re學習筆記（38）BUUCTF-re-[SCTF2019]babyre IDA無法F5|代碼修復|花指令

新手一枚，如有錯誤（不足）請指正，謝謝！！
個人博客：點擊進入
題目鏈接：[SCTF2019]babyre
題目下載：點擊下載

修復代碼可以F5

這道題不能F5，修改了好久，才顯示出僞代碼。
修復完的僞代碼顯示如下

__int64 __fastcall main(__int64 a1, char **a2, char **a3)
{
  __int64 result; // rax
  char v4; // [rsp+Fh] [rbp-151h]
  int v5; // [rsp+10h] [rbp-150h]
  signed int succ_flag; // [rsp+14h] [rbp-14Ch]
  char *local; // [rsp+18h] [rbp-148h]
  char v8[10]; // [rsp+26h] [rbp-13Ah]
  __int64 input3; // [rsp+30h] [rbp-130h]
  __int64 v10; // [rsp+38h] [rbp-128h]
  int v11; // [rsp+40h] [rbp-120h]
  __int64 input2; // [rsp+50h] [rbp-110h]
  __int64 v13; // [rsp+58h] [rbp-108h]
  __int64 v14; // [rsp+60h] [rbp-100h]
  char v15; // [rsp+68h] [rbp-F8h]
  __int64 v16; // [rsp+70h] [rbp-F0h]
  __int64 v17; // [rsp+78h] [rbp-E8h]
  __int64 v18; // [rsp+80h] [rbp-E0h]
  char v19; // [rsp+88h] [rbp-D8h]
  __int64 input1; // [rsp+90h] [rbp-D0h]
  __int64 v21; // [rsp+98h] [rbp-C8h]
  __int64 v22; // [rsp+A0h] [rbp-C0h]
  __int64 v23; // [rsp+A8h] [rbp-B8h]
  __int64 v24; // [rsp+B0h] [rbp-B0h]
  __int64 v25; // [rsp+B8h] [rbp-A8h]
  __int16 v26; // [rsp+C0h] [rbp-A0h]
  char map[125]; // [rsp+D0h] [rbp-90h]
  unsigned __int64 v28; // [rsp+158h] [rbp-8h]

  v28 = __readfsqword(0x28u);
  v5 = 0;
  input2 = 0LL;
  v13 = 0LL;
  v14 = 0LL;
  v15 = 0;
  v16 = 0LL;
  v17 = 0LL;
  v18 = 0LL;
  v19 = 0;
  input1 = 0LL;
  v21 = 0LL;
  v22 = 0LL;
  v23 = 0LL;
  v24 = 0LL;
  v25 = 0LL;
  v26 = 0;
  strcpy(
    map,
    "**************.****.**s..*..******.****.***********..***..**..#*..***..***.********************.**..*******..**...*..*.*.**.*");
  input3 = 0LL;
  v10 = 0LL;
  v11 = 0;
  local = &map[22];
  strcpy(v8, "sctf_9102");
  puts((const char *)(unsigned int)"plz tell me the shortest password1:");
  scanf("%s", &input1);
  succ_flag = 1;
  while ( succ_flag )
  {
    v4 = *((_BYTE *)&input1 + v5);
    switch ( v4 )
    {
      case 'w':
        local -= 5;
        break;
      case 's':
        local += 5;
        break;
      case 'd':
        ++local;
        break;
      case 'a':
        --local;
        break;
      case 'x':
        local += 25;
        break;
      case 'y':
        local -= 25;
        break;
      default:
        succ_flag = 0;
        break;
    }
    ++v5;
    if ( *local != '.' && *local != '#' )
      succ_flag = 0;
    if ( *local == '#' )
    {
      puts("good!you find the right way!\nBut there is another challenge!");
      break;
    }
  }
  if ( succ_flag )
  {
    puts((const char *)(unsigned int)"plz tell me the password2:");
    scanf("%s", &input2);
    sub_C22((const char *)&input2, (__int64)&v16);
    if ( (unsigned int)sub_F67(&v16, v8) == 1 )
    {
      puts("Congratulation!");
      puts((const char *)(unsigned int)"Now,this is the last!");
      puts("plz tell me the password3:");
      scanf("%s", &input3);
      if ( (unsigned int)sub_FFA((char *)&input3) == 1 )
      {
        puts("Congratulation!Here is your flag!:");
        printf("sctf{%s-%s(%s)}", &input1, &input2, &input3);
      }
      else
      {
        printf("something srong...");
      }
      result = 0LL;
    }
    else
    {
      printf("sorry,somthing wrong...", v8);
      result = 0LL;
    }
  }
  else
  {
    printf("sorry,is't not a right way...");
    result = 0LL;
  }
  return result;
}

以下步驟爲試驗多次的情況下找出的最佳步驟
先shift+F12查找到字符串，然後定位到main函數。

類似於上圖這樣的跳轉。將方框的三條指令都nop掉。
可以通過alt+T來快速尋找
修改之後

然後將所有類似矛盾的都修改掉

下圖的jb和jnb也nop掉。下圖的E13的in字節改爲90，花指令




發現一處call loc

這裏代碼爲call loc_c22，但是C22不是一個函數，需要給他修改類型。
雙擊快速定位到loc_C22，摁Y鍵修改類型。將其改爲一個獨立的函數

將test還原爲數據，(鍵盤‘d’鍵)
之後選中這些未聲明的代碼，摁P鍵聲明爲函數。
先選中798~C21聲明一段main函數，然後將C22~F66聲明爲函數

然後再對僞代碼的變量類型修改一下就能出來最開始的代碼。

實際修改過程中我是定位僞代碼中的JUMPOUT，然後去彙編代碼查看有什麼衝突導致IDA無法反彙編。

看最後flag

發現最後的flag與輸入的三部分有關，先看第一部分。

解題

第一部分

strcpy(
    map,
    "**************.****.**s..*..******.****.***********..***..**..#*..***..***.********************.**..*******..**...*..*.*.**.*");
  input3 = 0LL;
  v10 = 0LL;
  v11 = 0;
  local = &map[22];
  strcpy(v8, "sctf_9102");
  puts((const char *)(unsigned int)"plz tell me the shortest password1:");
  scanf("%s", &input1);
  succ_flag = 1;
  while ( succ_flag )
  {
    v4 = *((_BYTE *)&input1 + v5);
    switch ( v4 )
    {
      case 'w':
        local -= 5;
        break;
      case 's':
        local += 5;
        break;
      case 'd':
        ++local;
        break;
      case 'a':
        --local;
        break;
      case 'x':
        local += 25;
        break;
      case 'y':
        local -= 25;
        break;
      default:
        succ_flag = 0;
        break;
    }
    ++v5;
    if ( *local != '.' && *local != '#' )
      succ_flag = 0;
    if ( *local == '#' )
    {
      puts("good!you find the right way!\nBut there is another challenge!");
      break;
    }

可以看出是個迷宮題了。三維迷宮。

平面來看，w控制上，s控制下，a控制左，d控制右
x控制去上一層，y控制去下一層。
*是牆，.是路徑，#是終點,s是起點。
得出input1爲ddwwxxssxaxwwaasasyywwdd

第二部分

sub_C22()函數將input2加密後與v8進行比較

查看sub_C22()函數

unsigned __int64 __fastcall sub_C22(const char *a1, __int64 a2)
{
  bool v2; // al
  int v3; // eax
  int v4; // eax
  int v5; // eax
  int v7; // [rsp+14h] [rbp-24Ch]
  signed int v8; // [rsp+18h] [rbp-248h]
  int v9; // [rsp+1Ch] [rbp-244h]
  int v10; // [rsp+20h] [rbp-240h]
  int v11; // [rsp+24h] [rbp-23Ch]
  int v12; // [rsp+28h] [rbp-238h]
  int v13; // [rsp+2Ch] [rbp-234h]
  char *v14; // [rsp+48h] [rbp-218h]
  int v15[130]; // [rsp+50h] [rbp-210h]
  unsigned __int64 v16; // [rsp+258h] [rbp-8h]

  v16 = __readfsqword(0x28u);
  qmemcpy(v15, dword_1740, 512uLL);
  v8 = 3;
  v7 = 0;
  v10 = 0;
  v11 = 0;
  v12 = strlen(a1);
  v14 = (char *)a1;
  while ( 1 )
  {
    v13 = 0;
    if ( v10 < v12 )
      break;
LABEL_13:
    if ( v10 >= v12 )
      goto LABEL_14;
  }
  do
  {
    if ( a1[v10] != 25 )
      break;
    ++v10;
    ++v13;
  }
  while ( v10 < v12 );
  if ( v10 != v12 )
  {
    if ( v12 - v10 > 1 )
    {
      v2 = v10 == 19 && a1[20] == 16;
      a1[v2];
    }
    ++v10;
    goto LABEL_13;
  }
LABEL_14:
  v9 = 0;
  while ( v12 > 0 )
  {
    v8 -= v15[*v14] == 0x40;                    // v8初始爲3
    v7 = v15[*v14] & 0x3F | (v7 << 6);          // 3F的二進制爲111111
                                                // 也就是將v7左移6位，空缺由v15[*v14]的低六位補上。
    if ( ++v9 == 4 )                            // 每次存4位進入一次if條件代碼塊
    {                                           // 將其改爲三位，賦值給a2
      v9 = 0;
      if ( v8 )                                 // v11爲計數器
      {
        v3 = v11++;
        *(_BYTE *)(v3 + a2) = BYTE2(v7);        // BYTE2(V7)=((BYTE*)&(V7)+2)
      }
      if ( v8 > 1 )
      {
        v4 = v11++;
        *(_BYTE *)(v4 + a2) = BYTE1(v7);        // BYTE1(V7)=((BYTE*)&(V7)+1)
      }
      if ( v8 > 2 )
      {
        v5 = v11++;
        *(_BYTE *)(v5 + a2) = v7;
      }
    }
    ++v14;
    --v12;
  }
  return __readfsqword(0x28u) ^ v16;
}

看着挺長，發現實際操作的代碼就這些。

也就是將input2的每四位改成三位給v16，然後v16再與v8="sctf_9102"進行比較
v8有9位，可知input2有16位。
提取出數據，寫爆破腳本。

#include <stdio.h>


unsigned int data[128] = {
    0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
    0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
    0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
    0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
    0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
    0x7F, 0x7F, 0x7F, 0x3E, 0x7F, 0x7F, 0x7F, 0x3F,
    0x34, 0x35, 0x36, 0x37, 0x38, 0x39, 0x3A, 0x3B,
    0x3C, 0x3D, 0x7F, 0x7F, 0x7F, 0x40, 0x7F, 0x7F,
    0x7F, 0x00, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06,
    0x07, 0x08, 0x09, 0x0A, 0x0B, 0x0C, 0x0D, 0x0E,
    0x0F, 0x10, 0x11, 0x12, 0x13, 0x14, 0x15, 0x16,
    0x17, 0x18, 0x19, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F,
    0x7F, 0x1A, 0x1B, 0x1C, 0x1D, 0x1E, 0x1F, 0x20,
    0x21, 0x22, 0x23, 0x24, 0x25, 0x26, 0x27, 0x28,
    0x29, 0x2A, 0x2B, 0x2C, 0x2D, 0x2E, 0x2F, 0x30,
    0x31, 0x32, 0x33, 0x7F, 0x7F, 0x7F, 0x7F, 0x7F
};

int main()
{
    int shuju[3] = { 0x736374,0x665f39,0x313032 };
    int i0, i1, i2, i3, i4, i5;
    for (i0 = 0; i0 < 3; i0++)
    {
        for(i1=32;i1<128;i1++)
            for (i2 = 32; i2 < 128; i2++)
                for (i3 = 32; i3 < 128; i3++)
                    for (i4 = 32; i4 < 128; i4++)
                    {
                        i5 = (((((data[i1] << 6) | data[i2]) << 6) | data[i3]) << 6) | data[i4];
                        if (i5 == shuju[i0])
                            printf("第%d組：%c%c%c%c\n", i0+1,i1, i2, i3, i4);
                    }
    }
    return 0;
}

得到輸出
第1組：c2N0
第2組：Zl85
第3組：MS=y
第3組：MT=y
第3組：MTAy

動態調試一下，發現第三個應該是MTAy

所以input2應該爲c2N0Zl85MTAy

第三部分

只要輸入的字符串能讓sub_FFA()返回1就好了

查看sub_FFA()函數

signed __int64 __fastcall sub_FFA(char *a1)
{
  int v1; // ST24_4
  int v2; // ST28_4
  int v3; // ST2C_4
  signed int v5; // [rsp+18h] [rbp-158h]
  signed int i; // [rsp+18h] [rbp-158h]
  int v7; // [rsp+1Ch] [rbp-154h]
  int v8[16]; // [rsp+30h] [rbp-140h]
  unsigned int v9[16]; // [rsp+70h] [rbp-100h]
  int v10[30]; // [rsp+B0h] [rbp-C0h]
  unsigned __int64 v11; // [rsp+168h] [rbp-8h]

  v11 = __readfsqword(0x28u);
  v8[0] = 190;
  v8[1] = 4;
  v8[2] = 6;
  v8[3] = 128;
  v8[4] = 197;
  v8[5] = 175;
  v8[6] = 118;
  v8[7] = 71;
  v8[8] = 159;
  v8[9] = 204;
  v8[10] = 64;
  v8[11] = 31;
  v8[12] = 216;
  v8[13] = 191;
  v8[14] = 146;
  v8[15] = 239;
  v1 = (a1[6] << 8) | (a1[5] << 16) | (a1[4] << 24) | a1[7];
  v2 = (a1[10] << 8) | (a1[9] << 16) | (a1[8] << 24) | a1[11];
  v3 = (a1[14] << 8) | (a1[13] << 16) | (a1[12] << 24) | a1[15];// 將4個字符存儲在int裏，大端序存放
  v7 = 0;
  v5 = 4;
  v10[0] = sub_78A((a1[2] << 8) | (a1[1] << 16) | (*a1 << 24) | (unsigned int)a1[3]);
  v10[1] = sub_78A(v1);
  v10[2] = sub_78A(v2);
  v10[3] = sub_78A(v3);
  do
  {
    v10[v5] = sub_143B(v10[v7], v10[v7 + 1], v10[v7 + 2], v10[v7 + 3]);// 加密函數
    ++v7;
    ++v5;
  }
  while ( v5 <= 29 );
  v9[0] = (unsigned int)v10[26] >> 24;
  v9[1] = BYTE2(v10[26]);
  v9[2] = BYTE1(v10[26]);
  v9[3] = LOBYTE(v10[26]);
  v9[4] = (unsigned int)v10[27] >> 24;
  v9[5] = BYTE2(v10[27]);
  v9[6] = BYTE1(v10[27]);
  v9[7] = LOBYTE(v10[27]);
  v9[8] = (unsigned int)v10[28] >> 24;
  v9[9] = BYTE2(v10[28]);
  v9[10] = BYTE1(v10[28]);
  v9[11] = LOBYTE(v10[28]);
  v9[12] = (unsigned int)v10[29] >> 24;
  v9[13] = BYTE2(v10[29]);
  v9[14] = BYTE1(v10[29]);
  v9[15] = LOBYTE(v10[29]);
  for ( i = 0; i <= 15; ++i )
  {
    if ( v9[i] != v8[i] )
      return 0xFFFFFFFFLL;
  }
  return 1LL;
}

其中sub_143B()函數

sub1464()函數

第三步的加密是可逆的，直接使用它的代碼就好。
寫的腳本，使用了IDA自己的一個頭文件，在IDA目錄的plugins目錄裏

#include <stdio.h>
#include "defs.h"
unsigned int data1[288] = {
    0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7,
    0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
    0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3,
    0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
    0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A,
    0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
    0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95,
    0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
    0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA,
    0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
    0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B,
    0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
    0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2,
    0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,
    0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52,
    0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,
    0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5,
    0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,
    0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55,
    0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
    0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60,
    0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,
    0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F,
    0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,
    0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F,
    0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,
    0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD,
    0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,
    0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E,
    0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
    0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20,
    0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48,
    0xC6, 0xBA, 0xB1, 0xA3, 0x50, 0x33, 0xAA, 0x56,
    0x97, 0x91, 0x7D, 0x67, 0xDC, 0x22, 0x70, 0xB2,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00
};

unsigned int fun(unsigned int a1)
{
        int v1;
        v1 = (data1[BYTE2(a1)] << 16) | data1[(unsigned __int8)a1] | (data1[BYTE1(a1)] << 8) | (data1[a1 >> 24] << 24);
        return __ROL4__(v1, 12) ^ (unsigned int)(__ROL4__(v1, 8) ^ __ROR4__(v1, 2)) ^ __ROR4__(v1, 6);
}

int main()
{
	unsigned int data[30] = { 0 };
    data[26] = 0xBE040680;
    data[27] = 0xC5AF7647;
    data[28] = 0x9FCC401F;
    data[29] = 0xD8BF92EF;
    int i;
	for (i = 25; i >=0; i--)
		data[i] = fun(data[i+1] ^ data[i+2] ^ data[i+3]) ^ data[i+4];
    printf("%x %x %x %x\n", data[0], data[1], data[2], data[3]);
    for (i = 0; i < 4; i++)
        printf("%c%c%c%c", ((char*)&data[i])[0], ((char*)&data[i])[1], ((char*)&data[i])[2], ((char*)&data[i])[3]);
	return 0;
}

得出第三部分的input3爲fl4g_is_s0_ug1y!

得到flag

得到flag爲sctf{ddwwxxssxaxwwaasasyywwdd-c2N0Zl85MTAy(fl4g_is_s0_ug1y!)}