NsPack 手脱壳 xor

跟UPX差不多吧 进去下硬断 然后运行到原始OEP 然后dump出来 修一下IAT

  1. 在pushad之后下 右击esp转内存 在内存下硬件访问断点

image

  1. 运行到popfd后面 F8进看看 发现就是原始OPE

image

  1. dump 修复IAT

image

保存了之后 选择刚刚dump出来的文件

image

然后IDA打开 一个xor

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int v4; // eax
  char Buffer[52]; // [esp+4h] [ebp-38h] BYREF

  memset(Buffer, 0, 50);
  printf("Please Input Flag:");
  gets_s(Buffer, 0x2Cu);
  if ( strlen(Buffer) == 42 )
  {
    v4 = 0;
    while ( (Buffer[v4] ^ aThisIsNotFlag[v4 % 16]) == dword_402150[v4] )
    {
      if ( ++v4 >= 42 )
      {
        printf("right!\n");
        return 0;
      }
    }
    printf("error!\n");
    return 0;
  }
  else
  {
    printf("error!\n");
    return -1;
  }
}

数据

aThisIsNotFlag = b'this_is_not_flag'
IDA_402150 = [0x12, 0x4, 0x8, 0x14, 0x24, 0x5c, 0x4a, 0x3d, 0x56, 0xa, 0x10, 0x67, 0x0, 0x41, 0x0, 0x1, 0x46, 0x5a, 0x44, 0x42, 0x6e, 0xc, 0x44, 0x72, 0xc, 0xd, 0x40, 0x3e, 0x4b, 0x5f, 0x2, 0x1, 0x4c, 0x5e, 0x5b, 0x17, 0x6e, 0xc, 0x16, 0x68, 0x5b, 0x12]

exp

aThisIsNotFlag = b'this_is_not_flag'
IDA_402150 = [0x12, 0x4, 0x8, 0x14, 0x24, 0x5c, 0x4a, 0x3d, 0x56, 0xa, 0x10, 0x67, 0x0, 0x41, 0x0, 0x1, 0x46, 0x5a, 0x44, 0x42, 0x6e, 0xc, 0x44, 0x72, 0xc, 0xd, 0x40, 0x3e, 0x4b, 0x5f, 0x2, 0x1, 0x4c, 0x5e, 0x5b, 0x17, 0x6e, 0xc, 0x16, 0x68, 0x5b, 0x12]
for i in range(len(IDA_402150)):
    print(chr(IDA_402150[i] ^ aThisIsNotFlag[i % 16]), end='')

flag

flag{59b8ed8f-af22-11e7-bb4a-3cf862d1ee75}