攻防世界 Reverse secret-galaxy-300

最新推荐文章于 2024-01-07 20:47:57 发布

XFox_

最新推荐文章于 2024-01-07 20:47:57 发布

阅读量266

点赞数 1

本文链接：https://blog.csdn.net/XFox_/article/details/119459630

版权

这篇博客详细解析了通过IDA工具反汇编一个名为'secret-galaxy-300'的程序，发现了一个隐藏的'DARKSECRETGALAXY'字符串和加密算法。作者揭示了fill_starbase和print_starbase函数中的关键操作，以及如何通过脚本解码获取flag 'aliens_are_around_us'。

摘要由CSDN通过智能技术生成

secret-galaxy-300`

打开有三个文件，选择分析.exe文件`
拖进ida，并打开main函数

int __cdecl main(int argc, const char **argv, const char **envp)
{
  __main();
  fill_starbase(&starbase);
  print_starbase(&starbase);
  return 0;
}

只有两个函数，分别进入分析
fill_starbase函数：

void __cdecl fill_starbase(int a1)
{
  int i; // [esp+8h] [ebp-10h]
  int v2; // [esp+Ch] [ebp-Ch]

  v2 = 0;
  for ( i = 0; i <= 4; ++i )
  {
    *(_DWORD *)(a1 + 24 * i) = galaxy_name[i];
    *(_DWORD *)(24 * i + a1 + 4) = rand();
    *(_DWORD *)(24 * i + a1 + 8) = 0;
    *(_DWORD *)(24 * i + a1 + 12) = 0;
    *(_DWORD *)(24 * i + a1 + 16) = 24 * (i + 1) + a1;
    *(_DWORD *)(a1 + 24 * i + 20) = v2;
    v2 = 24 * i + a1;
  }
}

ptint_database函数：

int __cdecl print_starbase(int a1)
{
  int result; // eax
  const char *v2; // edx
  int i; // [esp+1Ch] [ebp-Ch]

  puts("--------------GALAXY DATABASE-------------");
  printf("%10s | %s | %s\n", "Galaxy name", "Existence of life", "Distance from Earth");
  result = puts("-------------------------------------------");
  for ( i = 0; i <= 4; ++i )
  {
    if ( *(_DWORD *)(24 * i + a1 + 8) == 1 )
      v2 = "INHABITED";
    else
      v2 = "IS NOT INHABITED";
    result = printf("%11s | %17s | %d\n", *(const char **)(24 * i + a1), v2, *(_DWORD *)(24 * i + a1 + 4));
  }
  return result;
}

没有可疑点，查看字符串
在这里插入图片描述
发现DARK SECRET GALAXY有问题
双击，并且需要两次交叉引用

反汇编得到

int __libc_csu_gala()
{
  int result; // eax

  sc[0] = off_409014;//off_409004 = "Andromeda"
  sc[3] = &byte_40DAC0;
  sc[1] = 31337;
  sc[2] = 1;
  byte_40DAC0 = off_409004[0][8];
  byte_40DAC1 = off_409010[0][7];//off_409010 = "Triangulum"
  byte_40DAC2 = off_409008[0][4];//off_409008 = "Messier"
  byte_40DAC3 = off_409004[0][6];
  byte_40DAC4 = off_409004[0][1];
  byte_40DAC5 = off_409008[0][2];
  byte_40DAC6 = 95;
  byte_40DAC7 = off_409004[0][8];
  byte_40DAC8 = off_409004[0][3];
  byte_40DAC9 = off_40900C[0][5];//off_40900C = "Sombrero"
  byte_40DACA = 95;
  byte_40DACB = off_409004[0][8];
  byte_40DACC = off_409004[0][3];
  byte_40DACD = off_409004[0][4];
  byte_40DACE = off_409010[0][6];
  byte_40DACF = off_409010[0][4];
  byte_40DAD0 = off_409004[0][2];
  byte_40DAD1 = 95;
  byte_40DAD2 = off_409010[0][6];
  result = *((unsigned __int8 *)off_409008[0] + 3);
  byte_40DAD3 = off_409008[0][3];
  byte_40DAD4 = 0;
  return result;
}

编写脚本

off_409004 = "Andromeda"
off_409010 = "Triangulum"
off_409008 = "Messier"
off_40900C = "Sombrero"
A = off_409004[8]+off_409010[7]+off_409008[4]+off_409004[6]+off_409004[1]+off_409008[2]
B = off_409004[8]+off_409004[3]+off_40900C[5]
C = off_409004[8]+off_409004[3]+off_409004[4]+off_409010[6]+off_409010[4]+off_409004[2]
D = off_409010[6]+off_409008[3]
print(A+'_'+B+'_'+C+'_'+D)