[HGAME 2023 week3]patchme

// positive sp value has been detected, the output may be wrong!
void __fastcall __noreturn start(__int64 a1, __int64 a2, void (*a3)(void))
{
  __int64 v3; // rax
  int v4; // esi
  __int64 v5; // [rsp-8h] [rbp-8h] BYREF
  char *retaddr; // [rsp+0h] [rbp+0h] BYREF

  v4 = v5;
  v5 = v3;
  _libc_start_main(main, v4, &retaddr, init, fini, a3, &v5);
  __halt();
}

init会在main前运行

void __fastcall init(unsigned int a1, __int64 a2, __int64 a3)
{
  signed __int64 v4; // rbp
  __int64 i; // rbx

  init_proc();
  v4 = &off_3D10 - off_3D00;
  if ( v4 )
  {
    for ( i = 0LL; i != v4; ++i )
      ((void (__fastcall *)(_QWORD, __int64, __int64))off_3D00[i])(a1, a2, a3);
  }
}

 sub_13E0没什么

sub_188C

int sub_188C()
{
  _BYTE *v0; // rax
  int v2; // [rsp+Ch] [rbp-1B4h] BYREF
  int j; // [rsp+10h] [rbp-1B0h]
  int fd; // [rsp+14h] [rbp-1ACh]
  char *i; // [rsp+18h] [rbp-1A8h]
  char buf[408]; // [rsp+20h] [rbp-1A0h] BYREF
  unsigned __int64 v7; // [rsp+1B8h] [rbp-8h]

  v7 = __readfsqword(0x28u);
  fd = open("/proc/self/status", 0);
  read(fd, buf, 0x190uLL);
  for ( i = buf; *i != 84 || i[1] != 114 || i[2] != 97 || i[3] != 99 || i[4] != 101 || i[5] != 114; ++i )
    ;
  i += 11;
  __isoc99_sscanf(i, &unk_2008, &v2);
  if ( v2 )
    exit(0);
  LODWORD(v0) = mprotect((void *)((unsigned __int64)&loc_14C6 & 0xFFFFFFFFFFFFF000LL), 0x3000uLL, 7);
  for ( j = 0; j <= 960; ++j )
  {
    v0 = (char *)&loc_14C6 + j;//起始地址为0x14C6
    *v0 ^= 0x66u;//异或了0x66
  }
  return (int)v0;
}

SMC函数，上idapython脚本

import idc

addr = 0x14C6   #起始地址
for i in range(961):
    idc.patch_byte(addr+i, idc.get_wide_byte(i+addr) ^ 0x66)

添加方法：

int sub_14C6()
{
  int result; // eax
  __WAIT_STATUS stat_loc; // [rsp+Ch] [rbp-2C4h] BYREF
  int i; // [rsp+14h] [rbp-2BCh]
  __int64 v3; // [rsp+18h] [rbp-2B8h]
  int pipedes[2]; // [rsp+20h] [rbp-2B0h] BYREF
  int v5[2]; // [rsp+28h] [rbp-2A8h] BYREF
  char *argv[4]; // [rsp+30h] [rbp-2A0h] BYREF
  char v7[48]; // [rsp+50h] [rbp-280h] BYREF
  __int64 v8; // [rsp+80h] [rbp-250h]
  __int64 v9[5]; // [rsp+E0h] [rbp-1F0h]
  int v10; // [rsp+108h] [rbp-1C8h]
  __int16 v11; // [rsp+10Ch] [rbp-1C4h]
  char v12; // [rsp+10Eh] [rbp-1C2h]
  __int64 v13[5]; // [rsp+110h] [rbp-1C0h]
  int v14; // [rsp+138h] [rbp-198h]
  __int16 v15; // [rsp+13Ch] [rbp-194h]
  char v16; // [rsp+13Eh] [rbp-192h]
  char buf[80]; // [rsp+140h] [rbp-190h] BYREF
  char s1[8]; // [rsp+190h] [rbp-140h] BYREF
  __int64 v19; // [rsp+198h] [rbp-138h]
  char v20[280]; // [rsp+1A0h] [rbp-130h] BYREF
  int v21; // [rsp+2B8h] [rbp-18h]
  unsigned __int64 v22; // [rsp+2C8h] [rbp-8h]

  v22 = __readfsqword(0x28u);
  result = dword_4028;
  if ( dword_4028 <= 1 )
  {
    pipe(pipedes);
    pipe(v5);
    if ( fork() )
    {
      close(pipedes[0]);
      close(v5[1]);
      HIDWORD(stat_loc.__iptr) = 0;
      while ( SHIDWORD(stat_loc.__iptr) <= 35 )
      {
        buf[2 * HIDWORD(stat_loc.__iptr)] = 37;
        buf[2 * HIDWORD(stat_loc.__iptr)++ + 1] = 110;
      }
      buf[72] = 10;
      buf[73] = 0;
      write(pipedes[1], buf, 0x4AuLL);
      *(_QWORD *)s1 = 0LL;
      v19 = 0LL;
      memset(v20, 0, sizeof(v20));
      v21 = 0;
      read(v5[0], s1, 0x12CuLL);
      wait((__WAIT_STATUS)&stat_loc);
      buf[23] = 0;
      if ( !LODWORD(stat_loc.__uptr) && !strcmp(s1, buf) )
      {
        v9[0] = 0x5416D999808A28FALL;
        v9[1] = 0x588505094953B563LL;
        v9[2] = 0xCE8CF3A0DC669097LL;
        v9[3] = 0x4C5CF3E854F44CBDLL;
        v9[4] = 0xD144E49916678331LL;
        v10 = -631149652;
        v11 = -17456;
        v12 = 85;
        v13[0] = 0x3B4FA2FCEDEB4F92LL;
        v13[1] = 0x7E45A6C3B67EA16LL;
        v13[2] = 0xAFE1ACC8BF12D0E7LL;
        v13[3] = 0x132EC3B7269138CELL;
        v13[4] = 0x8E2197EB7311E643LL;
        v14 = -1370223935;
        v15 = -13899;
        v16 = 40;
        result = putchar(10);
        for ( i = 0; i <= 46; ++i )
          result = putchar((char)(*((_BYTE *)v9 + i) ^ *((_BYTE *)v13 + i)));
      }
      else
      {
        return puts("\nthere are still bugs...");
      }
    }
    else
    {
      fflush(stdin);
      sub_1AB0(*(_QWORD *)qword_4020, v7);
      v3 = v8;
      if ( v8 == 14472 )
      {
        close(pipedes[1]);
        close(v5[0]);
        dup2(pipedes[0], 0);
        dup2(v5[1], 1);
        dup2(v5[1], 2);
        argv[0] = *(char **)qword_4020;
        argv[1] = "1";
        argv[2] = 0LL;
        return execve(*(const char **)qword_4020, argv, 0LL);
      }
      else
      {
        puts("\nyou cannot modify the file size");
        return 0;
      }
    }
  }
  return result;
}

EXP：

x = [0xFA, 0x28, 0x8A, 0x80, 0x99, 0xD9, 0x16, 0x54, 0x63, 0xB5, 0x53, 0x49, 0x09, 0x05, 0x85, 0x58, 0x97, 0x90, 0x66,
     0xDC, 0xA0, 0xF3, 0x8C, 0xCE, 0xBD, 0x4C, 0xF4, 0x54, 0xE8, 0xF3, 0x5C, 0x4C, 0x31, 0x83, 0x67, 0x16, 0x99, 0xE4,
     0x44, 0xD1, 0xAC, 0x6B, 0x61, 0xDA, 0xD0, 0xBB, 0x55]
y = [0x92, 0x4F, 0xEB, 0xED, 0xFC, 0xA2, 0x4F, 0x3B, 0x16, 0xEA, 0x67, 0x3B, 0x6C, 0x5A, 0xE4, 0x07, 0xE7, 0xD0, 0x12,
     0xBF, 0xC8, 0xAC, 0xE1, 0xAF, 0xCE, 0x38, 0x91, 0x26, 0xB7, 0xC3, 0x2E, 0x13, 0x43, 0xE6, 0x11, 0x73, 0xEB, 0x97,
     0x21, 0x8E, 0xC1, 0x0A, 0x54, 0xAE, 0xB5, 0xC9, 0x28]
for i in range(len(x)):
    print(chr(x[i] ^ y[i]), end='')
#hgame{You_4re_a_p@tch_master_0r_reverse_ma5ter}