文章目錄

• • vm_operad
  • • 函數(shù)功能
  • read
  • • 函數(shù)功能
    • • 流程代碼
  • 簡(jiǎn)介每個(gè)數(shù)字所要做的事（但是流程不是按照這樣進(jìn)行的）
  • • 注意：
  • 驗(yàn)證數(shù)據(jù)（逆向重點(diǎn)）
  • 逆向思維

vm_operad

int __cdecl vm_operad(int *a1, int a2) {int result; // eax@2char v3[100]; // [sp+13h] [bp-E5h]@4char v4[100]; // [sp+77h] [bp-81h]@5char v5; // [sp+DBh] [bp-1Dh]@5int v6; // [sp+DCh] [bp-1Ch]@1int v7; // [sp+E0h] [bp-18h]@1int v8; // [sp+E4h] [bp-14h]@1int v9; // [sp+E8h] [bp-10h]@1int v10; // [sp+ECh] [bp-Ch]@1v10 = 0;v9 = 0;v8 = 0;v7 = 0;v6 = 0;while ( 1 ){result = v10;if ( v10 >= a2 )return result;switch ( a1[v10] ){case 10:read(v3);++v10;break;case 1:v4[v7] = v5;++v10;++v7;++v9;break;case 2:v5 = a1[v10 + 1] + v3[v9];v10 += 2;break;case 3:v5 = v3[v9] - LOBYTE(a1[v10 + 1]);v10 += 2;break;case 4:v5 = a1[v10 + 1] ^ v3[v9];v10 += 2;break;case 5:v5 = a1[v10 + 1] * v3[v9];v10 += 2;break;case 6:++v10;break;case 7:if ( v4[v8] != a1[v10 + 1] ){printf("what a shame...");exit(0);}++v8;v10 += 2;break;case 11:v5 = v3[v9] - 1;++v10;break;case 12:v5 = v3[v9] + 1;++v10;break;case 8:v3[v6] = v5;++v10;++v6;break;default:continue;}} }

函數(shù)功能

利用文件字符串中保存的流程數(shù)據(jù)（以及加密數(shù)據(jù)）和控制臺(tái)數(shù)據(jù)配合進(jìn)行驗(yàn)證flag（這個(gè)文件字符串中保存的數(shù)據(jù)既起到了流程的作用還有加密作用）

read

size_t __cdecl read(char *a1) {size_t result; // eax@1printf("string:");scanf("%s", a1);result = strlen(a1);if ( result != 15 ){puts("WRONG!\n");exit(0);}return result; }

函數(shù)功能

這個(gè)read函數(shù)用來(lái)讀取控制臺(tái)輸入的命令，我覺(jué)得就是flag

0A 00 00 00 04 00 00 00 10 00 00 00 08 00 00 00 03 00 00 00 05 00 00 00 01 00 00 00 04 00 00 00 20 00 00 00 08 00 00 00 05 00 00 00 03 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00 08 00 00 00 0B 00 00 00 01 00 00 00 0C 00 00 00 08 00 00 00 04 00 00 00 04 00 00 00 01 00 00 00 05 00 00 00 03 00 00 00 08 00 00 00 03 00 00 00 21 00 00 00 01 00 00 00 0B 00 00 00 08 00 00 00 0B 00 00 00 01 00 00 00 04 00 00 00 09 00 00 00 08 00 00 00 03 00 00 00 20 00 00 00 01 00 00 00 02 00 00 00 51 00 00 00 08 00 00 00 04 00 00 00 24 00 00 00 01 00 00 00 0C 00 00 00 08 00 00 00 0B 00 00 00 01 00 00 00 05 00 00 00 02 00 00 00 08 00 00 00 02 00 00 00 25 00 00 00 01 00 00 00 02 00 00 00 36 00 00 00 08 00 00 00 04 00 00 00 41 00 00 00 01 00 00 00 02 00 00 00 20 00 00 00 08 00 00 00 05 00 00 00 01 00 00 00 01 00 00 00 05 00 00 00 03 00 00 00 08 00 00 00 02 00 00 00 25 00 00 00 01 00 00 00 04 00 00 00 09 00 00 00 08 00 00 00 03 00 00 00 20 00 00 00 01 00 00 00 02 00 00 00 41 00 00 00 08 00 00 00 0C 00 00 00 01 00 00 00 07 00 00 00 22 00 00 00 07 00 00 00 3F 00 00 00 07 00 00 00 34 00 00 00 07 00 00 00 32 00 00 00 07 00 00 00 72 00 00 00 07 00 00 00 33 00 00 00 07 00 00 00 18 00 00 00 07 00 00 00 A7 FF FF FF 07 00 00 00 31 00 00 00 07 00 00 00 F1 FF FF FF 07 00 00 00 28 00 00 00 07 00 00 00 84 FF FF FF 07 00 00 00 C1 FF FF FF 07 00 00 00 1E 00 00 00 07 00 00 00 7A 00 00 00

流程代碼

case 10:read(v3);++v10;break;case 1:v4[v7] = v5;++v10;++v7;++v9;break;case 2:v5 = a1[v10 + 1] + v3[v9];v10 += 2;break;case 3:v5 = v3[v9] - LOBYTE(a1[v10 + 1]);v10 += 2;break;case 4:v5 = a1[v10 + 1] ^ v3[v9];v10 += 2;break;case 5:v5 = a1[v10 + 1] * v3[v9];v10 += 2;break;case 6:++v10;break;case 7:if ( v4[v8] != a1[v10 + 1] ){printf("what a shame...");exit(0);}++v8;v10 += 2;break;case 11:v5 = v3[v9] - 1;++v10;break;case 12:v5 = v3[v9] + 1;++v10;break;case 8:v3[v6] = v5;++v10;++v6;break;default:continue;

簡(jiǎn)介每個(gè)數(shù)字所要做的事（但是流程不是按照這樣進(jìn)行的）

0x0A：讀取控制臺(tái)所輸入的15個(gè)字符

0x4：求v5值，文件字符串下一個(gè)位置值 ^ 控制臺(tái)第一個(gè)數(shù)據(jù)

0x10：continue

0x08:v5賦給v3數(shù)組的第一個(gè)元素

0x03:（v3數(shù)組的第一個(gè)元素-文件字符串下一個(gè)位置值）賦給v5

0x05:求V5值，文件字符串下一個(gè)位置值 * 控制臺(tái)第一個(gè)數(shù)據(jù)

0x01:v5賦給v4數(shù)組的第一個(gè)元素，然后v9自增，也就代表接下來(lái)需要利用到控制臺(tái)第二個(gè)數(shù)據(jù)

0x4：求v5值，文件字符串下一個(gè)位置值 ^ 控制臺(tái)第一個(gè)數(shù)據(jù)

0x20:continue

0x08:v5賦給v3數(shù)組的第二個(gè)元素

0x05：求V5值，文件字符串下一個(gè)位置值 * 控制臺(tái)第二個(gè)數(shù)據(jù)

0x03:（v3數(shù)組的第二個(gè)元素 - 文件字符串下一個(gè)位置值）賦給v5

0x01:v5賦給v4數(shù)組的第二個(gè)元素，然后v9自增，也就代表接下來(lái)需要利用到控制臺(tái)第三個(gè)數(shù)據(jù)
……………………………………

注意：

文件字符串遇到2 ,3,4,5,7時(shí)，那么下一個(gè)值并不控制流程（流程直接跳過(guò)！），而是被當(dāng)計(jì)算數(shù)據(jù)所用了。。所以才說(shuō)執(zhí)行流程并非是上面所寫的

驗(yàn)證數(shù)據(jù)（逆向重點(diǎn)）

07 00 00 00 22 00 00 00 07 00 00 00 3F 00 00 00 07 00 00 00 34 00 00 00 07 00 00 00 32 00 00 00 07 00 00 00 72 00 00 00 07 00 00 00 33 00 00 00 07 00 00 00 18 00 00 00 07 00 00 00 A7 FF FF FF 07 00 00 00 31 00 00 00 07 00 00 00 F1 FF FF FF 07 00 00 00 28 00 00 00 07 00 00 00 84 FF FF FF 07 00 00 00 C1 FF FF FF 07 00 00 00 1E 00 00 00 07 00 00 00 7A 00 00 00

這里全是用來(lái)驗(yàn)證的：
依次是 22h 3fh 34h 32h 72h 33h 18h ffffffa7h 31h fffff1h 28h ffff84h 1eh 7ah
所以按照標(biāo)準(zhǔn)字符串，然后把每個(gè)字符都逆著做一遍操作，然后就得到了我們所輸在控制臺(tái)的東西，緊接著就結(jié)束了。。。

逆向思維

(0x22+5）^ 0x10

(0x3f/3) ^ 0x20

(0x34 + 1) + 2

(0x32 ^ 4) - 1

(0x72 + 0x21) / 3

(0x33 + 1) + 1

(0x18 + 0x20) ^ 9

(0xa7 ^ 0x24) -0x51

(0x31 + 1) - 1

(0xf1 - 0x25) / 2

(0x28 ^ 0x41) - 0x36

(0x84 / 1) - 0x20

(0xc1 - 0x25) / 3

(0x1e + 0x20) ^ 9

(0x7a - 1) - 0x41

flag{757515121f3d478}

總結(jié)

以上是生活随笔為你收集整理的2020——网鼎杯 （青龙组）signal的全部?jī)?nèi)容，希望文章能夠幫你解決所遇到的問(wèn)題。

如果覺(jué)得生活随笔網(wǎng)站內(nèi)容還不錯(cuò)，歡迎將生活随笔推薦給好友。