linux逆向 视频教程,一道linux ctf入门题逆向。

本帖最后由 whyIDA 于 2017-12-1 11:45 编辑

下载地址:

https://www.52pojie.cn/forum.php ... &page=3#pid17643200

先用ida分析，main 函数入口。

[C] 纯文本查看 复制代码int __cdecl main(int argc, const char **argv, const char **envp)

{

int result; // eax

__int64 v4; // [rsp+0h] [rbp-20h]

__int64 v5; // [rsp+8h] [rbp-18h]

__int16 v6; // [rsp+10h] [rbp-10h]

int v7; // [rsp+14h] [rbp-Ch]

int v8; // [rsp+18h] [rbp-8h]

int i; // [rsp+1Ch] [rbp-4h]

puts("welcome");

v4 = 0x6D64616E696D6461LL;

v5 = 0x3332313332316E69LL;

v6 = 51;

v8 = 0;

for ( i = 0; i <= 16; ++i )

{

v7 = rand() % 255;

if ( (unsigned int)check(v7, *((char *)&v4 + i), i) )

++v8;

}

if ( v8 == 17 )

result = puts("good job,now you know what is flag!");

else

result = puts("wrong\ntry again!!!");

return result;

}

check 函数

[C] 纯文本查看 复制代码signed __int64 __fastcall check(unsigned int a1, unsigned int a2, int a3)

{

int v4; // [rsp+10h] [rbp-50h]

int v5; // [rsp+14h] [rbp-4Ch]

int v6; // [rsp+18h] [rbp-48h]

int v7; // [rsp+1Ch] [rbp-44h]

int v8; // [rsp+20h] [rbp-40h]

int v9; // [rsp+24h] [rbp-3Ch]

int v10; // [rsp+28h] [rbp-38h]

int v11; // [rsp+2Ch] [rbp-34h]

int v12; // [rsp+30h] [rbp-30h]

int v13; // [rsp+34h] [rbp-2Ch]

int v14; // [rsp+38h] [rbp-28h]

int v15; // [rsp+3Ch] [rbp-24h]

int v16; // [rsp+40h] [rbp-20h]

int v17; // [rsp+44h] [rbp-1Ch]

int v18; // [rsp+48h] [rbp-18h]

int v19; // [rsp+4Ch] [rbp-14h]

int v20; // [rsp+50h] [rbp-10h]

v4 = 7;

v5 = 8;

v6 = 12;

v7 = 14;

v8 = 21;

v9 = 13;

v10 = 13;

v11 = 3;

v12 = 28;

v13 = 22;

v14 = 110;

v15 = 93;

v16 = 64;

v17 = 110;

v18 = 93;

v19 = 88;

v20 = 78;

if ( (a2 ^ a1) != *(&v4 + a3) )

return 0LL;

printf("%d,%d,%d\n", a1, a2, (unsigned int)*(&v4 + a3));

putchar(a2 ^ a1);

return 1LL;

}

关键代码

[C] 纯文本查看 复制代码if ( (a2 ^ a1) != *(&v4 + a3) )

只要算出随机数就可得到flag

也就是a1=*(&v4 + a3) ^a2

[Python] 纯文本查看 复制代码tmp=[7,8,12,14,21,13,13,3,28,22,110,93,64,110,93,88,78]

tmp2=[0x61, 0x64, 0x6d, 0x69, 0x6e, 0x61, 0x64, 0x6d,0x69,0x6E,0x31,0x32,0x33,0x31,0x32,0x33]

t=[]

for i in range(16):

t= ((tmp[i])^(tmp2[i]))

print(chr(t),end='')

捕获.JPG (194.99 KB, 下载次数: 1)

2017-11-9 11:23 上传

捕获1.JPG (29.9 KB, 下载次数: 0)

2017-12-1 11:40 上传

感谢