2020国赛部分re -- wp

re1：

idapy 扒校验数组：

from __future__ import print_function#支持py2使用py3的函数
from __future__ import print_function#支持py2使用py3的函数
sea = 0x404020
for i in range(sea,sea+0xa8,4): 
  print('0x%x'%(Byte(i+1)),end="")
  print(('%x'%Byte(i)+','),end="")

注意部分元素补0

from z3 import*

check = [0x17,0x4f,0x0,0x0,0xf6,0x9c,0x0,0x0,0xdb,0x8d,0x0,0x0,0xa6,0x8e,0x0,0x0,0x29,0x69,0x0,0x0,0x11,0x99,0x0,0x0,0xa2,0x40,0x0,0x0,0x3e,0x2f,0x0,0x0,0xb6,0x62,0x0,0x0,0x82,0x4b,0x0,0x0,0x6c,0x48,0x0,0x0,0x2,0x40,0x0,0x0,0xd7,0x52,0x0,0x0,0xef,0x2d,0x0,0x0,0xdc,0x28,0x0,0x0,0xd,0x64,0x0,0x0,0x8f,0x52,0x0,0x0,0x3b,0x61,0x0,0x0,0x81,0x47,0x0,0x0,0x17,0x6b,0x0,0x0,0x37,0x32,0x0,0x0,0x93,0x2a,0x0,0x0,0x5f,0x61,0x0,0x0,0xbe,0x50,0x0,0x0,0x8e,0x59,0x0,0x0,0x56,0x46,0x0,0x0,0x31,0x5b,0x0,0x0,0x3a,0x31,0x0,0x0,0x10,0x30,0x0,0x0,0xfe,0x67,0x0,0x0,0x5f,0x4d,0x0,0x0,0xdb,0x58,0x0,0x0,0x99,0x37,0x0,0x0,0xa0,0x60,0x0,0x0,0x50,0x27,0x0,0x0,0x59,0x37,0x0,0x0,0x53,0x89,0x0,0x0,0x22,0x71,0x0,0x0,0xf9,0x81,0x0,0x0,0x24,0x55,0x0,0x0,0x71,0x89,0x0,0x0,0x1d,0x3a,0x0,0x0]
#for i in range(46,88):
 #   print('v'+str(i)+' ',end="")
v46,v47,v48,v49,v50,v51,v52,v53,v54,v55 = BitVecs('v46 v47 v48 v49 v50 v51 v52 v53 v54 v55'
,64)
v56,v57,v58,v59,v60,v61,v62,v63,v64,v65 = BitVecs('v56 v57 v58 v59 v60 v61 v62 v63 v64 v65',64)
v66,v67,v68,v69,v70,v71,v72,v73,v74,v75,v76,v77,v78,v79,v80,v81,v82,v83,v84,v85,v86,v87 = BitVecs('v66 v67 v68 v69 v70 v71 v72 v73 v74 v75 v76 v77 v78 v79 v80 v81 v82 v83 v84 v85 v86 v87',64)
#v46,v47,v48,v49,v4a,v4b,v4c,v4d,v4e,v4f,v50,v51,v52,v53,v54,v55,v56,v57,v58,v59,v5a,v5b,v5c,v5d,v5e,v5f,v60,v61,v62,v63,v64,v65,v66,v67,v68,v69,v6a,v6b,v6c,v6d,v6e,v6f,v70,v71,v72,v73,v74,v75,v76,v77,v78,v79,v7a,v7b,v7c,v7d,v7e,v7f,v80,v81,v82,v83,v84,v85,v86,v87= Int('v46 v47 v48 v49 v4a v4b v4c v4d v4e v4f v50 v51 v52 v53 v54 v55 v56 v57 v58 v59 v5a v5b v5c v5d v5e v5f v60 v61 v62 v63 v64 v65 v66 v67 v68 v69 v6a v6b v6c v6d v6e v6f v70 v71 v72 v73 v74 v75 v76 v77 v78 v79 v7a v7b v7c v7d v7e v7f v80 v81 v82 v83 v84 v85 v86 v87' ,64)
g = Solver()
g.add(check[0] == 34 * v49 + 12 * v46 + 53 * v47 + 6 * v48 + 58 * v50 + 36 * v51 + v52)
g.add(check[1] == 27 * v50 + 73 * v49 + 12 * v48 + 83 * v46 + 85 * v47 + 96 * v51 + 52 * v52)
g.add(check[2] == 24 * v48 + 78 * v46 + 53 * v47 + 36 * v49 + 86 * v50 + 25 * v51 + 46 * v52)
g.add(check[3] == 78 * v47 + 39 * v46 + 52 * v48 + 9 * v49 + 62 * v50 + 37 * v51 + 84 * v52)
g.add(check[4] == 48 * v50 + 14 * v48 + 23 * v46 + 6 * v47 + 74 * v49 + 12 * v51 + 83 * v52)
g.add(check[5] ==15 * v51 + 48 * v50 + 92 * v48 + 85 * v47 + 27 * v46 + 42 * v49 + 72 * v52)
g.add(check[6] ==26 * v51 + 67 * v49 + 6 * v47 + 4 * v46 + 3 * v48 + 68 * v52)
g.add(check[7] ==34 * v56 + 12 * v53 + 53 * v54 + 6 * v55 + 58 * v57 + 36 * v58 + v59)
g.add(check[8]==27 * v57 + 73 * v56 + 12 * v55 + 83 * v53 + 85 * v54 + 96 * v58 + 52 * v59)
g.add(check[9] ==24 * v55 + 78 * v53 + 53 * v54 + 36 * v56 + 86 * v57 + 25 * v58 + 46 * v59)
g.add(check[10] ==78 * v54 + 39 * v53 + 52 * v55 + 9 * v56 + 62 * v57 + 37 * v58 + 84 * v59)
g.add(check[11]==48 * v57 + 14 * v55 + 23 * v53 + 6 * v54 + 74 * v56 + 12 * v58 + 83 * v59)
g.add(check[12]==15 * v58 + 48 * v57 + 92 * v55 + 85 * v54 + 27 * v53 + 42 * v56 + 72 * v59)
g.add(check[13]==26 * v58 + 67 * v56 + 6 * v54 + 4 * v53 + 3 * v55 + 68 * v59)
g.add(check[14]==34 * v63 + 12 * v60 + 53 * v61 + 6 * v62 + 58 * v64 + 36 * v65 + v66)
g.add(check[15] ==27 * v64 + 73 * v63 + 12 * v62 + 83 * v60 + 85 * v61 + 96 * v65 + 52 * v66)
g.add(check[16]==24 * v62 + 78 * v60 + 53 * v61 + 36 * v63 + 86 * v64 + 25 * v65 + 46 * v66)
g.add(check[17]==78 * v61 + 39 * v60 + 52 * v62 + 9 * v63 + 62 * v64 + 37 * v65 + 84 * v66)
g.add(check[18]==48 * v64 + 14 * v62 + 23 * v60 + 6 * v61 + 74 * v63 + 12 * v65 + 83 * v66)
g.add(check[19] ==15 * v65 + 48 * v64 + 92 * v62 + 85 * v61 + 27 * v60 + 42 * v63 + 72 * v66)
g.add(check[20]==26 * v65 + 67 * v63 + 6 * v61 + 4 * v60 + 3 * v62 + 68 * v66)
g.add(check[21] ==34 * v70 + 12 * v67 + 53 * v68 + 6 * v69 + 58 * v71 + 36 * v72 + v73)
g.add(check[22]==27 * v71 + 73 * v70 + 12 * v69 + 83 * v67 + 85 * v68 + 96 * v72 + 52 * v73)
g.add(check[23] ==24 * v69 + 78 * v67 + 53 * v68 + 36 * v70 + 86 * v71 + 25 * v72 + 46 * v73)
g.add(check[24] ==78 * v68 + 39 * v67 + 52 * v69 + 9 * v70 + 62 * v71 + 37 * v72 + 84 * v73)
g.add(check[25] ==48 * v71 + 14 * v69 + 23 * v67 + 6 * v68 + 74 * v70 + 12 * v72 + 83 * v73)
g.add(check[26] ==15 * v72 + 48 * v71 + 92 * v69 + 85 * v68 + 27 * v67 + 42 * v70 + 72 * v73)
g.add(check[27] ==26 * v72 + 67 * v70 + 6 * v68 + 4 * v67 + 3 * v69 + 68 * v73)
g.add(check[28]==34 * v77 + 12 * v74 + 53 * v75 + 6 * v76 + 58 * v78 + 36 * v79 + v80)
g.add(check[29] ==27 * v78 + 73 * v77 + 12 * v76 + 83 * v74 + 85 * v75 + 96 * v79 + 52 * v80)
g.add(check[30]==24 * v76 + 78 * v74 + 53 * v75 + 36 * v77 + 86 * v78 + 25 * v79 + 46 * v80)
g.add(check[31]==78 * v75 + 39 * v74 + 52 * v76 + 9 * v77 + 62 * v78 + 37 * v79 + 84 * v80)
g.add(check[32]==48 * v78 + 14 * v76 + 23 * v74 + 6 * v75 + 74 * v77 + 12 * v79 + 83 * v80)
g.add(check[33] ==15 * v79 + 48 * v78 + 92 * v76 + 85 * v75 + 27 * v74 + 42 * v77 + 72 * v80)
g.add(check[34] == 26 * v79 + 67 * v77 + 6 * v75 + 4 * v74 + 3 * v76 + 68 * v80)
g.add(check[35] == 34 * v84 + 12 * v81 + 53 * v82 + 6 * v83 + 58 * v85 + 36 * v86 + v87)
g.add(check[36]== 27 * v85 + 73 * v84 + 12 * v83 + 83 * v81 + 85 * v82 + 96 * v86 + 52 * v87)
g.add(check[37] == 24 * v83 + 78 * v81 + 53 * v82 + 36 * v84 + 86 * v85 + 25 * v86 + 46 * v87)
g.add(check[38] == 78 * v82 + 39 * v81 + 52 * v83 + 9 * v84 + 62 * v85 + 37 * v86 + 84 * v87)
g.add(check[39] == 48 * v85 + 14 * v83 + 23 * v81 + 6 * v82 + 74 * v84 + 12 * v86 + 83 * v87)
g.add(check[40] == 15 * v86 + 48 * v85 + 92 * v83 + 85 * v82 + 27 * v81 + 42 * v84 + 72 * v87)
g.add(check[41]== 26 * v86 + 67 * v84 + 6 * v82 + 4 * v81 + 3 * v83 + 68 * v87)
if g.check() == sat:
    print (g.model())
else:
    print("error")

re2：

推荐在textview下进行分析

注意创建的进程会有错误的跳转，就是偏移+1的那个地方。如果想看伪代码的话按u取消定义后，可使用keypatch插件将其替换成nop，再c一下就可以f5了。

核心逻辑是低六和高二的交换，再异或0x23

有用的地方只有第一个进程Startadress，注意这部分代码的阅读，底下其实还有一个+0x23的加密。

最后写脚本即可，注意元素位数。

#include<stdio.h>
int main()
{
	int check[] = {0xdd,0x5b,0x9e,0x1d,0x20,0x9e,0x90,0x91,0x90,0x90,0x91,0x92,0xde,0x8b,0x11,0xd1,0x1e,0x9e,0x8b,0x51,0x11,0x50,0x51,0x8b,0x9e,0x5d,0x5d,0x11,0x8b,0x90,0x12,0x91,0x50,0x12,0xd2,0x91,0x92,0x1e,0x9e,0x90,0xd2,0x9f};
	for (int i = 0; i < 0x2a; i++)
	{
		check[i] -= 0x23 ;
		unsigned char t1 = check[i]^0x23;
		unsigned char t2 = t1<<2;
		unsigned char t3 = t1>>6;
		//printf("%x,%x,%x\n",t1,t2,t3);
	    printf("%c",(t2+t3));
	}
 }