MoeCTF 2021Re部分------Midpython.exe

文章目录

Midpython.exe
- marshal和dis库配合：
- 手动改为py
- 解密脚本
总结：

Midpython.exe

python代码写成的exe，进行反编译，先搞成pyc，然后把pyc反编译成py，但是再第二个步骤反编译成py的时候出现了如下报错：

Traceback (most recent call last):File "g:\python3.7.6-64\lib\runpy.py", line 193, in _run_module_as_main"__main__", mod_spec)File "g:\python3.7.6-64\lib\runpy.py", line 85, in _run_codeexec(code, run_globals)File "G:\python3.7.6-64\Scripts\uncompyle6.exe\__main__.py", line 7, in <module>File "g:\python3.7.6-64\lib\site-packages\uncompyle6\bin\uncompile.py", line 194, in main_bin**options)File "g:\python3.7.6-64\lib\site-packages\uncompyle6\main.py", line 324, in maindo_fragments,File "g:\python3.7.6-64\lib\site-packages\uncompyle6\main.py", line 222, in decompile_filedo_fragments=do_fragments,File "g:\python3.7.6-64\lib\site-packages\uncompyle6\main.py", line 141, in decompileco, out, bytecode_version, debug_opts=debug_opts, is_pypy=is_pypyFile "g:\python3.7.6-64\lib\site-packages\uncompyle6\semantics\pysource.py", line 2570, in code_deparsescanner = get_scanner(version, is_pypy=is_pypy)File "g:\python3.7.6-64\lib\site-packages\uncompyle6\scanner.py", line 566, in get_scanner"scan.Scanner%s(show_asm=show_asm)" % v_str, locals(), globals()File "<string>", line 1, in <module>File "g:\python3.7.6-64\lib\site-packages\uncompyle6\scanners\scanner39.py", line 36, in __init__Scanner37Base.__init__(self, 3.9, show_asm)File "g:\python3.7.6-64\lib\site-packages\uncompyle6\scanners\scanner37base.py", line 98, in __init__self.opc.END_FINALLY,
AttributeError: module 'xdis.opcodes.opcode_39' has no attribute 'END_FINALLY'

查看后是反编译器的版本出现了不合。uncompyle6可将python字节码转换回等效的python源代码，它接受python 1.3版到3.8版的字节码，但是这个题目是python3.9，所以需要换其他方法

marshal和dis库配合：

当然前提是需要到pyc的步骤，并且把头修改好。

import marshal
import dis
a=open('Midpython.pyc','rb')
a.seek(16)
dis.dis(marshal.load(a))

然后先跳过头结点（magic和time），原因，利用marshal进行以二进制格式读取，然后用dis库进行输出，

1           0 BUILD_LIST               02 LOAD_CONST               0 ((69, 70, 79, 72, 88, 75, 85, 127, 89, 85, 74, 19, 74, 122, 107, 103, 75, 77, 9, 73, 29, 28, 67))4 LIST_EXTEND              16 STORE_NAME               0 (key)2           8 LOAD_CONST               1 (<code object <lambda> at 0x7f0b479a2be0, file "Midpython.py", line 2>)10 LOAD_CONST               2 ('<lambda>')12 MAKE_FUNCTION            014 STORE_NAME               1 (xxor)3          16 LOAD_CONST               3 (<code object <lambda> at 0x7f0b479a2c90, file "Midpython.py", line 3>)18 LOAD_CONST               2 ('<lambda>')20 MAKE_FUNCTION            022 STORE_NAME               2 (xoor)4          24 LOAD_CONST               4 (<code object <lambda> at 0x7f0b479a2d40, file "Midpython.py", line 4>)26 LOAD_CONST               2 ('<lambda>')28 MAKE_FUNCTION            030 STORE_NAME               3 (xorr)5          32 LOAD_NAME                4 (len)34 LOAD_NAME                0 (key)36 CALL_FUNCTION            138 STORE_NAME               5 (length)6          40 LOAD_NAME                6 (input)42 LOAD_CONST               5 ('>>>input your flag:\n>>>')44 CALL_FUNCTION            146 STORE_NAME               7 (ipt)7          48 LOAD_CONST               6 (1)50 STORE_NAME               8 (flag)8          52 LOAD_NAME                4 (len)54 LOAD_NAME                7 (ipt)56 CALL_FUNCTION            158 LOAD_NAME                5 (length)60 COMPARE_OP               2 (==)62 POP_JUMP_IF_FALSE      1149          64 LOAD_NAME                9 (range)66 LOAD_NAME                5 (length)68 CALL_FUNCTION            170 GET_ITER>>   72 FOR_ITER                38 (to 112)74 STORE_NAME              10 (i)10          76 LOAD_NAME                3 (xorr)78 LOAD_NAME               11 (ord)80 LOAD_NAME                7 (ipt)82 LOAD_NAME               10 (i)84 BINARY_SUBSCR86 CALL_FUNCTION            188 LOAD_NAME               10 (i)90 CALL_FUNCTION            292 LOAD_NAME                0 (key)94 LOAD_NAME               10 (i)96 BINARY_SUBSCR98 COMPARE_OP               3 (!=)100 POP_JUMP_IF_FALSE       7211         102 LOAD_CONST               7 (0)104 STORE_NAME               8 (flag)12         106 POP_TOP108 JUMP_ABSOLUTE          118110 JUMP_ABSOLUTE           72>>  112 JUMP_FORWARD             4 (to 118)14     >>  114 LOAD_CONST               7 (0)116 STORE_NAME               8 (flag)15     >>  118 LOAD_NAME                8 (flag)120 LOAD_CONST               6 (1)122 COMPARE_OP               2 (==)124 POP_JUMP_IF_FALSE      13616         126 LOAD_NAME               12 (print)128 LOAD_CONST               8 ('>>>Right!!')130 CALL_FUNCTION            1132 POP_TOP134 JUMP_FORWARD             8 (to 144)18     >>  136 LOAD_NAME               12 (print)138 LOAD_CONST               9 ('>>>Wrong!!')140 CALL_FUNCTION            1142 POP_TOP>>  144 LOAD_CONST              10 (None)146 RETURN_VALUEDisassembly of <code object <lambda> at 0x7f0b479a2be0, file "Midpython.py", line 2>:2           0 LOAD_FAST                0 (x)2 LOAD_FAST                1 (y)4 BINARY_XOR6 LOAD_CONST               1 (11)8 BINARY_XOR10 RETURN_VALUEDisassembly of <code object <lambda> at 0x7f0b479a2c90, file "Midpython.py", line 3>:3           0 LOAD_GLOBAL              0 (xxor)2 LOAD_FAST                0 (x)4 LOAD_FAST                1 (y)6 CALL_FUNCTION            28 LOAD_CONST               1 (45)10 BINARY_XOR12 RETURN_VALUEDisassembly of <code object <lambda> at 0x7f0b479a2d40, file "Midpython.py", line 4>:4           0 LOAD_GLOBAL              0 (xoor)2 LOAD_FAST                0 (x)4 LOAD_FAST                1 (y)6 CALL_FUNCTION            28 LOAD_CONST               1 (14)10 BINARY_XOR12 RETURN_VALUE

手动改为py

import dis
def pyc():key=[(69, 70, 79, 72, 88, 75, 85, 127, 89, 85, 74, 19, 74, 122, 107, 103, 75, 77, 9, 73, 29, 28, 67)]xxor=lambda x,y:x^y^11xoor=lambda xxor,x,y:xxor(x,y)^45xorr=lambda xoor,x,y:xoor(x,y)^14length=len(key)ipt=input('>>>input your flag:\n>>>')flag=1if len(ipt)==length:for i in range(length):if xorr(ord(ipt[i]),i)!=key[i]:flag=0else:flag=0    if flag==1:print('>>>Right!!')else:print('>>>Wrong!!')dis.dis(pyc)

解密脚本

key=[69, 70, 79, 72, 88, 75, 85, 127, 89, 85, 74, 19, 74, 122, 107, 103, 75, 77, 9, 73, 29, 28, 67]
for i in range(len(key)):flag=key[i]^11^i^45^14print(chr(flag),end='')

moectf{Pyth0n_M@st3r!!}

总结：

python3.9编译的exe：

marshal库和dis库配合使用
uncompyle6对版本的限制

MoeCTF 2021Re部分------Midpython.exe相关推荐

MoeCTF 2021Re部分------PE
文章目录 ida分析算出秘钥解密脚本总结 ida分析这个题呢,目的是用附件异或一串秘钥得出一个exe,然后运行exe即可得出flag,然后秘钥主要藏在PE文件头中算出秘钥说实话,这题有点脑 ...
MoeCTF 2021Re部分------大佬请喝咖啡，A_game
文章目录大佬请喝咖啡反编译解释\u: z3解码 A_game 数独题: 这里判断行数据是1~9: 这里判断列数据是1~9: 9*9数独阵分为9个3*3方阵,每个方阵数据1~9 进行异或magic ...
MoeCTF 2021Re部分------ez（递归转循环）
文章目录 ida 分析总结 ida for ( i = 0; i <= 75; ++i ){Character = fuck(i * i) ^ flag[i];putchar(Characte ...
MoeCTF 2021Re部分------time2go
文章目录 time2go keypatch使用 main_fun2(后一半) 总结: time2go keypatch使用 (ida中的keypatch插件)考点主要是玩keypatch,把sleep ...
MoeCTF 2021Re部分------RedC4Bomb
文章目录去花后 keys(key) init(key, v9, (int)key); 脚本总结: 去花后只需要管是三个函数keys(key) init(key, v9, (int)key); e ...
MoeCTF 2021Re部分------baby_bc
文章目录 baby.bc 编译 ida分析 Rc4 初始化加密 Base64变形结果数组解密代码: 总结 baby.bc 编译 llc chall.bc -o chall.s 然后把.s(汇编代 ...
MoeCTF 2021Re部分------Algorithm_revenge
文章目录 ida分析脚本分析生成map地图数据累加提醒:绝对不是取出每行最大值相加(特别注意当前元素的上行元素的左中右这个限制),然后把所在列坐标进行存储挑出50行最大值列坐标总结 ida ...
【moeCTF题解-0x01】Reverse
title: [moeCTF题解-0x01]Reverse categories: CTF moeCTF tags: CTF [moeCTF题解-0x01]Reverse 一个全新的领域 [moeCT ...
2019 moeCTF新生题部分wp
author: xiaohuihui status: 初步完成,带×的题目尚未解出,已经出官方wp 官方wp: https://github.com/XDSEC/moeCTF_2019 说明1:题目附 ...