LetGo(记录第一次写逆向go

最新推荐文章于 2024-11-11 13:31:24 发布

白榆是星星

最新推荐文章于 2024-11-11 13:31:24 发布

阅读量265

点赞数 2

文章标签： golang 开发语言后端

本文链接：https://blog.csdn.net/2202_75640291/article/details/141790332

版权

（ida加载脚本，打开exe文件的第二个页面要no，不知道什么原因）

用IDA打开后出现很多红色0xFFFFFF，怀疑加密，打开main_main主函数发现是go加密

Script file打开go脚本

发现

while ( (unsigned __int64)&v76 <= *(_QWORD *)(v3 + 16) )
    runtime_morestack_noctxt();
  v80 = 0LL;
  v79[0] = &RTYPE_string;
  v79[1] = &main__stmp_0;
  fmt_Fprintln(
    (unsigned int)go_itab__os_File_io_Writer,
    os_Stdout,
    (unsigned int)v79,
    1,
    1,
    (unsigned int)&main__stmp_0,
    v0,
    v1,
    v2);
  p_string = (string *)runtime_newobject(&RTYPE_string);
  p_string->ptr = 0LL;
  v78[0] = &RTYPE_string;
  v78[1] = &main__stmp_1;
  fmt_Fprint(
    (unsigned int)go_itab__os_File_io_Writer,
    os_Stdout,
    (unsigned int)v78,
    1,
    1,
    (unsigned int)&main__stmp_1,
    v4,
    v5,
    v6);
  v77[0] = &RTYPE__ptr_string;
  v77[1] = p_string;
  v7 = os_Stdin;
  v8 = 2;
  v9 = v77;
  fmt_Fscanf(
    (unsigned int)go_itab__os_File_io_Reader,
    os_Stdin,
    (unsigned int)"%s",
    2,
    (unsigned int)v77,
    1,
    1,
    v10,
    v11,
    v52,
    v58,
    v62,
    HIDWORD(v62),
    v65,
    HIDWORD(v65),
    v67,
    HIDWORD(v67));
  v16 = 0LL;
  v17 = 0;
  v18 = 0LL;
  while ( v16 < 64 )
  {
    v24 = v16;
    v25 = v16 - ((v16 + 11) >> 6 << 6);
    if ( (unsigned __int64)(v25 + 11) >= 0x40 )
      runtime_panicIndex(v25 + 11, v7, 64LL, v24);
    v69 = v17;
    v70 = v24;
    v72 = v18;
    v19 = (unsigned __int8)aAbcdefghijklmn[v25 + 11];
    v8 = runtime_intstring(
           0,
           v19,
           (unsigned int)"ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/",
           v24,
           (int)v25 + 11,
           v12,
           v13,
           v14,
           v15,
           v53,
           v59);
    LODWORD(v9) = v19;
    v7 = v72;
    v18 = runtime_concatstring2(0, v72, v69, v8, (_DWORD)v9, v20, v21, v22, v23, v54, v60, v63, v66, v68);
    v16 = v70 + 1;
    v17 = v72;
  }
  v26 = v17;
  v71 = main__Cfunc_CString(v18, v17, v17, v8, (_DWORD)v9, v12, v13, v14, v15, v53, v59);
  v80 = (void (**)(void))main_main_func1(v71, v26, v27, v8, (_DWORD)v9, v28, v29, v30, v31, v55);
  len = p_string->len;
  v37 = main__Cfunc_CString(p_string->ptr, len, (_DWORD)p_string, v8, (_DWORD)v9, v33, v34, v35, v36, v56, v61);
  main__Cfunc_enc(v37, len, v71, v8, (_DWORD)v9, v38, v39, v40, v41, v37, v71, v63);
  v47 = runtime_gostring(v64, len, v42, v8, (_DWORD)v9, v43, v44, v45, v46, v57);
  if ( len == 60
    && (unsigned __int8)runtime_memequal(v47, "cPQebAcRp+n+ZeP+YePEWfP7bej4YefCYd/7cuP7WfcPb/URYeMRbesObi/=", 60LL) )
  {
    v74[0] = &RTYPE_string;
    v74[1] = &main__stmp_3;
    fmt_Fprintln((unsigned int)go_itab__os_File_io_Writer, os_Stdout, (unsigned int)v74, 1, 1, v48, v49, v50, v51);
  }
  else
  {
    v75 = &RTYPE_string;
    v76 = &main__stmp_2;
    fmt_Fprintln((unsigned int)go_itab__os_File_io_Writer, os_Stdout, (unsigned int)&v75, 1, 1, v48, v49, v50, v51);
  }
  (*v80)();
}

主要加密过程在

判断他是将其中的字符串进行了一个储存作为映射

改写一下运行，得到

LMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJK作为映射表

decoded_string = ""

for i in range(64):
    index = (i - ((i + 11) >> 6 << 6)) + 11
    c = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"[index]
    decoded_string += c
print(decoded_string)

密文是cPQebAcRp+n+ZeP+YePEWfP7bej4YefCYd/7cuP7WfcPb/URYeMRbesObi/=

得到flag。