正好学习一下vm的题目怎么分析
1.简单分析
主函数
1.初始化标准输入输出和错误
2.设置VMcontext
3.xxtea自解密dispatch代码
4.进入dispatch执行
2.解决smc问题
在自解密结束位置下断点,并将内容dump下来.
dump脚本
start = 0x80487A8
for idx in range(0x1000):
if idx%16 == 0:
print("")
print(hex(get_wide_byte(start+idx)),end=',')
修复内容并保存
start = 0x80487A8
a = [0x55,0x89,0xe5,0x53,0x83,0xec,0x34,0x8b,0x45,0x8,0x89,
0x45,0xd4,0x65,0xa1,0x14,0x0,0x0,0x0,0x89,0x45,0xf4,0x31,
0xc0,0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x71,
0x75,0x2f,0x8b,0x45,0xd4,0x8b,0x40,0x18,0x8d,0x50,0xfc,
0x8b,0x45,0xd4,0x89,0x50,0x18,0x8b,0x45,0xd4,0x8b,0x40,
0x18,0x8b,0x55,0xd4,0x8b,0x52,0x20,0x8b,0x52,0x1,0x89,
0x10,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,0x5,0x8b,
0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,0x20,
0xf,0xb6,0x0,0x3c,0x41,0x75,0x23,0x8b,0x45,0xd4,0x8b,
0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x8,0x1,0xc2,0x8b,0x45,
0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,
0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,
0x20,0xf,0xb6,0x0,0x3c,0x42,0x75,0x23,0x8b,0x45,0xd4,0x8b,
0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x10,0x29,0xc2,0x8b,0x45,
0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,
0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,
0x20,0xf,0xb6,0x0,0x3c,0x43,0x75,0x24,0x8b,0x45,0xd4,0x8b,
0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0xc,0xf,0xaf,0xd0,0x8b,
0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,
0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,
0x40,0x20,0xf,0xb6,0x0,0x3c,0x37,0x75,0x1b,0x8b,0x45,0xd4,
0x8b,0x50,0x14,0x8b,0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,
0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,
0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x38,0x75,
0x23,0x8b,0x45,0xd4,0x8b,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,
0x10,0x31,0xc2,0x8b,0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,
0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,
0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x39,0x75,
0x23,0x8b,0x45,0xd4,0x8b,0x50,0x4,0x8b,0x45,0xd4,0x8b,0x40,
0x14,0x31,0xc2,0x8b,0x45,0xd4,0x89,0x50,0x4,0x8b,0x45,0xd4,
0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,0xd4,0x89,0x50,0x20,
0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,0x0,0x3c,0x35,0x75,
0x1b,0x8b,0x45,0xd4,0x8b,0x50,0x4,0x8b,0x45,0xd4,0x89,0x50,
0x14,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,
0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,
0x0,0x3c,0xf7,0x75,0x23,0x8b,0x45,0xd4,0x8b,0x50,0x24,0x8b,
0x45,0xd4,0x8b,0x40,0x4,0x1,0xc2,0x8b,0x45,0xd4,0x89,0x50,
0x24,0x8b,0x45,0xd4,0x8b,0x40,0x20,0x8d,0x50,0x1,0x8b,0x45,
0xd4,0x89,0x50,0x20,0x8b,0x45,0xd4,0x8b,0x40,0x20,0xf,0xb6,
0x0,0x3c,0x44,0x75,0x2a,0x8b,0x45,0xd4,0x8b,0x40,0x4,0x8b,
0x55,0xd4,0x8b,0x5a,0x14,0xba,0x0,0x0,0x0,0x0,0xf7,0xf3,0x89,0xc2]
for i in range(len(a)):
ida_bytes.patch_byte(start+i, a[i])
修复完成之后可以看出dispatch
2.提取opcode
第一列是操作码,第二列是opcode数量,第三列是对应的操作
table[4] = [0x7b,0x2f,0x37,0xe8]
table2[2] = [0x0CF1304DC,0x283B8E84]
0x9 1 reg[1] = 0x6FEBF967
0x10 1 reg[9] = reg[1]
0x11 1 printf(%x,reg[1])
0x22 1 reg[1] >>= reg[2]
0x23 1 reg[1] <<= reg[2]
0x30 1 reg[1] |= reg[2]
0x31 1 reg[1] &= reg[2]
0x32 2 reg[3] = (byte)data
0x33 1 reg[4] = reg[1]
0x34 2 reg[2] = (byte)data
0x35 1 reg[5] = reg[1]
0x37 1 reg[1] = reg[5]
0x38 1 reg[1] ^= reg[4]
0x39 1 reg[1] ^= reg[5]
0x41 1 reg[1] += reg[2]
0x42 1 reg[1] -= reg[4]
0x43 1 reg[1] *= reg[3]
0x44 1 reg[1] /= reg[5]
0x53 2 putchar(*(char *)reg[3])
0x54 2 getchar(reg[3])
0x71 5 reg[6] = (DWORD)data
0x76 5 reg[3] = *(DWORD*)reg[6];*(DWORD*)reg[6]=0;reg[6]+=4
0x77 1 reg[1] ^= reg[9]
0x80 6 reg[sub_804875F(reg, 1)] = *(_DWORD *)(reg[8] + 2);
0x99 1 break
0xa0 1 reg[1]!=0x6FEBF967 exit
0xa1 1 read(flag)
0xa4 4 table[(byte)data]=reg[1]
0xb1 1 reg[9] = table[0]
0xb2 1 reg[9] = table[1]
0xb3 1 reg[9] = table[2]
0xb4 1 reg[9] = table[3]
0xc1 2 reg[1] = flag[(byte)data]
0xc2 5 reg[1] != (byte)data exit
0xc7 1 reg[1] != table2[0] exit
0xc8 1 reg[1] != table2[1] exit
0xf7 1 reg[9] += reg[1]
0xfe 1 reg[1] = reg[9]
3.输出对应的操作流程
code = [0xA1,0xC1,0x00,0xB1,0x77,0xC2,0x4A,0x01,0x00,0x00,0xC1,0x01,0xB2,0x77,0xC2,0x19,
0x01,0x00,0x00,0xC1,0x02,0xB4,0x77,0xC2,0xDD,0x01,0x00,0x00,0xC1,0x03,0xB3,0x77,
0xC2,0x0F,0x01,0x00,0x00,0xC1,0x04,0xB2,0x77,0xC2,0x1B,0x01,0x00,0x00,0xC1,0x05,
0xB4,0x77,0xC2,0x89,0x01,0x00,0x00,0xC1,0x06,0xB1,0x77,0xC2,0x19,0x01,0x00,0x00,
0xC1,0x07,0xB3,0x77,0xC2,0x54,0x01,0x00,0x00,0xC1,0x08,0xB1,0x77,0xC2,0x4F,0x01,
0x00,0x00,0xC1,0x09,0xB1,0x77,0xC2,0x4E,0x01,0x00,0x00,0xC1,0x0A,0xB3,0x77,0xC2,
0x55,0x01,0x00,0x00,0xC1,0x0B,0xB3,0x77,0xC2,0x56,0x01,0x00,0x00,0xC1,0x0C,0xB4,
0x77,0xC2,0x8E,0x00,0x00,0x00,0xC1,0x0D,0xB2,0x77,0xC2,0x49,0x00,0x00,0x00,0xC1,
0x0E,0xB3,0x77,0xC2,0x0E,0x01,0x00,0x00,0xC1,0x0F,0xB1,0x77,0xC2,0x4B,0x01,0x00,
0x00,0xC1,0x10,0xB3,0x77,0xC2,0x06,0x01,0x00,0x00,0xC1,0x11,0xB3,0x77,0xC2,0x54,
0x01,0x00,0x00,0xC1,0x12,0xB2,0x77,0xC2,0x1A,0x00,0x00,0x00,0xC1,0x13,0xB1,0x77,
0xC2,0x42,0x01,0x00,0x00,0xC1,0x14,0xB3,0x77,0xC2,0x53,0x01,0x00,0x00,0xC1,0x15,
0xB1,0x77,0xC2,0x1F,0x01,0x00,0x00,0xC1,0x16,0xB3,0x77,0xC2,0x52,0x01,0x00,0x00,
0xC1,0x17,0xB4,0x77,0xC2,0xDB,0x00,0x00,0x00,0xC1,0x18,0xB1,0x77,0xC2,0x19,0x01,
0x00,0x00,0xC1,0x19,0xB4,0x77,0xC2,0xD9,0x00,0x00,0x00,0xC1,0x1A,0xB1,0x77,0xC2,
0x19,0x01,0x00,0x00,0xC1,0x1B,0xB3,0x77,0xC2,0x55,0x01,0x00,0x00,0xC1,0x1C,0xB2,
0x77,0xC2,0x19,0x00,0x00,0x00,0xC1,0x1D,0xB3,0x77,0xC2,0x00,0x01,0x00,0x00,0xC1,
0x1E,0xB1,0x77,0xC2,0x4B,0x01,0x00,0x00,0xC1,0x1F,0xB2,0x77,0xC2,0x1E,0x00,0x00,
0x00,0xC1,0x20,0x80,0x02,0x18,0x00,0x00,0x00,0x23,0x10,0xC1,0x21,0x80,0x02,0x10,
0x00,0x00,0x00,0x23,0xF7,0xC1,0x22,0x80,0x02,0x08,0x00,0x00,0x00,0x23,0xF7,0xC1,
0x23,0xF7,0xFE,0x80,0x02,0x05,0x00,0x00,0x00,0x22,0x77,0x10,0x80,0x02,0x07,0x00,
0x00,0x00,0x23,0x80,0x02,0x23,0x77,0xF1,0x98,0x31,0x77,0x10,0x80,0x02,0x18,0x00,
0x00,0x00,0x23,0x80,0x02,0x20,0xB9,0xE4,0x35,0x31,0x77,0x10,0x80,0x02,0x12,0x00,
0x00,0x00,0x22,0x77,0xA0,0xC1,0x24,0x80,0x02,0x18,0x00,0x00,0x00,0x23,0x10,0xC1,
0x25,0x80,0x02,0x10,0x00,0x00,0x00,0x23,0xF7,0xC1,0x26,0x80,0x02,0x08,0x00,0x00,
0x00,0x23,0xF7,0xC1,0x27,0xF7,0xFE,0x32,0x20,0x43,0x33,0x77,0x80,0x02,0x11,0x00,
0x00,0x00,0x22,0x35,0x37,0x38,0x77,0x80,0x02,0x0D,0x00,0x00,0x00,0x23,0x77,0x38,
0x39,0x10,0x32,0x20,0x43,0x33,0x77,0x80,0x02,0x11,0x00,0x00,0x00,0x22,0x35,0x37,
0x38,0x77,0x80,0x02,0x0D,0x00,0x00,0x00,0x23,0x77,0x38,0x39,0xC7,0xC1,0x28,0x80,
0x02,0x18,0x00,0x00,0x00,0x23,0x10,0xC1,0x29,0x80,0x02,0x10,0x00,0x00,0x00,0x23,
0xF7,0xC1,0x2A,0x80,0x02,0x08,0x00,0x00,0x00,0x23,0xF7,0xC1,0x2B,0xF7,0xFE,0x32,
0x20,0x43,0x33,0x77,0x80,0x02,0x11,0x00,0x00,0x00,0x22,0x35,0x37,0x38,0x77,0x80,
0x02,0x0D,0x00,0x00,0x00,0x23,0x77,0x38,0x39,0x10,0x32,0x20,0x43,0x33,0x77,0x80,
0x02,0x11,0x00,0x00,0x00,0x22,0x35,0x37,0x38,0x77,0x80,0x02,0x0D,0x00,0x00,0x00,
0x23,0x77,0x38,0x39,0xC8,0x99]
table = [0x7b,0x2f,0x37,0xe8]
table2 = [0x0CF1304DC,0x283B8E84]
codeLen = {
0x9:1,0x10:1,0x11:1,0x22:1,
0x23:1,0x30:1,0x31:1,0x32:2,
0x33:1,0x34:2,0x35:1,0x37:1,
0x38:1,0x39:1,0x41:1,0x42:1,
0x43:1,0x44:1,0x53:2,0x54:2,
0x71:5,0x76:5,0x77:1,0x80:6,
0x99:1,0xa0:1,0xa1:1,0xa4:4,
0xb1:1,0xb2:1,0xb3:1,0xb4:1,
0xc1:2,0xc2:5,0xc7:1,0xc8:1,
0xf7:1,0xfe:1
}
codeName = {
0x9: "reg[1] = 0x6FEBF967",
0x10:"reg[9] = reg[1]",
0x11:"printf(%x,reg[1])",
0x22:"reg[1] >>= reg[2]",
0x23:"reg[1] <<= reg[2]",
0x30:"reg[1] |= reg[2]",
0x31:"reg[1] &= reg[2]",
0x32:"reg[3] = {}",
0x33:"reg[4] = reg[1]",
0x34:"reg[2] = {}",
0x35:"reg[5] = reg[1]",
0x37:"reg[1] = reg[5]",
0x38:"reg[1] ^= reg[4]",
0x39:"reg[1] ^= reg[5]",
0x41:"reg[1] += reg[2]",
0x42:"reg[1] -= reg[4]",
0x43:"reg[1] *= reg[3]",
0x44:"reg[1] /= reg[5]",
0x53:"putchar(*(char *)reg[3])",
0x54:"getchar(reg[3])",
0x71:"reg[6] = (DWORD)data",
0x76:"reg[3] = *(DWORD*)reg[6];*(DWORD*)reg[6]=0;reg[6]+=4",
0x77:"reg[1] ^= reg[9]",
0x80:"reg[{}] = {};",#reg[code[idx+1]]=(DWORD)code[idx+2]
0x99:"break",
0xa0:"reg[1]!=0x6FEBF967 exit",
0xa1:"read(flag)",
0xa4:"table[{}]=reg[1]",
0xb1:"reg[9] = table[0]",
0xb2:"reg[9] = table[1]",
0xb3:"reg[9] = table[2]",
0xb4:"reg[9] = table[3]",
0xc1:"reg[1] = flag[{}]",
0xc2:"reg[1] != {} exit",
0xc7:"reg[1] != table2[0] exit",
0xc8:"reg[1] != table2[1] exit",
0xf7:"reg[9] += reg[1]",
0xfe:"reg[1] = reg[9]"
}
idx = 0
line = 0;
while idx<len(code):
if code[idx] == 0x32 or code[idx] == 0x34 or code[idx] == 0xa4 or code[idx] == 0xc1 or code[idx] == 0xc2:
print("line{0} :".format(line),end="")
print(codeName[code[idx]].format(hex(code[idx+1])))
idx+=codeLen[code[idx]]
line += 1
continue
if code[idx] == 0xb1 or code[idx] == 0xb2 or code[idx] == 0xb3 or code[idx] == 0xb4:
print("line{0} :".format(line),end="")
print(codeName[code[idx]]," | :",hex(table[code[idx]-0xb1]))
idx+=codeLen[code[idx]]
line += 1
continue
if code[idx] == 0x80:
print("line{0} :".format(line),end="")
dword = hex(code[idx+2]|(code[idx+3]<<0x8)|(code[idx+4]<<0x10)|(code[idx+5]<<0x18))
print(codeName[code[idx]].format(code[idx+1],dword))
idx+=codeLen[code[idx]]
line += 1
continue
if code[idx] == 0x71:
print("line{} :".format(line),end="")
print(codeName[code[idx]]," | (DWORD)data:",hex(code[idx+1]),hex(code[idx+2]),hex(code[idx+3]),hex(code[idx+4]))
idx+=codeLen[code[idx]]
line += 1
continue
print("line{} :".format(line),end="")
print(codeName[code[idx]])
line += 1
idx+=codeLen[code[idx]]
4.运行得到操作流程
第一部分:32个字节异或得到
第二部分:4字节,各种运行算之后与0x6FEBF967比较
第三部分:4字节,各种运算与之后与0x0CF1304DC比较
第四部分:4字节,各种运算与之后与0x283B8E84比较
line0 :read(flag)
line1 :reg[1] = flag[0x0]
line2 :reg[9] = table[0] | : 0x7b
line3 :reg[1] ^= reg[9]
line4 :reg[1] != 0x4a exit
line5 :reg[1] = flag[0x1]
line6 :reg[9] = table[1] | : 0x2f
line7 :reg[1] ^= reg[9]
line8 :reg[1] != 0x19 exit
line9 :reg[1] = flag[0x2]
line10 :reg[9] = table[3] | : 0xe8
line11 :reg[1] ^= reg[9]
line12 :reg[1] != 0xdd exit
line13 :reg[1] = flag[0x3]
line14 :reg[9] = table[2] | : 0x37
line15 :reg[1] ^= reg[9]
line16 :reg[1] != 0xf exit
line17 :reg[1] = flag[0x4]
line18 :reg[9] = table[1] | : 0x2f
line19 :reg[1] ^= reg[9]
line20 :reg[1] != 0x1b exit
line21 :reg[1] = flag[0x5]
line22 :reg[9] = table[3] | : 0xe8
line23 :reg[1] ^= reg[9]
line24 :reg[1] != 0x89 exit
line25 :reg[1] = flag[0x6]
line26 :reg[9] = table[0] | : 0x7b
line27 :reg[1] ^= reg[9]
line28 :reg[1] != 0x19 exit
line29 :reg[1] = flag[0x7]
line30 :reg[9] = table[2] | : 0x37
line31 :reg[1] ^= reg[9]
line32 :reg[1] != 0x54 exit
line33 :reg[1] = flag[0x8]
line34 :reg[9] = table[0] | : 0x7b
line35 :reg[1] ^= reg[9]
line36 :reg[1] != 0x4f exit
line37 :reg[1] = flag[0x9]
line38 :reg[9] = table[0] | : 0x7b
line39 :reg[1] ^= reg[9]
line40 :reg[1] != 0x4e exit
line41 :reg[1] = flag[0xa]
line42 :reg[9] = table[2] | : 0x37
line43 :reg[1] ^= reg[9]
line44 :reg[1] != 0x55 exit
line45 :reg[1] = flag[0xb]
line46 :reg[9] = table[2] | : 0x37
line47 :reg[1] ^= reg[9]
line48 :reg[1] != 0x56 exit
line49 :reg[1] = flag[0xc]
line50 :reg[9] = table[3] | : 0xe8
line51 :reg[1] ^= reg[9]
line52 :reg[1] != 0x8e exit
line53 :reg[1] = flag[0xd]
line54 :reg[9] = table[1] | : 0x2f
line55 :reg[1] ^= reg[9]
line56 :reg[1] != 0x49 exit
line57 :reg[1] = flag[0xe]
line58 :reg[9] = table[2] | : 0x37
line59 :reg[1] ^= reg[9]
line60 :reg[1] != 0xe exit
line61 :reg[1] = flag[0xf]
line62 :reg[9] = table[0] | : 0x7b
line63 :reg[1] ^= reg[9]
line64 :reg[1] != 0x4b exit
line65 :reg[1] = flag[0x10]
line66 :reg[9] = table[2] | : 0x37
line67 :reg[1] ^= reg[9]
line68 :reg[1] != 0x6 exit
line69 :reg[1] = flag[0x11]
line70 :reg[9] = table[2] | : 0x37
line71 :reg[1] ^= reg[9]
line72 :reg[1] != 0x54 exit
line73 :reg[1] = flag[0x12]
line74 :reg[9] = table[1] | : 0x2f
line75 :reg[1] ^= reg[9]
line76 :reg[1] != 0x1a exit
line77 :reg[1] = flag[0x13]
line78 :reg[9] = table[0] | : 0x7b
line79 :reg[1] ^= reg[9]
line80 :reg[1] != 0x42 exit
line81 :reg[1] = flag[0x14]
line82 :reg[9] = table[2] | : 0x37
line83 :reg[1] ^= reg[9]
line84 :reg[1] != 0x53 exit
line85 :reg[1] = flag[0x15]
line86 :reg[9] = table[0] | : 0x7b
line87 :reg[1] ^= reg[9]
line88 :reg[1] != 0x1f exit
line89 :reg[1] = flag[0x16]
line90 :reg[9] = table[2] | : 0x37
line91 :reg[1] ^= reg[9]
line92 :reg[1] != 0x52 exit
line93 :reg[1] = flag[0x17]
line94 :reg[9] = table[3] | : 0xe8
line95 :reg[1] ^= reg[9]
line96 :reg[1] != 0xdb exit
line97 :reg[1] = flag[0x18]
line98 :reg[9] = table[0] | : 0x7b
line99 :reg[1] ^= reg[9]
line100 :reg[1] != 0x19 exit
line101 :reg[1] = flag[0x19]
line102 :reg[9] = table[3] | : 0xe8
line103 :reg[1] ^= reg[9]
line104 :reg[1] != 0xd9 exit
line105 :reg[1] = flag[0x1a]
line106 :reg[9] = table[0] | : 0x7b
line107 :reg[1] ^= reg[9]
line108 :reg[1] != 0x19 exit
line109 :reg[1] = flag[0x1b]
line110 :reg[9] = table[2] | : 0x37
line111 :reg[1] ^= reg[9]
line112 :reg[1] != 0x55 exit
line113 :reg[1] = flag[0x1c]
line114 :reg[9] = table[1] | : 0x2f
line115 :reg[1] ^= reg[9]
line116 :reg[1] != 0x19 exit
line117 :reg[1] = flag[0x1d]
line118 :reg[9] = table[2] | : 0x37
line119 :reg[1] ^= reg[9]
line120 :reg[1] != 0x0 exit
line121 :reg[1] = flag[0x1e]
line122 :reg[9] = table[0] | : 0x7b
line123 :reg[1] ^= reg[9]
line124 :reg[1] != 0x4b exit
line125 :reg[1] = flag[0x1f]
line126 :reg[9] = table[1] | : 0x2f
line127 :reg[1] ^= reg[9]
line128 :reg[1] != 0x1e exit
line129 :reg[1] = flag[0x20]
line130 :reg[2] = 0x18;
line131 :reg[1] <<= reg[2]
line132 :reg[9] = reg[1]
line133 :reg[1] = flag[0x21]
line134 :reg[2] = 0x10;
line135 :reg[1] <<= reg[2]
line136 :reg[9] += reg[1]
line137 :reg[1] = flag[0x22]
line138 :reg[2] = 0x8;
line139 :reg[1] <<= reg[2]
line140 :reg[9] += reg[1]
line141 :reg[1] = flag[0x23]
line142 :reg[9] += reg[1]
line143 :reg[1] = reg[9]
line144 :reg[2] = 0x5;
line145 :reg[1] >>= reg[2]
line146 :reg[1] ^= reg[9]
line147 :reg[9] = reg[1]
line148 :reg[2] = 0x7;
line149 :reg[1] <<= reg[2]
line150 :reg[2] = 0x98f17723;
line151 :reg[1] &= reg[2]
line152 :reg[1] ^= reg[9]
line153 :reg[9] = reg[1]
line154 :reg[2] = 0x18;
line155 :reg[1] <<= reg[2]
line156 :reg[2] = 0x35e4b920;
line157 :reg[1] &= reg[2]
line158 :reg[1] ^= reg[9]
line159 :reg[9] = reg[1]
line160 :reg[2] = 0x12;
line161 :reg[1] >>= reg[2]
line162 :reg[1] ^= reg[9]
line163 :reg[1]!=0x6FEBF967 exit
line164 :reg[1] = flag[0x24]
line165 :reg[2] = 0x18;
line166 :reg[1] <<= reg[2]
line167 :reg[9] = reg[1]
line168 :reg[1] = flag[0x25]
line169 :reg[2] = 0x10;
line170 :reg[1] <<= reg[2]
line171 :reg[9] += reg[1]
line172 :reg[1] = flag[0x26]
line173 :reg[2] = 0x8;
line174 :reg[1] <<= reg[2]
line175 :reg[9] += reg[1]
line176 :reg[1] = flag[0x27]
line177 :reg[9] += reg[1]
line178 :reg[1] = reg[9]
line179 :reg[3] = 0x20
line180 :reg[1] *= reg[3]
line181 :reg[4] = reg[1]
line182 :reg[1] ^= reg[9]
line183 :reg[2] = 0x11;
line184 :reg[1] >>= reg[2]
line185 :reg[5] = reg[1]
line186 :reg[1] = reg[5]
line187 :reg[1] ^= reg[4]
line188 :reg[1] ^= reg[9]
line189 :reg[2] = 0xd;
line190 :reg[1] <<= reg[2]
line191 :reg[1] ^= reg[9]
line192 :reg[1] ^= reg[4]
line193 :reg[1] ^= reg[5]
line194 :reg[9] = reg[1]
line195 :reg[3] = 0x20
line196 :reg[1] *= reg[3]
line197 :reg[4] = reg[1]
line198 :reg[1] ^= reg[9]
line199 :reg[2] = 0x11;
line200 :reg[1] >>= reg[2]
line201 :reg[5] = reg[1]
line202 :reg[1] = reg[5]
line203 :reg[1] ^= reg[4]
line204 :reg[1] ^= reg[9]
line205 :reg[2] = 0xd;
line206 :reg[1] <<= reg[2]
line207 :reg[1] ^= reg[9]
line208 :reg[1] ^= reg[4]
line209 :reg[1] ^= reg[5]
line210 :reg[1] != table2[0] exit
line211 :reg[1] = flag[0x28]
line212 :reg[2] = 0x18;
line213 :reg[1] <<= reg[2]
line214 :reg[9] = reg[1]
line215 :reg[1] = flag[0x29]
line216 :reg[2] = 0x10;
line217 :reg[1] <<= reg[2]
line218 :reg[9] += reg[1]
line219 :reg[1] = flag[0x2a]
line220 :reg[2] = 0x8;
line221 :reg[1] <<= reg[2]
line222 :reg[9] += reg[1]
line223 :reg[1] = flag[0x2b]
line224 :reg[9] += reg[1]
line225 :reg[1] = reg[9]
line226 :reg[3] = 0x20
line227 :reg[1] *= reg[3]
line228 :reg[4] = reg[1]
line229 :reg[1] ^= reg[9]
line230 :reg[2] = 0x11;
line231 :reg[1] >>= reg[2]
line232 :reg[5] = reg[1]
line233 :reg[1] = reg[5]
line234 :reg[1] ^= reg[4]
line235 :reg[1] ^= reg[9]
line236 :reg[2] = 0xd;
line237 :reg[1] <<= reg[2]
line238 :reg[1] ^= reg[9]
line239 :reg[1] ^= reg[4]
line240 :reg[1] ^= reg[5]
line241 :reg[9] = reg[1]
line242 :reg[3] = 0x20
line243 :reg[1] *= reg[3]
line244 :reg[4] = reg[1]
line245 :reg[1] ^= reg[9]
line246 :reg[2] = 0x11;
line247 :reg[1] >>= reg[2]
line248 :reg[5] = reg[1]
line249 :reg[1] = reg[5]
line250 :reg[1] ^= reg[4]
line251 :reg[1] ^= reg[9]
line252 :reg[2] = 0xd;
line253 :reg[1] <<= reg[2]
line254 :reg[1] ^= reg[9]
line255 :reg[1] ^= reg[4]
line256 :reg[1] ^= reg[5]
line257 :reg[1] != table2[1] exit
line258 :break
5.爆破得到flag
第二部分爆破,直接将上面的操作复制下来,爆破。第三,四部分也一样。最后得到
flag:16584abc45baff901c59dde3b1bb6701a254b06cdc23
#include "stdio.h"
int main() {
for (int i = 0; i < 0xffffffff; i++) {
unsigned int reg[10] = { 0 };
reg[1] = i;//初始化
reg[9] = i;//初始化
reg[2] = 0x5;
reg[1] >>= reg[2];
reg[1] ^= reg[9];
reg[9] = reg[1];
reg[2] = 0x7;
reg[1] <<= reg[2];
reg[2] = 0x98f17723;
reg[1] &= reg[2];
reg[1] ^= reg[9];
reg[9] = reg[1];
reg[2] = 0x18;
reg[1] <<= reg[2];
reg[2] = 0x35e4b920;
reg[1] &= reg[2];
reg[1] ^= reg[9];
reg[9] = reg[1];
reg[2] = 0x12;
reg[1] >>= reg[2];
reg[1] ^= reg[9];
if (reg[1] == 0x6FEBF967) {
printf("%x\n", i);
}
}
}
总结
vm的题目,
1.需要找到dispatch
2.找到opcode对应的操作
3.找到所有的code
4.输出所有的运行过程
这个流程有点像trace,如果很复杂会很麻烦的。不知道有没有什么更好的办法。如果能够解决vm的办法,大师傅教教我