学逆向论坛»论坛 › 软件安全 › CTF专区 › 高校战疫WP——easyparser

Lily

1379 积分	4 好友	24 主题

发消息

[Reverse] 高校战疫WP——easyparser

发表于 2020-3-9 13:49:56 | 查看: 10563| 回复: 11

相关题目：

[md]RUST写的虚拟机

在init_array中的sub_40DB20()函数中初始化被比较的字符串，主要是将dword_483C68中包含的32个字符都减去0x37

在main函数中进行比较，主要逻辑是将输入的每一位与'c'异或，即0x63，之后进行左移和且操作，即<<=2&0x3f

写爆破脚本逆出来即可

```python
a=[0x00000002, 0x00000000, 0x00000002, 0x00000000, 0x00000012, 0x00000000, 0x00000002, 0x00000000, 0x000000C7, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000183, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000053, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000127, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x000000BB, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000073, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000004F, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000077, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000077, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000127, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000107, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000008F, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000063, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000003F, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000006B, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000127, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000014B, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000127, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x000000B7, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000063, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000005F, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000006B, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000003F, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000127, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x000000C7, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000007B, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000067, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000087, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000093, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000063, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x0000013F, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000002, 0x00000000, 0x00000127, 0x00000000, 0x00000000, 0x00000000, 0x00000002, 0x00000000, 0x00000001, 0x00000000, 0x00000007, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000000, 0x00000019, 0x00000000]
x=r''
for i in a:
if i>0x37:
      print(hex(i-0x37),end=',')
#打印出来b
b=[0x90,0x14c,0x1c,0xf0,0x84,0x3c,0x18,0x40,0x40,0xf0,0xd0,0x58,0x2c,0x8,0x34,0xf0,0x114,0xf0,0x80,0x2c,0x28,0x34,0x8,0xf0,0x90,0x44,0x30,0x50,0x5c,0x2c,0x108,0xf0]
print(len(b))
for i in b:
for x in range(0x20,0x80):
      u=x
      u^=ord('c')
      u<<=2&0x3f
      if(u==i):
         print(chr(x),end='')
```

最后得flag{G0d_Bless_Wuhan_&_China_Growth!_}[/md]

我把那个带注释的i64文件也加进去了，里面有我对解释器各个功能的注释，pop和push啥的可能写反了，反正主要流程就下面那一点
0:(2,0,2,0,0x12): xor s[2],s[2]
5:(0,0,0,2,0,3): s[0]=q[s[2]]
11:(0,0,0,0x37,0,9):s[0]-=0x37
17:(0,2,0,0,0,4):q[s[2]]=s[0]
23:(0,2,0,1,0,7)s[2]+=1
cmp s[2],0x20
jnz 5

s[a]=0xe1
s[9]=q[s[7]]
s[6]=q[s[a]]
s[6]^='c'
s[6]<<=2&0x3f
cmp s[6] s[7]
jnz error
s[9]++
s[a]++
cmp s[9] 0x20
jxx 0x2a
具体的i64文件我也放到附件了，有一些注释是错的或者是简略的，还请大家独立分析

游客，如果您要查看本帖隐藏内容请回复

温馨提示：

1.如果您喜欢这篇帖子，请给作者点赞评分，点赞会增加帖子的热度，评分会给作者加学币。(评分不会扣掉您的积分，系统每天都会重置您的评分额度)。
2.回复帖子不仅是对作者的认可，还可以获得学币奖励，请尊重他人的劳动成果，拒绝做伸手党！
3.发广告、灌水回复等违规行为一经发现直接禁言，如果本帖内容涉嫌违规，请点击论坛底部的举报反馈按钮，也可以在【投诉建议】板块发帖举报。

收藏0 回复显示全部楼层道具举报打印