四川绵阳行业赛联通结业测试逆向wp

逆向出的也太简单了吧

0x01.task_upx

upx3.96的壳，upx3.96脱壳后发现是简单异或。
直接上脚本

temp='cjfor~c=~?|v &ti'
flag=[]
for i in range(16):
	flag.append(ord(temp[i])^(i+5))
print(''.join(map(chr,flag)))
#flag{th1s1sf14g}

0x02.task_源码

给了两个程序，还有一个合在一起的python脚本combine_file.py，查看combine_file.py并运行发现真的可以合成一个exe,这样就有CrackMe_real.exe和YC_CrackME.exe两个程序，发现它们序列号校验方式都是CrackMe_real.exe的z3
动调找到“验证正确”的字样，找到关键代码部分

z3一把梭，费时间的主要是文本处理
文本处理

sr='''
-15 * v17- 17 * v12+ 19 * (*this - v7)+ 7 * (2 * (v16 + v19) - v10)+ 2 * (5 * (v18 - v6) - 9 * (v15 + v9) + 4 * (v14 + 2 * v11) + 6 * v8 - v13) == -1002;
9 * (v7 - v10)+ 5 * (v12 + 3 * v9 - 2 * v8)+ 2 * (v18 + 3 * (v14 + v6 - 2 * v11) + v15 - v16 - 8 * v15)- 13 * v19- 19 * v13- 17 * v17 != -2404
v17+ 5 * (3 * v10 - 4 * v11 - v14)+ 3 * (v16 + 2 * (3 * (v15 + v8) - v9))- 13 * (v19 + v12)- 2 * (v18 + 7 * v13)+ 19 * v7 != 260 
13 * (v13 - v11) + 17 * (v7 - v17) + 3 * (v14 + v15 + v16 + 2 * (2 * v19 + v12) - v10) + 10 * v18 + 8 * v9 != 3430
11 * v9 + 13 * v18 + 3 * (v17 + 3 * v16 - 2 * v11) - 7 * (v14 + v19) + 20 * (v12 - v10) - 19 * v13 - v15 != 670
9 * v10+ 11 * v17+ 7 * (v15 + 2 * v9)+ 2 * (v16 - 2 * v14 + v18 + 2 * (v16 - 2 * v14) + 2 * (4 * v11 - v13 - 5 * v19)) != 2511
11 * v16 + 5 * (v17 + 4 * (v18 - v19) - v14) + 2 * (2 * (v10 + v15) - v13 - 3 * v11) != 911
2 * v19 + v11 + 13 * v14 + 8 * (2 * v19 + v11) + 2 * (2 * (v15 + 3 * v17 - 4 * v18) - 5 * v16 - v13) != 1084 
13 * v14 + 17 * (v13 - v19) - 6 * (v17 + 3 * v18) + 8 * v16 - 5 * v15 != -271
3 * (5 * v16 - v17) + 4 * (v19 + 2 * (v14 + v15)) - 7 * v18 != 1384
9 * (v16 + 2 * (v14 - v19)) + 20 * v17 + 8 * v18 != 2074
3 * v18 + -4 * v19 - 11 * v16 - 17 * v14 != -1567
5 * v14 + 17 * v16 - 8 * v19 != 988
3 * v19 + 16 * v16 != 1241
2 * v19 != 102
'''

print(sr)
sr=sr.replace('v11', 'this[7]').replace('v14', 'this[12]').replace('v13', 'this[8]').replace('v15', 'this[9]').replace('v18', 'this[11]').replace('v19', 'this[14]').replace('v16', 'this[13]').replace('v6', 'this[1]').replace('v7', 'this[3]').replace('v17', 'this[10]').replace('v12', 'this[4]').replace('v9', 'this[5]').replace('v10', 'this[6]').replace('v8', 'this[2]')
print(sr)

文本批量处理后，简单再修改一下，得到z3的条件

from z3 import *
s=Solver()
a1=[0 for i in range(15)]
for i in range(15):
	a1[i]=Int('a1['+str(i)+']')
s.add ( -15 * a1[10]- 17 * a1[4]+ 19 * (a1[0] - a1[3])+ 7 * (2 * (a1[13] + a1[14]) - a1[6])+ 2 * (5 * (a1[11] - a1[1]) - 9 * (a1[9] + a1[5]) + 4 * (a1[12] + 2 * a1[7]) + 6 * a1[2] - a1[8]) == -1002)
s.add ( 9 * (a1[3] - a1[6])+ 5 * (a1[4] + 3 * a1[5] - 2 * a1[2])+ 2 * (a1[11] + 3 * (a1[12] + a1[1] - 2 * a1[7]) + a1[9] - a1[13] - 8 * a1[9])- 13 * a1[14]- 19 * a1[8]- 17 * a1[10] == -2404)
s.add ( a1[10]+ 5 * (3 * a1[6] - 4 * a1[7] - a1[12])+ 3 * (a1[13] + 2 * (3 * (a1[9] + a1[2]) - a1[5]))- 13 * (a1[14] + a1[4])- 2 * (a1[11] + 7 * a1[8])+ 19 * a1[3] == 260 )
s.add ( 13 * (a1[8] - a1[7]) + 17 * (a1[3] - a1[10]) + 3 * (a1[12] + a1[9] + a1[13] + 2 * (2 * a1[14] + a1[4]) - a1[6]) + 10 * a1[11] + 8 * a1[5] == 3430)
s.add ( 11 * a1[5] + 13 * a1[11] + 3 * (a1[10] + 3 * a1[13] - 2 * a1[7]) - 7 * (a1[12] + a1[14]) + 20 * (a1[4] - a1[6]) - 19 * a1[8] - a1[9] == 670)
s.add ( 9 * a1[6]+ 11 * a1[10]+ 7 * (a1[9] + 2 * a1[5])+ 2 * (a1[13] - 2 * a1[12] + a1[11] + 2 * (a1[13] - 2 * a1[12]) + 2 * (4 * a1[7] - a1[8] - 5 * a1[14])) == 2511)
s.add ( 11 * a1[13] + 5 * (a1[10] + 4 * (a1[11] - a1[14]) - a1[12]) + 2 * (2 * (a1[6] + a1[9]) - a1[8] - 3 * a1[7]) == 911)
s.add ( 2 * a1[14] + a1[7] + 13 * a1[12] + 8 * (2 * a1[14] + a1[7]) + 2 * (2 * (a1[9] + 3 * a1[10] - 4 * a1[11]) - 5 * a1[13] - a1[8]) == 1084 )
s.add ( 13 * a1[12] + 17 * (a1[8] - a1[14]) - 6 * (a1[10] + 3 * a1[11]) + 8 * a1[13] - 5 * a1[9] == -271)
s.add ( 3 * (5 * a1[13] - a1[10]) + 4 * (a1[14] + 2 * (a1[12] + a1[9])) - 7 * a1[11] == 1384)
s.add ( 9 * (a1[13] + 2 * (a1[12] - a1[14])) + 20 * a1[10] + 8 * a1[11] == 2074)
s.add ( 3 * a1[11] + -4 * a1[14] - 11 * a1[13] - 17 * a1[12] == -1567 )
s.add (5 * a1[12] + 17 * a1[13] - 8 * a1[14] == 988)
s.add (3 * a1[14] + 16 * a1[13] == 1241)
s.add ( 2 * a1[14] == 102 )
print(s.check())
answer=s.model()
print(answer)

z3跑一下再转字符串即可得flag

UU_VM_5HE11C0D3

附件地址：
下载:https://wwx.lanzoux.com/iohOfjhgrgf 密码:1fgq