GFSJ1199-【ReadingSection】
tea + xor
拿到手发现是一个txt 打开看到是一个LLVM IR文件 我们转成.o文件直接IDA分析
转换命令
copy .\ReadingSection.txt .\ReadingSection.ll
(Get-Content .\ReadingSection.ll -Raw) `
-replace '@__const\.main\.flag = private unnamed_addr constant \[33 x i8\] c"CAT Hide Your Flag", align 16', '@__const.main.flag = private unnamed_addr constant [33 x i8] c"CAT Hide Your Flag\00\00\00\00\00\00\00\00\00\00\00\00\00\00\00", align 16' |
Set-Content .\ReadingSection.ll -Encoding ascii
& "C:\msys64\ucrt64\bin\clang.exe" -x ir -c .\ReadingSection.ll -o .\ReadingSection.o
这个报错不影响
进去能看到一个tea 一个xor
char __fastcall check()
{
size_t v0; // rax
int v1; // ecx
int v2; // eax
int v3; // eax
int v4; // eax
int v5; // eax
int v6; // ecx
int v7; // eax
int v8; // eax
int v9; // ecx
int v10; // eax
int v11; // eax
int v12; // eax
int v13; // eax
int v14; // eax
int v15; // eax
int v16; // ecx
int v17; // eax
int v18; // ecx
int v19; // eax
int v20; // eax
int v22; // eax
int v23; // eax
int v24; // eax
int v25; // [rsp+48h] [rbp-38h]
int v26; // [rsp+4Ch] [rbp-34h]
_QWORD v27[5]; // [rsp+50h] [rbp-30h]
int v28; // [rsp+78h] [rbp-8h]
int v29; // [rsp+7Ch] [rbp-4h]
int v30; // [rsp+80h] [rbp+0h]
int v31; // [rsp+84h] [rbp+4h]
int v32; // [rsp+88h] [rbp+8h]
int v33; // [rsp+8Ch] [rbp+Ch]
int v34; // [rsp+90h] [rbp+10h]
int v35; // [rsp+94h] [rbp+14h]
int v36; // [rsp+98h] [rbp+18h]
int v37; // [rsp+9Ch] [rbp+1Ch]
int v38; // [rsp+A0h] [rbp+20h]
unsigned int v39; // [rsp+A4h] [rbp+24h]
unsigned int v40; // [rsp+A8h] [rbp+28h]
int v41; // [rsp+ACh] [rbp+2Ch]
__int64 v42; // [rsp+B0h] [rbp+30h]
__int64 v43; // [rsp+B8h] [rbp+38h]
char *v44; // [rsp+C0h] [rbp+40h]
int v45; // [rsp+C8h] [rbp+48h]
char v46; // [rsp+CFh] [rbp+4Fh]
v45 = 0;
LOBYTE(v25) = -71;
while ( 1 )
{
while ( 1 )
{
v0 = strlen(yourcat);
v1 = -981760591;
if ( v45 < v0 )
v1 = 885835314;
v2 = v25 & 1;
v25 = v1;
if ( v2 )
goto LABEL_48;
LABEL_58:
if ( v25 == -1591015246 )
break;
switch ( v25 )
{
case -1564550806:
goto LABEL_45;
case -1164989570:
LABEL_43:
v22 = v25 & 1;
v25 = -1564550806;
if ( !v22 )
goto LABEL_58;
goto LABEL_70;
case -1161762662:
goto LABEL_18;
case -1115141670:
goto LABEL_26;
}
if ( v25 != -981760591 )
{
if ( v25 == -856038568 )
goto LABEL_22;
if ( v25 != -482200700 )
{
if ( v25 != -307564033 )
{
if ( v25 == 631447468 )
goto LABEL_32;
if ( v25 != 885835314 )
return v46 & 1;
LABEL_6:
yourcat[v45] ^= yourcat[v45 + 1];
v3 = v25 & 1;
v25 = -1591015246;
if ( !v3 )
goto LABEL_79;
goto LABEL_58;
}
LABEL_40:
v46 = 0;
v20 = v25 & 1;
v25 = 1325875719;
if ( v20 )
goto LABEL_79;
goto LABEL_58;
}
LABEL_24:
++v28;
v12 = v25 & 1;
v25 = -1161762662;
if ( v12 )
goto LABEL_79;
goto LABEL_58;
}
while ( 2 )
{
v44 = yourcat;
v42 = 0x29D3CE1E18BC8A17LL;
v43 = 0x199C7F4A42F740E3LL;
v41 = 0;
v5 = v25 & 1;
v25 = 684999598;
if ( !v5 )
goto LABEL_79;
LABEL_48:
switch ( v25 )
{
case -1164989570:
goto LABEL_43;
case -1161762662:
goto LABEL_18;
case -981760591:
continue;
case -482200700:
goto LABEL_24;
case -307564033:
goto LABEL_40;
case 631447468:
goto LABEL_32;
case 684999598:
goto LABEL_12;
case 885835314:
goto LABEL_6;
case 1325875719:
return v46 & 1;
}
}
}
LABEL_8:
++v45;
v4 = v25 & 1;
v25 = 2038647993;
if ( !v4 )
goto LABEL_48;
LABEL_70:
while ( v25 == -1564550806 )
{
LABEL_45:
++v26;
v23 = v25 & 1;
v25 = 631447468;
if ( v23 )
goto LABEL_58;
}
switch ( v25 )
{
case 232488417:
goto LABEL_28;
case 332476953:
goto LABEL_36;
case 457966756:
LABEL_16:
v40 = *(_DWORD *)&v44[8 * v41];
v39 = *(_DWORD *)&v44[8 * v41 + 4];
v38 = 0;
v37 = -897810688;
v35 = HIDWORD(v42);
v36 = v42;
v33 = HIDWORD(v43);
v34 = v43;
v32 = 4;
v31 = 2;
v30 = 3;
v29 = 20;
v28 = 0;
v8 = v25 & 1;
v25 = -1161762662;
if ( !v8 )
goto LABEL_79;
goto LABEL_48;
}
if ( v25 == 631447468 )
break;
switch ( v25 )
{
case 800030424:
goto LABEL_47;
case 1325875719:
return v46 & 1;
case 1842263789:
LABEL_30:
v27[0] = 0x7180F7B17D077DAALL;
v27[1] = 0x57580710E523AFDALL;
v27[2] = 0x567478E6717DF71ELL;
v27[3] = 0x2E3139F31153C09BLL;
v26 = 0;
v15 = v25 & 1;
v25 = 631447468;
if ( !v15 )
goto LABEL_58;
goto LABEL_48;
}
}
LABEL_32:
v16 = 800030424;
if ( (unsigned __int64)v26 < 0x20 )
v16 = 332476953;
v17 = v25 & 1;
v25 = v16;
if ( v17 )
goto LABEL_70;
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
while ( 1 )
{
LABEL_79:
if ( v25 == -1591015246 )
goto LABEL_8;
if ( v25 != -1161762662 )
break;
LABEL_18:
v9 = -1115141670;
if ( v28 < 28 )
v9 = -856038568;
v10 = v25 & 1;
v25 = v9;
if ( !v10 )
goto LABEL_58;
}
if ( v25 != -1115141670 )
break;
LABEL_26:
*(_DWORD *)&v44[8 * v41] = v40;
*(_DWORD *)&v44[8 * v41 + 4] = v39;
v13 = v25 & 1;
v25 = 232488417;
if ( v13 )
goto LABEL_70;
}
if ( v25 == -856038568 )
{
LABEL_22:
v38 += v37;
v40 += (v35 + (v39 >> (v29 / v32))) ^ (v38 + v39) ^ (v36 + (v39 << (v31 * v31)));
v39 += (v33 + (v40 >> ((v30 ^ v32) - 2))) ^ (v38 + v40) ^ (v34 + (v40 << (2 * v31)));
v11 = v25 & 1;
v25 = -482200700;
if ( !v11 )
goto LABEL_48;
goto LABEL_58;
}
if ( v25 != 232488417 )
break;
LABEL_28:
++v41;
v14 = v25 & 1;
v25 = 684999598;
if ( !v14 )
goto LABEL_48;
}
if ( v25 == 332476953 )
{
LABEL_36:
v18 = -1164989570;
if ( yourcat[v26] != *((_BYTE *)v27 + v26) )
v18 = -307564033;
v19 = v25 & 1;
v25 = v18;
if ( !v19 )
goto LABEL_48;
goto LABEL_58;
}
if ( v25 == 457966756 )
goto LABEL_16;
if ( v25 != 684999598 )
break;
LABEL_12:
v6 = 1842263789;
if ( v41 < 4 )
v6 = 457966756;
v7 = v25 & 1;
v25 = v6;
if ( !v7 )
goto LABEL_70;
}
if ( v25 == 800030424 )
{
LABEL_47:
v46 = 1;
v24 = v25 & 1;
v25 = 1325875719;
if ( v24 )
goto LABEL_70;
goto LABEL_48;
}
if ( v25 != 1325875719 )
goto LABEL_30;
return v46 & 1;
}
数据
k=[415009303,701746718,1123500259,429686602]
c=bytes.fromhex("aa7d077db1f78071daaf23e5100758571ef77d71e67874569bc05311f339312e")
exp
import struct
m=0xffffffff
k=[415009303,701746718,1123500259,429686602]
d=(-897810688)&m
c=bytes.fromhex("aa7d077db1f78071daaf23e5100758571ef77d71e67874569bc05311f339312e")
r=bytearray()
for i in range(0,32,8):
a,b=struct.unpack("<II",c[i:i+8])
s=d*28&m
for j in range(28):
b=(b-((((a<<4)&m)+k[2])^((a+s)&m)^((a>>5)+k[3])))&m
a=(a-((((b<<4)&m)+k[0])^((b+s)&m)^((b>>5)+k[1])))&m
s=(s-d)&m
r+=struct.pack("<II",a,b)
f=bytearray(32)
f[31]=r[31]
for i in range(30,-1,-1):
f[i]=r[i]^f[i+1]
print("CatCTF{"+f.decode()+"}")
flag
CatCTF{We1C0ME-2-CA7C7F's_ReVerSe-W0r1d}
评论