它的代码就好。
写的脚本，使用了IDA自己的一个头文件，在IDA目录的plugins目录里
#include <stdio.h>
#include "defs.h"
unsigned int data1[288] = {
0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7,
0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3,
0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A,
0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95,
0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA,
0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B,
0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2,
0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,
0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52,
0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,
0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5,
0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,
0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55,
0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60,
0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,
0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F,
0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,
0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F,
0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,
0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD,
0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,
0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E,
0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20,
0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48,
0xC6, 0xBA, 0xB1, 0xA3, 0x50, 0x33, 0xAA, 0x56,
0x97, 0x91, 0x7D, 0x67, 0xDC, 0x22, 0x70, 0xB2,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};
unsigned int fun(unsigned int a1)
{
int v1;
v1 = (data1[BYTE2(a1)] << 16) | data1[(unsigned __int8)a1] | (data1[BYTE1(a1)] << 8) | (data1[a1 >> 24] << 24);
return __ROL4__(v1, 12) ^ (unsigned int)(__ROL4__(v1, 8) ^ __ROR4__(v1, 2)) ^ __ROR4__(v1, 6);
}
int main()
{
unsigned int data[30] = { 0 };
data[26] = 0xBE040680;
data[27] = 0xC5AF7647;
data[28] = 0x9FCC401F;
data[29] = 0xD8BF92EF;
int i;
for (i = 25; i >=0; i--)
data[i] = fun(data[i+1] ^ data[i+2] ^ data[i+3]) ^ data[i+4];
printf("%x %x %x %x\n", data[0], data[1], data[2], data[3]);
for (i = 0; i < 4; i++)
printf("%c%c%c%c", ((char*)&data[i])[0], ((char*)&data[i])[1], ((char*)&data[i])[2], ((char*)&data[i])[3]);
return 0;
}
得出第三部分的input3为fl4g_is_s0_ug1y!
得到flag
得到flag为sctf{ddwwxxssxaxwwaasasyywwdd-c2N0Zl85MTAy(fl4g_is_s0_ug1y!)}
京公网安备 11010502036488号