2023NepCTF-RE部分题解

2023NepCTF-RE部分题解

九龙拉棺

过反调试

很容易发现

void __stdcall sub_401700() 

里面有tea的痕迹

接出来发现只是前半部分

#include <stdio.h>
#include <stdint.h>
#include"defs.h"
#include <stdio.h>

#include <stdio.h>
#include <stdint.h>  

//加密函数
void encrypt(uint32_t* v, uint32_t* k) {
    uint32_t v0 = v[0], v1 = v[1], sum = 0, i;           /* set up */
    uint32_t delta = 0x9e3779b9;                     /* a key schedule constant */
    uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];   /* cache key */
    for (i = 0; i < 32; i++) {                       /* basic cycle start */
        sum += delta;
        v0 += ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
        v1 += ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
    }                                              /* end cycle */
    v[0] = v0; v[1] = v1;
}
//解密函数
void decrypt(uint32_t* v, uint32_t* k) {
    uint32_t v0 = v[0], v1 = v[1], sum = 0xC6EF3720, i;//0xc6ef3720  /* set up */
    uint32_t delta = 0x61C88647;                     /* a key schedule constant */
    uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];   /* cache key */
    for (i = 0; i < 32; i++) {                         /* basic cycle start */
        v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
        v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
        sum += delta;
    }                                              /* end cycle */
    v[0] = v0; v[1] = v1;
}
int main() {

    uint32_t enc[17] = {
    0x88AFD2D6, 0x3FBE45A7, 0x27AAD1B9, 0x8CB3E51E, 0x09348FFA, 0xE19F3C42, 0xFFDD0D86, 0xEDB97383,
    0x12C4C0BF, 0x1B67BD19, 0xF7A514D6, 0x18F95254, 0xAB100CB0, 0x00CBA137, 0x02A91712, 0xC58D0D9E,0
    };
    int sum = 0;
    uint32_t v[2] = { 1,2 }, k[4] = { 1,2,3,4 };

    for (int i = 0; i < 16; i += 2)
    {
        decrypt(&enc[i], k);
    }
    puts((char*)enc);//NepCTF{c9cdnwdi3iu41m0pv3x7kllzu8pdq6mt9n2nwjdp6kat8ent4dhn5r158
    return 0;
}

卡在找后半段flag校验的地方很久，



这里其实有优先级

按创建顺序开始

tea后面的函数是根据密文直接校验的结果进行判断

。

慢慢看

void __usercall StartAddress(int a1@<ebp>)

里面



断点下在这，明显在内存看到MZ标识

这里使用idapython没把数据提取出来

纯shift+f12拉出来的

#include <stdio.h>
#include <stdint.h>
#include"defs.h"
#include <stdio.h>

//加密函数
void encrypt(uint32_t* v, uint32_t* k) {
    uint32_t v0 = v[0], v1 = v[1], sum = 0, i;           /* set up */
    uint32_t delta = 0x9e3779b9;                     /* a key schedule constant */
    uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];   /* cache key */
    for (i = 0; i < 32; i++) {                       /* basic cycle start */
        sum += delta;
        v0 += ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
        v1 += ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
    }                                              /* end cycle */
    v[0] = v0; v[1] = v1;
}
//解密函数
void decrypt(uint32_t* v, uint32_t* k) {
    uint32_t v0 = v[0], v1 = v[1], sum = 0xC6EF3720, i;//0xc6ef3720  /* set up */
    uint32_t delta = 0x61C88647;                     /* a key schedule constant */
    uint32_t k0 = k[0], k1 = k[1], k2 = k[2], k3 = k[3];   /* cache key */
    for (i = 0; i < 32; i++) {                         /* basic cycle start */
        v1 -= ((v0 << 4) + k2) ^ (v0 + sum) ^ ((v0 >> 5) + k3);
        v0 -= ((v1 << 4) + k0) ^ (v1 + sum) ^ ((v1 >> 5) + k1);
        sum += delta;
    }                                              /* end cycle */
    v[0] = v0; v[1] = v1;
}
int main() {

    uint32_t enc[17] = {
   0 };

    enc[0] = 0x1DC74989;
    enc[1] = 0xD979AF77;
    enc[2] = 0x888D136D;
    enc[3] = 0x8E26DB7F;
    enc[4] = 0xC10C3CC9;
    enc[5] = 0xC3845D40;
    enc[6] = 0xC6E04459;
    enc[7] = 0xA2EBDF07;
    enc[8] = 0xD484388D;
    enc[9] = 0x12F956A2;
    enc[10] = 0x5ED7EE59;
    enc[11] = 0x43137F85;
    enc[12] = 0xEF43F9F0;
    enc[13] = 0xB29683AA;
    enc[14] = 0x8E3640B4;
    enc[15] = 0xc2d36177;
    int sum = 0;
    uint32_t v[2] = { 1,2 }, k[4] = { 18,52,86,120 };

    for (int i = 0; i < 16; i += 2)
    {
        decrypt(&enc[i],k);
    }
    puts((char*)enc);
    return 0;
}

后64位flag

拼凑一下

Review

这里有反调试，patch就好



需要对aes的key进行爆破，有2位根据相等位置生成，xxtea加密后，有个异常处理，里面进行~操作

from Crypto.Cipher import AES
from ctypes import *

def MX(z, y, total, key, p, e):
  temp1 = (z.value >> 5 ^ y.value << 2) + (y.value >> 3 ^ z.value << 4)
  temp2 = (total.value ^ y.value) + (key[(p & 3) ^ e.value] ^ z.value)

  return c_uint32(temp1 ^ temp2)

def encrypt(n, v, key):
  delta = 0x9e3779b9
  rounds = 6 + 52 // n

  total = c_uint32(0)
  z = c_uint32(v[n - 1])
  e = c_uint32(0)

  while rounds > 0:
    total.value += delta
    e.value = (total.value >> 2) & 3
    for p in range(n - 1):
      y = c_uint32(v[p + 1])
      v[p] = c_uint32(v[p] + MX(z, y, total, key, p, e).value).value
      z.value = v[p]
    y = c_uint32(v[0])
    v[n - 1] = c_uint32(v[n - 1] + MX(z, y, total, key, n - 1, e).value).value
    z.value = v[n - 1]
    rounds -= 1

  return v

def decrypt(n, v, key):
  delta = 0x9e3779b9
  rounds = 6 + 52 // n

  total = c_uint32(rounds * delta)
  y = c_uint32(v[0])
  e = c_uint32(0)

  while rounds > 0:
    e.value = (total.value >> 2) & 3
    for p in range(n - 1, 0, -1):
      z = c_uint32(v[p - 1])
      v[p] = c_uint32((v[p] - MX(z, y, total, key, p, e).value)).value
      y.value = v[p]
    z = c_uint32(v[n - 1])
    v[0] = c_uint32(v[0] - MX(z, y, total, key, 0, e).value).value
    y.value = v[0]
    total.value -= delta
    rounds -= 1

  return v

Aeskey=[  0x19, 0x28, 0x6E, 0x04, 0x19, 0x28, 0x6E, 0x04, 0x46, 0x55,
  0xC8, 0x04, 0x46, 0x55, 0xC8, 0x04]

for i in range(47):
  v17=i+4
  Aeskey[3]=v17
  Aeskey[11]=v17
  enc = [0xF4, 0x9C, 0xDD, 0x41, 0x03, 0xDD, 0x5A, 0x13, 0x2E, 0x55, 0x97, 0x9E, 0xFF, 0xD5, 0x08, 0xD9, 0xF6, 0xD1,
         0x09, 0x8C, 0x68, 0x9E, 0x92, 0xFF, 0x75, 0x0F, 0x80, 0x95, 0x4B, 0x16, 0xB9, 0xC6, 0x7F, 0x54, 0x2E, 0x20,
         0x35, 0xFC, 0x1B, 0x46, 0x14, 0xAA, 0xDA, 0x5E, 0x4F, 0xBD, 0x59, 0x71]
  aes = AES.new(bytes(Aeskey), AES.MODE_ECB)  # 创建一个aes对象
  den_text = aes.decrypt(bytes(enc))  # 解密密文
  x=[i for i in den_text]
  for i in range(len(x)):
    x[i] = ~x[i]
    x[i]&=0xff

  enc1 = [int.from_bytes(x[i*4:i*4+4],'little') for i in range(12)]
  xxteakey = [0x00000019, 0x00000000, 0x0000006E, 0x00000003]
  m=decrypt(12,enc1,xxteakey)
  import libnum
  try:
    x=[libnum.n2s(i).decode()[::-1] for i in m]
    for i in x:
      print(i,end='')#NepCTF{tEA_with_AES_by_mixing_antiDebug_hahaHah}
  except :
    pass
# flag='NepCTF{'+'11112222'*5+'}'
# print(flag)
#NepCTF{1111222211112222111122221111222211112222}

待复现