【攻防世界】Reverse系列之CatFly

2024-01-17

CTF / Reverse

字数统计: 3.1k | 阅读时长≈ 17 分钟

【攻防世界】Reverse系列之CatFly

这个靶场的文件是一个ELF文件，需要在Linux系统上运行

使用IDA打开该文件进行静态分析，定位关键函数start，这是由c语言编写的ELF程序

在C++中main()在start()启动函数之后，在start()函数中定位main()

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  size_t v3; // rbx
  __int16 v5[4]; // [rsp+10h] [rbp-4B0h] BYREF
  time_t time1; // [rsp+18h] [rbp-4A8h] BYREF
  time_t timer; // [rsp+20h] [rbp-4A0h] BYREF
  int longind; // [rsp+2Ch] [rbp-494h] BYREF
  __int64 s[2]; // [rsp+30h] [rbp-490h] BYREF
  char v10[1008]; // [rsp+40h] [rbp-480h] BYREF
  const char *v11; // [rsp+430h] [rbp-90h]
  int v12; // [rsp+43Ch] [rbp-84h]
  double v13; // [rsp+440h] [rbp-80h]
  char *v14; // [rsp+448h] [rbp-78h]
  int v15; // [rsp+450h] [rbp-70h]
  unsigned int v16; // [rsp+454h] [rbp-6Ch]
  unsigned __int8 v17; // [rsp+45Ah] [rbp-66h]
  char v18; // [rsp+45Bh] [rbp-65h]
  int m; // [rsp+45Ch] [rbp-64h]
  int v20; // [rsp+460h] [rbp-60h]
  char v21; // [rsp+467h] [rbp-59h]
  int l; // [rsp+468h] [rbp-58h]
  int k; // [rsp+46Ch] [rbp-54h]
  char v24; // [rsp+473h] [rbp-4Dh]
  int v25; // [rsp+474h] [rbp-4Ch]
  unsigned __int64 v26; // [rsp+478h] [rbp-48h]
  int v27; // [rsp+484h] [rbp-3Ch]
  int v28; // [rsp+488h] [rbp-38h]
  int v29; // [rsp+48Ch] [rbp-34h]
  char v30; // [rsp+490h] [rbp-30h]
  bool v31; // [rsp+491h] [rbp-2Fh]
  unsigned __int16 v32; // [rsp+492h] [rbp-2Eh]
  int v33; // [rsp+494h] [rbp-2Ch]
  unsigned int v34; // [rsp+498h] [rbp-28h]
  unsigned int i; // [rsp+49Ch] [rbp-24h]
  int v36; // [rsp+4A0h] [rbp-20h]
  unsigned int j; // [rsp+4A4h] [rbp-1Ch]
  char *haystack; // [rsp+4A8h] [rbp-18h]

  haystack = 0LL;
  i = 0;
  v34 = 0;
  v33 = 0;
  s[0] = 0LL;
  s[1] = 0LL;
  memset(v10, 0, sizeof(v10));
  v32 = 0;
  v31 = 0;
  v30 = 0;
  v29 = 90;
  while ( 1 )
  {
    v28 = getopt_long(a1, a2, "eshiItnd:f:r:R:c:C:W:H:", &longopts, &longind);
    if ( v28 == -1 )
      break;
    if ( !v28 && !*((_QWORD *)&longopts.flag + 4 * longind) )
      v28 = *(&longopts.val + 8 * longind);
    switch ( v28 )
    {
      case 'C':
        dword_E1F8 = atoi(optarg);
        break;
      case 'H':
        dword_E1EC = (64 - atoi(optarg)) / 2;
        dword_E1F0 = (atoi(optarg) + 64) / 2;
        break;
      case 'I':
        v30 = 1;
        break;
      case 'R':
        dword_E1F0 = atoi(optarg);
        break;
      case 'W':
        dword_E1F4 = (64 - atoi(optarg)) / 2;
        dword_E1F8 = (atoi(optarg) + 64) / 2;
        break;
      case 'c':
        dword_E1F4 = atoi(optarg);
        break;
      case 'd':
        if ( atoi(optarg) > 9 && atoi(optarg) <= 1000 )
          v29 = atoi(optarg);
        break;
      case 'e':
        dword_E104 = 0;
        break;
      case 'f':
        dword_104C4 = atoi(optarg);
        break;
      case 'h':
        sub_67F0(a2);
        exit(0);
      case 'i':
        v31 = 1;
        break;
      case 'r':
        dword_E1EC = atoi(optarg);
        break;
      case 's':
        dword_E108 = 0;
        break;
      case 't':
        dword_104C0 = 1;
        break;
      default:
        continue;
    }
  }
  if ( dword_104C0 )
  {
    v31 = v30 == 0;
    sub_6669();
    for ( i = 0; i <= 0xFF; ++i )
    {
      if ( *((_BYTE *)&unk_104E0 + i) )
      {
        sub_66AF(*((unsigned __int8 *)&unk_104E0 + i), i);
        fflush(stdout);
      }
    }
    for ( i = 0; i <= 0xFF; ++i )
    {
      if ( *((_BYTE *)&unk_105E0 + i) )
      {
        sub_66AF(*((unsigned __int8 *)&unk_105E0 + i), i);
        fflush(stdout);
      }
    }
    signal(14, sub_64C0);
    if ( !_setjmp(env) )
    {
      alarm(1u);
LABEL_58:
      while ( !feof(stdin) && v34 <= 1 )
      {
        v18 = getchar();
        v17 = 0;
        if ( v18 == -1 )
        {
          v18 = getchar();
          switch ( v18 )
          {
            case -16:
              v33 = 0;
              if ( LOBYTE(s[0]) == 24 )
              {
                alarm(2u);
                haystack = strndup((const char *)s + 2, 0x3FEuLL);
                ++v34;
              }
              else if ( LOBYTE(s[0]) == 31 )
              {
                alarm(2u);
                dword_E1FC = (BYTE1(s[0]) << 8) | BYTE2(s[0]);
                dword_E200 = (BYTE3(s[0]) << 8) | BYTE4(s[0]);
                ++v34;
              }
              break;
            case -15:
              sub_66AF(241LL, 0LL);
              fflush(stdout);
              break;
            case -6:
              v33 = 1;
              v32 = 0;
              memset(s, 0, 0x400uLL);
              break;
            case -5:
            case -4:
              v17 = getchar();
              if ( !*((_BYTE *)&unk_105E0 + v17) )
                *((_BYTE *)&unk_105E0 + v17) = -4;
              sub_66AF(*((unsigned __int8 *)&unk_105E0 + v17), v17);
              fflush(stdout);
              if ( v18 == -5 && v17 == 24 )
              {
                printf("%c%c%c%c%c%c", 255LL, 250LL, 24LL, 1LL, 255LL, 240LL);
                fflush(stdout);
              }
              break;
            case -3:
            case -2:
              v17 = getchar();
              if ( !*((_BYTE *)&unk_104E0 + v17) )
                *((_BYTE *)&unk_104E0 + v17) = -2;
              sub_66AF(*((unsigned __int8 *)&unk_104E0 + v17), v17);
              fflush(stdout);
              break;
            case -1:
              v34 = 2;
              break;
            default:
              goto LABEL_58;
          }
        }
        else if ( v33 && v32 <= 0x3FEu )
        {
          *((_BYTE *)s + v32++) = v18;
        }
      }
    }
    alarm(0);
  }
  else
  {
    haystack = getenv("TERM");
    ioctl(0, 0x5413uLL, v5);
    dword_E1FC = (unsigned __int16)v5[1];
    dword_E200 = (unsigned __int16)v5[0];
  }
  v36 = 2;
  if ( haystack )
  {
    for ( j = 0; ; ++j )
    {
      v3 = j;
      if ( v3 >= strlen(haystack) )
        break;
      haystack[j] = tolower(haystack[j]);
    }
    if ( strstr(haystack, "xterm") )
    {
      v36 = 1;
    }
    else if ( strstr(haystack, "toaru") )
    {
      v36 = 1;
    }
    else if ( strstr(haystack, "linux") )
    {
      v36 = 3;
    }
    else if ( strstr(haystack, "vtnt") )
    {
      v36 = 5;
    }
    else if ( strstr(haystack, "cygwin") )
    {
      v36 = 5;
    }
    else if ( strstr(haystack, "vt220") )
    {
      v36 = 6;
    }
    else if ( strstr(haystack, "fallback") )
    {
      v36 = 4;
    }
    else if ( strstr(haystack, "rxvt-256color") )
    {
      v36 = 1;
    }
    else if ( strstr(haystack, "rxvt") )
    {
      v36 = 3;
    }
    else if ( strstr(haystack, "vt100") && dword_E1FC == 40 )
    {
      v36 = 7;
    }
    else if ( !strncmp(haystack, "st", 2uLL) )
    {
      v36 = 1;
    }
  }
  v27 = 0;
  signal(2, sub_64A8);
  signal(13, sub_64E6);
  if ( !dword_104C0 )
    signal(28, handler);
  switch ( v36 )
  {
    case 1:
      qword_FE20 = (__int64)"\x1B[48;5;17m";
      qword_FE30 = (__int64)"\x1B[48;5;231m";
      qword_FDF8 = (__int64)"\x1B[48;5;16m";
      qword_FEC0 = (__int64)"\x1B[48;5;230m";
      qword_FDE0 = (__int64)"\x1B[48;5;175m";
      qword_FE28 = (__int64)"\x1B[48;5;162m";
      qword_FEB0 = (__int64)"\x1B[48;5;196m";
      qword_FDF0 = (__int64)"\x1B[48;5;214m";
      qword_FE18 = (__int64)"\x1B[48;5;226m";
      qword_FDD8 = (__int64)"\x1B[48;5;118m";
      qword_FEA8 = (__int64)"\x1B[48;5;33m";
      qword_FE98 = (__int64)"\x1B[48;5;19m";
      qword_FE10 = (__int64)"\x1B[48;5;240m";
      qword_FDE8 = (__int64)"\x1B[48;5;175m";
      break;
    case 2:
      qword_FE20 = (__int64)"\x1B[104m";
      qword_FE30 = (__int64)"\x1B[107m";
      qword_FDF8 = (__int64)"\x1B[40m";
      qword_FEC0 = (__int64)"\x1B[47m";
      qword_FDE0 = (__int64)"\x1B[105m";
      qword_FE28 = (__int64)"\x1B[101m";
      qword_FEB0 = (__int64)"\x1B[101m";
      qword_FDF0 = (__int64)"\x1B[43m";
      qword_FE18 = (__int64)"\x1B[103m";
      qword_FDD8 = (__int64)"\x1B[102m";
      qword_FEA8 = (__int64)"\x1B[104m";
      qword_FE98 = (__int64)"\x1B[44m";
      qword_FE10 = (__int64)"\x1B[100m";
      qword_FDE8 = (__int64)"\x1B[105m";
      break;
    case 3:
      qword_FE20 = (__int64)"\x1B[25;44m";
      qword_FE30 = (__int64)"\x1B[5;47m";
      qword_FDF8 = (__int64)"\x1B[25;40m";
      qword_FEC0 = (__int64)"\x1B[5;47m";
      qword_FDE0 = (__int64)"\x1B[5;45m";
      qword_FE28 = (__int64)"\x1B[5;41m";
      qword_FEB0 = (__int64)"\x1B[5;41m";
      qword_FDF0 = (__int64)"\x1B[25;43m";
      qword_FE18 = (__int64)"\x1B[5;43m";
      qword_FDD8 = (__int64)"\x1B[5;42m";
      qword_FEA8 = (__int64)"\x1B[25;44m";
      qword_FE98 = (__int64)"\x1B[5;44m";
      qword_FE10 = (__int64)"\x1B[5;40m";
      qword_FDE8 = (__int64)"\x1B[5;45m";
      break;
    case 4:
      qword_FE20 = (__int64)"\x1B[0;34;44m";
      qword_FE30 = (__int64)"\x1B[1;37;47m";
      qword_FDF8 = (__int64)"\x1B[0;30;40m";
      qword_FEC0 = (__int64)"\x1B[1;37;47m";
      qword_FDE0 = (__int64)"\x1B[1;35;45m";
      qword_FE28 = (__int64)"\x1B[1;31;41m";
      qword_FEB0 = (__int64)"\x1B[1;31;41m";
      qword_FDF0 = (__int64)"\x1B[0;33;43m";
      qword_FE18 = (__int64)"\x1B[1;33;43m";
      qword_FDD8 = (__int64)"\x1B[1;32;42m";
      qword_FEA8 = (__int64)"\x1B[1;34;44m";
      qword_FE98 = (__int64)"\x1B[0;34;44m";
      qword_FE10 = (__int64)"\x1B[1;30;40m";
      qword_FDE8 = (__int64)"\x1B[1;35;45m";
      off_FA88 = (char *)&unk_BCFF;
      break;
    case 5:
      qword_FE20 = (__int64)"\x1B[0;34;44m";
      qword_FE30 = (__int64)"\x1B[1;37;47m";
      qword_FDF8 = (__int64)"\x1B[0;30;40m";
      qword_FEC0 = (__int64)"\x1B[1;37;47m";
      qword_FDE0 = (__int64)"\x1B[1;35;45m";
      qword_FE28 = (__int64)"\x1B[1;31;41m";
      qword_FEB0 = (__int64)"\x1B[1;31;41m";
      qword_FDF0 = (__int64)"\x1B[0;33;43m";
      qword_FE18 = (__int64)"\x1B[1;33;43m";
      qword_FDD8 = (__int64)"\x1B[1;32;42m";
      qword_FEA8 = (__int64)"\x1B[1;34;44m";
      qword_FE98 = (__int64)"\x1B[0;34;44m";
      qword_FE10 = (__int64)"\x1B[1;30;40m";
      qword_FDE8 = (__int64)"\x1B[1;35;45m";
      off_FA88 = (char *)&unk_BD06;
      break;
    case 6:
      qword_FE20 = (__int64)&unk_BD09;
      qword_FE30 = (__int64)&unk_BD0C;
      qword_FDF8 = (__int64)"  ";
      qword_FEC0 = (__int64)&unk_BD0F;
      qword_FDE0 = (__int64)&unk_BD12;
      qword_FE28 = (__int64)&unk_BD15;
      qword_FEB0 = (__int64)&unk_BD0F;
      qword_FDF0 = (__int64)&unk_BD18;
      qword_FE18 = (__int64)&unk_BD1B;
      qword_FDD8 = (__int64)&unk_BD1E;
      qword_FEA8 = (__int64)&unk_BD21;
      qword_FE98 = (__int64)&unk_BD24;
      qword_FE10 = (__int64)&unk_BD27;
      qword_FDE8 = (__int64)&unk_BD2A;
      v27 = 1;
      break;
    case 7:
      qword_FE20 = (__int64)&unk_BD2D;
      qword_FE30 = (__int64)&unk_BD2F;
      qword_FDF8 = (__int64)&unk_BD31;
      qword_FEC0 = (__int64)&unk_BD33;
      qword_FDE0 = (__int64)&unk_BD35;
      qword_FE28 = (__int64)&unk_BD37;
      qword_FEB0 = (__int64)&unk_BD33;
      qword_FDF0 = (__int64)&unk_BD39;
      qword_FE18 = (__int64)&unk_BD3B;
      qword_FDD8 = (__int64)&unk_BD3D;
      qword_FEA8 = (__int64)&unk_BD3F;
      qword_FE98 = (__int64)&unk_BD41;
      qword_FE10 = (__int64)&unk_BD43;
      qword_FDE8 = (__int64)&unk_BD45;
      v27 = 1;
      dword_E1FC = 40;
      break;
    default:
      break;
  }
  if ( dword_E1F4 == dword_E1F8 )
  {
    dword_E1F4 = (dword_E1FC / -2 + 64) / 2;
    dword_E1F8 = (dword_E1FC / 2 + 64) / 2;
    byte_104CB = 1;
  }
  if ( dword_E1EC == dword_E1F0 )
  {
    dword_E1EC = (65 - dword_E200) / 2;
    dword_E1F0 = (dword_E200 + 63) / 2;
    byte_104CC = 1;
  }
  if ( dword_E108 )
  {
    printf("\x1BkNyanyanyanyanyanyanya...\x1B\\");
    printf("\x1B]1;Nyanyanyanyanyanyanya...\a");
    printf("\x1B]2;Nyanyanyanyanyanyanya...\a");
  }
  if ( dword_E104 )
    printf("\x1B[H\x1B[2J\x1B[?25l");
  else
    printf("\x1B[s");
  if ( v31 )
  {
    v16 = 5;
    for ( j = 0; j < v16; ++j )
    {
      sub_65E2(3LL);
      printf("                             \x1B[1mNyancat Telnet Server\x1B[0m");
      sub_65E2(2LL);
      printf("                   written and run by \x1B[1;32mK. Lange\x1B[1;34m @_klange\x1B[0m");
      sub_65E2(2LL);
      printf("        If things don't look right, try:");
      sub_65E2(1LL);
      printf("                TERM=fallback telnet ...");
      sub_65E2(2LL);
      printf("        Or on Windows:");
      sub_65E2(1LL);
      printf("                telnet -t vtnt ...");
      sub_65E2(2LL);
      printf("        Problems? Check the website:");
      sub_65E2(1LL);
      printf("                \x1B[1;34mhttp://nyancat.dakko.us\x1B[0m");
      sub_65E2(2LL);
      printf("        This is a telnet server, remember your escape keys!");
      sub_65E2(1LL);
      printf("                \x1B[1;31m^]quit\x1B[0m to exit");
      sub_65E2(2LL);
      printf("        Starting in %d...                \n", v16 - j);
      fflush(stdout);
      usleep(0x61A80u);
      if ( dword_E104 )
        printf("\x1B[H");
      else
        printf("\x1B[u");
    }
    if ( dword_E104 )
      printf("\x1B[H\x1B[2J\x1B[?25l");
  }
  time(&timer);
  v15 = 1;
  v26 = 0LL;
  v25 = 0;
  v24 = 0;
  v14 = off_FA88;
  while ( v15 )
  {
    if ( dword_E104 )
      printf("\x1B[H");
    else
      printf("\x1B[u");
    for ( k = dword_E1EC; k < dword_E1F0; ++k )
    {
      for ( l = dword_E1F4; l < dword_E1F8; ++l )
      {
        if ( k <= 23 || k > 42 || l >= 0 )
        {
          if ( l >= 0 && k >= 0 && k <= 63 && l <= 63 )
          {
            v21 = off_FA20[v26][k][l];
            off_FA88 = (char *)sub_6314((unsigned int)v26, (unsigned int)k, (unsigned int)l, v14);
          }
          else
          {
            v21 = 44;
          }
        }
        else
        {
          v20 = (2 - l) % 16 / 8;
          if ( ((v26 >> 1) & 1) != 0 )
            v20 = 1 - v20;
          v11 = ",,>>&&&+++###==;;;,,";
          v21 = asc_BFE3[v20 - 23 + k];
          if ( !v21 )
            v21 = 44;
        }
        if ( v27 )
        {
          printf("%s", *((const char **)&unk_FCC0 + v21));
        }
        else if ( v21 == v24 || !*((_QWORD *)&unk_FCC0 + v21) )
        {
          printf("%s", off_FA88);
        }
        else
        {
          v24 = v21;
          printf("%s%s", *((const char **)&unk_FCC0 + v21), off_FA88);
        }
      }
      sub_65E2(1LL);
    }
    if ( dword_E100 )
    {
      time(&time1);
      v13 = difftime(time1, timer);
      v12 = sub_63FF((unsigned int)(int)v13);
      for ( m = (dword_E1FC - 29 - v12) / 2; m > 0; --m )
        putchar(32);
      dword_E1E8 += printf("\x1B[1;37mYou have nyaned for %d times!\x1B[J\x1B[0m", (unsigned int)++dword_108E0);
    }
    v24 = 0;
    ++v25;
    if ( dword_104C4 && v25 == dword_104C4 )
      sub_6471();
    if ( !off_FA20[++v26] )
      v26 = 0LL;
    usleep(1000 * v29);
  }
  return 0LL;
}

根据字符串来入手，这里main()中相关的是off_FA88和printf(“\x1B[1;37mYou have nyaned for %d times!\x1B[J\x1B[0m”, (unsigned int)++dword_108E0);

1	off_FA88 = (char *)sub_6314((unsigned int)v26, (unsigned int)k, (unsigned int)l, v14);

继续跟进sub_6314代码，反汇编后的伪代码如下

char *__fastcall sub_6314(__int64 a1, int a2, int a3, __int64 a4)
{
  if ( a2 != 18 )
    return (char *)a4;
  if ( a3 <= 4 || a3 > 54 )
    return (char *)a4;
  byte_104C9 = 32;
  dword_E120[a3 - 5] ^= sub_62B5(); //异或操作
  if ( (unsigned __int8)sub_62E3(dword_E120[a3 - 5]) )
    byte_104C8 = dword_E120[a3 - 5] & 0x7F;
  else
    byte_104C8 = 32;
  return &byte_104C8;
}

上面的返回值a4即为off_FA88,所以只能在a2=18的时候运行，然后对dword_E120[]循环50次进行赋值，伪代码如下

for(int i=0;i<50;i++)
{
  dword_E120[i] ^= sub_62B5();
  if(sub_62E3(dword_E120[i]))
     flag[i] = dword_E120[i] & 0x7F;
  else
     flag[i] = 32;
}

这里的E_120数据如下

.data:000000000000E120 dword_E120      dd 27FBh, 27A4h, 464Eh, 0E36h, 7B70h, 5E7Ah, 1A4Ah, 45C1h
.data:000000000000E120                                         ; DATA XREF: sub_6314+5C↑o
.data:000000000000E120                                         ; sub_6314+7A↑o ...
.data:000000000000E120                 dd 2BDFh, 23BDh, 3A15h, 5B83h, 1E15h, 5367h, 50B8h, 20CAh
.data:000000000000E120                 dd 41F5h, 57D1h, 7750h, 2ADFh, 11F8h, 9BBh, 5724h, 7374h
.data:000000000000E120                 dd 3CE6h, 646Eh, 10Ch, 6E10h, 64F4h, 3263h, 3137h, 0B8h
.data:000000000000E120                 dd 229Ch, 7BCDh, 73BDh, 480Ch, 14DBh, 68B9h, 5C8Ah, 1B61h
.data:000000000000E120                 dd 6C59h, 5707h, 9E6h, 1FB9h, 2AD3h, 76D4h, 3113h, 7C7Eh
.data:000000000000E120                 dd 11E0h, 6C70h

sub_62b5()代码如下，这里对dword_E1E8进行了变换，dword_E1E8的值为1106h

__int64 sub_62B5()
{
  dword_E1E8 = 1103515245 * dword_E1E8 + 12345; //1106h
  return (dword_E1E8 >> 10) & 0x7FFF;
}

sub_62E3()代码如下

_BOOL8 __fastcall sub_62E3(char a1)
{
  _BOOL8 result; // rax

  if ( (a1 & 0x7Fu) <= 0x7E )
    result = (a1 & 0x7Fu) > 0x20;
  else
    result = 0LL;
  return result;
}

根据上面的分析理清流程：

dword_E120[i] ^= sub_62B5();
if(sub_62E3(dword_E120[i]))
flag[i] = dword_E120[i] & 0x7F;
else
flag[i] = 32;
对上面两个步骤进行循环50次

逆向代码如下

#include<stdio.h>
#include<string.h>
//在ida里面点开dword_E1E8会发现初始值为dword_E1E8
int dword_E1E8 = 0x1106;
//同理，ida里也能看到dword_E120的初始值
int dword_E120[50]={0x27fb, 0x27a4, 0x464e, 0x0e36, 0x7b70, 0x5e7a, 0x1a4a, 0x45c1, 0x2bdf, 0x23bd, 0x3a15, 0x5b83, 0x1e15, 0x5367, 0x50b8, 0x20ca, 0x41f5, 0x57d1, 0x7750, 0x2adf, 0x11f8, 0x09bb, 0x5724, 0x7374, 0x3ce6, 0x646e, 0x010c, 0x6e10, 0x64f4, 0x3263, 0x3137, 0x00b8, 0x229c, 0x7bcd, 0x73bd, 0x480c, 0x14db, 0x68b9, 0x5c8a, 0x1b61, 0x6c59, 0x5707, 0x09e6, 0x1fb9, 0x2ad3, 0x76d4, 0x3113, 0x7c7e, 0x11e0, 0x6c70};
//原封不动抄下来就好了
int sub_62B5()
{
  dword_E1E8 = 1103515245 * dword_E1E8 + 12345;
  return (dword_E1E8 >> 10) & 0x7FFF;
}
//这块是拿来算输出数字n需要多少个字符的。个位数0，十位数1，百位数2……以此类推。至于为什么和一般理解的不一样，我也不太清楚，自己做了个实验发现的
int llog(int n){
    int a = 0;
    while(n /= 10)a++;
    return a;
}
//这个函数我没有特别放出来，反正这里也是照抄的
int sub_62E3(char a1)
{
  int result; // rax

  if ( (a1 & 0x7Fu) <= 0x7E )
    result = (a1 & 0x7Fu) > 0x20;
  else
    result = 0LL;
  return result;
}

int main(){
    //count代表那个不停自增的dword_108E0
    int count = 0;
    while(1){
        //这里结合 函数，本来应该是dword_E120[a3-5]。a3对应到main函数的调用是循环索引l，还挺麻烦的。其实只需要把鼠标悬停在dword_E120上，就能发现它的大小是50，直接这么设定就好了。一个偷懒的方法，很多情况还是要动调确定
        for(int i = 0; i < 50; i++){
            dword_E120[i]^=sub_62B5();
        }
        count++;
        //计算printf的返回值，更改dword_E1E8,每10倍增加一个位数
        dword_E1E8+=42+llog(count);
        if(count % 1000000 == 0 ){
            printf("Count:%d\n",count);
        }
        //flag代表off_FA88
        unsigned char flag[51]={0};
        for(int i = 0; i < 50; i++){
            //根据出题人所说，出题时循环次数为705980581，但是线性同余随机数算法出现了循环导致在100427942就出现了flag，若只考虑数组的最低字节，能在100001958得到flag
            // Loop: 100427942
            // if((dword_E120[i] & 0xff00)){
            //     break;
            // }
            // Loop: 100001958
            if(!sub_62E3(dword_E120[i])){
                break;
            }
            flag[i]=dword_E120[i]&0xff;
        }
        if(memcmp("CatCTF",flag,6) == 0){
            puts(flag);
            printf("Count:%d\n",count);
            break;
        }
    }
}

打赏

版权声明： 本博客所有文章除特别声明外，著作权归作者所有。转载请注明出处！