[GWCTF 2019]babyvm

liqingdi437

已于 2023-10-07 04:08:27 修改

阅读量51

点赞数

分类专栏： python CTF 逆向文章标签： python 青少年编程 c语言开发语言汇编 c++ 算法

于 2023-10-07 04:03:31 首次发布

本文链接：https://blog.csdn.net/liaochonxiang/article/details/133630673

版权

CTF 同时被 3 个专栏收录

53 篇文章 3 订阅

订阅专栏

逆向

43 篇文章 1 订阅

订阅专栏

python

20 篇文章 0 订阅

订阅专栏

main函数

存在三个主要函数

void __fastcall __noreturn main(int a1, char **a2, char **a3)
{
  __int64 v3[2]; // [rsp+10h] [rbp-10h] BYREF

  v3[1] = __readfsqword(0x28u);
  v3[0] = 0LL;
  puts("Please input something:");
  sub_CD1((__int64)v3);//初始化vm
  sub_E0B(v3);
  sub_F83(v3);//对比flag
  puts("And the flag is GWHT{true flag}");
  exit(0);
}

sub_CD1

unsigned __int64 __fastcall sub_CD1(__int64 a1)
{
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  *(_DWORD *)a1 = 0;
  *(_DWORD *)(a1 + 4) = 18;
  *(_DWORD *)(a1 + 8) = 0;
  *(_DWORD *)(a1 + 12) = 0;
  *(_QWORD *)(a1 + 16) = &unk_202060;//操作码
  *(_BYTE *)(a1 + 24) = -15;
  *(_QWORD *)(a1 + 32) = sub_B5F;
  *(_BYTE *)(a1 + 40) = -14;
  *(_QWORD *)(a1 + 48) = sub_A64;
  *(_BYTE *)(a1 + 56) = -11;
  *(_QWORD *)(a1 + 64) = sub_AC5;
  *(_BYTE *)(a1 + 72) = -12;
  *(_QWORD *)(a1 + 80) = sub_956;
  *(_BYTE *)(a1 + 88) = -9;
  *(_QWORD *)(a1 + 96) = sub_A08;
  *(_BYTE *)(a1 + 104) = -8;
  *(_QWORD *)(a1 + 112) = sub_8F0;
  *(_BYTE *)(a1 + 120) = -10;
  *(_QWORD *)(a1 + 128) = sub_99C;
  qword_2022A8 = malloc(0x512uLL);
  memset(qword_2022A8, 0, 0x512uLL);
  return __readfsqword(0x28u) ^ v2;
}

提取操作码

opcode = [0xF5, 0xF1, 0xE1, 0x00, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4,
          0x20, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x01, 0x00, 0x00, 0x00,
          0xF2, 0xF1, 0xE4, 0x21, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x02,
          0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x22, 0x00, 0x00, 0x00,
          0xF1, 0xE1, 0x03, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x23,
          0x00, 0x00, 0x00, 0xF1, 0xE1, 0x04, 0x00, 0x00, 0x00, 0xF2,
          0xF1, 0xE4, 0x24, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x05, 0x00,
          0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x25, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x06, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x26, 0x00,
          0x00, 0x00, 0xF1, 0xE1, 0x07, 0x00, 0x00, 0x00, 0xF2, 0xF1,
          0xE4, 0x27, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x08, 0x00, 0x00,
          0x00, 0xF2, 0xF1, 0xE4, 0x28, 0x00, 0x00, 0x00, 0xF1, 0xE1,
          0x09, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x29, 0x00, 0x00,
          0x00, 0xF1, 0xE1, 0x0A, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4,
          0x2A, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0B, 0x00, 0x00, 0x00,
          0xF2, 0xF1, 0xE4, 0x2B, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0C,
          0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x2C, 0x00, 0x00, 0x00,
          0xF1, 0xE1, 0x0D, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x2D,
          0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0E, 0x00, 0x00, 0x00, 0xF2,
          0xF1, 0xE4, 0x2E, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0F, 0x00,
          0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x2F, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x10, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x30, 0x00,
          0x00, 0x00, 0xF1, 0xE1, 0x11, 0x00, 0x00, 0x00, 0xF2, 0xF1,
          0xE4, 0x31, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x12, 0x00, 0x00,
          0x00, 0xF2, 0xF1, 0xE4, 0x32, 0x00, 0x00, 0x00, 0xF1, 0xE1,
          0x13, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x33, 0x00, 0x00,
          0x00, 0xF4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF5, 0xF1,
          0xE1, 0x00, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x01, 0x00, 0x00,
          0x00, 0xF2, 0xF1, 0xE4, 0x00, 0x00, 0x00, 0x00, 0xF1, 0xE1,
          0x01, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x02, 0x00, 0x00, 0x00,
          0xF2, 0xF1, 0xE4, 0x01, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x02,
          0x00, 0x00, 0x00, 0xF1, 0xE2, 0x03, 0x00, 0x00, 0x00, 0xF2,
          0xF1, 0xE4, 0x02, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x03, 0x00,
          0x00, 0x00, 0xF1, 0xE2, 0x04, 0x00, 0x00, 0x00, 0xF2, 0xF1,
          0xE4, 0x03, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x04, 0x00, 0x00,
          0x00, 0xF1, 0xE2, 0x05, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4,
          0x04, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x05, 0x00, 0x00, 0x00,
          0xF1, 0xE2, 0x06, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x05,
          0x00, 0x00, 0x00, 0xF1, 0xE1, 0x06, 0x00, 0x00, 0x00, 0xF1,
          0xE2, 0x07, 0x00, 0x00, 0x00, 0xF1, 0xE3, 0x08, 0x00, 0x00,
          0x00, 0xF1, 0xE5, 0x0C, 0x00, 0x00, 0x00, 0xF6, 0xF7, 0xF1,
          0xE4, 0x06, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x07, 0x00, 0x00,
          0x00, 0xF1, 0xE2, 0x08, 0x00, 0x00, 0x00, 0xF1, 0xE3, 0x09,
          0x00, 0x00, 0x00, 0xF1, 0xE5, 0x0C, 0x00, 0x00, 0x00, 0xF6,
          0xF7, 0xF1, 0xE4, 0x07, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x08,
          0x00, 0x00, 0x00, 0xF1, 0xE2, 0x09, 0x00, 0x00, 0x00, 0xF1,
          0xE3, 0x0A, 0x00, 0x00, 0x00, 0xF1, 0xE5, 0x0C, 0x00, 0x00,
          0x00, 0xF6, 0xF7, 0xF1, 0xE4, 0x08, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x0D, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x13, 0x00, 0x00,
          0x00, 0xF8, 0xF1, 0xE4, 0x0D, 0x00, 0x00, 0x00, 0xF1, 0xE7,
          0x13, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0E, 0x00, 0x00, 0x00,
          0xF1, 0xE2, 0x12, 0x00, 0x00, 0x00, 0xF8, 0xF1, 0xE4, 0x0E,
          0x00, 0x00, 0x00, 0xF1, 0xE7, 0x12, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x0F, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x11, 0x00, 0x00,
          0x00, 0xF8, 0xF1, 0xE4, 0x0F, 0x00, 0x00, 0x00, 0xF1, 0xE7,
          0x11, 0x00, 0x00, 0x00, 0xF4]

sub_B5F

进行mov

unsigned __int64 __fastcall sub_B5F(__int64 a1)
{
    int *v2; // [rsp+28h] [rbp-18h]
    unsigned __int64 v3; // [rsp+38h] [rbp-8h]

    v3 = __readfsqword(0x28u);
    v2 = (int *)(*(_QWORD *)(a1 + 16) + 2LL);
    switch ( *(_BYTE *)(*(_QWORD *)(a1 + 16) + 1LL) )
        {
            case 0xE1:
                *(_DWORD *)a1 = *((char *)qword_2022A8 + *v2);
                break;
            case 0xE2:
                *(_DWORD *)(a1 + 4) = *((char *)qword_2022A8 + *v2);
                break;
            case 0xE3:
                *(_DWORD *)(a1 + 8) = *((char *)qword_2022A8 + *v2);
                break;
            case 0xE4:
                *((_BYTE *)qword_2022A8 + *v2) = *(_DWORD *)a1;
                break;
            case 0xE5:
                *(_DWORD *)(a1 + 12) = *((char *)qword_2022A8 + *v2);
                break;
            case 0xE7:
                *((_BYTE *)qword_2022A8 + *v2) = *(_DWORD *)(a1 + 4);
                break;
            default:
                break;
        }
    *(_QWORD *)(a1 + 16) += 6LL;
    return __readfsqword(0x28u) ^ v3;
}

sub_A64

进行xor

unsigned __int64 __fastcall sub_A64(__int64 a1)
{
    unsigned __int64 v2; // [rsp+18h] [rbp-8h]

    v2 = __readfsqword(0x28u);
    *(_DWORD *)a1 ^= *(_DWORD *)(a1 + 4);
    ++*(_QWORD *)(a1 + 16);
    return __readfsqword(0x28u) ^ v2;
}

sub_AC5

判断flag长度为21

unsigned __int64 __fastcall sub_AC5(__int64 a1)
{
  const char *buf; // [rsp+10h] [rbp-10h]
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  buf = (const char *)qword_2022A8;
  read(0, qword_2022A8, 0x20uLL);
  dword_2022A4 = strlen(buf);
  if ( dword_2022A4 != 21 )
  {
    puts("WRONG!");
    exit(0);
  }
  ++*(_QWORD *)(a1 + 16);
  return __readfsqword(0x28u) ^ v3;
}

sub_956

nop结束

unsigned __int64 __fastcall sub_956(__int64 a1)
{
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  ++*(_QWORD *)(a1 + 16);
  return __readfsqword(0x28u) ^ v2;
}

sub_A08

进行mul

unsigned __int64 __fastcall sub_A08(__int64 a1)
{
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  *(_DWORD *)a1 *= *(_DWORD *)(a1 + 12);
  ++*(_QWORD *)(a1 + 16);
  return __readfsqword(0x28u) ^ v2;
}

sub_8F0

进行swap

unsigned __int64 __fastcall sub_8F0(int *a1)
{
  int v2; // [rsp+14h] [rbp-Ch]
  unsigned __int64 v3; // [rsp+18h] [rbp-8h]

  v3 = __readfsqword(0x28u);
  v2 = *a1;
  *a1 = a1[1];
  a1[1] = v2;
  ++*((_QWORD *)a1 + 2);
  return __readfsqword(0x28u) ^ v3;
}

sub_99C

运算操作

unsigned __int64 __fastcall sub_99C(__int64 a1)
{
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  *(_DWORD *)a1 = *(_DWORD *)(a1 + 8) + 2 * *(_DWORD *)(a1 + 4) + 3 * *(_DWORD *)a1;
  ++*(_QWORD *)(a1 + 16);
  return __readfsqword(0x28u) ^ v2;
}

sub_E0B

验证操作码吧

sub_F83

对加密后的flag进行对比

unsigned __int64 sub_F83()
{
  int i; // [rsp+Ch] [rbp-14h]
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  for ( i = 0; dword_2022A4 - 1 > i; ++i )
  {
    if ( *((_BYTE *)qword_2022A8 + i + 32) != aFzAmAmFmtSum[i] )
    {
      puts("WRONG!");
      exit(0);
    }
  }
  puts("Congratulation?");
  puts("tips: input is the start");
  return __readfsqword(0x28u) ^ v2;
}

发现里面的密文是假的，对qword_2022A8交叉引用

sub_F00

unsigned __int64 sub_F00()
{
  int i; // [rsp+Ch] [rbp-14h]
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  for ( i = 0; dword_2022A4 - 1 > i; ++i )
  {
    if ( *((_BYTE *)qword_2022A8 + i) != byte_202020[i] )
      exit(0);
  }
  return __readfsqword(0x28u) ^ v2;
}

提取密文

x = [0x69, 0x45, 0x2A, 0x37, 0x09, 0x17, 0xC5, 0x0B, 0x5C, 0x72,
     0x33, 0x76, 0x33, 0x21, 0x74, 0x31, 0x5F, 0x33, 0x73, 0x72]

汇编

opcode = [0xF5, 0xF1, 0xE1, 0x00, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4,
          0x20, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x01, 0x00, 0x00, 0x00,
          0xF2, 0xF1, 0xE4, 0x21, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x02,
          0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x22, 0x00, 0x00, 0x00,
          0xF1, 0xE1, 0x03, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x23,
          0x00, 0x00, 0x00, 0xF1, 0xE1, 0x04, 0x00, 0x00, 0x00, 0xF2,
          0xF1, 0xE4, 0x24, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x05, 0x00,
          0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x25, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x06, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x26, 0x00,
          0x00, 0x00, 0xF1, 0xE1, 0x07, 0x00, 0x00, 0x00, 0xF2, 0xF1,
          0xE4, 0x27, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x08, 0x00, 0x00,
          0x00, 0xF2, 0xF1, 0xE4, 0x28, 0x00, 0x00, 0x00, 0xF1, 0xE1,
          0x09, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x29, 0x00, 0x00,
          0x00, 0xF1, 0xE1, 0x0A, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4,
          0x2A, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0B, 0x00, 0x00, 0x00,
          0xF2, 0xF1, 0xE4, 0x2B, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0C,
          0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x2C, 0x00, 0x00, 0x00,
          0xF1, 0xE1, 0x0D, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x2D,
          0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0E, 0x00, 0x00, 0x00, 0xF2,
          0xF1, 0xE4, 0x2E, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0F, 0x00,
          0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x2F, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x10, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x30, 0x00,
          0x00, 0x00, 0xF1, 0xE1, 0x11, 0x00, 0x00, 0x00, 0xF2, 0xF1,
          0xE4, 0x31, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x12, 0x00, 0x00,
          0x00, 0xF2, 0xF1, 0xE4, 0x32, 0x00, 0x00, 0x00, 0xF1, 0xE1,
          0x13, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x33, 0x00, 0x00,
          0x00, 0xF4, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
          0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xF5, 0xF1,
          0xE1, 0x00, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x01, 0x00, 0x00,
          0x00, 0xF2, 0xF1, 0xE4, 0x00, 0x00, 0x00, 0x00, 0xF1, 0xE1,
          0x01, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x02, 0x00, 0x00, 0x00,
          0xF2, 0xF1, 0xE4, 0x01, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x02,
          0x00, 0x00, 0x00, 0xF1, 0xE2, 0x03, 0x00, 0x00, 0x00, 0xF2,
          0xF1, 0xE4, 0x02, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x03, 0x00,
          0x00, 0x00, 0xF1, 0xE2, 0x04, 0x00, 0x00, 0x00, 0xF2, 0xF1,
          0xE4, 0x03, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x04, 0x00, 0x00,
          0x00, 0xF1, 0xE2, 0x05, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4,
          0x04, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x05, 0x00, 0x00, 0x00,
          0xF1, 0xE2, 0x06, 0x00, 0x00, 0x00, 0xF2, 0xF1, 0xE4, 0x05,
          0x00, 0x00, 0x00, 0xF1, 0xE1, 0x06, 0x00, 0x00, 0x00, 0xF1,
          0xE2, 0x07, 0x00, 0x00, 0x00, 0xF1, 0xE3, 0x08, 0x00, 0x00,
          0x00, 0xF1, 0xE5, 0x0C, 0x00, 0x00, 0x00, 0xF6, 0xF7, 0xF1,
          0xE4, 0x06, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x07, 0x00, 0x00,
          0x00, 0xF1, 0xE2, 0x08, 0x00, 0x00, 0x00, 0xF1, 0xE3, 0x09,
          0x00, 0x00, 0x00, 0xF1, 0xE5, 0x0C, 0x00, 0x00, 0x00, 0xF6,
          0xF7, 0xF1, 0xE4, 0x07, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x08,
          0x00, 0x00, 0x00, 0xF1, 0xE2, 0x09, 0x00, 0x00, 0x00, 0xF1,
          0xE3, 0x0A, 0x00, 0x00, 0x00, 0xF1, 0xE5, 0x0C, 0x00, 0x00,
          0x00, 0xF6, 0xF7, 0xF1, 0xE4, 0x08, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x0D, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x13, 0x00, 0x00,
          0x00, 0xF8, 0xF1, 0xE4, 0x0D, 0x00, 0x00, 0x00, 0xF1, 0xE7,
          0x13, 0x00, 0x00, 0x00, 0xF1, 0xE1, 0x0E, 0x00, 0x00, 0x00,
          0xF1, 0xE2, 0x12, 0x00, 0x00, 0x00, 0xF8, 0xF1, 0xE4, 0x0E,
          0x00, 0x00, 0x00, 0xF1, 0xE7, 0x12, 0x00, 0x00, 0x00, 0xF1,
          0xE1, 0x0F, 0x00, 0x00, 0x00, 0xF1, 0xE2, 0x11, 0x00, 0x00,
          0x00, 0xF8, 0xF1, 0xE4, 0x0F, 0x00, 0x00, 0x00, 0xF1, 0xE7,
          0x11, 0x00, 0x00, 0x00, 0xF4]
for i in range(len(opcode)):
    if opcode[i] == 0xF1:
        print("mov\t", end='')
        if opcode[i + 1] == 0xE1:
            print('eax,flag[{}]'.format(opcode[i + 2]))
        elif opcode[i + 1] == 0xE2:
            print('ebx,flag[{}]'.format(opcode[i + 2]))
        elif opcode[i + 1] == 0xE3:
            print('ecx,flag[{}]'.format(opcode[i + 2]))
        elif opcode[i + 1] == 0xE4:
            print('flag[{}],eax'.format(opcode[i + 2]))
        elif opcode[i + 1] == 0xE5:
            print('edx,flag[{}]'.format(opcode[i + 2]))
        elif opcode[i + 1] == 0xE7:
            print('flag[{}],ebx'.format(opcode[i + 2]))
        i += 6
    elif opcode[i] == 0xF2:
        print("xor\teax,ebx")
        i += 1
    elif opcode[i] == 0xF5:
        print("cmp\tlen(flag),21")
        i += 1
    elif opcode[i] == 0xF4:
        print("nop\n")
        i += 1
    elif opcode[i] == 0xF7:
        print("mul\teax,edx")
        i += 1
    elif opcode[i] == 0xF8:
        print("swap\teax,ebx")
        i += 1
    elif opcode[i] == 0xF6:
        print("mov\teax,ecx+2*ebx+3*eax")
        i += 1

cmp	len(flag),21
mov	eax,flag[0]
xor	eax,ebx
mov	flag[32],eax
mov	eax,flag[1]
xor	eax,ebx
mov	flag[33],eax
mov	eax,flag[2]
xor	eax,ebx
mov	flag[34],eax
mov	eax,flag[3]
xor	eax,ebx
mov	flag[35],eax
mov	eax,flag[4]
xor	eax,ebx
mov	flag[36],eax
mov	eax,flag[5]
xor	eax,ebx
mov	flag[37],eax
mov	eax,flag[6]
xor	eax,ebx
mov	flag[38],eax
mov	eax,flag[7]
xor	eax,ebx
mov	flag[39],eax
mov	eax,flag[8]
xor	eax,ebx
mov	flag[40],eax
mov	eax,flag[9]
xor	eax,ebx
mov	flag[41],eax
mov	eax,flag[10]
xor	eax,ebx
mov	flag[42],eax
mov	eax,flag[11]
xor	eax,ebx
mov	flag[43],eax
mov	eax,flag[12]
xor	eax,ebx
mov	flag[44],eax
mov	eax,flag[13]
xor	eax,ebx
mov	flag[45],eax
mov	eax,flag[14]
xor	eax,ebx
mov	flag[46],eax
mov	eax,flag[15]
xor	eax,ebx
mov	flag[47],eax
mov	eax,flag[16]
xor	eax,ebx
mov	flag[48],eax
mov	eax,flag[17]
xor	eax,ebx
mov	flag[49],eax
mov	eax,flag[18]
xor	eax,ebx
mov	flag[50],eax
mov	eax,flag[19]
xor	eax,ebx
mov	flag[51],eax
nop

cmp	len(flag),21
mov	eax,flag[0]
mov	ebx,flag[1]
xor	eax,ebx
mov	flag[0],eax
mov	eax,flag[1]
mov	ebx,flag[2]
xor	eax,ebx
mov	flag[1],eax
mov	eax,flag[2]
mov	ebx,flag[3]
xor	eax,ebx
mov	flag[2],eax
mov	eax,flag[3]
mov	ebx,flag[4]
xor	eax,ebx
mov	flag[3],eax
mov	eax,flag[4]
mov	ebx,flag[5]
xor	eax,ebx
mov	flag[4],eax
mov	eax,flag[5]
mov	ebx,flag[6]
xor	eax,ebx
mov	flag[5],eax
mov	eax,flag[6]
mov	ebx,flag[7]
mov	ecx,flag[8]
mov	edx,flag[12]
mov	eax,ecx+2*ebx+3*eax
mul	eax,edx
mov	flag[6],eax
mov	eax,flag[7]
mov	ebx,flag[8]
mov	ecx,flag[9]
mov	edx,flag[12]
mov	eax,ecx+2*ebx+3*eax
mul	eax,edx
mov	flag[7],eax
mov	eax,flag[8]
mov	ebx,flag[9]
mov	ecx,flag[10]
mov	edx,flag[12]
mov	eax,ecx+2*ebx+3*eax
mul	eax,edx
mov	flag[8],eax
mov	eax,flag[13]
mov	ebx,flag[19]
swap	eax,ebx
mov	flag[13],eax
mov	flag[19],ebx
mov	eax,flag[14]
mov	ebx,flag[18]
swap	eax,ebx
mov	flag[14],eax
mov	flag[18],ebx
mov	eax,flag[15]
mov	ebx,flag[17]
swap	eax,ebx
mov	flag[15],eax
mov	flag[17],ebx
nop

反汇编

第一段明显是假的

逐端分析

mov	eax,flag[0]
mov	ebx,flag[1]
xor	eax,ebx
mov	flag[0],eax
//flag[0]^=flag[1]

mov	eax,flag[1]
mov	ebx,flag[2]
xor	eax,ebx
mov	flag[1],eax
//flag[1]^=flag[2]

mov	eax,flag[2]
mov	ebx,flag[3]
xor	eax,ebx
mov	flag[2],eax
//flag[2]^=flag[3]

mov	eax,flag[3]
mov	ebx,flag[4]
xor	eax,ebx
mov	flag[3],eax
//flag[3]^=flag[4]

mov	eax,flag[4]
mov	ebx,flag[5]
xor	eax,ebx
mov	flag[4],eax
//flag[4]^=flag[5]

mov	eax,flag[5]
mov	ebx,flag[6]
xor	eax,ebx
mov	flag[5],eax
//flag[5]^=flag[6]

mov	eax,flag[6]
mov	ebx,flag[7]
mov	ecx,flag[8]
mov	edx,flag[12]
mov	eax,ecx+2*ebx+3*eax
mul	eax,edx
mov	flag[6],eax
//flag[6]=(flag[8]+2*flag[7]+3*flag[6])*flag[12]

mov	eax,flag[7]
mov	ebx,flag[8]
mov	ecx,flag[9]
mov	edx,flag[12]
mov	eax,ecx+2*ebx+3*eax
mul	eax,edx
mov	flag[7],eax
//flag[7]=(flag[9]+2*flag[8]+3*flag[7])*flag[12]

mov	eax,flag[8]
mov	ebx,flag[9]
mov	ecx,flag[10]
mov	edx,flag[12]
mov	eax,ecx+2*ebx+3*eax
mul	eax,edx
mov	flag[8],eax
//flag[8]=(flag[10]+2*flag[9]+3*flag[8])*flag[12]

mov	eax,flag[13]
mov	ebx,flag[19]
swap	eax,ebx
mov	flag[13],eax
mov	flag[19],ebx
//swap(flag[13],flag[19])

mov	eax,flag[14]
mov	ebx,flag[18]
swap	eax,ebx
mov	flag[14],eax
mov	flag[18],ebx
//swap(flag[14],flag[18])

mov	eax,flag[15]
mov	ebx,flag[17]
swap	eax,ebx
mov	flag[15],eax
mov	flag[17],ebx
//swap(flag[15],flag[17])

nop


进程已结束,退出代码0

汇总

//flag[0]^=flag[1]
//flag[1]^=flag[2]
//flag[2]^=flag[3]
//flag[3]^=flag[4]
//flag[4]^=flag[5]
//flag[5]^=flag[6]
//flag[6]=(flag[8]+2*flag[7]+3*flag[6])*flag[12]
//flag[7]=(flag[9]+2*flag[8]+3*flag[7])*flag[12]
//flag[8]=(flag[10]+2*flag[9]+3*flag[8])*flag[12]
//swap(flag[13],flag[19])
//swap(flag[14],flag[18])
//swap(flag[15],flag[17])

EXP

from z3 import *

x = [0x69, 0x45, 0x2A, 0x37, 0x09, 0x17, 0xC5, 0x0B, 0x5C, 0x72,
     0x33, 0x76, 0x33, 0x21, 0x74, 0x31, 0x5F, 0x33, 0x73, 0x72]
x[13], x[19] = x[19], x[13]
x[14], x[18] = x[18], x[14]
x[15], x[17] = x[17], x[15]
s = Solver()
flag = [BitVec("num[%d]" % i, 8) for i in range(len(x))]
for i in range(len(flag)):
    if i < 6:
        s.add(x[i] == flag[i] ^ flag[i + 1])
    elif 6 <= i < 9:
        s.add(x[i] == (flag[i + 2] + 2 * flag[i + 1] + 3 * flag[i]) * flag[12])
    elif 9 <= i:
        s.add(x[i] == flag[i])
if s.check() == sat:
    s = s.model()
    for i in flag:
        print(chr(s[i].as_long()), end='')