18/10/05-5-BugKu-逆向-LittleRotatorGame(NJCTF)
Posted fingerprint
tags:
篇首语:本文由小常识网(cha138.com)小编为大家整理,主要介绍了18/10/05-5-BugKu-逆向-LittleRotatorGame(NJCTF)相关的知识,希望对你有一定的参考价值。
0x00
题目链接:https://pan.baidu.com/s/1FLIaSN6EOe34qQNO_8yi-g
提取码:phou
0x01
native层分析
根据提示程序用了O-LLVM混淆,IDA分析ANativeActivity_onCreate函数,分析此处
1 v24 = flg((int)v67, &v89); 2 j___android_log_print(4, "an-activity", "The flag is:njctf{%s}", v24); 3 v4 = -681054051; 4 v25 = v2; 5 v66 = v2; 6 goto LABEL_214;
可看出flag与flg函数有关。
0x02
分析flg层函数。
1 char *__fastcall flg(int a1, char *a2) 2 { 3 int v2; // ST0C_4 4 int v3; // r4 5 int v4; // r0 6 char v5; // ST08_1 7 int v6; // ST10_4 8 int v7; // r0 9 int v8; // r2 10 int v9; // r0 11 int v10; // r3 12 int v11; // r0 13 14 v2 = a1; 15 v3 = a1; 16 v4 = a1 % 10; 17 v5 = v4; 18 *a2 = 20 * v4; 19 v6 = v3 / 100 % 10; 20 v7 = 19 * v6 + 20 * v4; 21 a2[1] = v7; 22 a2[2] = v7 - 4; 23 v8 = v3 / 10 % 10; 24 a2[3] = v3 / 1000000 % 10 + 11 * v8; 25 v9 = v3 / 10000 % 10; 26 v10 = v3 / 1000 % 10; 27 a2[4] = 20 * v10 - v9; 28 a2[5] = (v8 + v5) * v10; 29 a2[6] = v8 * v10 * v9; 30 v11 = v2 / 100000 % 10; 31 a2[7] = 20 * v11 - v6; 32 a2[8] = 10 * v10 | 1; 33 a2[9] = (v8 + v5) * v11 - 1; 34 a2[10] = v5 * v8 * v6 * v6 - 4; 35 *(_WORD *)(a2 + 11) = (unsigned __int8)((v6 + v8) * v11 - 5); 36 return a2; 37 }
发现有/1000000,说明输入的数大于1000000,可以进行爆破。
0x03
写脚本进行爆破,从1000000到10000000。
cpp脚本
1 #include<iostream> 2 void check(int num); 3 int ok(char); 4 int main(void) 5 { 6 for(int i = 1000000; i < 10000000; i++) 7 { 8 check(i); 9 } 10 return 0; 11 } 12 void check(int num) 13 { 14 int m = 1; 15 16 char flag[13]; 17 int v4 = num % 10; 18 flag[0] = 20 * v4; 19 int v6 = num / 100 % 10; 20 int v7 = 19 * v6 + 20 * v4; 21 flag[1] = v7; 22 flag[2] = v7 - 4; 23 int v8 = num/10%10; 24 flag[3] = num / 1000000 % 10 + 11 * v8; 25 int v9 = num / 10000 % 10; 26 int v10 = num / 1000 % 10; 27 flag[4] = 20* v10 - v9; 28 flag[5] = (v8 + v4) * v10; 29 flag[6] = v8 * v10 * v9; 30 int v11 = num / 100000 % 10; 31 flag[7] = 20 * v11 - v6; 32 flag[8] = 10 * v10 | 1; 33 flag[9] = (v8 + v4) * v11 - 1; 34 flag[10] = v4 * v8 * v6 * v6 - 4; 35 flag[11] = (v6 + v8) * v11 - 5; 36 flag[12] = ‘