2019“嘉韦思杯”上海市高校网络安全邀请赛write up

Reverse

Auth

int __cdecl main(int argc, const char **argv, const char **envp)
{
  const CHAR *v3; // ebx
  HMODULE v4; // eax
  void (__stdcall *v5)(HMODULE, LPCSTR); // eax
  char v7; // [esp+1h] [ebp-157h]
  char v8[4]; // [esp+15h] [ebp-143h]
  int v9; // [esp+20h] [ebp-138h]
  int v10; // [esp+26h] [ebp-132h]
  int v11; // [esp+2Ah] [ebp-12Eh]
  int v12; // [esp+2Eh] [ebp-12Ah]
  int v13; // [esp+32h] [ebp-126h]
  int v14; // [esp+36h] [ebp-122h]
  int v15; // [esp+3Ah] [ebp-11Eh]
  __int16 v16; // [esp+3Eh] [ebp-11Ah]
  int v17; // [esp+40h] [ebp-118h]
  int v18; // [esp+44h] [ebp-114h]
  int v19; // [esp+48h] [ebp-110h]
  int v20; // [esp+4Ch] [ebp-10Ch]
  int v21; // [esp+50h] [ebp-108h]
  int v22; // [esp+54h] [ebp-104h]
  int v23; // [esp+58h] [ebp-100h]
  int v24; // [esp+5Ch] [ebp-FCh]
  int v25; // [esp+60h] [ebp-F8h]
  int v26; // [esp+64h] [ebp-F4h]
  int v27; // [esp+68h] [ebp-F0h]
  int v28; // [esp+6Ch] [ebp-ECh]
  int v29; // [esp+70h] [ebp-E8h]
  char v30; // [esp+74h] [ebp-E4h]
  int a_2; // [esp+75h] [ebp-E3h]
  int v32; // [esp+79h] [ebp-DFh]
  int v33; // [esp+7Dh] [ebp-DBh]
  int v34; // [esp+81h] [ebp-D7h]
  int v35; // [esp+85h] [ebp-D3h]
  int v36; // [esp+89h] [ebp-CFh]
  int v37; // [esp+8Dh] [ebp-CBh]
  int v38; // [esp+91h] [ebp-C7h]
  __int16 v39; // [esp+95h] [ebp-C3h]
  int a_1; // [esp+97h] [ebp-C1h]
  int v41; // [esp+9Bh] [ebp-BDh]
  int v42; // [esp+9Fh] [ebp-B9h]
  int v43; // [esp+A3h] [ebp-B5h]
  int v44; // [esp+A7h] [ebp-B1h]
  int v45; // [esp+ABh] [ebp-ADh]
  int v46; // [esp+AFh] [ebp-A9h]
  int v47; // [esp+B3h] [ebp-A5h]
  char v48; // [esp+B7h] [ebp-A1h]
  int v49; // [esp+B8h] [ebp-A0h]
  int v50; // [esp+BEh] [ebp-9Ah]
  int v51; // [esp+C2h] [ebp-96h]
  int v52; // [esp+C6h] [ebp-92h]
  int v53; // [esp+CAh] [ebp-8Eh]
  int v54; // [esp+CEh] [ebp-8Ah]
  int v55; // [esp+D2h] [ebp-86h]
  int v56; // [esp+D6h] [ebp-82h]
  int v57; // [esp+DAh] [ebp-7Eh]
  char v58; // [esp+DEh] [ebp-7Ah]
  int v59; // [esp+DFh] [ebp-79h]
  int v60; // [esp+E3h] [ebp-75h]
  int v61; // [esp+E7h] [ebp-71h]
  int v62; // [esp+EBh] [ebp-6Dh]
  int v63; // [esp+EFh] [ebp-69h]
  int v64; // [esp+F3h] [ebp-65h]
  int v65; // [esp+F7h] [ebp-61h]
  int v66; // [esp+FBh] [ebp-5Dh]
  __int16 v67; // [esp+FFh] [ebp-59h]
  int v68; // [esp+101h] [ebp-57h]
  int v69; // [esp+105h] [ebp-53h]
  char v70; // [esp+109h] [ebp-4Fh]
  int v71; // [esp+10Ah] [ebp-4Eh]
  int v72; // [esp+10Eh] [ebp-4Ah]
  int v73; // [esp+112h] [ebp-46h]
  int v74; // [esp+116h] [ebp-42h]
  int v75; // [esp+11Ah] [ebp-3Eh]
  int v76; // [esp+11Eh] [ebp-3Ah]
  int v77; // [esp+122h] [ebp-36h]
  int v78; // [esp+126h] [ebp-32h]
  int v79; // [esp+12Ah] [ebp-2Eh]
  int v80; // [esp+12Eh] [ebp-2Ah]
  int v81; // [esp+132h] [ebp-26h]
  int v82; // [esp+136h] [ebp-22h]
  int v83; // [esp+13Ah] [ebp-1Eh]
  int v84; // [esp+13Eh] [ebp-1Ah]
  int v85; // [esp+142h] [ebp-16h]
  int v86; // [esp+146h] [ebp-12h]
  int v87; // [esp+14Ah] [ebp-Eh]
  __int16 v88; // [esp+14Eh] [ebp-Ah]
  int *v89; // [esp+150h] [ebp-8h]

  v89 = &argc;
  sub_402940();
  puts(
    "            .     \n"
    "           _|_    ROBOTIC AUTHENTICATION SYSTEM\n"
    "    /\\/\\  (. .)  /\n"
    "    `||'   |#|  \n"
    "     ||__.-\"-\"-.___   \n"
    "     `---| . . |--.\\  \n"
    "         | : : |  ,||,\n"
    "         `..-..'  \\/\\/\n"
    "          || ||   \n"
    "          || ||    \n"
    "         |__|__|  \n");
  v49 = 0x539;
  v50 = 0x60646D51;
  v51 = 0x64216472;
  v52 = 0x7364756F;
  v53 = 0x64697521;
  v54 = 0x73686721;
  v55 = 0x51217572;
  v56 = 0x76727260;
  v57 = 0x3B65736E;
  v58 = 1;
  a_1 = 0x60646D51;
  v41 = 0x64216472;
  v42 = 0x7364756F;
  v43 = 0x64697521;
  v44 = 0x73686721;
  v45 = 0x51217572;
  v46 = 0x76727260;
  v47 = 0x3B65736E;
  v48 = 1;
  v59 = 0x60646D51;
  v60 = 0x64216472;
  v61 = 0x7364756F;
  v62 = 0x64697521;
  v63 = 0x62647221;
  v64 = 0x21656F6E;
  v65 = 0x72726051;
  v66 = 0x65736E76;
  v67 = 315;
  v31 = 0x60646D51;                             
  v32 = 0x64216472;
  v33 = 0x7364756F;
  v34 = 0x64697521;
  v35 = 0x62647221;
  v36 = 0x21656F6E;
  v37 = 0x72726051;
  v38 = 0x65736E76;
  v39 = 315;
  v68 = 0x6F6F3074;
  v69 = 0x666D3367;
  v70 = 3;
  v28 = 0x6F6F3074;
  v29 = 0x666D3367;
  v30 = 3;
  v71 = 0x6F73646A;
  v72 = 0x33326D64;
  v73 = 0x6D6D652F;
  v74 = 0x13F0101;
  v24 = 0x6F73646A;
  v25 = 0x33326D64;
  v26 = 0x6D6D652F;
  v27 = 0x13F0101;
  v75 = 0x57656540;
  v76 = 0x6E756264;
  v77 = 0x44656473;
  v78 = 0x71646279;
  v79 = 0x6F6E6875;
  v80 = 0x656F6049;
  v81 = 0x173646D;
  v17 = 0x57656540;
  v18 = 0x6E756264;
  v19 = 0x44656473;
  v20 = 0x71646279;
  v21 = 0x6F6E6875;
  v22 = 0x656F6049;
  v23 = 0x173646D;
  v82 = 0x21746E58;
  v83 = 0x2F6F6876;
  v84 = 0x6F6E4221;
  v85 = 0x75607366;
  v86 = 0x75606D74;
  v87 = 0x726F6E68;
  v88 = 0x120;
  v10 = 0x21746E58;
  v11 = 0x2F6F6876;
  v12 = 0x6F6E4221;
  v13 = 0x75607366;
  v14 = 0x75606D74;
  v15 = 0x726F6E68;
  v16 = 0x120;
  v9 = 0x539;
  strcpy(v8, "r0b0RUlez!");
  dword_40AD94 = (int)&v9;
  dword_40ADA0 = (int)&v49;
  dword_40AD8C = (char *)&a_1;
  dword_40AD90 = (char *)&a_2;
  dword_40AD98 = (int)&v28;
  lpProcName = (LPCSTR)&v17;
  lpModuleName = (LPCSTR)&v24;
  dword_40ADA4 = (char *)&v10;
  sub_401500(0);
  v3 = lpProcName;
  v4 = GetModuleHandleA(lpModuleName);
  v5 = (void (__stdcall *)(HMODULE, LPCSTR))GetProcAddress(v4, v3);
  v5((HMODULE)1, (LPCSTR)sub_40157F);
  puts(dword_40AD8C);
  scanf("%20s", &v7);
  if ( !strcmp(&v7, v8) )
  {
    puts("You passed level1!");
    sub_4015EA(0);
  }
  return 0;
}

进入sub_401500函数

int __cdecl sub_401500(signed int a1)
{
  int result; // eax
  _BYTE *i; // [esp+1Ch] [ebp-Ch]

  if ( a1 <= 9 )
    return sub_401500(a1 + 1);
  for ( i = (_BYTE *)dword_40AD94; ; ++i )
  {
    result = dword_40ADA0;
    if ( (unsigned int)i >= dword_40ADA0 )
      break;
    *i ^= 1u;
  }
  return result;
}

发现是将main函数中的数据与1进行异或

这个先放后面
输入v7 r0b0RUlez! 进入到了sub_4015EA函数

int __cdecl sub_4015EA(signed int a1)
{
  if ( a1 <= 9 )
    return sub_4015EA(a1 + 1);
  puts(dword_40AD90);
  dword_40ADA8 = 0x401619;
  __debugbreak();
  return 0;
}

看一下这个函数的汇编代码

.text:004015EA arg_0           = dword ptr  8
.text:004015EA
.text:004015EA                 push    ebp
.text:004015EB                 mov     ebp, esp
.text:004015ED                 sub     esp, 18h
.text:004015F0                 cmp     [ebp+arg_0], 9
.text:004015F4                 jg      short loc_401607
.text:004015F6                 add     [ebp+arg_0], 1
.text:004015FA                 mov     eax, [ebp+arg_0]
.text:004015FD                 mov     [esp], eax
.text:00401600                 call    sub_4015EA
.text:00401605                 jmp     short locret_401625
.text:00401607 ; ---------------------------------------------------------------------------
.text:00401607
.text:00401607 loc_401607:                             ; CODE XREF: sub_4015EA+A↑j
.text:00401607                 mov     eax, ds:dword_40AD90
.text:0040160C                 mov     [esp], eax      ; char *
.text:0040160F                 call    puts
.text:00401614                 call    $+5
.text:00401619                 pop     eax
.text:0040161A                 mov     ds:dword_40ADA8, eax
.text:0040161F                 int     3               ; Trap to Debugger
.text:00401620                 mov     eax, 0
.text:00401625
.text:00401625 locret_401625:                          ; CODE XREF: sub_4015EA+1B↑j
.text:00401625                 leave
.text:00401626                 retn
.text:00401626 sub_4015EA      endp

经过动态调试发现还会跳转到sub_40157F函数

解题脚本：

data = "74306F6F67336D66"

string =""
for x in range(0,len(data),2):
        string += chr(eval("0x"+data[x:x+2])^1^2)
print string

所以最后的flag为：

r0b0RUlez!w3lld0ne

obfuse

在sub_8048580函数中是一位一位的check
想到了pintools逐字节验证