REVERSE-PRACTICE-CthulhuOJ

Cthulhu OJ-simple
Cthulhu OJ-easy-VM

Cthulhu OJ-simple

exe程序，运行后提示输入flag，无壳，用ida分析
main函数，输入和下标异或，结果与已知的res数组比较

写逆异或运算脚本即可得到flag

res=[122,114,118,118,103,113,96,124,92,97,59,120,83,60,125,80,113,78,39,34,121,101,122,114,71,126,91,118,121,96,30]
flag=[]
for i in range(0,31):flag.append(i^res[i])
print(''.join(chr(i) for i in flag))
#zstuctf{Th1s_1s_a_51mple_gAme}

Cthulhu OJ-easy-VM

elf文件，运行后输入，无壳，ida分析
main函数逻辑清晰，读取输入，限制输入的最大长度为32，将输入传入vm进行变换，将变换后的输入与已知字符串进行比较，验证输入

进入start_vm函数，感觉由opcode决定的各种运算非常乱，几个字节来回交换，也有异或运算，不太明白怎么写逆vm脚本

__int64 __fastcall start_vm(const char *a1, __int64 a2)
{__int64 result; // rax__int64 v3; // [rsp+0h] [rbp-20h]unsigned __int8 v4; // [rsp+1Fh] [rbp-1h]v3 = a2;state = a2;while ( 1 ){result = (unsigned __int8)a1[(unsigned __int8)byte_5640DC557028];v4 = a1[(unsigned __int8)byte_5640DC557028];if ( !v4 )break;switch ( (unsigned int)off_5640DC355F50 ){case 1u:li(a1[(unsigned __int8)byte_5640DC557028 + 1], (unsigned __int8)a1[(unsigned __int8)byte_5640DC557028 + 2]);break;case 2u:lb(a1[(unsigned __int8)byte_5640DC557028 + 1], (unsigned __int8)a1[(unsigned __int8)byte_5640DC557028 + 2]);break;case 3u:sb(a1[(unsigned __int8)byte_5640DC557028 + 1], a1[(unsigned __int8)byte_5640DC557028 + 2]);break;case 4u:sub(a1[(unsigned __int8)byte_5640DC557028 + 1],a1[(unsigned __int8)byte_5640DC557028 + 2],a1[(unsigned __int8)byte_5640DC557028 + 3]);break;case 5u:xor(a1[(unsigned __int8)byte_5640DC557028 + 1],a1[(unsigned __int8)byte_5640DC557028 + 2],a1[(unsigned __int8)byte_5640DC557028 + 3]);break;case 6u:jmp(a1[(unsigned __int8)byte_5640DC557028 + 1]);break;case 7u:beq(a1[(unsigned __int8)byte_5640DC557028 + 1],a1[(unsigned __int8)byte_5640DC557028 + 2],a1[(unsigned __int8)byte_5640DC557028 + 3]);break;case 8u:call(a1[(unsigned __int8)byte_5640DC557028 + 1]);break;case 9u:ret();break;default:printf("unrecognized opcode: %#x\n", v4, v3);break;}byte_5640DC557028 += 4;}return result;
}

动调，把最后要比较的字符串当作输入，发现经过vm变换后直接得到了flag
需要注意的是，输入的长度限制为32，已知的字符串不考虑转义字符的话，其长度为33，所以调试的时候，输入要把多出来的一个"\"去掉，经过vm即可得到flag

REVERSE-PRACTICE-CthulhuOJ相关推荐

linux内核路由反向检查,反向路径过滤——reverse path filter
反向路径过滤--reverse path filter 一.原理先介绍个非对称路由的概念参考<Understanding Linux Network Internals>三十章, 30 ...
java中Collections常用方法总结（包括sort，copy，reverse等）
1.sort(Collection)方法的使用(含义:对集合进行排序). 例:对已知集合c进行排序public class Practice {public static void main(Stri ...
A Guide To Reverse Tethering
By Kevin Pocock on February 04, 2013 Using a mobile device such as a smartphone to act as a hotspot ...
picoCTF，Reverse Engineering，逆向类，42/55
picoCTF,Reverse Engineering,42/55 2019 picoCTF 01.vault-door-training,50分 02.vault-door-1,100分 03.va ...
PAT (Advanced Level) Practice 题解代码 - II （1051-1100）
PAT PAT (Advanced Level) Practice - II(1051-1100) -------------------------------------------------- ...
(Python) PAT(Basic Level) Practice 刷题笔记(34-66)
我的代码仅能解题,效率不高也不够简洁,欢迎师傅们提出建议,能让我加以改进. Practice 1036 跟奥巴马一起编程 (15 分) 1037 在霍格沃茨找零钱 (20 分) 1038 统计同成绩学 ...
minty_Brit666‘s python practice no.2
minty_Brit666 Today's blog is about the practice of the leetcode. And I'll give my own answer in thi ...
【水一波题解】题解 of University of Central Florida 2020 (Fall) “Practice” Local Programming Contest
题解 of University of Central Florida 2020 (Fall) "Practice" Local Programming Contest [by_0 ...
动态规划十大经典案例（Dynamic Programming Practice Problems）
目录 leetcode 53 最大子序列和(Maximum Value Contiguous Subsequence) leetcode 53 零钱兑换(Making Change) LeetCode ...
206. Reverse Linked List
Reverse a singly linked list. 反转单链表 C++(9ms): 迭代 1 /** 2 * Definition for singly-linked list. 3 * s ...

REVERSE-PRACTICE-CthulhuOJ

REVERSE-PRACTICE-CthulhuOJ

Cthulhu OJ-simple

Cthulhu OJ-easy-VM

REVERSE-PRACTICE-CthulhuOJ相关推荐

最新文章

热门文章