简单逆向13(angr,控制流平坦化)

诺莫13

开始

放入IDA：

查看流程视图
这是一个控制流平坦化

比较复杂的控制台流程，使用deflat.py（需要angr环境支持：安装教程）去平坦化后放入ida：

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char v3; // al
  char v4; // al
  char v5; // al
  char v6; // al
  char v8; // al
  char v9; // al
  char v10; // al
  char v11; // al
  char v12; // [rsp+A0h] [rbp-90h]
  char v13; // [rsp+A8h] [rbp-88h]
  char v14; // [rsp+B0h] [rbp-80h]
  char v15; // [rsp+B8h] [rbp-78h]
  char v16; // [rsp+C0h] [rbp-70h]
  char v17; // [rsp+C8h] [rbp-68h]
  char v18; // [rsp+CFh] [rbp-61h]
  int v19; // [rsp+D0h] [rbp-60h]
  int v20; // [rsp+D4h] [rbp-5Ch]
  int v21; // [rsp+D8h] [rbp-58h]
  int v22; // [rsp+DCh] [rbp-54h]
  char s[24]; // [rsp+E0h] [rbp-50h]
  char v24; // [rsp+F8h] [rbp-38h]
  char v25; // [rsp+100h] [rbp-30h]
  char v26; // [rsp+108h] [rbp-28h]
  char v27; // [rsp+110h] [rbp-20h]
  int v28; // [rsp+114h] [rbp-1Ch]
  const char **v29; // [rsp+118h] [rbp-18h]
  int v30; // [rsp+120h] [rbp-10h]
  int v31; // [rsp+124h] [rbp-Ch]
  int v32; // [rsp+128h] [rbp-8h]
  bool v33; // [rsp+12Eh] [rbp-2h]
  bool v34; // [rsp+12Fh] [rbp-1h]

  v31 = 0;
  v30 = argc;
  v29 = argv;
  v28 = time(0LL);
  puts("func(?)=\"01abfc750a0c942167651c40d088531d\"?");
  s[0] = getchar();
  fgets(&s[1], 21, stdin);
  v22 = time(0LL);
  v21 = v22 - v28;
  v32 = v22 - v28;
  if ( y >= 10 && (((_BYTE)x - 1) * (_BYTE)x & 1) != 0 )
    goto LABEL_14;
  while ( 1 )
  {
    v20 = strlen(s);
    v33 = v20 != 21;
    if ( y < 10 || (((_BYTE)x - 1) * (_BYTE)x & 1) == 0 )
      break;
LABEL_14:
    v20 = strlen(s);
  }
  if ( y >= 10 && (((_BYTE)x - 1) * (_BYTE)x & 1) != 0 )
    goto LABEL_15;
  while ( 1 )
  {
    v19 = 1;
    if ( y < 10 || (((_BYTE)x - 1) * (_BYTE)x & 1) == 0 )
      break;
LABEL_15:
    v19 = 1;
  }
  while ( v19 < 21 )
  {
    if ( y >= 10 && (((_BYTE)x - 1) * (_BYTE)x & 1) != 0 )
    {
      v18 = v21 ^ s[v19];
      v17 = main::$_0::operator() const((__int64)&v26, v18);
      v16 = main::$_1::operator() const(&v24, (unsigned int)s[v21 - 1 + v19]);
      v8 = main::$_1::operator() const(char)::{lambda(int)#1}::operator() const(&v16, 7);
      v18 = main::$_0::operator() const(char)::{lambda(char)#1}::operator() const((__int64)&v17, v8);
      v15 = main::$_2::operator() const((__int64)&v27, v18);
      v14 = main::$_2::operator() const((__int64)&v27, s[v21 - 1 + v19]);
      v9 = main::$_2::operator() const(char)::{lambda(char)#1}::operator() const(&v14, 18);
      v13 = main::$_3::operator() const(&v25, (unsigned int)v9);
      v10 = main::$_3::operator() const(char)::{lambda(char)#1}::operator() const(&v13, 3);
      v12 = main::$_0::operator() const((__int64)&v26, v10);
      v11 = main::$_0::operator() const(char)::{lambda(char)#1}::operator() const((__int64)&v12, 2);
      v18 = main::$_2::operator() const(char)::{lambda(char)#1}::operator() const(&v15, v11);
    }
    do
    {
      v18 = v21 ^ s[v19];
      v17 = main::$_0::operator() const((__int64)&v26, v18);
      v16 = main::$_1::operator() const(&v24, (unsigned int)s[v21 - 1 + v19]);
      v3 = main::$_1::operator() const(char)::{lambda(int)#1}::operator() const(&v16, 7);
      v18 = main::$_0::operator() const(char)::{lambda(char)#1}::operator() const((__int64)&v17, v3);
      v15 = main::$_2::operator() const((__int64)&v27, v18);
      v14 = main::$_2::operator() const((__int64)&v27, s[v21 - 1 + v19]);
      v4 = main::$_2::operator() const(char)::{lambda(char)#1}::operator() const(&v14, 18);
      v13 = main::$_3::operator() const(&v25, (unsigned int)v4);
      v5 = main::$_3::operator() const(char)::{lambda(char)#1}::operator() const(&v13, 3);
      v12 = main::$_0::operator() const((__int64)&v26, v5);
      v6 = main::$_0::operator() const(char)::{lambda(char)#1}::operator() const((__int64)&v12, 2);
      v18 = main::$_2::operator() const(char)::{lambda(char)#1}::operator() const(&v15, v6);
      v34 = enc[v19 - 1] != v18;
    }
    while ( v34 );
    while ( y >= 10 && (((_BYTE)x - 1) * (_BYTE)x & 1) != 0 )
      ;
    ++v19;
  }
  if ( y >= 10 && (((_BYTE)x - 1) * (_BYTE)x & 1) != 0 )
    goto LABEL_17;
  while ( 1 )
  {
    puts("You win");
    if ( y < 10 || (((_BYTE)x - 1) * (_BYTE)x & 1) == 0 )
      break;
LABEL_17:
    puts("You win");
  }
  return 0;
}

有部分混淆，勉强可以看

分析：

程序大概：
将输入的字符串经过处理，处理过后的字符v18 == enc[v19 - 1] ，就能输出You win。

数据：

enc数组

“func(?)=“01abfc750a0c942167651c40d088531d”?” 由提示得：第一个字符为#（md5）

解题：

写出逆向脚本：

enc=[0xf3,0x2e,0x18,0x36,0xe1,0x4c,0x22,0xd1,0xf9,0x8c,0x40,0x76,0xf4,0xe,0x0,0x5,0xa3,0x90,0xe,0xa5]
flag='#'
for i in range(0,20):
	flag+=chr(((enc[i]^((ord(flag[-1])^18)*3+2))-(ord(flag[-1])%7)) &0xff)
print(flag)