[NSSRound#X Basic]ez_z3

最新推荐文章于 2024-07-09 00:09:55 发布

re_halo

最新推荐文章于 2024-07-09 00:09:55 发布

阅读量417

点赞数 4

文章标签：网络安全密码学安全

本文链接：https://blog.csdn.net/2302_79135465/article/details/137958221

版权

UPX壳

一，直接工具脱

二，魔改壳

将其放到010editor等十六进制工具，XYU改成UPX，再进行脱壳

要改三个地方，区段名

标识

还有进阶版，去除特征码（还没遇到）

特征码1:60 BE ?? ?? ?? 00 8D BE ?? ?? ?? FF
特征码2:60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75
特征码3:55 FF 96 ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB ?? FF 96 ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? 00 00 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80

感谢https://blog.csdn.net/qq_73505302/article/details/130580670

通过string或者Code找到关键函数

z3库使用，使用向量类型定义未知数可以加快求解速度（不太会）

from z3 import *

a1 = [BitVec("num[%d]" % i, 32) for i in range(20)]
s = Solver()
s.add(
    20 * a1[19] * 19 * a1[18]
    + 14 * a1[13]
    + 13 * a1[12]
    + 11 * a1[10] * 10 * a1[9]
    + 30 * a1[5]
    + 5 * a1[4]
    + a1[0]
+ 2 * a1[1]
- 3 * a1[2]
- 4 * a1[3]
- 7 * a1[6]
+ 8 * a1[7]
- 9 * a1[8]
- 12 * a1[11]
- 16 * a1[15] * 15 * a1[14]
- 17 * a1[16]
- 18 * a1[17] == 2582239)
s.add(
    20 * a1[19] * 19 * a1[18]
    + 14 * a1[13]
    + 13 * a1[12]
    + 11 * a1[10] * 10 * a1[9]
    + 30 * a1[5]
    - 7 * a1[6]
    + 8 * a1[7]
    - 9 * a1[8]
    + 5 * a1[4]
    + 3 * a1[2]
    + 2 * a1[1] * a1[0]
    - 4 * a1[3]
    - 12 * a1[11]
    - 16 * a1[15] * 15 * a1[14]
    - (18 * a1[17]
       + 17 * a1[16]) == 2602741)
s.add(19 * a1[18]
     + 18 * a1[17]
     + 14 * a1[13] * 13 * a1[12]
     + 12 * a1[11] * 11 * a1[10]
     + 9 * a1[8]
     + 7 * a1[6] * 30 * a1[5]
     + a1[0]
     - 2 * a1[1]
     - 4 * a1[3] * 3 * a1[2]
     - 5 * a1[4]
     + 8 * a1[7]
     - 10 * a1[9]
     - 15 * a1[14]
     - 17 * a1[16] * 16 * a1[15]
     - 20 * a1[19] == 2668123)
s.add(20 * a1[19] * 19 * a1[18]
     + 14 * a1[13]
     + (13 * a1[12] + 11 * a1[10] - 12 * a1[11]) * 10 * a1[9]
     + 30 * a1[5]
     + 5 * a1[4]
     + a1[0]
     + 2 * a1[1]
     - 3 * a1[2]
     - 4 * a1[3]
     - 7 * a1[6]
     + 8 * a1[7]
     - 9 * a1[8]
     - 16 * a1[15] * 15 * a1[14]
     - 17 * a1[16]
     - 18 * a1[17] == 2520193)
s.add(
    18 * a1[17]
    + 17 * a1[16]
    + 15 * a1[14]
    + 13 * a1[12] * 12 * a1[11]
    + 10 * a1[9]
    + 9 * a1[8] * 8 * a1[7]
    + 3 * a1[2] * 2 * a1[1] * a1[0]
    - 4 * a1[3]
    - 5 * a1[4]
    - 30 * a1[5]
    - 7 * a1[6]
    - 11 * a1[10]
    - 14 * a1[13]
    - 16 * a1[15]
    - 19 * a1[18]
    - 20 * a1[19] == 8904587)
s.add(
    18 * a1[17]
    + 7 * a1[6] * 30 * a1[5] * 5 * a1[4]
    + 4 * a1[3]
    + 8 * a1[7]
    + a1[0]
- 2 * a1[1]
- 3 * a1[2]
- 9 * a1[8]
- 11 * a1[10] * 10 * a1[9]
- 16 * a1[15] * (13 * a1[12] + 12 * a1[11] - 14 * a1[13] - 15 * a1[14])
- 17 * a1[16]
- 19 * a1[18]
- 20 * a1[19] == 1227620874)
s.add(20 * a1[19] * 19 * a1[18]
     + 17 * a1[16]
     + 14 * a1[13]
     + 13 * a1[12]
     + 12 * a1[11] * 11 * a1[10] * 10 * a1[9]
     + 7 * a1[6] * 30 * a1[5]
     + 5 * a1[4]
     + 3 * a1[2]
     + a1[0]
     + 2 * a1[1]
     + 4 * a1[3]
     + 8 * a1[7]
     - 9 * a1[8]
     - 16 * a1[15] * 15 * a1[14]
     - 18 * a1[17] == 1836606059)
s.add(
    20 * a1[19] * 19 * a1[18]
    + 16 * a1[15] * 15 * a1[14]
    + 14 * a1[13]
    + 13 * a1[12]
    + 12 * a1[11]
    + 7 * a1[6] * 30 * a1[5]
    + 5 * a1[4]
    + 2 * a1[1] * a1[0]
    - 3 * a1[2]
    + 4 * a1[3]
    + 8 * a1[7]
    - 9 * a1[8]
    - 10 * a1[9]
    - 11 * a1[10]
    - 17 * a1[16]
    - 18 * a1[17] == 8720560)
s.add(20 * a1[19] * 19 * a1[18]
     + 14 * a1[13]
     + 13 * a1[12]
     + 11 * a1[10] * (10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8])
     + a1[0]
     + 2 * a1[1]
     - 3 * a1[2]
     - 12 * a1[11]
     - (16 * a1[15] - 17 * a1[16] - 18 * a1[17]) * 15 * a1[14] == 11387045)
s.add(
    20 * a1[19] * 19 * a1[18]
    + 16 * a1[15] * 15 * a1[14]
    + 14 * a1[13]
    + 11 * a1[10] * 10 * a1[9]
    + 9 * a1[8]
    + 3 * a1[2]
    + a1[0]
- 2 * a1[1]
+ 4 * a1[3]
- 5 * a1[4]
- 30 * a1[5]
- 7 * a1[6]
+ 8 * a1[7]
- 12 * a1[11]
- 13 * a1[12]
- 17 * a1[16]
- 18 * a1[17] == 7660269)
s.add(20 * a1[19] * 19 * a1[18]
     + 14 * a1[13]
     + 13 * a1[12]
     + 11 * a1[10] * 10 * a1[9]
     - 12 * a1[11]
     + a1[0]
     + 2 * a1[1]
     - (4 * a1[3] * 3 * a1[2]
      - 5 * a1[4]
      - 30 * a1[5])
     - 7 * a1[6]
     + 8 * a1[7]
     - 9 * a1[8]
     - 16 * a1[15] * 15 * a1[14]
     - 17 * a1[16]
     - 18 * a1[17] == 2461883)
s.add(
    14 * a1[13]
    + 11 * a1[10] * 10 * a1[9]
    + 9 * a1[8] * 8 * a1[7]
    + 7 * a1[6]
    + 2 * a1[1] * a1[0]
    - 4 * a1[3] * 3 * a1[2]
    - 5 * a1[4]
    - 30 * a1[5]
    - 12 * a1[11]
    - 13 * a1[12]
    - 15 * a1[14]
    - 17 * a1[16] * 16 * a1[15]
    - 18 * a1[17]
    - 19 * a1[18]
    - 20 * a1[19] == -966296)

s.add(
14 * a1[13]
     + 13 * a1[12]
     + (11 * a1[10] * 10 * a1[9] + 30 * a1[5] + 5 * a1[4] + 3 * a1[2] + 4 * a1[3] - 7 * a1[6] + 8 * a1[7] - 9 * a1[8])
     * 2
     * a1[1]
     + a1[0]
     - 12 * a1[11]
     - 15 * a1[14]
     - 16 * a1[15]
     - 17 * a1[16]
     - 18 * a1[17]
     - 20 * a1[19] * 19 * a1[18] == 254500223
    )
s.add(
16 * a1[15] * 15 * a1[14]
     + 14 * a1[13]
     + 11 * a1[10] * 10 * a1[9]
     + 7 * a1[6] * 30 * a1[5]
     + a1[0]
     - 2 * a1[1]
     - 3 * a1[2]
     - 5 * a1[4] * 4 * a1[3]
     + 8 * a1[7]
     - 9 * a1[8]
     - 12 * a1[11]
     - 13 * a1[12]
     - 17 * a1[16]
     - 18 * a1[17]
     - 19 * a1[18]
     - 20 * a1[19] == 6022286
    )
s.add(
18 * a1[17]
     + 16 * a1[15]
     - 17 * a1[16]
     + 14 * a1[13]
     + 12 * a1[11]
     + 11 * a1[10] * 10 * a1[9]
     + 30 * a1[5]
     + 5 * a1[4]
     + 4 * a1[3] * 3 * a1[2]
     + 2 * a1[1] * a1[0]
     - 9 * a1[8] * 8 * a1[7] * 7 * a1[6]
     - 13 * a1[12]
     - 15 * a1[14]
     - 19 * a1[18]
     - 20 * a1[19] == -636956022
    )
s.add(
20 * a1[19] * 19 * a1[18]
     + 13 * a1[12]
     + 12 * a1[11]
     + 11 * a1[10] * 10 * a1[9]
     + 7 * a1[6]
     + 30 * a1[5]
     + 5 * a1[4]
     + 3 * a1[2] * 2 * a1[1] * a1[0]
     - 4 * a1[3]
     - 9 * a1[8] * 8 * a1[7]
     - 14 * a1[13]
     - 15 * a1[14]
     - 16 * a1[15]
     - 17 * a1[16]
     - 18 * a1[17] == 10631829
)
s.add(
20 * a1[19] * 19 * a1[18]
     + 16 * a1[15]
     - 17 * a1[16]
     - 18 * a1[17]
     + 15 * a1[14] * 14 * a1[13]
     + 13 * a1[12]
     + 11 * a1[10] * 10 * a1[9]
     - 12 * a1[11]
     + 7 * a1[6]
     + (4 * a1[3] - 5 * a1[4] - 30 * a1[5]) * 3 * a1[2]
     + a1[0]
     + 2 * a1[1]
     + 8 * a1[7]
     - 9 * a1[8] == 6191333
)
s.add(
14 * a1[13]
     + 10 * a1[9] * 9 * a1[8] * 8 * a1[7]
     + 5 * a1[4]
     + 4 * a1[3] * 3 * a1[2]
     + 2 * a1[1] * a1[0]
     - 7 * a1[6] * 30 * a1[5]
     - 11 * a1[10]
     - 13 * a1[12] * 12 * a1[11]
     - 16 * a1[15] * 15 * a1[14]
     - 18 * a1[17] * 17 * a1[16]
     - 20 * a1[19] * 19 * a1[18] == 890415359
)
s.add(
20 * a1[19]
     + 19 * a1[18]
     + 18 * a1[17]
     + 16 * a1[15]
     - 17 * a1[16]
     + 12 * a1[11]
     + 11 * a1[10]
     + 10 * a1[9]
     + 9 * a1[8]
     + 30 * a1[5]
     + a1[0]
     + 4 * a1[3] * 3 * a1[2] * 2 * a1[1]
     - 5 * a1[4]
     - 7 * a1[6]
     + 8 * a1[7]
     - 13 * a1[12]
     - 14 * a1[13]
     - 15 * a1[14] == 23493664
)
s.add(
20 * a1[19] * 19 * a1[18]
     + 13 * a1[12]
     + 12 * a1[11]
     + 10 * a1[9]
     + 3 * a1[2] * 2 * a1[1]
     + a1[0]
     - 4 * a1[3]
     - 5 * a1[4]
     + 8 * a1[7] * 7 * a1[6] * 30 * a1[5]
     - 9 * a1[8]
     - 11 * a1[10]
     - 14 * a1[13]
     - 16 * a1[15] * 15 * a1[14]
     - 17 * a1[16]
     - 18 * a1[17] == 1967260144
)
print(s.check())
for i in a1:
    print(s.model()[i].as_long(), end=",")

得到104,97,104,97,104,97,116,104,105,115,105,115,102,97,99,107,102,108,97,103,

肯定不是和0异或，继续翻

得到254D0,异或

还有一个快速幂算法（通过迭代地平方底数并将指数减半来计算指数函数的结果）

b = [4615,19616,20257,57,107811,570,2342,19623,25952,54,108955,19624,113632,14085,2342,30675,39576,25979,24,2833]
a = [104,97,104,97,104,97,116,104,105,115,105,115,102,97,99,107,102,108,97,103]
d =[0]*20
for i in range(20):
    d[i] = b[i] ^ a[19-i]    #异或
print(d)
key = [7,7,7,9,5,6,7,7,7,9,7,7,5,7,7,7,5,7,9,7]
def powmod(b,c):
    ans = 1
    while (c != 0):
        if ((c & 1) != 0):
            ans *= b
            y1 = (b * b) % 1000
            b = y1
            c >>= 2
            return ans       #快速幂
for i in range(len(key)):
    for x in range(32,128):
        y=powmod(x,key[i])
        if y==d[i]:
            print(chr(x),end="")
            break

跑的比较慢。

总结：就是输入flag-->快速幂-->z3-->异或-->比较爆破。

感谢余和5.8---5.14 reverse刷题笔记_upx防脱壳-CSDN博客