Angr-CTF学习笔记6-10

最新推荐文章于 2023-04-17 11:20:54 发布

C-haidragon

最新推荐文章于 2023-04-17 11:20:54 发布

阅读量128

点赞数

分类专栏： ctf 渗透文章标签：学习 java javascript

原文链接：https://github.com/haidragon

版权

渗透同时被 2 个专栏收录

5 篇文章 0 订阅

订阅专栏

ctf

4 篇文章 0 订阅

订阅专栏

06_angr_symbolic_dynamic_memory

汇编代码:

.text:08048621                 push    9               ; size
.text:08048623                 call    _malloc
.text:08048628                 add     esp, 10h
.text:0804862B                 mov     ds:buffer0, eax
.text:08048630                 sub     esp, 0Ch
.text:08048633                 push    9               ; size
.text:08048635                 call    _malloc
.text:0804863A                 add     esp, 10h
.text:0804863D                 mov     ds:buffer1, eax
.text:08048642                 mov     eax, ds:buffer0
.text:08048647                 sub     esp, 4
.text:0804864A                 push    9               ; n
.text:0804864C                 push    0               ; c
.text:0804864E                 push    eax             ; s
.text:0804864F                 call    _memset
.text:08048654                 add     esp, 10h
.text:08048657                 mov     eax, ds:buffer1
.text:0804865C                 sub     esp, 4
.text:0804865F                 push    9               ; n
.text:08048661                 push    0               ; c
.text:08048663                 push    eax             ; s
.text:08048664                 call    _memset
.text:08048669                 add     esp, 10h
.text:0804866C                 sub     esp, 0Ch
.text:0804866F                 push    offset aEnterThePasswo ; "Enter the password: "
.text:08048674                 call    _printf
.text:08048679                 add     esp, 10h
.text:0804867C                 mov     edx, ds:buffer1
.text:08048682                 mov     eax, ds:buffer0
.text:08048687                 sub     esp, 4
.text:0804868A                 push    edx
.text:0804868B                 push    eax
.text:0804868C                 push    offset a8s8s    ; "%8s %8s"
.text:08048691                 call    ___isoc99_scanf

这次scanf() 有两个输入参数,数据保存的位置是通过全局变量的char* 指针来保存到buffer 中,大小为8 字节.

.text:08048699                 mov     [ebp+var_C], 0
.text:080486A0                 jmp     short loc_8048706
.text:080486A2 ; ---------------------------------------------------------------------------
.text:080486A2
.text:080486A2 loc_80486A2:                            ; CODE XREF: main+FE↓j
.text:080486A2                 mov     edx, ds:buffer0
.text:080486A8                 mov     eax, [ebp+var_C]
.text:080486AB                 lea     ebx, [edx+eax]
.text:080486AE                 mov     edx, ds:buffer0
.text:080486B4                 mov     eax, [ebp+var_C]
.text:080486B7                 add     eax, edx
.text:080486B9                 movzx   eax, byte ptr [eax]
.text:080486BC                 movsx   eax, al
.text:080486BF                 sub     esp, 8
.text:080486C2                 push    [ebp+var_C]
.text:080486C5                 push    eax
.text:080486C6                 call    complex_function
.text:080486CB                 add     esp, 10h
.text:080486CE                 mov     [ebx], al
.text:080486D0                 mov     edx, ds:buffer1
.text:080486D6                 mov     eax, [ebp+var_C]
.text:080486D9                 lea     ebx, [edx+eax]
.text:080486DC                 mov     eax, [ebp+var_C]
.text:080486DF                 lea     edx, [eax+20h]
.text:080486E2                 mov     ecx, ds:buffer1
.text:080486E8                 mov     eax, [ebp+var_C]
.text:080486EB                 add     eax, ecx
.text:080486ED                 movzx   eax, byte ptr [eax]
.text:080486F0                 movsx   eax, al
.text:080486F3                 sub     esp, 8
.text:080486F6                 push    edx
.text:080486F7                 push    eax
.text:080486F8                 call    complex_function
.text:080486FD                 add     esp, 10h
.text:08048700                 mov     [ebx], al
.text:08048702                 add     [ebp+var_C], 1
.text:08048706
.text:08048706 loc_8048706:                            ; CODE XREF: main+94↑j
.text:08048706                 cmp     [ebp+var_C], 7
.text:0804870A                 jle     short loc_80486A2

接下来就到了complex_function 运算的地方了,我们主要是对buffer0 和buffer1 指向的内存做求解.

.bss:09FD92AC buffer0         dd ?                    ; DATA XREF: main+1F↑w
.bss:09FD92AC                                         ; main+36↑r ...
.bss:09FD92B0                 public buffer3
.bss:09FD92B0 buffer3         db    ? ;
.bss:09FD92B1                 db    ? ;
.bss:09FD92B2                 db    ? ;
.bss:09FD92B3                 db    ? ;

所以,我们在利用 initial_state.memory.store() 构造内存时,还需要在里面填入指向保存数据的地址,Angr可以不用创建新内存(malloc),直接指向内存中一个任意位置即可,所以我们写0x4444440 和0x44444450 到buffer0 和buffer1 的内存中.

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  start_address = 0x8048699
  initial_state = project.factory.blank_state(addr=start_address)

  password0 = claripy.BVS('password0', 4 * 8)
  password1 = claripy.BVS('password1', 4 * 8)

  fake_heap_address0 = 0x4444440
  pointer_to_malloc_memory_address0 = 0x9FD92AC
  initial_state.memory.store(pointer_to_malloc_memory_address0,fake_heap_address0, endness=project.arch.memory_endness)
  fake_heap_address1 = 0x4444450
  pointer_to_malloc_memory_address1 = 0x9FD92B0
  initial_state.memory.store(pointer_to_malloc_memory_address1,fake_heap_address1, endness=project.arch.memory_endness)

  initial_state.memory.store(fake_heap_address0, password0)
  initial_state.memory.store(fake_heap_address1, password1)

  simulation = project.factory.simgr(initial_state)

  simulation.explore(find=0x8048759, avoid=0x8048747)

  if simulation.found:
    solution_state = simulation.found[0]

    solution0 = solution_state.se.eval(password0)
    solution1 = solution_state.se.eval(password1)

    solution = ' '.join(map('{:x}'.format, [ solution0, solution1 ]))

    print(solution)

Angr函数使用总结:

initial_state.memory.store(地址,数据,endness = 数据字节顺序) => 设置初始化内存数据

project.arch.memory_endness => 指的是内存字节顺序

07_angr_symbolic_file

汇编代码:

.text:0804888E                 push    40h             ; n
.text:08048890                 push    0               ; c
.text:08048892                 push    offset buffer   ; s
.text:08048897                 call    _memset
.text:0804889C                 add     esp, 10h
.text:0804889F                 sub     esp, 0Ch
.text:080488A2                 push    offset aEnterThePasswo ; "Enter the password: "
.text:080488A7                 call    _printf
.text:080488AC                 add     esp, 10h
.text:080488AF                 sub     esp, 8
.text:080488B2                 push    offset buffer
.text:080488B7                 push    offset a64s     ; "%64s"
.text:080488BC                 call    ___isoc99_scanf
.text:080488C1                 add     esp, 10h
.text:080488C4                 sub     esp, 8
.text:080488C7                 push    40h             ; n
.text:080488C9                 push    offset buffer   ; int
.text:080488CE                 call    ignore_me
.text:080488D3                 add     esp, 10h
.text:080488D6                 sub     esp, 4
.text:080488D9                 push    40h             ; n
.text:080488DB                 push    0               ; c
.text:080488DD                 push    offset buffer   ; s
.text:080488E2                 call    _memset
.text:080488E7                 add     esp, 10h
.text:080488EA                 sub     esp, 8
.text:080488ED                 push    offset aRb      ; "rb"
.text:080488F2                 push    offset name     ; "MRXJKZYR.txt"
.text:080488F7                 call    _fopen
.text:080488FC                 add     esp, 10h
.text:080488FF                 mov     ds:fp, eax
.text:08048904                 mov     eax, ds:fp
.text:08048909                 push    eax             ; stream
.text:0804890A                 push    40h             ; n
.text:0804890C                 push    1               ; size
.text:0804890E                 push    offset buffer   ; ptr
.text:08048913                 call    _fread
.text:08048918                 add     esp, 10h
.text:0804891B                 mov     eax, ds:fp
.text:08048920                 sub     esp, 0Ch
.text:08048923                 push    eax             ; stream
.text:08048924                 call    _fclose
.text:08048929                 add     esp, 10h
.text:0804892C                 sub     esp, 0Ch
.text:0804892F                 push    offset name     ; "MRXJKZYR.txt"
.text:08048934                 call    _unlink

程序逻辑是用户输入一串Key之后,经过计算保存到文件里(在ignore_me() 里面实现),然后通过fread() 读取文件获取数据.Angr库中有一个模拟的文件系统,我们可以通过这个文件系统来模拟fread() 出来的数据,继续往下看汇编

.text:0804893C                 mov     [ebp+var_C], 0
.text:08048943                 jmp     short loc_8048972
.text:08048945 ; ---------------------------------------------------------------------------
.text:08048945
.text:08048945 loc_8048945:                            ; CODE XREF: main+FC↓j
.text:08048945                 mov     eax, [ebp+var_C]
.text:08048948                 add     eax, 804A0A0h
.text:0804894D                 movzx   eax, byte ptr [eax]  ;  生成数据
.text:08048950                 movsx   eax, al
.text:08048953                 sub     esp, 8
.text:08048956                 push    [ebp+var_C]
.text:08048959                 push    eax
.text:0804895A                 call    complex_function
.text:0804895F                 add     esp, 10h
.text:08048962                 mov     edx, eax
.text:08048964                 mov     eax, [ebp+var_C]
.text:08048967                 add     eax, 804A0A0h
.text:0804896C                 mov     [eax], dl
.text:0804896E                 add     [ebp+var_C], 1
.text:08048972
.text:08048972 loc_8048972:                            ; CODE XREF: main+C9↑j
.text:08048972                 cmp     [ebp+var_C], 7
.text:08048976                 jle     short loc_8048945
.text:08048978                 sub     esp, 4
.text:0804897B                 push    9               ; n
.text:0804897D                 push    offset s2       ; "UKNRZDIR"
.text:08048982                 push    offset buffer   ; s1
.text:08048987                 call    _strncmp
.text:0804898C                 add     esp, 10h
.text:0804898F                 test    eax, eax
.text:08048991                 jz      short loc_80489AD  ;  校验用户输入和生成数据
.text:08048993                 sub     esp, 0Ch
.text:08048996                 push    offset s        ; "Try again."
.text:0804899B                 call    _puts
.text:080489A0                 add     esp, 10h
.text:080489A3                 sub     esp, 0Ch
.text:080489A6                 push    1               ; status
.text:080489A8                 call    _exit
.text:080489AD ; ---------------------------------------------------------------------------
.text:080489AD
.text:080489AD loc_80489AD:                            ; CODE XREF: main+117↑j
.text:080489AD                 sub     esp, 0Ch
.text:080489B0                 push    offset aGoodJob ; "Good Job."
.text:080489B5                 call    _puts
.text:080489BA                 add     esp, 10h
.text:080489BD                 sub     esp, 0Ch
.text:080489C0                 push    0               ; status
.text:080489C2                 call    _exit

这段代码并没有什么特别之处,只是简单地对进行数据生成和校验然后输出判断结果.那么现在我们使用Angr的文件系统来进行求解

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  start_address = 0x80488D6
  initial_state = project.factory.blank_state(addr=start_address)

  filename = 'MRXJKZYR.txt'  # :string
  symbolic_file_size_bytes = 0x40

  password = claripy.BVS('password', symbolic_file_size_bytes * 8)

  password_file = angr.storage.SimFile(filename, password, size=symbolic_file_size_bytes) # 模拟读文件,默认的文件内容是password,文件大小是symbolic_file_size_bytes

  symbolic_filesystem = {
    filename : password_file
  }
  initial_state.posix.fs = symbolic_filesystem # 构建状态上下文里的文件系统数据

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Good Job' in str(stdout_output)

  def should_abort(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Try again' in str(stdout_output)

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:
    solution_state = simulation.found[0]

    solution = solution_state.se.eval(password)#,cast_to=str)

    print(solution)

我们也可以继续用旧的内存跟踪的方法来做,示例代码如下

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  start_address = 0x804893C
  initial_state = project.factory.blank_state(addr=start_address)

  password = claripy.BVS('password', 0x40 * 8)

  initial_state.memory.store(0x804A0A0, password)

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Good Job' in str(stdout_output)

  def should_abort(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Try again' in str(stdout_output)

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:
    solution_state = simulation.found[0]

    solution = solution_state.se.eval(password)

    print(solution)

注意事项:

在Angr-CTF 的解题Python 文件中,我们直接执行程序可能会遇到下面这个结果

Traceback (most recent call last):
File “solve07.py”, line 130, in
main(sys.argv)
File “solve07.py”, line 91, in main
password_file = angr.storage.SimFile(filename, file_options, content=symbolic_file_backing_memory, size=symbolic_file_size_bytes)
TypeError: init() got multiple values for argument ‘content’

这是因为Angr-CTF 是使用旧版的Angr 库来实现的,现在SimFile() 函数的声明已经被修改如下

SimFile(name, content=None**,** size=None**,** has_end=None**,** seekable=True**,** writable=True**,** ident=None**,** concrete=None**,** kwargs)

也就是说,SimFile 的第二个参数不再是file_options 了,所以我们可以看到SimFile() 提示content 参数被传递了两个参数;而且新版的SimFile() 函数的content 参数只接受字符串或者BitVector ,所以用solution 中的解题脚本会出问题是因为它传递的是内存对象而不是BitVector ,于是代码修改如下

password_file = angr.storage.SimFile(filename, password, size=symbolic_file_size_bytes)

Angr函数使用总结:

angr.storage.SimFile(文件名,文件内容, size = 文件大小) => 创建一个模拟文件,当有被执行的程序fopen 打开文件时,我们可以控制其里面的内容

initial_state.posix.fs => 状态上下文的文件系统对象

08_angr_constraints

汇编代码:

.text:080485C4                 mov     ds:password, 4A58524Dh  ;  这个是全局变量:0x804A040
.text:080485CE                 mov     ds:dword_804A044, 52595A4Bh
.text:080485D8                 mov     ds:dword_804A048, 454B4D4Bh
.text:080485E2                 mov     ds:dword_804A04C, 425A464Eh
.text:080485EC                 sub     esp, 4
.text:080485EF                 push    11h             ; n
.text:080485F1                 push    0               ; c
.text:080485F3                 push    offset buffer   ; s
.text:080485F8                 call    _memset
.text:080485FD                 add     esp, 10h
.text:08048600                 sub     esp, 0Ch
.text:08048603                 push    offset aEnterThePasswo ; "Enter the password: "
.text:08048608                 call    _printf
.text:0804860D                 add     esp, 10h
.text:08048610                 sub     esp, 8
.text:08048613                 push    offset buffer
.text:08048618                 push    offset a16s     ; "%16s"
.text:0804861D                 call    ___isoc99_scanf  ;  用户输入,这个也是全局变量:0x804A050
.text:08048622                 add     esp, 10h
.text:08048625                 mov     [ebp+var_C], 0
.text:0804862C                 jmp     short loc_8048663
.text:0804862E ; ---------------------------------------------------------------------------
.text:0804862E
.text:0804862E loc_804862E:                            ; CODE XREF: main+B4↓j
.text:0804862E                 mov     eax, 0Fh
.text:08048633                 sub     eax, [ebp+var_C]
.text:08048636                 mov     edx, eax
.text:08048638                 mov     eax, [ebp+var_C]
.text:0804863B                 add     eax, 804A050h
.text:08048640                 movzx   eax, byte ptr [eax]
.text:08048643                 movsx   eax, al
.text:08048646                 sub     esp, 8
.text:08048649                 push    edx
.text:0804864A                 push    eax
.text:0804864B                 call    complex_function  ;  对用户输入进行计算
.text:08048650                 add     esp, 10h
.text:08048653                 mov     edx, eax
.text:08048655                 mov     eax, [ebp+var_C]
.text:08048658                 add     eax, 804A050h
.text:0804865D                 mov     [eax], dl
.text:0804865F                 add     [ebp+var_C], 1
.text:08048663
.text:08048663 loc_8048663:                            ; CODE XREF: main+79↑j
.text:08048663                 cmp     [ebp+var_C], 0Fh
.text:08048667                 jle     short loc_804862E
.text:08048669                 sub     esp, 8
.text:0804866C                 push    10h
.text:0804866E                 push    offset buffer
.text:08048673                 call    check_equals_MRXJKZYRKMKENFZB  ;  check_equals() 函数是把buffer 和password 来对比
.text:08048678                 add     esp, 10h
.text:0804867B                 test    eax, eax
.text:0804867D                 jnz     short loc_8048691  ;  对比校验结果
.text:0804867F                 sub     esp, 0Ch
.text:08048682                 push    offset s        ; "Try again."
.text:08048687                 call    _puts
.text:0804868C                 add     esp, 10h
.text:0804868F                 jmp     short loc_80486A1
.text:08048691 ; ---------------------------------------------------------------------------
.text:08048691
.text:08048691 loc_8048691:                            ; CODE XREF: main+CA↑j
.text:08048691                 sub     esp, 0Ch
.text:08048694                 push    offset aGoodJob ; "Good Job."
.text:08048699                 call    _puts
.text:0804869E                 add     esp, 10h
.text:080486A1

主要的思路是把complex_function() 计算的结果和字符串MRXJKZYRKMKENFZB 来做对比,我们假定complex_function() 的输入是未知的,check_equals() 函数中对比的内容是已知的,那么我们的关注点就在于对输入进行求解.

首先第一步,我们需要在complex_function() 循环计算之后(地址0x804866C)就可以得到buffer 的符号执行内容,接下来我们需要根据buffer 的内容和对比的字符串MRXJKZYRKMKENFZB来计算是否有满足的解.

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  start_address = 0x8048625  #  scanf() 之后的位置
  initial_state = project.factory.blank_state(addr=start_address)

  buffer = claripy.BVS('buffer', 0x10* 8)  #  buffer的大小是0x10 字节,也就是0x10 * 8 比特
  buffer_address = 0x804A050
  initial_state.memory.store(buffer_address, buffer)  #  buffer 是全局变量,地址是0x804A050

  simulation = project.factory.simgr(initial_state)
  address_to_check_constraint = 0x804866C
  simulation.explore(find=address_to_check_constraint)  #  compilex_function() 计算结束位置

  if simulation.found:
    solution_state = simulation.found[0]

    constrained_parameter_address = 0x804A050  #  计算约束的内存位置
    constrained_parameter_size_bytes = 0x10    #  计算约束的内存大小
    constrained_parameter_bitvector = solution_state.memory.load(  #  加载内存
      constrained_parameter_address,
      constrained_parameter_size_bytes
    )

    constrained_parameter_desired_value = 'MRXJKZYRKMKENFZB' #  Key-String

    solution_state.add_constraints(constrained_parameter_bitvector == constrained_parameter_desired_value)  #  添加约束条件使用求解器求解内存中的bitvector 和Key-String 相等时是否有满足的解

    solution = solution_state.se.eval(buffer)

    print(solution)

Angr函数使用总结:

solution_state.memory.load(内存地址,内存大小) => 加载内存

solution_state.add_constraints(约束条件) => 添加约束条件

09_angr_hooks

汇编代码:

.text:08048604                 mov     ds:password, 4A58524Dh
.text:0804860E                 mov     ds:dword_804A048, 52595A4Bh
.text:08048618                 mov     ds:dword_804A04C, 454B4D4Bh
.text:08048622                 mov     ds:dword_804A050, 425A464Eh  ;  Key-String
.text:0804862C                 sub     esp, 4
.text:0804862F                 push    11h             ; n
.text:08048631                 push    0               ; c
.text:08048633                 push    offset buffer   ; s
.text:08048638                 call    _memset         
.text:0804863D                 add     esp, 10h
.text:08048640                 sub     esp, 0Ch
.text:08048643                 push    offset aEnterThePasswo ; "Enter the password: "
.text:08048648                 call    _printf
.text:0804864D                 add     esp, 10h
.text:08048650                 sub     esp, 8
.text:08048653                 push    offset buffer
.text:08048658                 push    offset a16s     ; "%16s"
.text:0804865D                 call    ___isoc99_scanf ; 用户输入Key
.text:08048662                 add     esp, 10h
.text:08048665                 mov     [ebp+var_10], 0
.text:0804866C                 jmp     short loc_80486A3
.text:0804866E ; ---------------------------------------------------------------------------
.text:0804866E
.text:0804866E loc_804866E:                            ; CODE XREF: main+B4↓j
.text:0804866E                 mov     eax, 12h
.text:08048673                 sub     eax, [ebp+var_10]
.text:08048676                 mov     edx, eax
.text:08048678                 mov     eax, [ebp+var_10]
.text:0804867B                 add     eax, 804A054h   ;  这个地址是用户输入buffer
.text:08048680                 movzx   eax, byte ptr [eax]
.text:08048683                 movsx   eax, al
.text:08048686                 sub     esp, 8
.text:08048689                 push    edx
.text:0804868A                 push    eax
.text:0804868B                 call    complex_function  ;  对用户输入进行计算
.text:08048690                 add     esp, 10h
.text:08048693                 mov     edx, eax
.text:08048695                 mov     eax, [ebp+var_10]
.text:08048698                 add     eax, 804A054h
.text:0804869D                 mov     [eax], dl
.text:0804869F                 add     [ebp+var_10], 1
.text:080486A3
.text:080486A3 loc_80486A3:                            ; CODE XREF: main+79↑j
.text:080486A3                 cmp     [ebp+var_10], 0Fh
.text:080486A7                 jle     short loc_804866E  ;  这是一个循环complex_function() 计算
.text:080486A9                 sub     esp, 8
.text:080486AC                 push    10h
.text:080486AE                 push    offset buffer
.text:080486B3                 call    check_equals_MRXJKZYRKMKENFZB  ;  check_equals() 对比结果
.text:080486B8                 add     esp, 10h
.text:080486BB                 mov     ds:equals, eax  ;  check_equals 的结果保存在全局变量equals里
.text:080486C0                 mov     [ebp+var_C], 0
.text:080486C7                 jmp     short loc_80486FA
.text:080486C9 ; ---------------------------------------------------------------------------
.text:080486C9
.text:080486C9 loc_80486C9:                            ; CODE XREF: main+10B↓j
.text:080486C9                 mov     eax, [ebp+var_C]
.text:080486CC                 lea     edx, [eax+9]
.text:080486CF                 mov     eax, [ebp+var_C]
.text:080486D2                 add     eax, 804A044h  ;  这个是Key-String
.text:080486D7                 movzx   eax, byte ptr [eax]
.text:080486DA                 movsx   eax, al
.text:080486DD                 sub     esp, 8
.text:080486E0                 push    edx
.text:080486E1                 push    eax
.text:080486E2                 call    complex_function  ;  这次是对Key-String 进行计算了
.text:080486E7                 add     esp, 10h
.text:080486EA                 mov     edx, eax
.text:080486EC                 mov     eax, [ebp+var_C]
.text:080486EF                 add     eax, 804A044h
.text:080486F4                 mov     [eax], dl
.text:080486F6                 add     [ebp+var_C], 1
.text:080486FA
.text:080486FA loc_80486FA:                            ; CODE XREF: main+D4↑j
.text:080486FA                 cmp     [ebp+var_C], 0Fh
.text:080486FE                 jle     short loc_80486C9  ;  comp
.text:08048700                 sub     esp, 8
.text:08048703                 push    offset buffer
.text:08048708                 push    offset a16s     ; "%16s"
.text:0804870D                 call    ___isoc99_scanf
.text:08048712                 add     esp, 10h
.text:08048715                 mov     eax, ds:equals
.text:0804871A                 test    eax, eax
.text:0804871C                 jz      short loc_8048740  ;  对比第二次用户输入
.text:0804871E                 sub     esp, 4
.text:08048721                 push    10h             ; n
.text:08048723                 push    offset password ; s2
.text:08048728                 push    offset buffer   ; s1
.text:0804872D                 call    _strncmp
.text:08048732                 add     esp, 10h
.text:08048735                 test    eax, eax
.text:08048737                 jnz     short loc_8048740
.text:08048739                 mov     eax, 1
.text:0804873E                 jmp     short loc_8048745
.text:08048740 ; ---------------------------------------------------------------------------
.text:08048740
.text:08048740 loc_8048740:                            ; CODE XREF: main+129↑j
.text:08048740                                         ; main+144↑j
.text:08048740                 mov     eax, 0
.text:08048745
.text:08048745 loc_8048745:                            ; CODE XREF: main+14B↑j
.text:08048745                 mov     ds:equals, eax
.text:0804874A                 mov     eax, ds:equals
.text:0804874F                 test    eax, eax
.text:08048751                 jnz     short loc_8048765
.text:08048753                 sub     esp, 0Ch
.text:08048756                 push    offset s        ; "Try again."
.text:0804875B                 call    _puts
.text:08048760                 add     esp, 10h
.text:08048763                 jmp     short loc_8048775
.text:08048765 ; ---------------------------------------------------------------------------
.text:08048765
.text:08048765 loc_8048765:                            ; CODE XREF: main+15E↑j
.text:08048765                 sub     esp, 0Ch
.text:08048768                 push    offset aGoodJob ; "Good Job."
.text:0804876D                 call    _puts
.text:08048772                 add     esp, 10h

由上面的代码我们可以知道基本的逻辑,第一部分是对用户输入进行complex_function() 计算,然后把计算结果传给check_equals() 检查对比;第二部分是把Key-String 传递给complex_function() 计算,再通过第二次用户输入来进行结果对比.

我们来看一下check_equals() 函数的代码,check_equals() 函数主要功能是对比complex_function() 函数计算结果和Key-String 进行对比,相等则返回1 ,不相等返回0 .

.text:080485A5 check_equals_MRXJKZYRKMKENFZB proc near ; CODE XREF: main+C0↓p
.text:080485A5
.text:080485A5 var_8           = dword ptr -8
.text:080485A5 var_4           = dword ptr -4
.text:080485A5 arg_0           = dword ptr  8
.text:080485A5 arg_4           = dword ptr  0Ch
.text:080485A5
.text:080485A5 ; __unwind {
.text:080485A5                 push    ebp
.text:080485A6                 mov     ebp, esp
.text:080485A8                 sub     esp, 10h
.text:080485AB                 mov     [ebp+var_8], 0
.text:080485B2                 mov     [ebp+var_4], 0
.text:080485B9                 jmp     short loc_80485DD
.text:080485BB ; ---------------------------------------------------------------------------
.text:080485BB
.text:080485BB loc_80485BB:                            ; CODE XREF: check_equals_MRXJKZYRKMKENFZB+3E↓j
.text:080485BB                 mov     edx, [ebp+var_4]
.text:080485BE                 mov     eax, [ebp+arg_0]
.text:080485C1                 add     eax, edx
.text:080485C3                 movzx   edx, byte ptr [eax]
.text:080485C6                 mov     eax, [ebp+var_4]
.text:080485C9                 add     eax, 804A044h  ;  Key-String ..
.text:080485CE                 movzx   eax, byte ptr [eax]
.text:080485D1                 cmp     dl, al
.text:080485D3                 jnz     short loc_80485D9
.text:080485D5                 add     [ebp+var_8], 1
.text:080485D9
.text:080485D9 loc_80485D9:                            ; CODE XREF: check_equals_MRXJKZYRKMKENFZB+2E↑j
.text:080485D9                 add     [ebp+var_4], 1
.text:080485DD
.text:080485DD loc_80485DD:                            ; CODE XREF: check_equals_MRXJKZYRKMKENFZB+14↑j
.text:080485DD                 mov     eax, [ebp+var_4]
.text:080485E0                 cmp     eax, [ebp+arg_4]
.text:080485E3                 jb      short loc_80485BB
.text:080485E5                 mov     eax, [ebp+var_8]
.text:080485E8                 cmp     eax, [ebp+arg_4]
.text:080485EB                 setz    al
.text:080485EE                 movzx   eax, al
.text:080485F1                 leave
.text:080485F2                 retn
.text:080485F2 ; } // starts at 80485A5

在这一题里,使用的方法是Angr Hook .那么我们需要设计一个Hook check_equals() 函数来模拟它的功能.Hook 的插入位置在.text:080486B3 call check_equals_MRXJKZYRKMKENFZB .

根据这些信息,构造的solver.py 代码如下:


def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  initial_state = project.factory.entry_state()

  check_equals_called_address = 0x80486B3  #  Hook Call Address
  instruction_to_skip_length = 0x5         #  Call instruction length

  @project.hook(check_equals_called_address, length=instruction_to_skip_length)
  def skip_check_equals_(state):
    user_input_buffer_address = 0x804A054  #  The input buffer address
    user_input_buffer_length = 0x10        #  input buffer length

    user_input_string = state.memory.load( #  load this buffer to check 
      user_input_buffer_address,
      user_input_buffer_length
    )

    check_against_string = 'MRXJKZYRKMKENFZB' # :string

    state.regs.eax = claripy.If(           #  Add a constraint .
      user_input_string == check_against_string,  #  Check condition
      claripy.BVV(1, 32),                  #  The condition is True than return a int value 1
      claripy.BVV(0, 32)                   #  The condition is False than return a int value 0
    )

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Good Job' in str(stdout_output)

  def should_abort(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Try again' in str(stdout_output)

  simulation.explore(find=is_successful, avoid=should_abort)  #  Try Explore Execute Path

  if simulation.found:
    solution_state = simulation.found[0]
    solution = solution_state.posix.dumps(sys.stdin.fileno())  #  Get data ..

    print(solution)

Angr函数使用总结:

Hook回调函数格式:

@project.hook(Hook地址,执行完Hook函数后指令往后跳转n字节)
def skip_check_equals_(state):

pass

claripy.If(条件,条件为True时的返回值,条件为False时的返回值) => 创建条件判断

claripy.BVV(值,值大小) => 创建一个数值

10_angr_simprocedures

汇编代码:

.text:08048678                 push    10h             ; n
.text:0804867A                 push    offset aMrxjkzyrkmkenf ; "MRXJKZYRKMKENFZB"
.text:0804867F                 push    offset password ; dest
.text:08048684                 call    _memcpy         ;  Key-String = MRXJKZYRKMKENFZB
.text:08048689                 add     esp, 10h
.text:0804868C                 sub     esp, 4
.text:0804868F                 push    11h             ; n
.text:08048691                 push    0               ; c
.text:08048693                 lea     eax, [ebp+s]
.text:08048696                 push    eax             ; s
.text:08048697                 call    _memset         ;  注意这次buffer 是在栈上的
.text:0804869C                 add     esp, 10h
.text:0804869F                 sub     esp, 0Ch
.text:080486A2                 push    offset aEnterThePasswo ; "Enter the password: "
.text:080486A7                 call    _printf
.text:080486AC                 add     esp, 10h
.text:080486AF                 sub     esp, 8
.text:080486B2                 lea     eax, [ebp+s]
.text:080486B5                 push    eax
.text:080486B6                 push    offset a16s     ; "%16s"
.text:080486BB                 call    ___isoc99_scanf ;  用户输入16 字节大小的内容
.text:080486C0                 add     esp, 10h
.text:080486C3                 mov     [ebp+var_28], 0
.text:080486CA                 jmp     short loc_8048701
.text:080486CC ; ---------------------------------------------------------------------------
.text:080486CC
.text:080486CC loc_80486CC:                            ; CODE XREF: main+C2↓j
.text:080486CC                 mov     eax, 12h
.text:080486D1                 sub     eax, [ebp+var_28]
.text:080486D4                 mov     edx, eax
.text:080486D6                 lea     ecx, [ebp+s]
.text:080486D9                 mov     eax, [ebp+var_28]
.text:080486DC                 add     eax, ecx
.text:080486DE                 movzx   eax, byte ptr [eax]
.text:080486E1                 movsx   eax, al
.text:080486E4                 sub     esp, 8
.text:080486E7                 push    edx
.text:080486E8                 push    eax
.text:080486E9                 call    complex_function  ;  这是复杂的complex_function() 计算操作
.text:080486EE                 add     esp, 10h
.text:080486F1                 mov     ecx, eax
.text:080486F3                 lea     edx, [ebp+s]
.text:080486F6                 mov     eax, [ebp+var_28]
.text:080486F9                 add     eax, edx
.text:080486FB                 mov     [eax], cl
.text:080486FD                 add     [ebp+var_28], 1
.text:08048701
.text:08048701 loc_8048701:                            ; CODE XREF: main+87↑j
.text:08048701                 cmp     [ebp+var_28], 0Fh
.text:08048705                 jle     short loc_80486CC
.text:08048707                 cmp     [ebp+var_24], 0DEADBEEFh
.text:0804870E                 jz      loc_8049847
.text:08048714                 cmp     [ebp+var_24], 0DEADBEEFh
.text:0804871B                 jnz     loc_8048FB4
.text:08048721                 cmp     [ebp+var_24], 0DEADBEEFh
.text:08048728                 jnz     loc_8048B71
.text:0804872E                 cmp     [ebp+var_24], 0DEADBEEFh
.text:08048735                 jnz     loc_8048956
.text:0804873B                 cmp     [ebp+var_24], 0DEADBEEFh
.text:08048742                 jz      loc_804884F
.text:08048748                 cmp     [ebp+var_24], 0DEADBEEFh
.text:0804874F                 jz      short loc_80487D0
.text:08048751                 cmp     [ebp+var_24], 0DEADBEEFh
.text:08048758                 jnz     short loc_8048795
.text:0804875A                 cmp     [ebp+var_24], 0DEADBEEFh
.text:08048761                 jz      short loc_804877C

代码的第一部分对用户输入做了一系列复杂的计算操作之后,然后就分别跳转到不同的位置,最后执行check_equals() 函数进行数据校验.

.text:08048758                 jnz     short loc_8048795
.text:0804875A                 cmp     [ebp+var_24], 0DEADBEEFh
.text:08048761                 jz      short loc_804877C
.text:08048763                 sub     esp, 8
.text:08048766                 push    10h
.text:08048768                 lea     eax, [ebp+s]
.text:0804876B                 push    eax
.text:0804876C                 call    check_equals_MRXJKZYRKMKENFZB
.text:08048771                 add     esp, 10h
.text:08048774                 mov     [ebp+var_2C], eax
.text:08048777                 jmp     loc_804A969
.text:0804877C ; ---------------------------------------------------------------------------
.text:0804877C
.text:0804877C loc_804877C:                            ; CODE XREF: main+11E↑j
.text:0804877C                 sub     esp, 8
.text:0804877F                 push    10h
.text:08048781                 lea     eax, [ebp+s]
.text:08048784                 push    eax
.text:08048785                 call    check_equals_MRXJKZYRKMKENFZB
.text:0804878A                 add     esp, 10h
.text:0804878D                 mov     [ebp+var_2C], eax
.text:08048790                 jmp     loc_804A969
.text:08048795 ; ---------------------------------------------------------------------------
.text:08048795
.text:08048795 loc_8048795:                            ; CODE XREF: main+115↑j
.text:08048795                 cmp     [ebp+var_24], 0DEADBEEFh
.text:0804879C                 jz      short loc_80487B7
.text:0804879E                 sub     esp, 8
.text:080487A1                 push    10h
.text:080487A3                 lea     eax, [ebp+s]
.text:080487A6                 push    eax
.text:080487A7                 call    check_equals_MRXJKZYRKMKENFZB
.text:080487AC                 add     esp, 10h
.text:080487AF                 mov     [ebp+var_2C], eax
.text:080487B2                 jmp     loc_804A969
.text:080487B7 ; ---------------------------------------------------------------------------
.text:080487B7
.text:080487B7 loc_80487B7:                            ; CODE XREF: main+159↑j
.text:080487B7                 sub     esp, 8
.text:080487BA                 push    10h
.text:080487BC                 lea     eax, [ebp+s]
.text:080487BF                 push    eax
.text:080487C0                 call    check_equals_MRXJKZYRKMKENFZB
.text:080487C5                 add     esp, 10h
.text:080487C8                 mov     [ebp+var_2C], eax
.text:080487CB                 jmp     loc_804A969

那么我们来看看check_equals() 的代码:

.text:080485F5 check_equals_MRXJKZYRKMKENFZB proc near ; CODE XREF: main+129↓p
.text:080485F5                                         ; main+142↓p ...
.text:080485F5
.text:080485F5 var_8           = dword ptr -8
.text:080485F5 var_4           = dword ptr -4
.text:080485F5 arg_0           = dword ptr  8
.text:080485F5 arg_4           = dword ptr  0Ch
.text:080485F5
.text:080485F5 ; __unwind {
.text:080485F5                 push    ebp
.text:080485F6                 mov     ebp, esp
.text:080485F8                 sub     esp, 10h
.text:080485FB                 mov     [ebp+var_8], 0
.text:08048602                 mov     [ebp+var_4], 0
.text:08048609                 jmp     short loc_804862D
.text:0804860B ; ---------------------------------------------------------------------------
.text:0804860B
.text:0804860B loc_804860B:                            ; CODE XREF: check_equals_MRXJKZYRKMKENFZB+3E↓j
.text:0804860B                 mov     edx, [ebp+var_4]
.text:0804860E                 mov     eax, [ebp+arg_0]
.text:08048611                 add     eax, edx
.text:08048613                 movzx   edx, byte ptr [eax]
.text:08048616                 mov     eax, [ebp+var_4]
.text:08048619                 add     eax, 804C048h   ;  Key-String 的地址
.text:0804861E                 movzx   eax, byte ptr [eax]
.text:08048621                 cmp     dl, al
.text:08048623                 jnz     short loc_8048629 
.text:08048625                 add     [ebp+var_8], 1
.text:08048629
.text:08048629 loc_8048629:                            ; CODE XREF: check_equals_MRXJKZYRKMKENFZB+2E↑j
.text:08048629                 add     [ebp+var_4], 1
.text:0804862D
.text:0804862D loc_804862D:                            ; CODE XREF: check_equals_MRXJKZYRKMKENFZB+14↑j
.text:0804862D                 mov     eax, [ebp+var_4]
.text:08048630                 cmp     eax, [ebp+arg_4]
.text:08048633                 jb      short loc_804860B  ;  这是一个for 循环的Buffer 内容校验逻辑
.text:08048635                 mov     eax, [ebp+var_8]
.text:08048638                 cmp     eax, [ebp+arg_4]
.text:0804863B                 setz    al
.text:0804863E                 movzx   eax, al
.text:08048641                 leave
.text:08048642                 retn

所以,我们需要Hook check_equals() 并模拟它的执行,这个题目和09 题不同之处在于,09 题我们可以通过一处指令Hook 来实现,但是10 题我们就不能这么做了,是因为Call check_equals() 的地址太多,用09 题的方式不方便,所以我们可以用Angr 的Hook Symbol 来实现对check_equals() 函数的Hook ,而不是想09 题那样只对指令进行Hook .代码如下:

def main(argv):
  path_to_binary = argv[1]
  project = angr.Project(path_to_binary)

  initial_state = project.factory.entry_state()

  class ReplacementCheckEquals(angr.SimProcedure):

    def run(self, check_data_address, check_data_length):  #  基本和09 题的逻辑一样,唯独不同的是我们可以获取check_equals() 的参数
      check_input_string = self.state.memory.load(
        check_data_address,
        check_data_length
      )

      check_against_string = 'MRXJKZYRKMKENFZB'

      return claripy.If(check_input_string == check_against_string, claripy.BVV(1, 32), claripy.BVV(0, 32))

  check_equals_symbol = 'check_equals_MRXJKZYRKMKENFZB' # :string
  project.hook_symbol(check_equals_symbol, ReplacementCheckEquals())  #  Hook Symbol

  simulation = project.factory.simgr(initial_state)

  def is_successful(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Good Job' in str(stdout_output)

  def should_abort(state):
    stdout_output = state.posix.dumps(sys.stdout.fileno())
    return 'Try again' in str(stdout_output)

  simulation.explore(find=is_successful, avoid=should_abort)

  if simulation.found:
    solution_state = simulation.found[0]

    solution = solution_state.posix.dumps(sys.stdin.fileno())
    print(solution)

Angr函数使用总结:

Hook 回调函数格式:

class ReplacementCheckEquals(angr.SimProcedure):

def run(self, Hook的函数参数列表):

….

return 函数返回值 # 如果是void函数可以省略

project.hook_symbol(要Hook的函数名,SimProcedure类实例)

点击关注，共同学习！
安全狗的自我修养

github haidragon