看雪CTF第八题
Posted qintangtao
tags:
篇首语：本文由小常识网(cha138.com)小编为大家整理，主要介绍了看雪CTF第八题相关的知识，希望对你有一定的参考价值。
IDA查看Exports有3个TlsCallback
只有TlsCallback_2有用
其中创建6个线程用于代码动态解码smc
只有前三个线程有用 分别对check_part1,check_part2,check_part3代码解码
HANDLE sub_402C70() { hMutex = CreateMutexW(0, 0, "Mutex"); CreateThread(0, 0, (LPTHREAD_START_ROUTINE)thread_smc1, 0, 0, 0); CreateThread(0, 0, (LPTHREAD_START_ROUTINE)thread_smc2, 0, 0, 0); CreateThread(0, 0, (LPTHREAD_START_ROUTINE)thread_smc3, 0, 0, 0); CreateThread(0, 0, (LPTHREAD_START_ROUTINE)sub_402BB0, 0, 0, 0); CreateThread(0, 0, (LPTHREAD_START_ROUTINE)sub_402BF0, 0, 0, 0); return CreateThread(0, 0, (LPTHREAD_START_ROUTINE)sub_402C30, 0, 0, 0); }
thread_smc1
void __stdcall __noreturn thread_smc1(LPVOID lpThreadParameter) { signed int v1; // eax@2 signed int v2; // ecx@4 signed int v3; // esi@4 char v4; // bl@5 char *v5; // eax@5 char v6; // dl@5 DWORD flOldProtect; // [sp+Ch] [bp-10h]@2 char v8[6]; // [sp+10h] [bp-Ch]@1 while ( 1 ) { v8[0] = -117; v8[1] = -64; v8[2] = -117; v8[3] = -1; v8[4] = -117; v8[5] = -37; WaitForSingleObject(hMutex, 0xFFFFFFFF); if ( thread_flag == 1 ) { flOldProtect = 0; VirtualProtect(check_part1, 0x2Eu, 0x40u, &flOldProtect); v1 = 1; do { *((_BYTE *)check_part1 + v1 - 1) ^= byte_4064F0[v1 - 1]; *((_BYTE *)check_part1 + v1) ^= byte_4064F0[v1]; v1 += 2; } while ( v1 - 1 < 46 ); VirtualProtect(check_part1, 0x2Eu, flOldProtect, &flOldProtect); VirtualProtect(smc_code1, 6u, 0x40u, &flOldProtect); v2 = 0; v3 = (_BYTE *)smc_code1 - v8; do { v4 = v8[v2]; v5 = &v8[v2]; v6 = *(&v8[v2++] + v3); v5[v3] = v4; *v5 = v6; } while ( v2 < 6 ); VirtualProtect(smc_code1, 6u, flOldProtect, &flOldProtect); thread_flag = 0; } ReleaseMutex(hMutex); Sleep(0x32u); } }
thread_smc2
void __stdcall __noreturn thread_smc2(LPVOID lpThreadParameter) { signed int v1; // eax@3 signed int v2; // ecx@5 signed int v3; // esi@5 char v4; // bl@6 char *v5; // eax@6 char v6; // dl@6 DWORD flOldProtect; // [sp+10h] [bp-10h]@3 char v8[6]; // [sp+14h] [bp-Ch]@1 v8[0] = -117; v8[1] = -64; v8[2] = -117; v8[3] = -37; v8[4] = -117; v8[5] = -1; while ( 1 ) { WaitForSingleObject(hMutex, 0xFFFFFFFF); if ( thread_flag == 2 ) { flOldProtect = 0; VirtualProtect(check_part2, 0x2Eu, 0x40u, &flOldProtect); v1 = 1; do { *((_BYTE *)check_part2 + v1 - 1) ^= byte_406520[v1 - 1]; *((_BYTE *)check_part2 + v1) ^= byte_406520[v1]; v1 += 2; } while ( v1 - 1 < 46 ); VirtualProtect(check_part2, 0x2Eu, flOldProtect, &flOldProtect); VirtualProtect(smc_code2, 6u, 0x40u, &flOldProtect); v2 = 0; v3 = (_BYTE *)smc_code2 - v8; do { v4 = v8[v2]; v5 = &v8[v2]; v6 = *(&v8[v2++] + v3); v5[v3] = v4; *v5 = v6; } while ( v2 < 6 ); VirtualProtect(smc_code2, 6u, flOldProtect, &flOldProtect); thread_flag = 0; } ReleaseMutex(hMutex); Sleep(0x32u); } }
thread_smc3
void __stdcall __noreturn thread_smc3(LPVOID lpThreadParameter) { signed int v1; // eax@3 char *v2; // ecx@5 signed int v3; // eax@5 char v4; // bl@6 DWORD flOldProtect; // [sp+10h] [bp-10h]@3 char v6[6]; // [sp+14h] [bp-Ch]@1 v6[0] = -117; v6[1] = -1; v6[2] = -117; v6[3] = -64; v6[4] = -117; v6[5] = -37; while ( 1 ) { WaitForSingleObject(hMutex, 0xFFFFFFFF); if ( thread_flag == 3 ) { flOldProtect = 0; VirtualProtect(check_part3, 0x2Eu, 0x40u, &flOldProtect); v1 = 1; do { *((_BYTE *)check_part3 + v1 - 1) ^= byte_406550[v1 - 1]; *((_BYTE *)check_part3 + v1) ^= byte_406550[v1]; v1 += 2; } while ( v1 - 1 < 46 ); VirtualProtect(check_part3, 0x2Eu, flOldProtect, &flOldProtect); VirtualProtect(smc_code3, 6u, 0x40u, &flOldProtect); v2 = (char *)smc_code3; v3 = 0; do { v4 = v6[v3]; v6[v3] = *v2; *v2 = v4; ++v3; ++v2; } while ( v3 < 6 ); VirtualProtect(smc_code3, 6u, flOldProtect, &flOldProtect); thread_flag = 0; } ReleaseMutex(hMutex); Sleep(0x32u); } }
调用check_part1前，会置thread_flag=1, 这个时候thread_smc1开始解密
调用check_part1后，会置thread_flag=1, 这个时候thread_smc1开始加密
调用check_part2前，会置thread_flag=2, 这个时候thread_smc2开始解密
调用check_part2后，会置thread_flag=2, 这个时候thread_smc2开始加密
调用check_part3前，会置thread_flag=3, 这个时候thread_smc3开始解密
调用check_part3后，会置thread_flag=3, 这个时候thread_smc3开始加密
smc需要还原代码
import idaapi tmp_point = {0x4068E4:0x4025DC, 0x4068E0:0x40263C, 0x4068EC:0x40269C} def dec_func(func_addr, key_addr, tmp_addr, tmp): func = bytearray(idaapi.get_many_bytes(func_addr, 0x2E)) key = bytearray(idaapi.get_many_bytes(key_addr, 0x2E)) for i in xrange(len(func)): func[i] ^= key[i] idaapi.patch_many_bytes(func_addr, str(func)) idaapi.patch_many_bytes(tmp_point[tmp_addr], str(bytearray(tmp))) dec_func(0x401EC0, 0x4064F0, 0x4068E4, [0x8B, 0xC0, 0x8B, 0xFF, 0x8B, 0xDB]) dec_func(0x402090, 0x406520, 0x4068E0, [0x8B, 0xC0, 0x8B, 0xDB, 0x8B, 0xFF]) dec_func(0x4021D0, 0x406550, 0x4068EC, [0x8B, 0xFF, 0x8B, 0xC0, 0x8B, 0xDB])
fn_check
int __cdecl fn_check(const char *src) { int result; // eax@14 char v2; // [sp+20h] [bp-110h]@3 char Dst; // [sp+21h] [bp-10Fh]@3 char v4; // [sp+34h] [bp-FCh]@4 char v5; // [sp+35h] [bp-FBh]@5 char v6; // [sp+5Dh] [bp-D3h]@6 char v7; // [sp+5Eh] [bp-D2h]@7 int len; // [sp+128h] [bp-8h]@2 int v9; // [sp+12Ch] [bp-4h]@3 lpAddress = &loc_4025DC; dword_4068E0 = &loc_40263C; dword_4068EC = &loc_40269C; if ( (unsigned __int8)crc_check() && (len = strlen(src), len <= 0x100) && (v2 = 0, memset(&Dst, 0, 0xFFu), v9 = base64_decode(&v2), strlen(&v2) == 0x5A) && v4 == \'-\' && v5 == \'-\' && v6 == \'-\' && v7 == \'-\' ) { if ( !(unsigned __int8)crc_check() ) ExitProcess(1u); thread_flag = 1; while ( thread_flag ) ; if ( ((int (__cdecl *)(char *))check_part1)(&v2) ) { thread_flag = 1; while ( thread_flag ) ; if ( !(unsigned __int8)crc_check() ) ExitProcess(1u); thread_flag = 2; while ( thread_flag ) ; if ( ((int (__cdecl *)(char *))check_part2)(&v2) ) { thread_flag = 2; while ( thread_flag ) ; if ( !(unsigned __int8)crc_check() ) ExitProcess(1u); thread_flag = 3; while ( thread_flag ) ; if ( (*(int (__cdecl **)(char *))check_part3)(&v2) ) { thread_flag = 3; while ( thread_flag ) ; if ( !(unsigned __int8)crc_check() ) ExitProcess(1u); result = 1; } else { result = 0; } } else { result = 0; } } else { result = 0; } } else { result = 0; } return result; }
check_part1
signed int __cdecl fn_check_part1(_BYTE *a1) { unsigned __int64 v1; // rax@1 _BYTE *v2; // eax@1 signed int v3; // edx@1 char v4; // bl@3 bool v5; // zf@3 const char *v6; // esi@4 signed int result; // eax@6 unsigned __int64 v8; // [sp+10h] [bp-28h]@4 signed int v9; // [sp+14h] [bp-24h]@1 unsigned __int64 v10; // [sp+30h] [bp-8h]@1 __asm { fcmovnbe st, st(2) } v1 = __rdtsc(); v10 = (unsigned int)v1 + ((unsigned __int64)HIDWORD(v1) << 32); v2 = a1; v3 = &unk_99B6F1 - (_UNKNOWN *)a1; v9 = 4; while ( 1 ) { v4 = *v2 ^ v2["abcdefghijklmnopqrstuvwxyzabcdefghijklmnopqrstuvwxyz" - a1]; v2 += 5; v2[&unk_99B6F0 - (_UNKNOWN *)a1 - 5] = v4; v2[v3 - 5] = *(v2 - 4) ^ v2[4215109 - (_DWORD)a1 - 5]; v2[&unk_99B6F2 - (_UNKNOWN *)a1 - 5] = *(v2 - 3) ^ v2[4215110 - (_DWORD)a1 - 5]; v2[&unk_99B6F3 - (_UNKNOWN *)a1 - 5] = *(v2 - 2) ^ v2[4215111 - (_DWORD)a1 - 5]; v5 = v9-- == 1; v2[byte_99B6F4 - a1 - 5] = *(v2 - 1) ^ v2[4215112 - (_DWORD)a1 - 5]; if ( v5 ) break; v3 = &unk_99B6F1 - (_UNKNOWN *)a1; } v6 = (const char *)sub_403EA0(&unk_99B6F0, aXztrprtzxzrt_0); v8 = __rdtsc(); if ( !strcmp(v6, aPwwRWX_Zhejg_0) && (unsigned int)v8 + ((unsigned __int64)HIDWORD(v8) << 32) - v10 < (unsigned int)&unk_87A238 ) { operator delete(v6); result = 1; } else { operator delete(v6); result = 0; } return result; }
check_part2
signed int __cdecl check_part2(int a1) { unsigned __int64 v1; // rax@1 unsigned __int64 v2; // kr00_8@1 signed int v3; // eax@1 char v4; // dl@2 const char *v5; // esi@3 unsigned __int64 v7; // ST20_8@6 __asm { fcmovnbe st, st(2) } v1 = __rdtsc(); v2 = ((unsigned __int64)HIDWORD(v1) << 32) + (unsigned int)v1; v3 = 0; do { v4 = aAbcdefghijklmn[v3] ^ *(_BYTE *)(a1 + v3 + 22); v3 += 3; *(_BYTE *)(v3 + 10073861) = v4; *(_BYTE *)(v3 + 10073862) = *(_BYTE *)(v3 + 4215106) ^ *(_BYTE *)(a1 + v3 + 20); *(_BYTE *)(v3 + 10073863) = *(_BYTE *)(v3 + 4215107) ^ *(_BYTE *)(a1 + v3 + 21); } while ( v3 < 39 ); v5 = (const char *)sub_403EA0(10073864, 10073864); sub_403DC0(v5, aXuvwttsQzrXB_0); if ( strcmp(v5, a13095069099216) ) { operator delete(v5); return 0; } operator delete(v5); v7 = __rdtsc(); if ( (unsigned int)v7 + ((unsigned __int64)HIDWORD(v7) << 32) - v2 >= 0x14B230CE38i64 ) return 0; return 1; }
check_part3
int __cdecl check_part3(int a1) { unsigned __int64 v1; // rax@1 char *v2; // edi@1 char *v3; // ecx@1 signed int v4; // ebx@1 signed int v5; // esi@2 signed int v6; // ecx@3 char v7; // al@4 char v8; // al@6 char v9; // al@8 char v10; // al@10 char v11; // al@12 char v12; // al@14 char v13; // al@16 char v14; // al@18 char v15; // al@20 char v16; // al@22 char v17; // al@24 char v18; // al@26 int result; // eax@29 unsigned __int64 v20; // rax@32 unsigned __int64 v21; // [sp+18h] [bp-2E8h]@1 char v22; // [sp+20h] [bp-2E0h]@29 int v23; // [sp+24h] [bp-2DCh]@29 int v24[40]; // [sp+28h] [bp-2D8h]@30 char v25; // [sp+170h] [bp-190h]@29 char v26; // [sp+2C4h] [bp-3Ch]@1 char Dst; // [sp+2C5h] [bp-3Bh]@1 char v28; // [sp+2C6h] [bp-3Ah]@12 char v29; // [sp+2C7h] [bp-39h]@16 char v30; // [sp+2C8h] [bp-38h]@20 char v31[51]; // [sp+2C9h] [bp-37h]@24 v1 = __rdtsc(); v21 = (unsigned int)v1 + ((unsigned __int64)HIDWORD(v1) << 32); sub_4010C0(); v26 = 0; memset(&Dst, 0, 0x37u); v2 = (char *)(a1 + 63); v3 = &Dst; v4 = 27; do { v5 = *v2; *(v3 - 1) = *v2 / 16; *v3 = v5 % 16; ++v2; v3 += 2; --v4; } while ( v4 ); v6 = 0; do { v7 = *(&v26 + v6); if ( v7 < 0 || v7 > 9 ) v8 = v7 + 55; else v8 = v7 + 48; *(&v26 + v6) = v8; v9 = *(&Dst + v6); if ( v9 < 0 || v9 > 9 ) v10 = v9 + 55; else v10 = v9 + 48; *(&Dst + v6) = v10; v11 = *(&v28 + v6); if ( v11 < 0 || v11 > 9 ) v12 = v11 + 55; else v12 = v11 + 48; *(&v28 + v6) = v12; v13 = *(&v29 + v6); if ( v13 < 0 || v13 > 9 ) v14 = v13 + 55; else v14 = v13 + 48; *(&v29 + v6) = v14; v15 = *(&v30 + v6); if ( v15 < 0 || v15 > 9 ) v16 = v15 + 55; else v16 = v15 + 48; *(&v30 + v6) = v16; v17 = v31[v6]; if ( v17 < 0 || v17 > 9 ) v18 = v17 + 55; else v18 = v17 + 48; v31[v6] = v18; v6 += 6; } while ( v6 < 54 ); sub_401C50(&v26, 16); sub_4010C0(); sub_401C50(&unk_99B6F0, 10); sub_4010C0(); sub_401C50(10073864, 10); sub_401A90(&v22, &v25); result = 0; if ( v23 == 4 ) { while ( v24[result] == dword_4064E0[result] ) { ++result; if ( result >= 4 ) { v20 = __rdtsc(); if ( (unsigned int)v20 + ((unsigned __int64)HIDWORD(v20) << 32) - v21 < 0x54C5638 ) return 1; break; } } result = 0; } return result * 4; }
vm_context
00000000 vm_context struc ; (sizeof=0x70, mappedto_32) 00000000 r0 dd ? 00000004 r1 dd ? 00000008 r2 dd ? 0000000C r3 dd ? 00000010 r4 dd ? 00000014 opcode dd ? 00000018 cmdA0 dd ? 0000001C fn_set_imm dd ? 00000020 cmdA1 dd ? 00000024 fn_xor_r0_r1 dd ? 00000028 cmdA2 dd ? 0000002C fn_cmp dd ? 00000030 cmdA4 dd ? 00000034 fn_prompt dd ? 00000038 cmdA5 dd ? 0000003C fn_exit dd ? 00000040 cmdA3 dd ? 00000044 fn_null dd ? 00000048 cmdA6 dd ? 0000004C fn_jnz dd ? 00000050 cmdA7 dd ? 00000054 fn_input dd ? 00000058 cmdA8 dd ? 0000005C fn_output dd ? 00000060 cmdA9 dd ? 00000064 fn_check dd ? 00000068 cmdAA dd ? 0000006C fn_decrypt_string dd ? 00000070 vm_context ends
vm_init()
void *__usercall vm_init@<eax>(vm_context *vm_ctx@<eax>, void *data_start)
{
char *v2; // ecx@1
signed int v3; // edx@1
vm_ctx->r0 = 0;
vm_ctx->r1 = 0;
vm_ctx->r2 = 0;
vm_ctx->r3 = 0;
vm_ctx->r4 = 0;
v2 = (char *)&vm_ctx->cmdA0;
v3 = 32;
do
{
*v2 = 0;
v2 += 8;
--v3;
}
while ( v3 );
LOBYTE(vm_ctx->cmdA0) = 0xA0u;
vm_ctx->fn_set_imm = (int)fn_set_imm;
LOBYTE(vm_ctx->cmdA1) = 0xA1u;
vm_ctx->fn_xor_r0_r1 = (int)fn_xor_r0_r1;
LOBYTE(vm_ctx->cmdA2) = 0xA2u;
vm_ctx->fn_cmp = (int)fn_cmp;
LOBYTE(vm_ctx->cmdA4) = 0xA4u;
vm_ctx->fn_prompt = (int)fn_prompt;
LOBYTE(vm_ctx->cmdA5) = 0xA5u;
vm_ctx->fn_exit = (int)fn_exit;
LOBYTE(vm_ctx->cmdA3) = 0xA3u;
vm_ctx->fn_null = (int)fn_null;
LOBYTE(vm_ctx->cmdA6) = 0xA6u;
vm_ctx->fn_jnz = (int)fn_jnz;
LOBYTE(vm_ctx->cmdA7) = 0xA7u;
vm_ctx->fn_input = (int)fn_input;
LOBYTE(vm_ctx->cmdA8) = 0xA8u;
vm_ctx->fn_output = (int)fn_output;
LOBYTE(vm_ctx->cmdA9) = 0xA9u;
vm_ctx->fn_check = (int)fn_check;
LOBYTE(vm_ctx->cmdAa) = 0xAAu;
vm_ctx->fn_decrypt_string = (int)fn_decrypt_string;
return memset(data_start, 0, 0x1000u);
}
vm_dispatcher()
int __usercall vm_dispatcher@<eax>(int opcode_start@<eax>, vm_context *vm_ctx@<esi>, int data_start)
{
char *vm_handler_type; // ecx@2
vm_ctx->opcode = opcode_start;
while ( *(_BYTE *)vm_ctx->opcode != 0xA3u )
{
opcode_start = 0;
vm_handler_type = (char *)&vm_ctx->cmdA0;
while ( opcode_start < 0x20 )
{
if ( *(_BYTE *)vm_ctx->opcode == *vm_handler_type )
{
opcode_start = (*((int (__cdecl **)(_DWORD, _DWORD))&vm_ctx->fn_set_imm + 2 * opcode_start))(vm_ctx, data_start);
break;
}
++opcode_start;
vm_handler_type += 8;
}
}
return opcode_start;
}
自定义vm虚拟机
python指令解析器
#!/usr/bin/python # -*- coding: UTF-8 -*- # 代码段 text = [0xAA, 0x15, 0x20, 0x01, 0x00, 0x00, 0xAA, 0x15, 0x40, 0x01, 0x00, 0x00, 0xA0, 0x10, 0x00, 0x00, 0x00, 0x00, 0xA8, 0xA0, 0x10, 0xF0, 0x00, 0x00, 0x00, 0xA8, 0xA0, 0x10, 0x60, 0x01, 0x00, 0x00, 0xA7, 0xAA, 0x11, 0x80, 0x00, 0x00, 0x00, 0xAA, 0x10, 0x60, 0x00, 0x00, 0x00, 0xAA, 0x12, 0xB0, 0x00, 0x00, 0x00, 0xA9, 0xA2, 0xEA, 0xA6, 0x0E, 0xA0, 0x10, 0x20, 0x01, 0x00, 0x00, 0xA0, 0x11, 0x10, 0x01, 0x00, 0x00, 0xA4, 0xA5, 0xA0, 0x10, 0x40, 0x01, 0x00, 0x00, 0xA0, 0x11, 0x10, 0x01, 0x00, 0x00, 0xA4, 0xA5] def toUint(arr): return arr[0] | (arr[1]<<8 | arr[2]<<16 | arr[3]<<24) class Context: def __init__(self): self.ip = CG-CTF