攻防世界--key

测试文件：https://adworld.xctf.org.cn/media/task/attachments/c6cf449ae4b7498eba5027c533386a40.exe

1.准备

获取信息：

• 32位文件

2.IDA打开

反汇编main函数

 void sub_401100()
 {
   signed int v0; // esi
   signed int v1; // esi
   unsigned int v2; // edi
   void **v3; // ebx
   void **v4; // eax
   int v5; // ecx
   int v6; // ST04_4
   int v7; // ST08_4
   int v8; // ST0C_4
   int v9; // eax
   int v10; // ST0C_4
   char *v11; // esi
   int v12; // ecx
   void **v13; // eax
   int v14; // eax
   int v15; // ST0C_4
   int v16; // eax
   int v17; // ST0C_4
   int v18; // eax
   int v19; // ST0C_4
   int v20; // eax
   int v21; // ST0C_4
   int v22; // eax
   int v23; // ST0C_4
   int v24; // eax
   int v25; // ST0C_4
   int v26; // eax
   int v27; // ST0C_4
   int v28; // eax
   int v29; // [esp-4h] [ebp-13Ch]
   int Dst; // [esp+14h] [ebp-124h]
   char v31[]; // [esp+20h] [ebp-118h]
   char v32; // [esp+24h] [ebp-114h]
   int v33; // [esp+5Ch] [ebp-DCh]
   char v34; // [esp+61h] [ebp-D7h]
   int v35; // [esp+64h] [ebp-D4h]
   int v36; // [esp+68h] [ebp-D0h]
   char v37; // [esp+6Ch] [ebp-CCh]
   FILE *File; // [esp+70h] [ebp-C8h]
   char v39; // [esp+84h] [ebp-B4h]
   void *v40; // [esp+CCh] [ebp-6Ch]
   int v41; // [esp+DCh] [ebp-5Ch]
   unsigned int v42; // [esp+E0h] [ebp-58h]
   void *v43; // [esp+E4h] [ebp-54h]
   unsigned int v44; // [esp+F4h] [ebp-44h]
   unsigned int v45; // [esp+F8h] [ebp-40h]
   void *Memory[]; // [esp+FCh] [ebp-3Ch]
   unsigned int v47; // [esp+10Ch] [ebp-2Ch]
   unsigned int v48; // [esp+110h] [ebp-28h]
   __int128 v49; // [esp+114h] [ebp-24h]
   __int16 v50; // [esp+124h] [ebp-14h]
   char v51; // [esp+126h] [ebp-12h]
   int v52; // [esp+134h] [ebp-4h]

   v45 = ;
   v44 = ;
   LOBYTE(v43) = ;
   v52 = ;
   v42 = ;
   v41 = ;
   LOBYTE(v40) = ;
   LOBYTE(v52) = ;
   v0 = ;
   v47 = 'dime';
   LOWORD(v48) = 'a';
   *(_OWORD *)Memory = xmmword_40528C;           // htadimehtadimeht
   v50 = '.<';
   v51 = ;
   v49 = xmmword_4052A4;                         // <<<....++++---->
   do
   {
     sub_4021E0(&v40, 1u, (*((_BYTE *)Memory + v0) ^ *((_BYTE *)&v49 + v0)) + );
     ++v0;
   }
   while ( v0 <  );
   v1 = ;
   v48 = ;
   v47 = ;
   LOBYTE(Memory[]) = ;
   LOBYTE(v52) = ;
   v2 = v42;
   v3 = (void **)v40;
   do
   {
     v4 = &v40;
     if ( v2 >= 0x10 )
       v4 = v3;
     sub_4021E0(Memory, 1u, *((_BYTE *)v4 + v1++) + );
   }
   while ( v1 <  );
   memset(&Dst, , 0xB8u);
   sub_401620(v5, v6, v7, v8);
   LOBYTE(v52) = ;
   if ( v31[*(_DWORD *)(Dst + )] &  )
   {
     v9 = sub_402A00(std::cerr, "?W?h?a?t h?a?p?p?e?n?", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v9, v10);
     exit(-);
   }
   sub_402E90(&Dst, &v43);
   v11 = &v32;
   if ( File )
   {
     if ( !(unsigned __int8)sub_4022F0(&v32) )
       v11 = ;
     if ( fclose(File) )
       v11 = ;
   }
   else
   {
     v11 = ;
   }
   v37 = ;
   v34 = ;
   std::basic_streambuf<char,std::char_traits<char>>::_Init(&v32);
   v35 = dword_408590;
   File = ;
   v36 = dword_408594;
   v33 = ;
   if ( !v11 )
     std::basic_ios<char,std::char_traits<char>>::setstate((char *)&Dst + *(_DWORD *)(Dst + ), , );
   v13 = Memory;
   if ( v48 >= 0x10 )
     v13 = (void **)Memory[];
   if ( sub_4020C0(&v43, v12, v44, (int)v13, v47) )
   {
     v28 = sub_402A00(std::cout, "=W=r=o=n=g=K=e=y=", sub_402C50);
   }
   else
   {
     v14 = sub_402A00(std::cout, "|------------------------------|", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v14, v15);
     v16 = sub_402A00(std::cout, "|==============================|", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v16, v17);
     v18 = sub_402A00(std::cout, "|==============================|", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v18, v19);
     v20 = sub_402A00(std::cout, "|==============================|", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v20, v21);
     v22 = sub_402A00(std::cout, "\\  /\\  /\\  /\\  /\\==============|", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v22, v23);
     v24 = sub_402A00(std::cout, " \\/  \\/  \\/  \\/  \\=============|", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v24, v25);
     v26 = sub_402A00(std::cout, "                 |-------------|", sub_402C50);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(v26, v27);
     std::basic_ostream<char,std::char_traits<char>>::operator<<(std::cout, sub_402C50);
     v28 = sub_402A00(std::cout, "Congrats You got it!", sub_402C50);
   }
   std::basic_ostream<char,std::char_traits<char>>::operator<<(v28, v29);
   sub_401570(&v39);
   std::basic_ios<char,std::char_traits<char>>::~basic_ios<char,std::char_traits<char>>(&v39);
   if ( v48 >= 0x10 )
     sub_402630(Memory[], v48 + );
   if ( v2 >= 0x10 )
     sub_402630(v3, v2 + );
   if ( v45 >= 0x10 )
     sub_402630(v43, v45 + );
 }

第74行调用sub_4021E0函数的最后一个参数生成了一个字符传入。连起来生成字符串

#include <iostream>

#define _BYTE unsigned char

using namespace std;

int main()
{
    const char* Memory = "themidathemidathemid";
    const char* v50 = ">----++++....<<<<.";
    signed int v0 = 0;
    char str;
    do {
        str = (*(Memory + v0) ^ *(v50 + v0)) + 22;
        cout << str;
        ++v0;
    } while (v0 < 18);
    system("PAUSE");
    return 0;
}

`[^VZe`uYaY]`s^joY

3.OD打开

程序打开输出是这样

使用OD打开之后，定位到字符串处，发现前面有条指令是可以跳过这段字符串输出的

   .  8B40        mov eax,dword ptr ds:[eax+0x4]
   .  F68405 E8FEFF>test byte ptr ss:[ebp+eax-0x118],0x6
0021123E      74 25         je Xkey.00211265
   .  8B0D C8502100 mov ecx,dword ptr ds:[<&MSVCP140.std::ce>;  MSVCP140.std::cerr
   .  BA E4522100   mov edx,key.002152E4                     ;  ASCII "?W?h?a?t h?a?p?p?e?n?"
0021124B   .   502C2100   push key.00212C50
   .  E8 AB170000   call key.00212A00
   .  8BC8          mov ecx,eax
   .  FF15  call dword ptr ds:[<&MSVCP140.std::basic>;  MSVCP140.std::basic_ostream<wchar_t,std::char_traits<wchar_t> >::operator<<
0021125D   .  6A FF         push -0x1                                ; /status = FFFFFFFF (-1.)
0021125F   .  FF15  call dword ptr ds:[<&api-ms-win-crt-runt>; \exit

因此我们可以判断出，这段字符串就是个烟雾弹，让我们不能进入真正的程序的，而真正的key就在下面。

4.代码分析

  if ( v48 >= 0x10 )
    v13 = (void **)Memory[];
  if ( sub_4020C0(&v43, v12, v44, (int)v13, v47) )
  {
    v28 = sub_402A00(std::cout, "=W=r=o=n=g=K=e=y=", sub_402C50);
  }
  else
  {
  ...

通过这段代码我们可以知道，sub_4020C0函数就藏着key，OD中找到对应的代码，设置断点

   .  FF75 D4       push dword ptr ss:[ebp-0x2C]
0021131A   .  0F4345 C4     cmovnb eax,dword ptr ss:[ebp-0x3C]
0021131E   .              push eax
0021131F   .  FF75 BC       push dword ptr ss:[ebp-0x44]
   .              push ecx
   .  8D4D AC       lea ecx,dword ptr ss:[ebp-0x54]
00211326   .  E8 950D0000   call key.002120C0

前面都是函数的参数，运行到断点处

在寄存器处，我们找到了我们需要的key

5.get flag！

idg_cni~bjbfi|gsxb