2021 羊城杯 EasyVM

最新推荐文章于 2022-12-06 20:54:13 发布

努力学习的大康

最新推荐文章于 2022-12-06 20:54:13 发布

阅读量767

点赞数 1

分类专栏：逆向分析 CTF

本文链接：https://blog.csdn.net/abel_big_xu/article/details/120285565

版权

安全

逆向分析同时被 2 个专栏收录

24 篇文章 18 订阅

订阅专栏

CTF

23 篇文章 2 订阅

订阅专栏

正好学习一下vm的题目怎么分析

1.简单分析

主函数
1.初始化标准输入输出和错误
2.设置VMcontext
3.xxtea自解密dispatch代码
4.进入dispatch执行
在这里插入图片描述

2.解决smc问题

在自解密结束位置下断点，并将内容dump下来.
在这里插入图片描述
dump脚本

start = 0x80487A8
for idx in range(0x1000):
	if idx%16 == 0:
		print("")
	
    print(hex(get_wide_byte(start+idx)),end=',')

修复内容并保存

start = 0x80487A8
a = [0x55,0x89,0xe5,0x53,0x83,0xec,0x34,0x8b,0x45,0x8,0x89,
	0x45,0xd4,0x65,0xa1,0x14,0x0,0x0,0x0,0x89,0x45,0xf4,0x31,
	0xc0,0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x71,
	0x75,0x2f,0x8b,0x45,0xd4,0x8b,0x40,0x18,0x8d,0x50,0xfc,
	0x8b,0x45,0xd4,0x89,0x50,0x18,0x8b,0x45,0xd4,0x8b,0x40,
	0x18,0x8b,0x55,0xd4,0x8b,0x52,0x20,0x8b,0x52,0x1,0x89,
	0x10,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,0x5,0x8b,
	0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,0x20,
	0xf,0xb6,0x0,0x3c,0x41,0x75,0x23,0x8b,0x45,0xd4,0x8b,
	0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x8,0x1,0xc2,0x8b,0x45,
	0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,
	0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,
	0x20,0xf,0xb6,0x0,0x3c,0x42,0x75,0x23,0x8b,0x45,0xd4,0x8b,
	0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x10,0x29,0xc2,0x8b,0x45,
	0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,
	0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,
	0x20,0xf,0xb6,0x0,0x3c,0x43,0x75,0x24,0x8b,0x45,0xd4,0x8b,
	0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0xc,0xf,0xaf,0xd0,0x8b,
	0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,
	0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,
	0x40,0x20,0xf,0xb6,0x0,0x3c,0x37,0x75,0x1b,0x8b,0x45,0xd4,
	0x8b,0x50,0x14,0x8b,0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,
	0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,
	0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x38,0x75,
	0x23,0x8b,0x45,0xd4,0x8b,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,
	0x10,0x31,0xc2,0x8b,0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,
	0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,
	0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x39,0x75,
	0x23,0x8b,0x45,0xd4,0x8b,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,
	0x14,0x31,0xc2,0x8b,0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,
	0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,
	0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x35,0x75,
	0x1b,0x8b,0x45,0xd4,0x8b,0x50,0x4,0x8b,0x45,0xd4,0x89,0x50,
	0x14,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,
	0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,
	0x0,0x3c,0xf7,0x75,0x23,0x8b,0x45,0xd4,0x8b,0x50,0x24,0x8b,
	0x45,0xd4,0x8b,0x40,0x4,0x1,0xc2,0x8b,0x45,0xd4,0x89,0x50,
	0x24,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,
	0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,
	0x0,0x3c,0x44,0x75,0x2a,0x8b,0x45,0xd4,0x8b,0x40,0x4,0x8b,
	0x55,0xd4,0x8b,0x5a,0x14,0xba,0x0,0x0,0x0,0x0,0xf7,0xf3,0x89,0xc2]
for i in range(len(a)):
    ida_bytes.patch_byte(start+i, a[i])

修复完成之后可以看出dispatch
在这里插入图片描述

2.提取opcode

第一列是操作码，第二列是opcode数量，第三列是对应的操作

table[4] = [0x7b,0x2f,0x37,0xe8]
table2[2] = [0x0CF1304DC,0x283B8E84]
0x9 1 reg[1] = 0x6FEBF967
0x10 1 reg[9] = reg[1]
0x11 1 printf(%x,reg[1])
0x22 1 reg[1] >>= reg[2]
0x23 1 reg[1] <<= reg[2]
0x30 1 reg[1] |= reg[2]
0x31 1 reg[1] &= reg[2]
0x32 2 reg[3] = (byte)data
0x33 1 reg[4] = reg[1]
0x34 2 reg[2] = (byte)data
0x35 1 reg[5] = reg[1]
0x37 1 reg[1] = reg[5]
0x38 1 reg[1] ^= reg[4]
0x39 1 reg[1] ^= reg[5]
0x41 1 reg[1] += reg[2]
0x42 1 reg[1] -= reg[4]
0x43 1 reg[1] *= reg[3]
0x44 1 reg[1] /= reg[5]
0x53 2 putchar(*(char *)reg[3])
0x54 2 getchar(reg[3])
0x71 5 reg[6] = (DWORD)data
0x76 5 reg[3] = *(DWORD*)reg[6];*(DWORD*)reg[6]=0;reg[6]+=4
0x77 1 reg[1] ^= reg[9]
0x80 6 reg[sub_804875F(reg, 1)] = *(_DWORD *)(reg[8] + 2);
0x99 1 break
0xa0 1 reg[1]!=0x6FEBF967 exit
0xa1 1 read(flag)
0xa4 4 table[(byte)data]=reg[1]
0xb1 1 reg[9] = table[0]
0xb2 1 reg[9] = table[1]
0xb3 1 reg[9] = table[2]
0xb4 1 reg[9] = table[3]
0xc1 2 reg[1] = flag[(byte)data]
0xc2 5 reg[1] != (byte)data exit
0xc7 1 reg[1] != table2[0] exit
0xc8 1 reg[1] != table2[1] exit
0xf7 1 reg[9] += reg[1]
0xfe 1 reg[1] = reg[9]

3.输出对应的操作流程

code = [0xA1,0xC1,0x00,0xB1,0x77,0xC2,0x4A,0x01,0x00,0x00,0xC1,0x01,0xB2,0x77,0xC2,0x19,
0x01,0x00,0x00,0xC1,0x02,0xB4,0x77,0xC2,0xDD,0x01,0x00,0x00,0xC1,0x03,0xB3,0x77,
0xC2,0x0F,0x01,0x00,0x00,0xC1,0x04,0xB2,0x77,0xC2,0x1B,0x01,0x00,0x00,0xC1,0x05,
0xB4,0x77,0xC2,0x89,0x01,0x00,0x00,0xC1,0x06,0xB1,0x77,0xC2,0x19,0x01,0x00,0x00,
0xC1,0x07,0xB3,0x77,0xC2,0x54,0x01,0x00,0x00,0xC1,0x08,0xB1,0x77,0xC2,0x4F,0x01,
0x00,0x00,0xC1,0x09,0xB1,0x77,0xC2,0x4E,0x01,0x00,0x00,0xC1,0x0A,0xB3,0x77,0xC2,
0x55,0x01,0x00,0x00,0xC1,0x0B,0xB3,0x77,0xC2,0x56,0x01,0x00,0x00,0xC1,0x0C,0xB4,
0x77,0xC2,0x8E,0x00,0x00,0x00,0xC1,0x0D,0xB2,0x77,0xC2,0x49,0x00,0x00,0x00,0xC1,
0x0E,0xB3,0x77,0xC2,0x0E,0x01,0x00,0x00,0xC1,0x0F,0xB1,0x77,0xC2,0x4B,0x01,0x00,
0x00,0xC1,0x10,0xB3,0x77,0xC2,0x06,0x01,0x00,0x00,0xC1,0x11,0xB3,0x77,0xC2,0x54,
0x01,0x00,0x00,0xC1,0x12,0xB2,0x77,0xC2,0x1A,0x00,0x00,0x00,0xC1,0x13,0xB1,0x77,
0xC2,0x42,0x01,0x00,0x00,0xC1,0x14,0xB3,0x77,0xC2,0x53,0x01,0x00,0x00,0xC1,0x15,
0xB1,0x77,0xC2,0x1F,0x01,0x00,0x00,0xC1,0x16,0xB3,0x77,0xC2,0x52,0x01,0x00,0x00,
0xC1,0x17,0xB4,0x77,0xC2,0xDB,0x00,0x00,0x00,0xC1,0x18,0xB1,0x77,0xC2,0x19,0x01,
0x00,0x00,0xC1,0x19,0xB4,0x77,0xC2,0xD9,0x00,0x00,0x00,0xC1,0x1A,0xB1,0x77,0xC2,
0x19,0x01,0x00,0x00,0xC1,0x1B,0xB3,0x77,0xC2,0x55,0x01,0x00,0x00,0xC1,0x1C,0xB2,
0x77,0xC2,0x19,0x00,0x00,0x00,0xC1,0x1D,0xB3,0x77,0xC2,0x00,0x01,0x00,0x00,0xC1,
0x1E,0xB1,0x77,0xC2,0x4B,0x01,0x00,0x00,0xC1,0x1F,0xB2,0x77,0xC2,0x1E,0x00,0x00,
0x00,0xC1,0x20,0x80,0x02,0x18,0x00,0x00,0x00,0x23,0x10,0xC1,0x21,0x80,0x02,0x10,
0x00,0x00,0x00,0x23,0xF7,0xC1,0x22,0x80,0x02,0x08,0x00,0x00,0x00,0x23,0xF7,0xC1,
0x23,0xF7,0xFE,0x80,0x02,0x05,0x00,0x00,0x00,0x22,0x77,0x10,0x80,0x02,0x07,0x00,
0x00,0x00,0x23,0x80,0x02,0x23,0x77,0xF1,0x98,0x31,0x77,0x10,0x80,0x02,0x18,0x00,
0x00,0x00,0x23,0x80,0x02,0x20,0xB9,0xE4,0x35,0x31,0x77,0x10,0x80,0x02,0x12,0x00,
0x00,0x00,0x22,0x77,0xA0,0xC1,0x24,0x80,0x02,0x18,0x00,0x00,0x00,0x23,0x10,0xC1,
0x25,0x80,0x02,0x10,0x00,0x00,0x00,0x23,0xF7,0xC1,0x26,0x80,0x02,0x08,0x00,0x00,
0x00,0x23,0xF7,0xC1,0x27,0xF7,0xFE,0x32,0x20,0x43,0x33,0x77,0x80,0x02,0x11,0x00,
0x00,0x00,0x22,0x35,0x37,0x38,0x77,0x80,0x02,0x0D,0x00,0x00,0x00,0x23,0x77,0x38,
0x39,0x10,0x32,0x20,0x43,0x33,0x77,0x80,0x02,0x11,0x00,0x00,0x00,0x22,0x35,0x37,
0x38,0x77,0x80,0x02,0x0D,0x00,0x00,0x00,0x23,0x77,0x38,0x39,0xC7,0xC1,0x28,0x80,
0x02,0x18,0x00,0x00,0x00,0x23,0x10,0xC1,0x29,0x80,0x02,0x10,0x00,0x00,0x00,0x23,
0xF7,0xC1,0x2A,0x80,0x02,0x08,0x00,0x00,0x00,0x23,0xF7,0xC1,0x2B,0xF7,0xFE,0x32,
0x20,0x43,0x33,0x77,0x80,0x02,0x11,0x00,0x00,0x00,0x22,0x35,0x37,0x38,0x77,0x80,
0x02,0x0D,0x00,0x00,0x00,0x23,0x77,0x38,0x39,0x10,0x32,0x20,0x43,0x33,0x77,0x80,
0x02,0x11,0x00,0x00,0x00,0x22,0x35,0x37,0x38,0x77,0x80,0x02,0x0D,0x00,0x00,0x00,
0x23,0x77,0x38,0x39,0xC8,0x99]
table = [0x7b,0x2f,0x37,0xe8]
table2 = [0x0CF1304DC,0x283B8E84]
codeLen = {
    0x9:1,0x10:1,0x11:1,0x22:1,
    0x23:1,0x30:1,0x31:1,0x32:2,
    0x33:1,0x34:2,0x35:1,0x37:1,
    0x38:1,0x39:1,0x41:1,0x42:1,
    0x43:1,0x44:1,0x53:2,0x54:2,
    0x71:5,0x76:5,0x77:1,0x80:6,
    0x99:1,0xa0:1,0xa1:1,0xa4:4,
    0xb1:1,0xb2:1,0xb3:1,0xb4:1,
    0xc1:2,0xc2:5,0xc7:1,0xc8:1,
    0xf7:1,0xfe:1
}
codeName = {
    0x9: "reg[1] = 0x6FEBF967",
    0x10:"reg[9] = reg[1]",
    0x11:"printf(%x,reg[1])",
    0x22:"reg[1] >>= reg[2]",
    0x23:"reg[1] <<= reg[2]",
    0x30:"reg[1] |= reg[2]",
    0x31:"reg[1] &= reg[2]",
    0x32:"reg[3] = {}",
    0x33:"reg[4] = reg[1]",
    0x34:"reg[2] = {}",
    0x35:"reg[5] = reg[1]",
    0x37:"reg[1] = reg[5]",
    0x38:"reg[1] ^= reg[4]",
    0x39:"reg[1] ^= reg[5]",
    0x41:"reg[1] += reg[2]",
    0x42:"reg[1] -= reg[4]",
    0x43:"reg[1] *= reg[3]",
    0x44:"reg[1] /= reg[5]",
    0x53:"putchar(*(char *)reg[3])",
    0x54:"getchar(reg[3])",
    0x71:"reg[6] = (DWORD)data",
    0x76:"reg[3] = *(DWORD*)reg[6];*(DWORD*)reg[6]=0;reg[6]+=4",
    0x77:"reg[1] ^= reg[9]",
    0x80:"reg[{}] = {};",#reg[code[idx+1]]=(DWORD)code[idx+2]
    0x99:"break",
    0xa0:"reg[1]!=0x6FEBF967 exit",
    0xa1:"read(flag)",
    0xa4:"table[{}]=reg[1]",
    0xb1:"reg[9] = table[0]",
    0xb2:"reg[9] = table[1]",
    0xb3:"reg[9] = table[2]",
    0xb4:"reg[9] = table[3]",
    0xc1:"reg[1] = flag[{}]",
    0xc2:"reg[1] != {} exit",
    0xc7:"reg[1] != table2[0] exit",
    0xc8:"reg[1] != table2[1] exit",
    0xf7:"reg[9] += reg[1]",
    0xfe:"reg[1] = reg[9]"
}
idx = 0
line = 0;
while idx<len(code):
    if code[idx] == 0x32 or code[idx] == 0x34 or code[idx] == 0xa4 or code[idx] == 0xc1 or code[idx] == 0xc2:
        print("line{0}  :".format(line),end="")
        print(codeName[code[idx]].format(hex(code[idx+1])))
        idx+=codeLen[code[idx]]
        line += 1
        continue
    if code[idx] == 0xb1 or code[idx] == 0xb2 or code[idx] == 0xb3 or code[idx] == 0xb4:
        print("line{0}  :".format(line),end="")
        print(codeName[code[idx]]," | :",hex(table[code[idx]-0xb1]))
        idx+=codeLen[code[idx]]
        line += 1
        continue
    if code[idx] == 0x80:
        print("line{0}  :".format(line),end="")
        dword = hex(code[idx+2]|(code[idx+3]<<0x8)|(code[idx+4]<<0x10)|(code[idx+5]<<0x18))
        print(codeName[code[idx]].format(code[idx+1],dword))
        idx+=codeLen[code[idx]]
        line += 1
        continue
    if code[idx] == 0x71:
        print("line{}  :".format(line),end="")
        print(codeName[code[idx]]," | (DWORD)data:",hex(code[idx+1]),hex(code[idx+2]),hex(code[idx+3]),hex(code[idx+4]))
        idx+=codeLen[code[idx]]
        line += 1
        continue
    print("line{}  :".format(line),end="")
    print(codeName[code[idx]])
    line += 1
    idx+=codeLen[code[idx]]

4.运行得到操作流程

第一部分：32个字节异或得到
第二部分：4字节，各种运行算之后与0x6FEBF967比较
第三部分：4字节，各种运算与之后与0x0CF1304DC比较
第四部分：4字节，各种运算与之后与0x283B8E84比较

line0  :read(flag)
line1  :reg[1] = flag[0x0]
line2  :reg[9] = table[0]  | : 0x7b
line3  :reg[1] ^= reg[9]
line4  :reg[1] != 0x4a exit
line5  :reg[1] = flag[0x1]
line6  :reg[9] = table[1]  | : 0x2f
line7  :reg[1] ^= reg[9]
line8  :reg[1] != 0x19 exit
line9  :reg[1] = flag[0x2]
line10  :reg[9] = table[3]  | : 0xe8
line11  :reg[1] ^= reg[9]
line12  :reg[1] != 0xdd exit
line13  :reg[1] = flag[0x3]
line14  :reg[9] = table[2]  | : 0x37
line15  :reg[1] ^= reg[9]
line16  :reg[1] != 0xf exit
line17  :reg[1] = flag[0x4]
line18  :reg[9] = table[1]  | : 0x2f
line19  :reg[1] ^= reg[9]
line20  :reg[1] != 0x1b exit
line21  :reg[1] = flag[0x5]
line22  :reg[9] = table[3]  | : 0xe8
line23  :reg[1] ^= reg[9]
line24  :reg[1] != 0x89 exit
line25  :reg[1] = flag[0x6]
line26  :reg[9] = table[0]  | : 0x7b
line27  :reg[1] ^= reg[9]
line28  :reg[1] != 0x19 exit
line29  :reg[1] = flag[0x7]
line30  :reg[9] = table[2]  | : 0x37
line31  :reg[1] ^= reg[9]
line32  :reg[1] != 0x54 exit
line33  :reg[1] = flag[0x8]
line34  :reg[9] = table[0]  | : 0x7b
line35  :reg[1] ^= reg[9]
line36  :reg[1] != 0x4f exit
line37  :reg[1] = flag[0x9]
line38  :reg[9] = table[0]  | : 0x7b
line39  :reg[1] ^= reg[9]
line40  :reg[1] != 0x4e exit
line41  :reg[1] = flag[0xa]
line42  :reg[9] = table[2]  | : 0x37
line43  :reg[1] ^= reg[9]
line44  :reg[1] != 0x55 exit
line45  :reg[1] = flag[0xb]
line46  :reg[9] = table[2]  | : 0x37
line47  :reg[1] ^= reg[9]
line48  :reg[1] != 0x56 exit
line49  :reg[1] = flag[0xc]
line50  :reg[9] = table[3]  | : 0xe8
line51  :reg[1] ^= reg[9]
line52  :reg[1] != 0x8e exit
line53  :reg[1] = flag[0xd]
line54  :reg[9] = table[1]  | : 0x2f
line55  :reg[1] ^= reg[9]
line56  :reg[1] != 0x49 exit
line57  :reg[1] = flag[0xe]
line58  :reg[9] = table[2]  | : 0x37
line59  :reg[1] ^= reg[9]
line60  :reg[1] != 0xe exit
line61  :reg[1] = flag[0xf]
line62  :reg[9] = table[0]  | : 0x7b
line63  :reg[1] ^= reg[9]
line64  :reg[1] != 0x4b exit
line65  :reg[1] = flag[0x10]
line66  :reg[9] = table[2]  | : 0x37
line67  :reg[1] ^= reg[9]
line68  :reg[1] != 0x6 exit
line69  :reg[1] = flag[0x11]
line70  :reg[9] = table[2]  | : 0x37
line71  :reg[1] ^= reg[9]
line72  :reg[1] != 0x54 exit
line73  :reg[1] = flag[0x12]
line74  :reg[9] = table[1]  | : 0x2f
line75  :reg[1] ^= reg[9]
line76  :reg[1] != 0x1a exit
line77  :reg[1] = flag[0x13]
line78  :reg[9] = table[0]  | : 0x7b
line79  :reg[1] ^= reg[9]
line80  :reg[1] != 0x42 exit
line81  :reg[1] = flag[0x14]
line82  :reg[9] = table[2]  | : 0x37
line83  :reg[1] ^= reg[9]
line84  :reg[1] != 0x53 exit
line85  :reg[1] = flag[0x15]
line86  :reg[9] = table[0]  | : 0x7b
line87  :reg[1] ^= reg[9]
line88  :reg[1] != 0x1f exit
line89  :reg[1] = flag[0x16]
line90  :reg[9] = table[2]  | : 0x37
line91  :reg[1] ^= reg[9]
line92  :reg[1] != 0x52 exit
line93  :reg[1] = flag[0x17]
line94  :reg[9] = table[3]  | : 0xe8
line95  :reg[1] ^= reg[9]
line96  :reg[1] != 0xdb exit
line97  :reg[1] = flag[0x18]
line98  :reg[9] = table[0]  | : 0x7b
line99  :reg[1] ^= reg[9]
line100  :reg[1] != 0x19 exit
line101  :reg[1] = flag[0x19]
line102  :reg[9] = table[3]  | : 0xe8
line103  :reg[1] ^= reg[9]
line104  :reg[1] != 0xd9 exit
line105  :reg[1] = flag[0x1a]
line106  :reg[9] = table[0]  | : 0x7b
line107  :reg[1] ^= reg[9]
line108  :reg[1] != 0x19 exit
line109  :reg[1] = flag[0x1b]
line110  :reg[9] = table[2]  | : 0x37
line111  :reg[1] ^= reg[9]
line112  :reg[1] != 0x55 exit
line113  :reg[1] = flag[0x1c]
line114  :reg[9] = table[1]  | : 0x2f
line115  :reg[1] ^= reg[9]
line116  :reg[1] != 0x19 exit
line117  :reg[1] = flag[0x1d]
line118  :reg[9] = table[2]  | : 0x37
line119  :reg[1] ^= reg[9]
line120  :reg[1] != 0x0 exit
line121  :reg[1] = flag[0x1e]
line122  :reg[9] = table[0]  | : 0x7b
line123  :reg[1] ^= reg[9]
line124  :reg[1] != 0x4b exit
line125  :reg[1] = flag[0x1f]
line126  :reg[9] = table[1]  | : 0x2f
line127  :reg[1] ^= reg[9]
line128  :reg[1] != 0x1e exit

line129  :reg[1] = flag[0x20]
line130  :reg[2] = 0x18;
line131  :reg[1] <<= reg[2]
line132  :reg[9] = reg[1]
line133  :reg[1] = flag[0x21]
line134  :reg[2] = 0x10;
line135  :reg[1] <<= reg[2]
line136  :reg[9] += reg[1]
line137  :reg[1] = flag[0x22]
line138  :reg[2] = 0x8;
line139  :reg[1] <<= reg[2]
line140  :reg[9] += reg[1]
line141  :reg[1] = flag[0x23]
line142  :reg[9] += reg[1]
line143  :reg[1] = reg[9]

line144  :reg[2] = 0x5;
line145  :reg[1] >>= reg[2]
line146  :reg[1] ^= reg[9]
line147  :reg[9] = reg[1]
line148  :reg[2] = 0x7;
line149  :reg[1] <<= reg[2]
line150  :reg[2] = 0x98f17723;
line151  :reg[1] &= reg[2]
line152  :reg[1] ^= reg[9]
line153  :reg[9] = reg[1]
line154  :reg[2] = 0x18;
line155  :reg[1] <<= reg[2]
line156  :reg[2] = 0x35e4b920;
line157  :reg[1] &= reg[2]
line158  :reg[1] ^= reg[9]
line159  :reg[9] = reg[1]
line160  :reg[2] = 0x12;
line161  :reg[1] >>= reg[2]
line162  :reg[1] ^= reg[9]
line163  :reg[1]!=0x6FEBF967 exit


line164  :reg[1] = flag[0x24]
line165  :reg[2] = 0x18;
line166  :reg[1] <<= reg[2]
line167  :reg[9] = reg[1]
line168  :reg[1] = flag[0x25]
line169  :reg[2] = 0x10;
line170  :reg[1] <<= reg[2]
line171  :reg[9] += reg[1]
line172  :reg[1] = flag[0x26]
line173  :reg[2] = 0x8;
line174  :reg[1] <<= reg[2]
line175  :reg[9] += reg[1]
line176  :reg[1] = flag[0x27]
line177  :reg[9] += reg[1]
line178  :reg[1] = reg[9]

line179  :reg[3] = 0x20
line180  :reg[1] *= reg[3]
line181  :reg[4] = reg[1]
line182  :reg[1] ^= reg[9]
line183  :reg[2] = 0x11;
line184  :reg[1] >>= reg[2]
line185  :reg[5] = reg[1]
line186  :reg[1] = reg[5]
line187  :reg[1] ^= reg[4]
line188  :reg[1] ^= reg[9]
line189  :reg[2] = 0xd;
line190  :reg[1] <<= reg[2]
line191  :reg[1] ^= reg[9]
line192  :reg[1] ^= reg[4]
line193  :reg[1] ^= reg[5]
line194  :reg[9] = reg[1]
line195  :reg[3] = 0x20
line196  :reg[1] *= reg[3]
line197  :reg[4] = reg[1]
line198  :reg[1] ^= reg[9]
line199  :reg[2] = 0x11;
line200  :reg[1] >>= reg[2]
line201  :reg[5] = reg[1]
line202  :reg[1] = reg[5]
line203  :reg[1] ^= reg[4]
line204  :reg[1] ^= reg[9]
line205  :reg[2] = 0xd;
line206  :reg[1] <<= reg[2]
line207  :reg[1] ^= reg[9]
line208  :reg[1] ^= reg[4]
line209  :reg[1] ^= reg[5]
line210  :reg[1] != table2[0] exit

line211  :reg[1] = flag[0x28]
line212  :reg[2] = 0x18;
line213  :reg[1] <<= reg[2]
line214  :reg[9] = reg[1]
line215  :reg[1] = flag[0x29]
line216  :reg[2] = 0x10;
line217  :reg[1] <<= reg[2]
line218  :reg[9] += reg[1]
line219  :reg[1] = flag[0x2a]
line220  :reg[2] = 0x8;
line221  :reg[1] <<= reg[2]
line222  :reg[9] += reg[1]
line223  :reg[1] = flag[0x2b]
line224  :reg[9] += reg[1]
line225  :reg[1] = reg[9]

line226  :reg[3] = 0x20
line227  :reg[1] *= reg[3]
line228  :reg[4] = reg[1]
line229  :reg[1] ^= reg[9]
line230  :reg[2] = 0x11;
line231  :reg[1] >>= reg[2]
line232  :reg[5] = reg[1]
line233  :reg[1] = reg[5]
line234  :reg[1] ^= reg[4]
line235  :reg[1] ^= reg[9]
line236  :reg[2] = 0xd;
line237  :reg[1] <<= reg[2]
line238  :reg[1] ^= reg[9]
line239  :reg[1] ^= reg[4]
line240  :reg[1] ^= reg[5]
line241  :reg[9] = reg[1]
line242  :reg[3] = 0x20
line243  :reg[1] *= reg[3]
line244  :reg[4] = reg[1]
line245  :reg[1] ^= reg[9]
line246  :reg[2] = 0x11;
line247  :reg[1] >>= reg[2]
line248  :reg[5] = reg[1]
line249  :reg[1] = reg[5]
line250  :reg[1] ^= reg[4]
line251  :reg[1] ^= reg[9]
line252  :reg[2] = 0xd;
line253  :reg[1] <<= reg[2]
line254  :reg[1] ^= reg[9]
line255  :reg[1] ^= reg[4]
line256  :reg[1] ^= reg[5]
line257  :reg[1] != table2[1] exit
line258  :break

5.爆破得到flag

第二部分爆破，直接将上面的操作复制下来，爆破。第三，四部分也一样。最后得到
flag:16584abc45baff901c59dde3b1bb6701a254b06cdc23

#include "stdio.h"

int main() {
    for (int i = 0; i < 0xffffffff; i++) {
        unsigned int reg[10] = { 0 };
        reg[1] = i;//初始化
        reg[9] = i;//初始化
        reg[2] = 0x5;
        reg[1] >>= reg[2];
        reg[1] ^= reg[9];
        reg[9] = reg[1];
        reg[2] = 0x7;
        reg[1] <<= reg[2];
        reg[2] = 0x98f17723;
        reg[1] &= reg[2];
        reg[1] ^= reg[9];
        reg[9] = reg[1];
        reg[2] = 0x18;
        reg[1] <<= reg[2];
        reg[2] = 0x35e4b920;
        reg[1] &= reg[2];
        reg[1] ^= reg[9];
        reg[9] = reg[1];
        reg[2] = 0x12;
        reg[1] >>= reg[2];
        reg[1] ^= reg[9];
        if (reg[1] == 0x6FEBF967) {
            printf("%x\n", i);
        }
    }
}

总结

vm的题目，
1.需要找到dispatch
2.找到opcode对应的操作
3.找到所有的code
4.输出所有的运行过程

这个流程有点像trace，如果很复杂会很麻烦的。不知道有没有什么更好的办法。如果能够解决vm的办法，大师傅教教我

努力学习的大康

关注

1
点赞
踩
0

收藏

觉得还不错? 一键收藏
0
评论
2021 羊城杯 EasyVM

正好学习一下vm的题目怎么分析1.简单分析主函数1.初始化标准输入输出和错误2.设置VMcontext3.xxtea自解密dispatch代码4.进入dispatch执行2.解决smc问题在自解密结束位置下断点，并将内容dump下来.dump脚本start = 0x80487A8for idx in range(0x1000): if idx%16 == 0: print("") print(hex(get_wide_byte(start+idx)),end=',
复制链接

扫一扫

专栏目录