考点:tea,反调试
觉得不太一样的是:当调试到exit的时候,会退出,所以为了不让他退出,就nop掉
要nop3,4次
之后得到key的值
点入tea_encrypt,有tea加密过程
点enc有加密后的密文
那就开始写exp了,注意*(_DWORD *)的处理
#include <stdio.h>
#include <string.h>
#include <stdint.h>
int main(void)
{
unsigned int a1[]={0x0DAD5B6C5, 0x0CE5F717, 0x8BE8AF6B, 0x0D74C6EB4, 0x0EEB8B5A0, 0x0A07618E0, 0x1B425FD0, 0x0C0B77641, 0x0A30FA9BE,0x0CB4F5089, 0x0EBF9EC1D, 0x0F870EF3D};
int a2[] = {0x91,0x71,0x11,0xbb};
unsigned int v0,v1,i;
for (int k = 0; k < 12; k += 2)
{
v0 = a1[k];
v1 = a1[k + 1];
long delta = 0x79B99E37;
long sum = (32 * delta);
for (i = 0; i <= 31; ++i)
{
v1 -= (((v0 * 16) ^ (v0 >> 5)) + v0) ^ (sum + a2[(sum >> 11 ) & 3]);
sum -= delta;
v0 -= (((v1 * 16) ^ (v1 >> 5)) + v1) ^ (sum + a2[(sum & 3)]);
}
a1[k] = v0;
a1[k+1] = v1;
}
for (i = 0; i < 12; i++)
{
printf("%c",a1[i]);
}
}
// #_Ant!+Debu9