文章目錄

• • vm_operad
  • • 函數功能
  • read
  • • 函數功能
    • • 流程代碼
  • 簡介每個數字所要做的事（但是流程不是按照這樣進行的）
  • • 注意：
  • 驗證數據（逆向重點）
  • 逆向思維

vm_operad

int __cdecl vm_operad(int *a1, int a2) {int result; // eax@2char v3[100]; // [sp+13h] [bp-E5h]@4char v4[100]; // [sp+77h] [bp-81h]@5char v5; // [sp+DBh] [bp-1Dh]@5int v6; // [sp+DCh] [bp-1Ch]@1int v7; // [sp+E0h] [bp-18h]@1int v8; // [sp+E4h] [bp-14h]@1int v9; // [sp+E8h] [bp-10h]@1int v10; // [sp+ECh] [bp-Ch]@1v10 = 0;v9 = 0;v8 = 0;v7 = 0;v6 = 0;while ( 1 ){result = v10;if ( v10 >= a2 )return result;switch ( a1[v10] ){case 10:read(v3);++v10;break;case 1:v4[v7] = v5;++v10;++v7;++v9;break;case 2:v5 = a1[v10 + 1] + v3[v9];v10 += 2;break;case 3:v5 = v3[v9] - LOBYTE(a1[v10 + 1]);v10 += 2;break;case 4:v5 = a1[v10 + 1] ^ v3[v9];v10 += 2;break;case 5:v5 = a1[v10 + 1] * v3[v9];v10 += 2;break;case 6:++v10;break;case 7:if ( v4[v8] != a1[v10 + 1] ){printf("what a shame...");exit(0);}++v8;v10 += 2;break;case 11:v5 = v3[v9] - 1;++v10;break;case 12:v5 = v3[v9] + 1;++v10;break;case 8:v3[v6] = v5;++v10;++v6;break;default:continue;}} }

函數功能

利用文件字符串中保存的流程數據（以及加密數據）和控制臺數據配合進行驗證flag（這個文件字符串中保存的數據既起到了流程的作用還有加密作用）

read

size_t __cdecl read(char *a1) {size_t result; // eax@1printf("string:");scanf("%s", a1);result = strlen(a1);if ( result != 15 ){puts("WRONG!\n");exit(0);}return result; }

函數功能

這個read函數用來讀取控制臺輸入的命令，我覺得就是flag

0A 00 00 00 04 00 00 00 10 00 00 00 08 00 00 00 03 00 00 00 05 00 00 00 01 00 00 00 04 00 00 00 20 00 00 00 08 00 00 00 05 00 00 00 03 00 00 00 01 00 00 00 03 00 00 00 02 00 00 00 08 00 00 00 0B 00 00 00 01 00 00 00 0C 00 00 00 08 00 00 00 04 00 00 00 04 00 00 00 01 00 00 00 05 00 00 00 03 00 00 00 08 00 00 00 03 00 00 00 21 00 00 00 01 00 00 00 0B 00 00 00 08 00 00 00 0B 00 00 00 01 00 00 00 04 00 00 00 09 00 00 00 08 00 00 00 03 00 00 00 20 00 00 00 01 00 00 00 02 00 00 00 51 00 00 00 08 00 00 00 04 00 00 00 24 00 00 00 01 00 00 00 0C 00 00 00 08 00 00 00 0B 00 00 00 01 00 00 00 05 00 00 00 02 00 00 00 08 00 00 00 02 00 00 00 25 00 00 00 01 00 00 00 02 00 00 00 36 00 00 00 08 00 00 00 04 00 00 00 41 00 00 00 01 00 00 00 02 00 00 00 20 00 00 00 08 00 00 00 05 00 00 00 01 00 00 00 01 00 00 00 05 00 00 00 03 00 00 00 08 00 00 00 02 00 00 00 25 00 00 00 01 00 00 00 04 00 00 00 09 00 00 00 08 00 00 00 03 00 00 00 20 00 00 00 01 00 00 00 02 00 00 00 41 00 00 00 08 00 00 00 0C 00 00 00 01 00 00 00 07 00 00 00 22 00 00 00 07 00 00 00 3F 00 00 00 07 00 00 00 34 00 00 00 07 00 00 00 32 00 00 00 07 00 00 00 72 00 00 00 07 00 00 00 33 00 00 00 07 00 00 00 18 00 00 00 07 00 00 00 A7 FF FF FF 07 00 00 00 31 00 00 00 07 00 00 00 F1 FF FF FF 07 00 00 00 28 00 00 00 07 00 00 00 84 FF FF FF 07 00 00 00 C1 FF FF FF 07 00 00 00 1E 00 00 00 07 00 00 00 7A 00 00 00

流程代碼

case 10:read(v3);++v10;break;case 1:v4[v7] = v5;++v10;++v7;++v9;break;case 2:v5 = a1[v10 + 1] + v3[v9];v10 += 2;break;case 3:v5 = v3[v9] - LOBYTE(a1[v10 + 1]);v10 += 2;break;case 4:v5 = a1[v10 + 1] ^ v3[v9];v10 += 2;break;case 5:v5 = a1[v10 + 1] * v3[v9];v10 += 2;break;case 6:++v10;break;case 7:if ( v4[v8] != a1[v10 + 1] ){printf("what a shame...");exit(0);}++v8;v10 += 2;break;case 11:v5 = v3[v9] - 1;++v10;break;case 12:v5 = v3[v9] + 1;++v10;break;case 8:v3[v6] = v5;++v10;++v6;break;default:continue;

簡介每個數字所要做的事（但是流程不是按照這樣進行的）

0x0A：讀取控制臺所輸入的15個字符

0x4：求v5值，文件字符串下一個位置值 ^ 控制臺第一個數據

0x10：continue

0x08:v5賦給v3數組的第一個元素

0x03:（v3數組的第一個元素-文件字符串下一個位置值）賦給v5

0x05:求V5值，文件字符串下一個位置值 * 控制臺第一個數據

0x01:v5賦給v4數組的第一個元素，然后v9自增，也就代表接下來需要利用到控制臺第二個數據

0x4：求v5值，文件字符串下一個位置值 ^ 控制臺第一個數據

0x20:continue

0x08:v5賦給v3數組的第二個元素

0x05：求V5值，文件字符串下一個位置值 * 控制臺第二個數據

0x03:（v3數組的第二個元素 - 文件字符串下一個位置值）賦給v5

0x01:v5賦給v4數組的第二個元素，然后v9自增，也就代表接下來需要利用到控制臺第三個數據
……………………………………

注意：

文件字符串遇到2 ,3,4,5,7時，那么下一個值并不控制流程（流程直接跳過！），而是被當計算數據所用了。。所以才說執行流程并非是上面所寫的

驗證數據（逆向重點）

07 00 00 00 22 00 00 00 07 00 00 00 3F 00 00 00 07 00 00 00 34 00 00 00 07 00 00 00 32 00 00 00 07 00 00 00 72 00 00 00 07 00 00 00 33 00 00 00 07 00 00 00 18 00 00 00 07 00 00 00 A7 FF FF FF 07 00 00 00 31 00 00 00 07 00 00 00 F1 FF FF FF 07 00 00 00 28 00 00 00 07 00 00 00 84 FF FF FF 07 00 00 00 C1 FF FF FF 07 00 00 00 1E 00 00 00 07 00 00 00 7A 00 00 00

這里全是用來驗證的：
依次是 22h 3fh 34h 32h 72h 33h 18h ffffffa7h 31h fffff1h 28h ffff84h 1eh 7ah
所以按照標準字符串，然后把每個字符都逆著做一遍操作，然后就得到了我們所輸在控制臺的東西，緊接著就結束了。。。

逆向思維

(0x22+5）^ 0x10

(0x3f/3) ^ 0x20

(0x34 + 1) + 2

(0x32 ^ 4) - 1

(0x72 + 0x21) / 3

(0x33 + 1) + 1

(0x18 + 0x20) ^ 9

(0xa7 ^ 0x24) -0x51

(0x31 + 1) - 1

(0xf1 - 0x25) / 2

(0x28 ^ 0x41) - 0x36

(0x84 / 1) - 0x20

(0xc1 - 0x25) / 3

(0x1e + 0x20) ^ 9

(0x7a - 1) - 0x41

flag{757515121f3d478}

總結

以上是生活随笔為你收集整理的2020——网鼎杯 （青龙组）signal的全部內容，希望文章能夠幫你解決所遇到的問題。

如果覺得生活随笔網站內容還不錯，歡迎將生活随笔推薦給好友。