Shiori's Coffee Nook

软件系统安全赛

Sun, 15 Mar 2026 00:00:00 GMT

1.re3

pyinstxtractor解包得到client.pyc：

看流量发现readme.txt, config.txt, flag.txt 和密文：

Pylingual 反编译client.pyc:

# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: 'client.py'
# Bytecode version: 3.10.b1 (3439)
# Source timestamp: 1970-01-01 00:00:00 UTC (0)

import base64
import sys
import os
import json
import socket
import hashlib
import crypt_core
import builtins
def _oe(_d, _k1, _k2, _rn):
    # ***<module>._oe: Failure: Compilation Error
    try:
        _b = base64.b85decode(_d.encode())
        _r = []
        for _i, _x in enumerate(_b):
            return ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn), _i, 3) or ((_k1, _k2, _rn),
            _r.append(_x, _k if _k else None)
        _s = bytes(_r).decode()
        _res = []
        for _c in _s:
            if _c.isalpha():
                _base = ord('A') if _c.isupper() else ord('a')
                _res.append((chr, ord(_c), _base, _rn, 26, _base))
            else:
                if _c.isdigit():
                    _res.append(str(int(_c), _rn or 10))
                else:
                    _res.append(_c)
        return ''.join(_res)
    except:
        return _d
_globs = dict(__name__='__main__', __file__=__file__, __package__=None, _oe=_oe)
for _k in dir(builtins):
    if not _k.startswith('_'):
        _globs[_k] = getattr(builtins, _k)
_globs['base64'] = base64
_globs['sys'] = sys
_globs['os'] = os
_globs['json'] = json
_globs['socket'] = socket
_globs['hashlib'] = hashlib
_globs['crypt_core'] = crypt_core
def _obf_check():
    if hasattr(sys, 'gettrace'):
        _tr = sys.gettrace()
        if _tr is not None:
            return False
    return True
def _obf_exec(_code):
    # ***<module>._obf_exec: Failure: Different bytecode
    if not _obf_check():
        return None
    else:
        exec(compile, _code, chr(60) | chr(111) | chr(98) | chr(102) | chr(101) | chr(120) | chr(99))
_1667 = '[b85 encoded string (omitted)]'
_obf_exec(base64.b85decode(_1667).decode())

client.py里面exec的payload使用base85解码： 1

_j0 = lambda: (30 ^ 126) + (520 % 26)
_j1 = lambda: (158 ^ 184) + (820 % 54)
_j2 = lambda: (37 ^ 2) + (687 % 25)
_j3 = lambda: (72 ^ 112) + (474 % 30)
_j4 = lambda: (173 ^ 82) + (257 % 73)
_j5 = lambda: (117 ^ 203) + (331 % 54)
_j6 = lambda: (242 ^ 46) + (846 % 33)
_j7 = lambda: (21 ^ 148) + (425 % 77)
_j8 = lambda: (139 ^ 134) + (427 % 21)
_j9 = lambda: (245 ^ 62) + (413 % 85)
_j10 = lambda: (242 ^ 65) + (892 % 30)
_j11 = lambda: (22 ^ 58) + (740 % 59)
_j12 = lambda: (139 ^ 248) + (771 % 74)
_j13 = lambda: (219 ^ 230) + (262 % 63)
_j14 = lambda: (17 ^ 89) + (622 % 38)
_j15 = lambda: (229 ^ 205) + (369 % 25)
_j16 = lambda: (111 ^ 33) + (433 % 50)
_j17 = lambda: (41 ^ 142) + (512 % 21)

class _Obf3776:
    def __init__(self):
        self._v = 751
    def _m(self):
        return self._v * 5

#!/usr/bin/env python3

import socket
import json
import os
import sys
import hashlib
import time

sys.path.insert(0, os.path.dirname(os.path.dirname(os.path.abspath(__file__))))
import crypt_core


class CustomBase64:
    CUSTOM_ALPHABET = _oe("8<<BLok1UrR}_R>27yTmms1djUI&{(7Ls{Apm;c@eJQYZA-rTHu4po}aw559KBaUw?kHpDBVghrW#KRr", 83, 214, 17)
    STANDARD_ALPHABET = (
        _oe("0fj{dfJO_COA?e)7n4^Mo>&>3T^^WT1BYWEqGTnZX)3I6F|~Czuy#AYdpNp$J-J~b;VEk7AYtVtX5cz}", 83, 214, 17)
    )
    ENCODE_TABLE = str.maketrans(STANDARD_ALPHABET, CUSTOM_ALPHABET)
    DECODE_TABLE = str.maketrans(CUSTOM_ALPHABET, STANDARD_ALPHABET)

    @classmethod
    def decode(cls, data: str) -> bytes:
        import base64

        std_b64 = data.translate(cls.DECODE_TABLE)
        return base64.b64decode(std_b64)


SERVER_HOST = ""
SERVER_PORT = 9999
KEY_B64 = _oe("C7MAupdc5tRBM!52kv4Wmp~Hle`A4N5`t?5nObY+L~6Pz5wdF*y=E$zQv!xZ", 83, 214, 17)
KEY = CustomBase64.decode(KEY_B64)
FILES_TO_SEND = [_oe("I-p}FvS)q0emD", 83, 214, 17), _oe("B(-BJ_<B6O", 83, 214, 17), _oe("C$MxRtZ99{emD", 83, 214, 17)]


def _opaque_true():
    _x = 0
    for _i in range(100):
        _x += _i * (_i - _i + 1)
    return _x >= 0


def _opaque_false():
    _a, _b = 5, 7
    return (_a * _b) == (_b * _a + 1)


def _dead_calc():
    _dead = 0
    for _i in range(50):
        _dead = (_dead + _i) % 17
        if _dead > 100:
            _dead = _dead * 2 + 1
    return _dead


def encrypt_file(key: bytes, plaintext: bytes) -> bytes:
    _state = 0
    _result = None
    while _state < 3:
        if _state == 0:
            if _opaque_true():
                _result = crypt_core.encode_data(plaintext, key[:16])
                _state = 2
            else:
                _dead_calc()
                _state = 1
        elif _state == 1:
            _dead_calc()
            _state = 2
        elif _state == 2:
            if _opaque_false():
                _result = None
            _state = 3
    return _result


def send_single_file(sock, filename, plaintext):
    _s = 0
    _ct = None
    _pl = None
    while _s < 5:
        if _s == 0:
            _ct = encrypt_file(KEY, plaintext)
            _s = 1
        elif _s == 1:
            _pl = {_oe("B&>2Jvtu`)", 83, 214, 17): filename, _oe("C#-fVpm;c-emD", 83, 214, 17): _ct.hex()}
            _s = 2
        elif _s == 2:
            if _opaque_true():
                sock.sendall(json.dumps(_pl).encode(_oe("KfPvt;{", 83, 214, 17)) + b"\n")
                _s = 4
            else:
                _dead_calc()
                _s = 3
        elif _s == 3:
            _dead_calc()
            _s = 4
        elif _s == 4:
            if not _opaque_false():
                time.sleep(0.1)
            _s = 5


def _verify_cmd(cmd):
    _state = 10
    _hash_val = None
    _valid = False

    while _state < 50:
        if _state == 10:
            if len(cmd) > 0:
                _state = 20
            else:
                _state = 49
        elif _state == 20:
            _hash_val = hashlib.md5(cmd.encode()).hexdigest()
            _state = 30
        elif _state == 30:
            if _opaque_true():
                _valid = _hash_val == _oe("VWK4=qGuqYBxK?sVWlBw<RW0^B4q9&VB;re<0L2U", 83, 214, 17)
                _state = 40
            else:
                _dead_calc()
                _state = 49
        elif _state == 40:
            if _valid:
                _state = 50
            else:
                _state = 49
        elif _state == 49:
            return False

    return _valid


def _get_server_host(args):
    _s = 100
    _host = None

    while _s < 200:
        if _s == 100:
            if len(args) > 2:
                _s = 110
            else:
                _s = 120
        elif _s == 110:
            _host = args[2]
            _s = 200
        elif _s == 120:
            if _opaque_true():
                _host = ""
            _s = 200
        elif _s == 200:
            if _opaque_false():
                _host = _oe("Ywsm};Xh>fDF", 83, 214, 17)
            _s = 201

    return _host


def main():
    _state = 0
    _sock = None
    _idx = 0
    _printed_header = False

    while _state < 100:
        if _state == 0:
            if _opaque_false():
                print(_oe("2B2dm_GLArX8", 83, 214, 17))
            _state = 1
        elif _state == 1:
            if len(sys.argv) < 2:
                _state = 5
            else:
                _state = 2
        elif _state == 2:
            if _verify_cmd(sys.argv[1]):
                _state = 3
            else:
                _state = 4
        elif _state == 3:
            if not _printed_header:
                print("=" * 50)
                print(_oe("8K7l9zh`rSYcQZO7{6mSyk;f8F$cA4C9`^SyD5F)", 83, 214, 17))
                print("=" * 50)
                _printed_header = True
            _state = 10
        elif _state == 4:
            print("错误：无效的命令")
            _state = 99
        elif _state == 5:
            print("用法：python client.py <command> [SERVER_HOST]")
            _state = 99
        elif _state == 10:
            try:
                _sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
                _state = 11
            except Exception:
                _state = 99
        elif _state == 11:
            _host = _get_server_host(sys.argv)
            _state = 12
        elif _state == 12:
            try:
                _sock.connect((_host, SERVER_PORT))
                _state = 20
            except Exception as e:
                print(f"[!] 连接失败：{e}")
                _state = 99
        elif _state == 20:
            if _idx < len(FILES_TO_SEND):
                _state = 21
            else:
                _state = 30
        elif _state == 21:
            _fname = FILES_TO_SEND[_idx]
            _state = 22
        elif _state == 22:
            if os.path.exists(_fname):
                _state = 23
            else:
                _state = 28
        elif _state == 23:
            with open(_fname, "rb") as _f:
                _data = _f.read()
            _state = 24
        elif _state == 24:
            if _opaque_true():
                print(f"[*] 发送文件")
            _state = 25
        elif _state == 25:
            if not _opaque_false():
                send_single_file(_sock, _fname, _data)
            _state = 26
        elif _state == 26:
            _idx += 1
            _state = 20
        elif _state == 28:
            print(f"[-] 文件不存在")
            _state = 29
        elif _state == 29:
            _idx += 1
            _state = 20
        elif _state == 30:
            if _opaque_true():
                time.sleep(0.2)
            _state = 31
        elif _state == 31:
            if _sock:
                _sock.close()
            _state = 99
        elif _state == 99:
            break


if __name__ == _oe("42g9itaJ>C", 83, 214, 17):
    _dead_calc()
    if _opaque_true():
        main()
    else:
        _dead_calc()

注意到：

开始逆向crypt_core.so：

交叉应用字符串encode_data：

sub_9820 使用了多次这个字符串，点进去看是个 Python 包装层（有一堆参数校验 + 异常API调用），参数校验后点进sub_60B0，是个魔改SM4：

加密逻辑是魔改SM4-PKCS#7，一般赛题只改一些常量 + 轮数，核心算法不会改；发现改了S-box，FK（4个DWORD），CK（32个DWORD，用了前24个），轮数24轮，key取前16bytes。

对照标准SM4常量：

# 系统参数
FK = [0xA3B1BAC6, 0x56AA3350, 0x677D9197, 0xB27022DC]

# 固定参数CK
CK = [
    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
]
SBox = [
    0xD6, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6, 0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05,
    0x2B, 0x67, 0x9A, 0x76, 0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86, 0x06, 0x99,
    0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A, 0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62,
    0xE4, 0xB3, 0x1C, 0xA9, 0xC9, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA, 0x75, 0x8F, 0x3F, 0xA6,
    0x47, 0x07, 0xA7, 0xFC, 0xF3, 0x73, 0x17, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0x4F, 0xA8,
    0x68, 0x6B, 0x81, 0xB2, 0x71, 0x64, 0xDA, 0x8B, 0xF8, 0xEB, 0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35,
    0x1E, 0x24, 0x0E, 0x5E, 0x63, 0x58, 0xD1, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21, 0x78, 0x87,
    0xD4, 0x00, 0x46, 0x57, 0x9F, 0xD3, 0x27, 0x52, 0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E,
    0xEA, 0xBF, 0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5, 0xA3, 0xF7, 0xF2, 0xCE, 0xF9, 0x61, 0x15, 0xA1,
    0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34, 0x1A, 0x55, 0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
    0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60, 0xC0, 0x29, 0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F,
    0xD5, 0xDB, 0x37, 0x45, 0xDE, 0xFD, 0x8E, 0x2F, 0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C, 0x5B, 0x51,
    0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F, 0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8,
    0x0A, 0xC1, 0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD, 0x2D, 0x74, 0xD0, 0x12, 0xB8, 0xE5, 0xB4, 0xB0,
    0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96, 0x77, 0x7E, 0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
    0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20, 0x79, 0xEE, 0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48
]

PKCS#7：

改了SBOX：

改了FK：

改了CK：

改成了24轮：

写脚本解密：

from __future__ import annotations

import argparse
import base64
import json
import socket
import struct
from pathlib import Path

CUSTOM_ALPHABET = "QWERTYUIOPASDFGHJKLZXCVBNMqwertyuiopasdfghjklzxcvbnm1234567890!@"
STANDARD_ALPHABET = "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/"
KEY_B64 = "eUYme4MkN1KSC1bWJZJ2w3FUJCiEXT13D2u1KmiNtfhXKZYE"

SBOX = [
    0xEC, 0xCA, 0x0E, 0xF3, 0x08, 0xF0, 0x2A, 0xA2, 0x3B, 0x18, 0x2B, 0x5C, 0x37, 0xBD, 0x12, 0xA8,
    0x05, 0xD3, 0xA1, 0x57, 0x4F, 0x96, 0xFC, 0xF5, 0xA7, 0x14, 0x19, 0x66, 0x58, 0x9B, 0xBF, 0xB4,
    0x39, 0xD5, 0x1E, 0x1A, 0x30, 0xBC, 0x6C, 0x80, 0xB7, 0xED, 0x41, 0x06, 0xD9, 0x17, 0x67, 0xCD,
    0x1D, 0x2C, 0xAE, 0x24, 0x03, 0x13, 0xC6, 0x53, 0x83, 0x11, 0x0A, 0xF7, 0xC0, 0x4D, 0xC4, 0x9E,
    0x8D, 0x00, 0x1F, 0xC3, 0x3F, 0x35, 0x9F, 0xCB, 0x72, 0x9D, 0x16, 0x6F, 0xAC, 0xCE, 0x3C, 0x5E,
    0xA6, 0xE1, 0x7B, 0x34, 0x36, 0x32, 0xB8, 0x95, 0x91, 0x89, 0x52, 0xC1, 0xE7, 0xA3, 0x33, 0x48,
    0x04, 0xCF, 0x10, 0xEB, 0x25, 0xBB, 0x8E, 0x0F, 0x81, 0x6E, 0xB3, 0x43, 0x45, 0x8F, 0x49, 0xF8,
    0x4B, 0x59, 0x07, 0x4A, 0xDE, 0xFD, 0xC8, 0xD0, 0x84, 0x8B, 0xFB, 0xDA, 0xDB, 0x28, 0xD4, 0x3E,
    0xA4, 0x2F, 0x56, 0xBE, 0xEF, 0x86, 0xC7, 0x62, 0xEA, 0x76, 0xE9, 0xD6, 0x74, 0xA5, 0x6B, 0xF9,
    0x98, 0x7D, 0x3A, 0x26, 0x5A, 0xAF, 0x87, 0x0D, 0x1B, 0x2E, 0xB2, 0xE3, 0x6A, 0xCC, 0xF1, 0xFF,
    0xD7, 0xF6, 0x1C, 0xC9, 0xE8, 0x70, 0x20, 0x4E, 0x23, 0x3D, 0xC2, 0xAA, 0xDC, 0x0B, 0xF2, 0x5F,
    0x7A, 0xFA, 0x88, 0x97, 0x47, 0xD1, 0x0C, 0x02, 0x31, 0x7F, 0xF4, 0x75, 0x15, 0x93, 0x38, 0x8A,
    0x42, 0x90, 0x71, 0xDD, 0x73, 0x55, 0x7E, 0xB5, 0x5B, 0x29, 0x4C, 0x9A, 0xE0, 0x8C, 0xB0, 0xE5,
    0x64, 0x27, 0x01, 0xDF, 0xAD, 0x21, 0x79, 0x94, 0x92, 0x51, 0x69, 0x7C, 0x22, 0x63, 0x50, 0x85,
    0x2D, 0xE2, 0x40, 0x46, 0x44, 0xA9, 0x82, 0xB6, 0x61, 0xD8, 0xD2, 0xB9, 0x68, 0xAB, 0xB1, 0x5D,
    0x65, 0x54, 0x77, 0xA0, 0xC5, 0xBA, 0x60, 0x9C, 0xE4, 0xFE, 0xEE, 0x99, 0xE6, 0x78, 0x6D, 0x09,
]

FK = [0x3B1F86A4, 0x83F7332D, 0x58ADBA8E, 0x71DC3F73]
CK = [
    0x9A148706, 0x657904A4, 0xB0535D2D, 0x865C7AA7, 0xF7FEF2D4, 0xF09D3A8B,
    0x67CB0390, 0xF3B1D1AA, 0x1941EDE3, 0xCDD55650, 0x272AA612, 0x397B1DC6,
    0x767AAB6B, 0x71A39044, 0x8A77F592, 0x7B5A7907, 0x97D18251, 0xCA1960CB,
    0x44B54134, 0x3F30C70A, 0x5EB36C72, 0x5569E716, 0x51BF832C, 0xF13A95BC,
]

def decode_custom_b64(data: str) -> bytes:
    table = str.maketrans(CUSTOM_ALPHABET, STANDARD_ALPHABET)
    return base64.b64decode(data.translate(table))

def rol32(x: int, n: int) -> int:
    x &= 0xFFFFFFFF
    return ((x << n) | (x >> (32 - n))) & 0xFFFFFFFF

def tau(x: int) -> int:
    return (
        (SBOX[(x >> 24) & 0xFF] << 24)
        | (SBOX[(x >> 16) & 0xFF] << 16)
        | (SBOX[(x >> 8) & 0xFF] << 8)
        | SBOX[x & 0xFF]
    )

def t_encrypt(x: int) -> int:
    y = tau(x)
    return y ^ rol32(y, 2) ^ rol32(y, 10) ^ rol32(y, 18) ^ rol32(y, 24)

def t_key(x: int) -> int:
    y = tau(x)
    return y ^ rol32(y, 13) ^ rol32(y, 23)

def expand_round_keys(key: bytes) -> list[int]:
    mk = [int.from_bytes(key[i : i + 4], "big") for i in range(0, 16, 4)]
    state = [mk[i] ^ FK[i] for i in range(4)]
    round_keys = []
    for i in range(24):
        nxt = state[i] ^ t_key(state[i + 1] ^ state[i + 2] ^ state[i + 3] ^ CK[i])
        state.append(nxt)
        round_keys.append(nxt)
    return round_keys

def crypt_block(block: bytes, round_keys: list[int]) -> bytes:
    words = [int.from_bytes(block[i : i + 4], "big") for i in range(0, 16, 4)]
    for i in range(24):
        words.append(words[i] ^ t_encrypt(words[i + 1] ^ words[i + 2] ^ words[i + 3] ^ round_keys[i]))
    return b"".join(word.to_bytes(4, "big") for word in words[-1:-5:-1])

def decrypt_ecb(ciphertext: bytes, key: bytes) -> bytes:
    round_keys = expand_round_keys(key)[::-1]
    out = bytearray()
    for i in range(0, len(ciphertext), 16):
        out.extend(crypt_block(ciphertext[i : i + 16], round_keys))
    pad = out[-1]
    if not (1 <= pad <= 16 and out[-pad:] == bytes([pad]) * pad):
        raise ValueError("invalid PKCS#7 padding")
    return bytes(out[:-pad])

def iter_pcapng_tcp_payloads(path: Path) -> list[bytes]:
    data = path.read_bytes()
    if data[:4] != b"\x0a\x0d\x0d\x0a":
        raise ValueError("expected pcapng file")

    payloads = []
    offset = 0
    endian = "<"

    while offset + 12 <= len(data):
        block_type = struct.unpack_from("<I", data, offset)[0]
        if block_type == 0x0A0D0D0A:
            bom = struct.unpack_from("<I", data, offset + 8)[0]
            endian = "<" if bom == 0x1A2B3C4D else ">"
        block_len = struct.unpack_from(endian + "I", data, offset + 4)[0]
        if block_type == 0x00000006:
            cap_len = struct.unpack_from(endian + "I", data, offset + 20)[0]
            packet = data[offset + 28 : offset + 28 + cap_len]
            payload = extract_tcp_payload(packet)
            if payload:
                payloads.append(payload)
        if block_len < 12:
            break
        offset += block_len

    return payloads

def extract_tcp_payload(packet: bytes) -> bytes:
    if len(packet) < 14:
        return b""
    eth_type = struct.unpack_from("!H", packet, 12)[0]
    if eth_type != 0x0800:
        return b""

    ip = packet[14:]
    if len(ip) < 20 or ip[9] != 6:
        return b""
    ihl = (ip[0] & 0x0F) * 4
    tcp = ip[ihl:]
    if len(tcp) < 20:
        return b""

    sport, dport = struct.unpack_from("!HH", tcp, 0)
    if 9999 not in (sport, dport):
        return b""
    data_offset = ((tcp[12] >> 4) & 0x0F) * 4
    return tcp[data_offset:]

def load_records_from_pcap(path: Path) -> list[dict[str, str]]:
    records = []
    for payload in iter_pcapng_tcp_payloads(path):
        for line in payload.splitlines():
            line = line.strip()
            if not line.startswith(b"{"):
                continue
            obj = json.loads(line.decode("utf-8"))
            if "filename" in obj and "ciphertext" in obj:
                records.append(obj)
    return records

def default_pcap_path() -> Path:
    return Path(__file__).resolve().parent.parent / "capture.pcap"

def main() -> None:
    parser = argparse.ArgumentParser(description="Decrypt captured files produced by crypt_core.so")
    parser.add_argument("--pcap", type=Path, default=default_pcap_path(), help="pcapng file to parse")
    parser.add_argument("--name", help="only print one decrypted filename")
    args = parser.parse_args()

    key = decode_custom_b64(KEY_B64)[:16]
    records = load_records_from_pcap(args.pcap)

    for record in records:
        name = record["filename"]
        if args.name and name != args.name:
            continue
        plaintext = decrypt_ecb(bytes.fromhex(record["ciphertext"]), key)
        print(f"=== {name} ===")
        try:
            print(plaintext.decode("utf-8"))
        except UnicodeDecodeError:
            print(plaintext.hex())

if __name__ == "__main__":
    main()

5.re2

三层套娃：UPX + b64 + rc4，最后AES解密

魔改UPX，改section脱不了，x64dbg + scylla动调脱壳：

main里面有个比较：

还有b64解码：

法一：厨子解码一下得到一个exe
法二：直接去 C:\Users\xxx\AppData\Local\Temp 拿到解码出来的exe，看到对两 section 自解密，开始动调到校验函数，明显 aes-PKCS#7，看前面有XOR就是CBC模式：

PKCS#7：

aes128_encrypt_block：

add_round_key(state, round_keys);



for (int round = 1; round < AES_ROUND_COUNT; ++round) {
    sub_bytes(state);
    shift_rows(state);
    mix_columns(state);
    add_round_key(state, round_keys + 4 * round);
}



sub_bytes(state);
shift_rows(state);
add_round_key(state, round_keys + 4 * AES_ROUND_COUNT);

aes-keyExpasion改了RCON：

static void key_expansion(const uint8_t key[AES_BLOCK_BYTES], uint32_t round_keys[AES_ROUND_KEY_WORDS]) {
    for (int i = 0; i < 4; ++i) {
        round_keys[i] = ((uint32_t)key[4 * i] << 24) |
                        ((uint32_t)key[4 * i + 1] << 16) |
                        ((uint32_t)key[4 * i + 2] << 8) |
                        (uint32_t)key[4 * i + 3];
    }

    for (int i = 4; i < AES_ROUND_KEY_WORDS; ++i) {
        uint32_t temp = round_keys[i - 1];
        if (i % 4 == 0) {
            temp = sub_word(rot_word(temp)) ^ rcon[(i / 4) - 1];
        }
        round_keys[i] = round_keys[i - 4] ^ temp;
    }
}

exp：

SBOX = [
    0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76,
    0xca,0x82,0xc9,0x7d,0xfa,0x59,0x47,0xf0,0xad,0xd4,0xa2,0xaf,0x9c,0xa4,0x72,0xc0,
    0xb7,0xfd,0x93,0x26,0x36,0x3f,0xf7,0xcc,0x34,0xa5,0xe5,0xf1,0x71,0xd8,0x31,0x15,
    0x04,0xc7,0x23,0xc3,0x18,0x96,0x05,0x9a,0x07,0x12,0x80,0xe2,0xeb,0x27,0xb2,0x75,
    0x09,0x83,0x2c,0x1a,0x1b,0x6e,0x5a,0xa0,0x52,0x3b,0xd6,0xb3,0x29,0xe3,0x2f,0x84,
    0x53,0xd1,0x00,0xed,0x20,0xfc,0xb1,0x5b,0x6a,0xcb,0xbe,0x39,0x4a,0x4c,0x58,0xcf,
    0xd0,0xef,0xaa,0xfb,0x43,0x4d,0x33,0x85,0x45,0xf9,0x02,0x7f,0x50,0x3c,0x9f,0xa8,
    0x51,0xa3,0x40,0x8f,0x92,0x9d,0x38,0xf5,0xbc,0xb6,0xda,0x21,0x10,0xff,0xf3,0xd2,
    0xcd,0x0c,0x13,0xec,0x5f,0x97,0x44,0x17,0xc4,0xa7,0x7e,0x3d,0x64,0x5d,0x19,0x73,
    0x60,0x81,0x4f,0xdc,0x22,0x2a,0x90,0x88,0x46,0xee,0xb8,0x14,0xde,0x5e,0x0b,0xdb,
    0xe0,0x32,0x3a,0x0a,0x49,0x06,0x24,0x5c,0xc2,0xd3,0xac,0x62,0x91,0x95,0xe4,0x79,
    0xe7,0xc8,0x37,0x6d,0x8d,0xd5,0x4e,0xa9,0x6c,0x56,0xf4,0xea,0x65,0x7a,0xae,0x08,
    0xba,0x78,0x25,0x2e,0x1c,0xa6,0xb4,0xc6,0xe8,0xdd,0x74,0x1f,0x4b,0xbd,0x8b,0x8a,
    0x70,0x3e,0xb5,0x66,0x48,0x03,0xf6,0x0e,0x61,0x35,0x57,0xb9,0x86,0xc1,0x1d,0x9e,
    0xe1,0xf8,0x98,0x11,0x69,0xd9,0x8e,0x94,0x9b,0x1e,0x87,0xe9,0xce,0x55,0x28,0xdf,
    0x8c,0xa1,0x89,0x0d,0xbf,0xe6,0x42,0x68,0x41,0x99,0x2d,0x0f,0xb0,0x54,0xbb,0x16,
]

INV_SBOX = [0] * 256
for i, v in enumerate(SBOX):
    INV_SBOX[v] = i

RCON = [0x9c, 0x10, 0x13, 0x15, 0x19, 0x01, 0x31]

NB = 4   # block words
NK = 8   # AES-256 key words
NR = 14  # AES-256 rounds

def xtime(a: int) -> int:
    return ((a << 1) ^ 0x1b) & 0xff if (a & 0x80) else ((a << 1) & 0xff)

def gf_mul(a: int, b: int) -> int:
    res = 0
    for _ in range(8):
        if b & 1:
            res ^= a
        hi = a & 0x80
        a = (a << 1) & 0xff
        if hi:
            a ^= 0x1b
        b >>= 1
    return res

def sub_word(word):
    return [SBOX[b] for b in word]

def rot_word(word):
    return word[1:] + word[:1]

def xor_words(a, b):
    return [x ^ y for x, y in zip(a, b)]

def bytes_to_state(block: bytes):
    state = [[0] * 4 for _ in range(4)]
    for i in range(16):
        state[i % 4][i // 4] = block[i]
    return state

def state_to_bytes(state):
    out = bytearray(16)
    for i in range(16):
        out[i] = state[i % 4][i // 4]
    return bytes(out)

def add_round_key(state, round_key):
    for c in range(4):
        for r in range(4):
            state[r][c] ^= round_key[4 * c + r]

def inv_sub_bytes(state):
    for r in range(4):
        for c in range(4):
            state[r][c] = INV_SBOX[state[r][c]]

def inv_shift_rows(state):
    state[1] = state[1][-1:] + state[1][:-1]
    state[2] = state[2][-2:] + state[2][:-2]
    state[3] = state[3][-3:] + state[3][:-3]

def inv_mix_columns(state):
    for c in range(4):
        s0 = state[0][c]
        s1 = state[1][c]
        s2 = state[2][c]
        s3 = state[3][c]

        state[0][c] = gf_mul(s0, 0x0e) ^ gf_mul(s1, 0x0b) ^ gf_mul(s2, 0x0d) ^ gf_mul(s3, 0x09)
        state[1][c] = gf_mul(s0, 0x09) ^ gf_mul(s1, 0x0e) ^ gf_mul(s2, 0x0b) ^ gf_mul(s3, 0x0d)
        state[2][c] = gf_mul(s0, 0x0d) ^ gf_mul(s1, 0x09) ^ gf_mul(s2, 0x0e) ^ gf_mul(s3, 0x0b)
        state[3][c] = gf_mul(s0, 0x0b) ^ gf_mul(s1, 0x0d) ^ gf_mul(s2, 0x09) ^ gf_mul(s3, 0x0e)

def expand_key_256_custom_rcon(key: bytes) -> bytes:
    if len(key) != 32:
        raise ValueError("AES-256 key must be exactly 32 bytes")

    w = []
    for i in range(NK):
        w.append([key[4*i], key[4*i+1], key[4*i+2], key[4*i+3]])

    total_words = NB * (NR + 1)  # 60
    rcon_index = 0

    for i in range(NK, total_words):
        temp = w[i - 1][:]

        if i % NK == 0:
            temp = xor_words(sub_word(rot_word(temp)), [RCON[rcon_index], 0x00, 0x00, 0x00])
            rcon_index += 1
        elif i % NK == 4:
            temp = sub_word(temp)

        w.append(xor_words(w[i - NK], temp))

    expanded = bytearray()
    for word in w:
        expanded.extend(word)
    return bytes(expanded)

def get_round_key(expanded_key: bytes, round_index: int) -> bytes:
    start = round_index * 16
    return expanded_key[start:start + 16]

def aes256_decrypt_block(block: bytes, expanded_key: bytes) -> bytes:
    if len(block) != 16:
        raise ValueError("block must be 16 bytes")

    state = bytes_to_state(block)

    add_round_key(state, get_round_key(expanded_key, NR))

    for rnd in range(NR - 1, 0, -1):
        inv_shift_rows(state)
        inv_sub_bytes(state)
        add_round_key(state, get_round_key(expanded_key, rnd))
        inv_mix_columns(state)

    inv_shift_rows(state)
    inv_sub_bytes(state)
    add_round_key(state, get_round_key(expanded_key, 0))

    return state_to_bytes(state)

def xor_bytes(a: bytes, b: bytes) -> bytes:
    return bytes(x ^ y for x, y in zip(a, b))

def pkcs7_unpad(data: bytes) -> bytes:
    if not data:
        raise ValueError("empty data")
    pad = data[-1]
    if pad < 1 or pad > 16:
        raise ValueError("invalid PKCS#7 padding")
    if data[-pad:] != bytes([pad]) * pad:
        raise ValueError("invalid PKCS#7 padding")
    return data[:-pad]

def aes256_cbc_decrypt(ciphertext: bytes, key: bytes, iv: bytes, unpad: bool = False) -> bytes:
    if len(key) != 32:
        raise ValueError("key must be 32 bytes for AES-256")
    if len(iv) != 16:
        raise ValueError("iv must be 16 bytes")
    if len(ciphertext) % 16 != 0:
        raise ValueError("ciphertext length must be multiple of 16")

    expanded_key = expand_key_256_custom_rcon(key)

    plaintext = bytearray()
    prev = iv

    for i in range(0, len(ciphertext), 16):
        block = ciphertext[i:i+16]
        dec = aes256_decrypt_block(block, expanded_key)
        plain_block = xor_bytes(dec, prev)
        plaintext.extend(plain_block)
        prev = block

    result = bytes(plaintext)
    return pkcs7_unpad(result) if unpad else result

def to_hex(data: bytes) -> str:
    return data.hex()

def main():
    cipher = bytes([
        0x9b, 0x5e, 0x1e, 0x8f, 0xd7, 0xc3, 0x43, 0x62,
        0xa2, 0x37, 0x86, 0xc0, 0xce, 0x3d, 0x3c, 0xf4,
        0xc3, 0xb6, 0x88, 0xff, 0x3c, 0x9c, 0x13, 0xd2,
        0xbb, 0x6f, 0x49, 0xce, 0xff, 0x59, 0xa2, 0x5c,
        0x36, 0xe4, 0x61, 0x9e, 0x60, 0x61, 0xc3, 0xbb,
        0x3f, 0x63, 0xaf, 0x00, 0x3b, 0x3d, 0x8d, 0xa7
    ])

    key = bytes.fromhex("c23012ab39101833f8ed4e468da15d8d8cfbf0726899dc7c846e7ecf32bbdaf8")
    iv  = bytes.fromhex("aeba0dbbca267f9906ed7c70e38d8b11")

    plaintext = aes256_cbc_decrypt(cipher, key, iv, unpad=False)

    print("Ciphertext hex :", cipher.hex())
    print("Plaintext hex  :", plaintext.hex())

    print("Plaintext", plaintext)

if __name__ == "__main__":
    main()

6.re1

loader使用b64解码一个pyc并运行：

解码stager_pyc_base64并提出pyc，pyc用pylingual反编译：

# Decompiled with PyLingual (https://pylingual.io)
# Internal filename: 'Payload_To_PixelCode_video.py'
# Bytecode version: 3.7.0 (3394)
# Source timestamp: 2026-01-04 04:02:18 UTC (1767499338)

from PIL import Image
import math
import os
import sys
import numpy as np
import imageio
from tqdm import tqdm
def file_to_video(input_file, width=640, height=480, pixel_size=8, fps=10, output_file='video.mp4'):
    if not os.path.isfile(input_file):
        return None
    file_size = os.path.getsize(input_file)
    binary_string = ''
    with open(input_file, 'rb') as f:
        for chunk in tqdm(iterable=iter(lambda: f.read(1024), b''), total=math.ceil(file_size / 1024), unit='KB', desc='读取文件'):
            binary_string += ''.join((f'{byte:08b}' for byte in chunk))
    xor_key = '10101010'
    xor_binary_string = ''
    for i in range(0, len(binary_string), 8):
        chunk = binary_string[i:i + 8]
        if len(chunk) == 8:
            chunk_int = int(chunk, 2)
            key_int = int(xor_key, 2)
            xor_result = chunk_int ^ key_int
            xor_binary_string += f'{xor_result:08b}'
        else:
            xor_binary_string += chunk
    binary_string = xor_binary_string
    pixels_per_image = width // pixel_size * (height // pixel_size)
    num_images = math.ceil(len(binary_string) / pixels_per_image)
    frames = []
    for i in tqdm(range(num_images), desc='生成视频帧'):
        start = i * pixels_per_image
        bits = binary_string[start:start + pixels_per_image]
        if len(bits) < pixels_per_image:
            bits = bits + '0' * (pixels_per_image - len(bits))
        img = Image.new('RGB', (width, height), color='white')
        for r in range(height // pixel_size):
            row_start = r * (width // pixel_size)
            row_end = (r + 1) * (width // pixel_size)
            row = bits[row_start:row_end]
            for c, bit in enumerate(row):
                color = (0, 0, 0) if bit == '1' else (255, 255, 255)
                x1, y1 = (c * pixel_size, r * pixel_size)
                img.paste(color, (x1, y1, x1 + pixel_size, y1 + pixel_size))
        frames.append(np.array(img))
    with imageio.get_writer(output_file, fps=fps, codec='libx264') as writer:
        for frame in tqdm(frames, desc='写入视频帧'):
            writer.append_data(frame)
if __name__ == '__main__':
    input_path = 'payload'
    if os.path.exists(input_path):
        file_to_video(input_path)
    else:
        sys.exit(1)

XOR 0xaa之后的 payload_file 的二进制 -> 按照 8 * 8 一块像素生成一堆图片，1黑像素，0白像素，一张图片像素个数为 80 * 60 个，使用opencv解出来是个ELF：

#!/usr/bin/env python3
"""Reverse stager.py: extract payload from video.mp4"""

import cv2
import numpy as np
import sys

PIXEL_SIZE = 8
XOR_KEY = 0xAA

def extract_payload(video_path, output_path="payload"):
    cap = cv2.VideoCapture(video_path)
    if not cap.isOpened():
        print(f"Cannot open {video_path}", file=sys.stderr)
        sys.exit(1)

    width = int(cap.get(cv2.CAP_PROP_FRAME_WIDTH))
    height = int(cap.get(cv2.CAP_PROP_FRAME_HEIGHT))
    total = int(cap.get(cv2.CAP_PROP_FRAME_COUNT))
    print(f"{width}x{height}, {total} frames")

    bits = []
    idx = 0
    while True:
        ret, frame = cap.read()
        if not ret:
            break
        gray = cv2.cvtColor(frame, cv2.COLOR_BGR2GRAY)
        for r in range(0, height, PIXEL_SIZE):
            for c in range(0, width, PIXEL_SIZE):
                block = gray[r:r + PIXEL_SIZE, c:c + PIXEL_SIZE]
                bits.append("1" if np.mean(block) < 128 else "0")
        idx += 1
        print(f"\r[{idx}/{total}]", end="", flush=True)
    cap.release()
    print()

    out = bytearray()
    for i in range(0, len(bits) - 7, 8):
        out.append(int("".join(bits[i:i + 8]), 2) ^ XOR_KEY)

    with open(output_path, "wb") as f:
        f.write(out)
    print(f"Wrote {len(out)} bytes -> {output_path}")

if __name__ == "__main__":
    extract_payload("video.mp4")

exp：

import hashlib

md5_map = {hashlib.md5(bytes([i])).hexdigest(): chr(i) for i in range(256)}

hashes = [
    "8277e0910d750195b448797616e091ad",
    "0cc175b9c0f1b6a831c399e269772661",
    "4b43b0aee35624cd95b910189b3dc231",
    "e358efa489f58062f10dd7316b65649e",
    "f95b70fdc3088560732a5ac135644506",
    "c81e728d9d4c2f636f067f89cc14862c",
    "92eb5ffee6ae2fec3ad71c777531578f",
    "c4ca4238a0b923820dcc509a6f75849b",
    "8fa14cdd754f91cc6554c9e71929cce7",
    "c9f0f895fb98ab9159f51fd0297e236d",
    "336d5ebc5436534e61d16e63ddfca327",
    "eccbc87e4b5ce2fe28308fd9f2a7baf3",
    "cfcd208495d565ef66e7dff9f98764da",
    "a87ff679a2f3e71d9181a67b7542122c",
    "e4da3b7fbbce2345d7772b0674a318d5",
    "e1671797c52e15f763380b45e841ec32",
    "8f14e45fceea167a5a36dedd4bea2543",
    "1679091c5a880faf6fb5e6087eb1b2dc",
    "4a8a08f09d37b73795649038408b5f33",
    "cbb184dd8e05c9709e5dcaedaa0495cf",
]

flag = "".join(md5_map[h] for h in hashes)
print(flag)

DASCTF 2025

Mon, 08 Dec 2025 00:00:00 GMT

ezmac

参考：

去掉一个花指令：

__text:00000001000003A8 00 00 80 D2       MOV             X0, #0
__text:00000001000003AC 00 00 00 CB       SUB             X0, X0, X0
[ ... ]
__text:00000001000003C4 E4 03 00 AA       MOV             X4, X0
__text:00000001000003C8 9F 00 00 F1       CMP             X4, #0
[ ... begin]
__text:00000001000003CC 40 01 00 54       B.EQ            loc_1000003F4
__text:00000001000003D0 25 00 00 90 A5 EC ADRL            X5, input
__text:00000001000003D0 00 91
__text:00000001000003D8 86 04 00 D1       SUB             X6, X4, #1
__text:00000001000003DC A5 00 06 8B       ADD             X5, X5, X6    ; byte_10000403A
__text:00000001000003E0 A7 00 40 39       LDRB            W7, [X5]
__text:00000001000003E4 FF 28 00 71       CMP             W7, #0xA
__text:00000001000003E8 61 00 00 54       B.NE            loc_1000003F4
__text:00000001000003EC 07 00 80 52       MOV             W7, #0
__text:00000001000003F0 A7 00 00 39       STRB            W7, [X5]
[ ... end]
__text:00000001000003F4                   loc_1000003F4

key = 0x39
cipher = [0x7d, 0x7b, 0x68, 0x7f, 0x69, 0x78, 0x44, 0x78, 0x72, 0x21, 0x74, 0x76, 0x75, 0x22, 0x26, 0x7b, 0x7c, 0x7e, 0x78, 0x7a, 0x2e, 0x2d, 0x7f, 0x2d]

key_list = []
for i in range(len(cipher)):
    key_list.append(key)
    key += 1

for c, k in zip(cipher, key_list):
    print(chr(c ^ k), end='')

DASCTF{83c720da35436cc0}

如果缺少OpenSSL 1.1可以下一个:

wget https://mirror.cs.uchicago.edu/ubuntu/ubuntu/pool/main/o/openssl/libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb
sudo dpkg -i libssl1.1_1.1.1f-1ubuntu2.24_amd64.deb

client有一个读config：

if (mode == 0) {
    memcpy(out, buf + 4, 16);       // bytes [4:19] -> key
} else if (mode == 1) {
    memcpy(out, buf + 23, 16);      // bytes [23:38] -> iv
} else if (mode == 2) {
    memcpy(out, buf + 46, 42);      // bytes [46:87] -> passwd
} else {
    free(buf);
    fclose(f);
    return 0;
}

传明文时除了”req login …”都用RC4，传Key IV时用RSA。 server的state有0123分别对应：接收”req login …”明文，接收rsa(IV)，接收rsa(Key)，接收aes-cbc(passwd)。每个state都有一个简单的for循环校验，不通过输出backdoor。

nepqd已知，先构建出PEM：

from cryptography.hazmat.primitives.asymmetric import rsa
from cryptography.hazmat.primitives import serialization

N_HEX = "9a49428cadd84b7a81cb80f916e645a6a9dd23c2fe679f93af6a77eff0f0bb1309b77fb7861275f07ab41e98ae5c2ecf933f27d47b9ce0a55a3e06569cacbb4c9183f8ee9a47f2cfbb3a5965c9326f45d2d608cfeabea1a1879eae95b70224d2e7736b9bc4109756f55a3f70f11a9b9c6564fb6456d329c336fbb59859db5fde1f2338294e863c4f05b4a89e6c3b761d52a2081a0af0a320fde831daa741fad77aa7ef2dd30b3e33d1a6e7b44ed44ef40de4557a4fd65b63db63d105386bbd81071739ec3d0fe44b6a0952a2b065bededfecea6e22229fea32adfc9a6e2ccfdf5da437a56ad41d7ef08c2c4635d3a0218aab2a5ed6e9dd42d684bc918efe24d3"     # off_C2D0
E_HEX = "10001"
P_HEX = "b782eca6a75067d398dd8ef00e9d024cc554f292d7820a72848d3c619dafaf61ab8f7d719d4cd8ac44351281afd64f8cf23bc8aa5ec48bbd9eb301af50b96f528a108e6643223130a84addd5b9e1ad108c44d706adc5fb097a17ab990f395f3781296e356ac60d64b9a2a641c3e2f593bbe98d38df528a1c67e583ef623b667f"     # off_C2E0
Q_HEX = "d73b03a9b0c4b7e9236d56938d6264e6c8ecaab709effcf02f4e5ec26310273b81089e1cb3d4c050e852721d3daf1d5b7a2be2df02bafcffb77e17d1a8e6428bf87579c859cbe778d3b9ea93aff0d934a0e7b83a1d7a39d0a1779ea18db5fffd99b118c4c2361a22308f54f7ae568e7bf2de6d1b6eb0be1d77eca8edd94f9fad"     # off_C2E8
D_HEX = "28c7df24a5798679db2a44979275f5f3179db180d91335702942fb1b70e985de825da90f2eb65d20ddf8be1d9d4e15bc1d84e95795ff8c0c28ce3c33fde054f6e82a4f4cc22597b350c9c62ccc0188bd4152a701a3601558f22aa9fae8b9fdac6c2bc09b1637f71e0511805e04b203c4fdb2b36ad232fe819b06ed4e57c74f39fd9b72623c16ff2100f148f622bf12876260c4859672360dc0da3da6b45c5c8c6215ccda072765840c213fba11a91d6bf598a8a8065797566c8950a34ea0a072a9ed0c38bdc58662f186ec578ca55d5098443fd566cc722ace9c4e89afc4e302c8a4870e11a003b935f4a102695bfd64bb0fa74dcc372682e2b24ff45a1a69"     # off_C2F0

n = int(N_HEX, 16)
e = int(E_HEX, 16)
p = int(P_HEX, 16)
q = int(Q_HEX, 16)
d = int(D_HEX, 16)

# 计算 CRT 参数
dp = d % (p - 1)
dq = d % (q - 1)
qi = pow(q, -1, p)

priv_numbers = rsa.RSAPrivateNumbers(
    p=p, q=q, d=d,
    dmp1=dp, dmq1=dq, iqmp=qi,
    public_numbers=rsa.RSAPublicNumbers(e=e, n=n),
)

key = priv_numbers.private_key()

pem = key.private_bytes(
    encoding=serialization.Encoding.PEM,
    format=serialization.PrivateFormat.TraditionalOpenSSL,  # BEGIN RSA PRIVATE KEY
    encryption_algorithm=serialization.NoEncryption(),
)

print(pem.decode())

再用厨子，RSA-OAEP解密出key和IV:

IV aassddffgghhjjll
Key qqwweerrttyyuuii
Passwd 是个aes-cbc

DASCTF{dqmaxfwkm921kr21m;df1m1dqmlk1d12d1}

羊城杯 2025

Tue, 14 Oct 2025 00:00:00 GMT

ez_py

给了两个玩意:

pyinstaller 打包的key.exe, 要求输入正确9个数字
pyarmor 打包的src.py, 需要用Pyarmor Static Unpack One-Shot Tool解包

每个pyarmor-obfuscated app文件夹内一般都会有一个pyarmor_runtime.pyd文件, 运行shot.py的时候需要-r指定pyarmor_runtime.pyd; 同时需要补一下文件头才能被工具扫, 后六位和给的pyarmor_runtime_000000文件夹名字后六位相同:

 python shot.py ./ -r C:\path\to\src\pyarmor_runtime_000000\pyarmor_runtime.pyd

看解出来的src.py.1shot.cdc.py有KSA和PRGA; print一下make.__doc__:

差key, 用decompyle3, pycdc都不行, 只有一部分, 用pylingual:

jinhsi内部调用逻辑不全, 接下来两步:

根据pylingual + das信息丢给LLM还原程序源代码, 还原的程序缺Carlotta
写个AST截胡脚本把Carlotta截下来

还原的源码, 逻辑和源程序完全一致:

# -*- coding: utf-8 -*-
# Reconstructed from your disassembly

import ast
import types  # 按原文件导入，但未直接使用
import sys

def Carlotta(o0oC, o0oD, o0oE, o0oF):
    o0oH = 305419896
    o0oI = o0oE & 65535
    o0oJ = o0oE >> 16 & 65535
    o0oK = (o0oE ^ o0oF) & 65535
    o0oL = (o0oE >> 8 ^ o0oF) & 65535
    o0oM = o0oH * (o0oF + 1) & 4294967295
    o0oN = (o0oD << 5) + o0oI ^ o0oD + o0oM ^ (o0oD >> 5) + o0oJ
    o0oP = o0oC + o0oN & 65535
    o0oN = (o0oP << 5) + o0oK ^ o0oP + o0oM ^ (o0oP >> 5) + o0oL
    o0oQ = o0oD + o0oN & 65535
    return (o0oP, o0oQ)

def _tea_helper_func(a, b, c):
    magic1 = (a ^ b) & 3735928559
    magic2 = c << 3 | a >> 5
    return magic1 + magic2 - (b & 3405691582) & 4294967295

def _fake_tea_round(x, y):
    return (x * 2654435769 ^ y + 305419896) & 4294967295
_tea_magic_delta = 2654435769 ^ 305419896
_tea_dummy_keys = [4369, 8738, 13107, 17476]


# 正确答案（9 个整数）
o0o0o0 = [
    105084753,
    3212558540,  # 0xBF7BC0CC
    351342182,
    844102737,
    2002504052,
    356536456,
    2463183122,  # 0x92D13112
    615034880,
    1156203296,
]

def changli(o0o0o1, o0o0o2, o0o0o3):
    """
    TEA 风格的 32 轮混淆（与反汇编一致）
    """
    o0o0o4 = 0x87456123  # 2269471011
    o0o0o5 = o0o0o3 & 0xFFFFFFFF
    o0o0o6 = ((o0o0o3 >> 8) ^ 0x12345678) & 0xFFFFFFFF
    o0o0o7 = ((o0o0o3 << 4) ^ 0x87654321) & 0xFFFFFFFF
    o0o0o8 = ((o0o0o3 >> 12) ^ 0xABCDEF00) & 0xFFFFFFFF

    o0o0o9  = o0o0o1 & 0xFFFFFFFF
    o0o0o10 = o0o0o2 & 0xFFFFFFFF
    o0o0o11 = 0

    for _ in range(32):
        o0o0o11 = (o0o0o11 + o0o0o4) & 0xFFFFFFFF
        o0o0o9  = (
            o0o0o9
            + (((o0o0o10 << 4) + o0o0o5) ^ (o0o0o10 + o0o0o11) ^ ((o0o0o10 >> 4) + o0o0o6))
        ) & 0xFFFFFFFF
        o0o0o10 = (
            o0o0o10
            + (((o0o0o9 << 4) + o0o0o7) ^ (o0o0o9 + o0o0o11) ^ ((o0o0o9 >> 4) + o0o0o8))
        ) & 0xFFFFFFFF

    return (o0o0o9, o0o0o10)

def Shorekeeper(o0o0o12):
    """
    拆 32 位为 (高 16, 低 16)
    """
    o0o0o13 = o0o0o12 >> 16
    o0o0o14 = o0o0o12 & 0xFFFF
    return (o0o0o13, o0o0o14)

def Kathysia(o0o0o15, o0o0o16):
    """
    合并为 32 位
    """
    return (o0o0o15 << 16) | (o0o0o16 + 0)

def shouan(o0o0o32):
    """
    传入 9 个整数的 key，做一轮拆分→Carlotta→合并，
    然后再做 8 次相邻 pair 的 changli 混淆，返回 9 个整数。
    """
    if len(o0o0o32) != 9:
        raise ValueError("需要输入9个key")

    o0o0o35 = []
    for o0o0o49, o0o0o34 in enumerate(o0o0o32):
        o0o0o33 = o0o0o49 * o0o0o49
        o0o0o36, o0o0o37 = Shorekeeper(o0o0o34)
        o0o0o38, o0o0o39 = Carlotta(o0o0o36, o0o0o37, 2025 + o0o0o49, o0o0o33)
        o0o0o40 = Kathysia(o0o0o38, o0o0o39)
        o0o0o35.append(o0o0o40)

    o0o0o41 = []
    for i in range(8):
        r1, r2 = changli(o0o0o35[i], o0o0o35[i + 1], 2025)
        o0o0o35[i]     = r1
        o0o0o35[i + 1] = r2
        o0o0o41.append(o0o0o35[i])

    o0o0o41.append(o0o0o35[8])
    return o0o0o41

def jinhsi():
    print("请输入9个数字:")
    try:
        o0o0o46 = input().strip()
        if "," in o0o0o46:
            o0o0o42 = o0o0o46.split(",")
        else:
            o0o0o42 = o0o0o46.split()

        if len(o0o0o42) != 9:
            print("错误: 需要输入9个数")
            return

        o0o0o43 = []
        for o0o0o44 in o0o0o42:
            o0o0o45 = int(o0o0o44.strip())
            o0o0o43.append(o0o0o45)

        o0o0o48 = shouan(o0o0o43)
        if o0o0o48 == o0o0o0:
            print("正确!这是真正的key")
            sys.exit(0)
        else:
            print("错误!这不是正确的key")
            print(f"你的结果: {o0o0o48}")
            sys.exit(0)

    except ValueError:
        print(f"错误: '{o0o0o44}' 不是有效的整数")
    except Exception as e:
        print(f"发生错误: {e}")

if __name__ == '__main__':
    jinhsi()

写脚本解出key1234, 5678, 9123, 4567, 8912, 3456, 7891, 2345, 6789, 进而解出flag:

# -*- coding: utf-8 -*-

MASK32 = 0xFFFFFFFF

# 题目给定的最终比对列表 o0o0o0
TARGET = [
    105084753,
    3212558540,
    351342182,
    844102737,
    2002504052,
    356536456,
    2463183122,
    615034880,
    1156203296
]

# ---------- changli 的 32 轮“解密”（逆向） ----------
def changli_decrypt(v0, v1, c):
    delta = 2269471011
    k0 = c & MASK32
    k1 = ((c >> 8) ^ 305419896) & MASK32
    k2 = ((c << 4) ^ 2271560481) & MASK32
    k3 = ((c >> 12) ^ 2882400000) & MASK32
    s = (delta * 32) & MASK32
    v0 &= MASK32
    v1 &= MASK32
    for _ in range(32):
        v1 = (v1 - (((v0 << 4) + k2) ^ (v0 + s) ^ ((v0 >> 4) + k3))) & MASK32
        v0 = (v0 - (((v1 << 4) + k0) ^ (v1 + s) ^ ((v1 >> 4) + k1))) & MASK32
        s = (s - delta) & MASK32
    return v0, v1

# ---------- Carlotta 的闭式逆向 ----------
def invert_carlotta(P, Q, idx):
    # E=2025+idx, F=idx^2, H=0x12345678
    E = 2025 + idx
    F = idx * idx
    H = 305419896

    I = E & 0xFFFF
    J = (E >> 16) & 0xFFFF
    K = (E ^ F) & 0xFFFF
    L = ((E >> 8) ^ F) & 0xFFFF
    M = (H * (F + 1)) & 0xFFFFFFFF

    def f0(D):
        return (((D << 5) + I) ^ (D + M) ^ ((D >> 5) + J))
    def f1(Pv):
        return (((Pv << 5) + K) ^ (Pv + M) ^ ((Pv >> 5) + L))

    N1 = f1(P)
    D  = (Q - N1) & 0xFFFF
    N0 = f0(D)
    C  = (P - N0) & 0xFFFF
    return C, D

# ---------- 主过程：先逆 changli，再逆 Carlotta ----------
def recover_inputs():
    # 1) 逆 8 次链式 changli，复原 Carlotta 拼回的 9 个 32 位数
    arr = TARGET[:]  # 最终数组
    for i in range(7, -1, -1):
        arr[i], arr[i+1] = changli_decrypt(arr[i], arr[i+1], 2025)

    # 2) 对每个 32 位数（高16= P, 低16= Q）闭式反推 (C,D)，得到原始输入 v=(C<<16)|D
    res = []
    for idx, val in enumerate(arr):
        P = (val >> 16) & 0xFFFF
        Q = val & 0xFFFF
        C, D = invert_carlotta(P, Q, idx)
        v = ((C & 0xFFFF) << 16) | (D & 0xFFFF)
        res.append(v)
    return res

if __name__ == "__main__":
    keys = recover_inputs()
    print("Recovered 9 numbers (comma-separated):")
    print(", ".join(str(x) for x in keys))
# 1234, 5678, 9123, 4567, 8912, 3456, 7891, 2345, 6789

def ksa(key):
    key_len = len(key)
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % key_len]) % 256
        S[i], S[j] = S[j], S[i]
    return S

def prga(S, data_len):
    i = 0
    j = 0
    keystream = []
    for index in range(data_len):
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        t = (S[i] + S[j] + index % 23) % 256
        keystream.append(S[t])
    return keystream

cipher = [
    1473,
    3419,
    9156,
    1267,
    9185,
    2823,
    7945,
    618,
    7036,
    2479,
    5791,
    1945,
    4639,
    1548,
    3634,
    3502,
    2433,
    1407,
    1263,
    3354,
    9274,
    1085,
    8851,
    3022,
    8031,
    734,
    6869,
    2644,
    5798,
    1862,
    4745,
    1554,
    3523,
    3631,
    2512,
    1499,
    1221,
    3226,
    9237]


flag = cipher
fuck_key = [1234, 5678, 9123, 4567, 8912, 3456, 7891, 2345, 6789]
t0 = [i % 0xff for i in fuck_key]
key = prga(ksa(bytes(t0)), len(cipher))
for i in range(len(cipher)):
    t1 = fuck_key[i % 9] if i % 2 == 0 else (fuck_key[i % 9] * 2) % 0xFFF
    flag[i] ^= key[i] + t1

print(bytes(flag))
# flag{8561a-852sad-7561b-asd-4896-qwx56}

Tauri

用Tauri Dumper:

$ tauri-dumper.exe -i easyTauri.exe -o C:\path\to\your\dump

用synchrony去混淆actuator.js发现里面调了一个native函数greet:

async function _0x9a2c6e7() {
    greetInputEl = document.querySelector('#greet-input');
    greetMsgEl = document.querySelector('#greet-msg');
    let getFlag = greetInputEl.value;
    const ciphertext = rc4('SadTongYiAiRC4HH', getFlag);
    greetMsgEl.textContent = await invoke('ipc_command', { name: uint8ArrayToBase64(ciphertext) });
}

搜ipc_command, 或者base64表ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/; 逆的时候注意Rust的Borrow机制, 值存储在堆上, 被一个binding (实际是个三指针结构体: cap, ptr, len. i.e, 容量, buffer起始, 当前长度)引用.

整体逻辑为hacked_RC4 + b64 + hacked_tea + _byteswap_ulong + b64:

RC4 改了S盒初始化
TEA改了初始sum = 0x7E3997B7

#include <stdio.h>
#include <stdlib.h>
#include <stdint.h>
#include <string.h>

#define ARRLEN(arr) (int)(sizeof(arr) / sizeof(arr[0]))
#define DELTA 0x7E3997B7

void TEA_decrypt(uint32_t v[2], const uint32_t key[4])
{
    uint32_t v0 = _byteswap_ulong(v[0]), v1 = _byteswap_ulong(v[1]), delta = 0x7E3997B7, sum = delta * 33;
    for (int i = 0; i < 32; i++)
    { // 32 rounds
        sum -= delta;
        v1 -= ((v0 << 4) + key[2]) ^ (v0 + sum) ^ ((v0 >> 5) + key[3]);
        v0 -= ((v1 << 4) + key[0]) ^ (v1 + sum) ^ ((v1 >> 5) + key[1]);
    }
    v[0] = v0;
    v[1] = v1;
}

void print(uint8_t *data, int len)
{
    int i;
    for (i = 0; i < len; ++i)
    {
        printf("%02X ", data[i]);
        if ((i + 1) % 16 == 0 || i == len - 1)
        {
            int j;
            printf(" ");
            for (j = (i / 16) * 16; j <= i; ++j)
            {
                printf("%c", (data[j] >= 32 && data[j] <= 126) ? data[j] : '.');
            }
            printf("\n");
        }
    }
    printf("%s", data);
}

uint8_t cipher[] = {0x75,0xa1,0x7f,0x0e,0x44,0x31,0x8b,0x11,0xa6,0xce,0x7d,0x1a,0x3c,0x55,0xb6,0x13,0x63,0xe1,0x33,0xc3,0x5a,0x6d,0x1b,0x4b,0x8e,0x9e,0xa9,0x23,0xe7,0x3c,0x4e,0xd6,0x37,0x58,0xcb,0x8f,0xc5,0xf9,0xef,0x94,0x0b,0x29,0xf5,0xa9,0x6e,0x7f,0xc9,0xe8,0x67,0x2f,0xd3,0xe9,0x2c,0xfd,0x0c,0x98};
uint32_t key[] = {0x636C6557, 0x74336D4F, 0x73757230, 0x55615474};
int main(){
	for(int i = 0;i < ARRLEN(cipher);i += 8){
        TEA_decrypt((uint32_t *)&cipher[i], key);
    }
    print(cipher, ARRLEN(cipher));
	return 0;
}
// jmyHBntjPmBiE9k5OTl+7WHUjc6aLHY1ZThmMWRhvUAxZIVhZn0=

def ksa(key):
    key_len = len(key)
    S = [0] * 256
    j = 0
    for i in range(256):
        S[i] = i
        j = (j + S[i] + key[i % key_len]) % 256
        S[i], S[j] = S[j], S[i]
    return S

def prga(S, data_len):
    i = 0
    j = 0
    keystream = []
    for _ in range(data_len):
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        t = (S[i] + S[j]) % 256
        keystream.append(S[t])
    return keystream

def rc4(key, data):
    result = []
    keystream = prga(ksa(key), len(data))
    for c, k in zip(data , keystream):
        result.append(c ^ k)
    return bytes(result)

cipher = [0x8e,0x6c,0x87,0x06,0x7b,0x63,0x3e,0x60,0x62,0x13,0xd9,0x39,0x39,0x39,0x7e,0xed,0x61,0xd4,0x8d,0xce,0x9a,0x2c,0x76,0x35,0x65,0x38,0x66,0x31,0x64,0x61,0xbd,0x40,0x31,0x64,0x85,0x61,0x66,0x7d]
key = b'SadTongYiAiRC4HH'

print(bytes(rc4(key, cipher)))
# flag{cf8be09b1c8a415f8b5e8f1dac71d4af}

关于Bash和Linux

Fri, 10 Oct 2025 00:00:00 GMT

Bourne Again SHell

来自GNU Project, 是 Bourne shell (sh) 加强版, 属于Shell大类, 本质上是个程序, 运行在GNU操作系统上, 作为用户与操作系统用户空间程序交互的接口.

说这些可能会让你一头雾水. 所以, 先用再说. 如果你是Windows系统, 需要使用WSL¹安装使用Bash的GNU/Linux发行版 (推荐Ubuntu或Debian等). 过程不难, 可以参照官方文档操作²; 如果你是GNU/Linux系统, 想必你应该熟悉一些Bash的基本命令了. 首先在这里看看bash都有哪些指令. 另外, 在mini赛题中会出现ELF格式的文件, 需要在GNU/Linux环境 (原生, WSL, 容器或虚拟机) 上进行运行和调试.

了解Bash

如果想要系统学习Bash以及相关基础, 推荐: The Missing Semester of Your CS Education
或者说直接下手开干, 大语言模型 是不错的老师
当然Bash只是Shell家族中最广泛使用的一员, 还有一些和它平起平坐的Shell: Zsh, nushell, KornShell, Tcsh, Fish 等等.

一些问题

Terminal / Shell / CLI / Bash 都是一个东西吗?
Linux, GNU/Linux, GNU Project, GNU Operating System 都是一个东西吗?
编译C的编译器gcc, g++, 全称是什么? 属于什么?
Unix和Unix-like的关系是什么?

Terminal / Shell / CLI / Bash 都是一个东西吗？ 当然———不是, 他们相关, 但不属于一个层级, Terminal (终端程序, 是个程序³, 负责显示和输入) 提供一个界面让你访问, Shell (命令解释器) 是一个抽象的集合, 具体包括Bash等等, 他们既可以让你在终端中敲命令与操作系统交互⁴, 还能写成脚本批量执行 (Bash既是交互式命令解释器, 也是脚本语言⁵, 暂且把它想成Python⁶); CLI (命令行界面) 更抽象, 是一种交互方式. Shell及其他的CLI程序 (e.g., git, curl 等等) 是CLI的具体化, 都是使用line-by-line的命令行方式与软件本身交互.

Linux, GNU/Linux, GNU Project, GNU Operating System 都是一个东西吗? 也不是, Linux严格来讲是Linux内核 (组成操作系统的核心); GNU/Linux = Linux 内核⁷ + GNU 用户空间的工具们 (包括Bash); GNU Project顾名思义是个项目, 由 Richard Stallman 发起, 感兴趣可以看看官方的介绍; GNU Operating System = GNU Hurd内核 + GNU 用户空间的工具们 (包括Bash), 虽然单说Linux并不是完整的操作系统, 但随着人们的误解和这么说的人越来越多, Linux也可以指代 GNU/Linux ,感兴趣可以看看GNU创始人的澄清.

编译C的编译器gcc, g++, 全称是什么? 属于什么? gcc (原本只是GNU C Compiler, 后来是GNU Compiler Collection), 它不仅可以编译C, 还可以编译C++, Objective-C, Fortran, Ada, Go等挺多语言; g++ (GNU C++ Compiler, 是GCC 中的 C++ 前端) g++（GNU C++ Compiler）是 GCC 的 C++ 前端/驱动程序。就命令 g++ 而言，它调用 GCC 的 C++ 前端，默认按 C++ 语法处理源文件（包括 .c，除非用 -x c 指定为 C），并默认链接 C++ 标准库。GCC 属于 GNU Project 的一部分。

省流版丢个表格能清晰点, 当我们使用gcc main.* -o main时:

扩展名	默认语言模式
`.c`	C (但用 `g++` 编译会当作 C++)
`.cc` `.cpp` `.cxx` `.c++`	C++
`.C`（大写）	C++
`.m`	Objective-C
`.mm`	Objective-C++
…	…

所以.cpp 用g++, .c用gcc.

Unix和Unix-like的关系是什么? Unix-like系统现在包含正统的Unix系统,, 一个直观的树形图:

Unix-like
 ├── Certified Unix
 │    ├── IBM AIX
 │    ├── HP-UX
 │    ├── Oracle Solaris
 │    └── macOS
 └── Non-certified but Unix-like
      ├── GNU/Linux
      ├── FreeBSD / OpenBSD / NetBSD
      ├── illumos
      └── Minix
      └── ...

展示了二者的关系. 图表中的第二类Unix-like系统 (无认证) 的描述: 具有Unix特性和接口的系统, 目录和文件系统的层级结构类似Unix, 遵循POSIX的操作系统.

最后

零零零基础, 不用担心很多东西不懂, 从 LLMs, Google, Wikipedia, Github, 甚至Youtube, Bilibili 等等网站能学到的东西数不胜数, 关键要有耐心, 推荐先浏览NJU-PA的Introduction部分
玩的开心
本文如有任何问题, 欢迎大佬指正!

推荐 WSL2, 最接近真实 Linux. 注意换行符 CRLF/LF 与路径差异. 可以在Windows Terminal中设置WSL路径转换
也可用 Git for Windows 自带的 Git Bash, Cygwin 或 MSYS2 等, 但还不急, 这些你以后可能会遇到
这里指Terminal Emulator, 并不是真正的Terminal, 感兴趣可以看看这个reddit的讨论
当然不止终端交互 (ref: wikipedia), 比如 Windows 的 explorer.exe. 右键菜单, 文件关联, 桌面等都属于它的职能, 而他是个Windows Shell (GUI Shell). 简而言之, 如果它主要启动/管理其他程序和环境, 那就是shell, 否则不是.
Windows 用 CRLF (\r\n), Unix/WSL/macOS 用 LF (\n). Bash 脚本必须是 LF; CRLF 会报错哦
实际上不准确, 我们用Bash编排流程 (它擅长使用CLI工具制作流程); 用 Python/Go 写程序; 性能交给 C/C++/Rust.
Note: Project 是组织与计划; Operating System 指 Hurd 内核 + 用户空间; 多数人日常用的是 Linux 内核而非 Hurd.

陇剑杯

Tue, 09 Sep 2025 00:00:00 GMT

Lesscommon

注意x + y == (x ^ y) + ((x & y) << 1)

__int64 __fastcall one_rond_enc(context *context_struct, unsigned __int8 *p_input_i, _BYTE *p_output_i)
{
  interim_0 = v0 + key[0];
  interim_1 = v1 + key[1];
  for ( i = 1; i <= 12 ++i ) // 12 iters
  {
    interim_0 = interim_1 ^ ROL4(key[2*i] + interim_0, interim_1);
    interim_1 = interim_0 ^ ROL4(key[2*i] + interim_1, interim_0);
  }
}

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
#include <stdint.h>

unsigned int cipher[12] = {
    0xF3AB6F4C, 0xF6E27813, 0x991C9D86, 0x10CC85DE, 0x05EE28E8, 0x344B2192, 0x3C172843, 0x51735B56, 
    0x0F1D8A9F, 0x562C3497, 0x48699F42, 0xF58AD5A3
};

unsigned int key[26] = {
    0xE29075B4, 0xBBF28559, 0x01CEA3AA, 0xC32F06A9, 0x322BCBD2, 0x4B6947FD, 0xC65A9676, 0xE6EC21DE, 
    0xFC0D4679, 0xFBAD7BE4, 0x1E6A2032, 0x47150799, 0xFCA5733F, 0xD7D2FD1C, 0xA957923D, 0x94A4D5C6, 
    0xD8EBABA8, 0x7321CBE0, 0x5A0E0417, 0xA9F74244, 0x4616ADBD, 0xFB0925C4, 0x168F9ACC, 0xBE6AF2E2, 
    0xDB033BA9, 0xFFA2830E
};

uint32_t ROR4(uint32_t value, uint32_t count){
    count %= 32;
    return (value >> count) | (value << (32 - count));
}

int main(){
    for (int i = 0;i < 12;i++){
        uint32_t v0 = cipher[2 * i];
        uint32_t v1 = cipher[2 * i + 1];
        for (int i = 12; i >= 1 ;--i ) // 12 iters
        {
            v1 = ROR4(v1 ^ v0, v0) - key[2*i + 1];
            v0 = ROR4(v0 ^ v1, v1) - key[2*i];
        }
            v0 -=  key[0];
            v1 -=  key[1];

            cipher[2 * i] = v0;
            cipher[2 * i + 1] = v1;
    }

    printf("%s", cipher);
    
    return 0;
}
// flag{8c1fe64f-1085-48bb-947e-7635abc40f4c}

Precedence	Operator	Description	Associativity
1	`()` `[]` `->` `.` `++` `--` (postfix)	Function call, array subscript, member access, postfix increment/decrement	Left to Right
2	`++` `--` (prefix) `+` `-` (unary) `!` `~` `*` (dereference) `&` (address-of) `sizeof` `_Alignof`	Unary operators, prefix increment/decrement	Right to Left
3	`*` `/` `%`	Multiplication, division, modulus	Left to Right
4	`+` `-`	Addition, subtraction	Left to Right
5	`<<` `>>`	Bitwise left shift, right shift	Left to Right
6	`<` `<=` `>` `>=`	Relational operators	Left to Right
7	`==` `!=`	Equality operators	Left to Right
8	`&`	Bitwise AND	Left to Right
9	`^`	Bitwise XOR (exclusive OR)	Left to Right
10	`\|`	Bitwise OR (inclusive OR)	Left to Right
11	`&&`	Logical AND	Left to Right
12	`\|\|`	Logical OR	Left to Right
13	`?:`	Ternary conditional operator	Right to Left
14	`=` `+=` `-=` `*=` `/=` `%=` `<<=` `>>=` `&=` `^=` `\|=`	Assignment operators	Right to Left
15	`,`	Comma operator	Left to Right

Prover

用到了四个等式和四个校验和做约束z3求解, 注意Concat接收俩都要是BitVec, z3加和运算在有限域上, BitVec需要扩展.

from z3 import *

def ROL4(x, n):
    # Correctly handle 32-bit rotation for BitVecs
    return (x << n) | (LShR(x, 32 - n))

def popcount8(x):
    # This function works as-is, Z3's operators handle the integer constants
    return (x & 1) + ((x>>1) & 1) + ((x>>2) & 1) + ((x>>3) & 1) + ((x>>4) & 1) + ((x>>5) & 1) + ((x>>6) & 1) + ((x>>7) & 1)

s = Solver()

V0 = BitVec('V0', 32)
V1 = BitVec('V1', 32)
V2 = BitVec('V2', 32)
V3 = BitVec('V3', 32)
V4 = BitVec('V4', 32)
V5 = BitVec('V5', 32)

s.add(V0 == 0x1B744424)
s.add((V1 & 0xFF) == 0x4E)
s.add((V5 & 0xFFFF0000) == 0)
s.add((V5 & 0xFF00) == 0xD500)

# Equation1
t = ROL4(V0, 5)
term1 = ROL4(V1, 11)
term2 = V4 ^ 0xDEADBEEF
term3 = (V2 - 0x61C88647) ^ t
s.add(term1 + term2 + term3 == 0xC356FD3A)

# Equation2
termA = ROL4(V3, 17)
termB = 0x27D4EB2D * V3
termC = V2 + 0x7F4A7C15
termD = ROL4(V5, 13) + 0x85EBCA6B * V1
v13 = termB ^ termC ^ termD
s.add(termA + v13 == 0xB5CCF033)

# Loop part
a0 = V3 ^ V0 ^ 0x13579BDF
b0 = ROL4(V2, 7) + V1

# n2=0
v9_0 = ROL4(0x9E3779B9 - (0x7A143595 * b0), 5)
b1 = ROL4(b0, 11) ^ b0 ^ v9_0 ^ a0

# n2=1
v9_1 = ROL4(0x9E3779B8 - (0x7A143595 * b1), 10)
b2 = ROL4(b1, 11) ^ b1 ^ v9_1 ^ b0

# Constraints on b1 and b2
s.add(b1 + b2 == 0x2FD99233)
s.add(ROL4(b2, 11) + ROL4(b1, 3) == 0x2BAF2082)

# Define bytes from V as a list for easier processing
All_Bytes = [Extract(i*8+7, i*8, V) for V in [V0,V1,V2,V3,V4] for i in range(4)]
All_Bytes.extend([Extract(7,0,V5), Extract(15,8,V5)]) # B20, B21

B0, B1, B2, B3, B4, B5, B6, B7, B8, B9, B10, B11, B12, B13, B14, B15, B16, B17, B18, B19, B20, B21 = All_Bytes

# Add known bytes
s.add(B0 == 0x24)
s.add(B1 == 0x44)
s.add(B2 == 0x74)
s.add(B3 == 0x1B)
s.add(B4 == 0x4E)
s.add(B21 == 0xD5)

# ** FIX APPLIED HERE **
# The integer 0 is replaced with BitVecVal(0, ) for zero-extension.
zero_ext = lambda b: Concat(BitVecVal(0, 8), b)

# Checksum3
sum_val = Sum([zero_ext(b) for b in All_Bytes])
checksum_3 = Extract(15,0, sum_val)
s.add(checksum_3 == 0x913)

# Checksum2
xor_val = All_Bytes[0]
for i in range(1, len(All_Bytes)):
    xor_val = xor_val ^ All_Bytes[i]
s.add(xor_val == 0x55)

# ** AND FIX APPLIED HERE **
# Checksum1
weighted_sum = Sum([zero_ext(All_Bytes[i]) * (i + 1) for i in range(len(All_Bytes))])
checksum_1 = Extract(7,0, weighted_sum)
s.add(checksum_1 == 0x43)

# Checksum
pop_sum = Sum([popcount8(b) for b in All_Bytes])
checksum = Extract(7,0, pop_sum)
s.add(checksum == 0x50)

if s.check() == sat:
    m = s.model()
    print("Solution found!")
    print("V0 =", hex(m[V0].as_long()))
    print("V1 =", hex(m[V1].as_long()))
    print("V2 =", hex(m[V2].as_long()))
    print("V3 =", hex(m[V3].as_long()))
    print("V4 =", hex(m[V4].as_long()))
    print("V5 =", hex(m[V5].as_long()))
else:
    print("No solution")

hex_bytes= ['0x24', '0x44', '0x74', '0x1b', '0x4e', '0x84', '0x0f', '0xab', '0xf2', '0xdc', '0x30', '0x4e', '0x1f', '0xc4', '0x22', '0xa0', '0x55', '0x0b', '0xfe', '0x1a', '0x52', '0xd5']
hex_bytes = [int(s, 16) for s in hex_bytes]
key_1 = [0x03, 0x05, 0x09, 0x0B, 0x0D]
key_2 = [0xA5, 0x5C, 0xC3, 0x96, 0x3E, 0xD7, 0x21]
_ROR_ = lambda b, i: ((b >> (i)) | (b << (8 - i))) & 0xff

plain = []

for i in range(22):
    c1 = _ROR_(hex_bytes[i], (i % 5))
    c2 = (c1 ^ key_2[i % 7]) & 0xff
    temp = (c2 - (19 * i + 79)) & 0xff
    # 求乘法逆元
    c3 = (temp * pow(key_1[i % 5], -1, 0x100)) & 0xff
    plain.append(chr(c3 & 0xff))

print(''.join(plain))
# flag{7ac1d3e59f0b2468}

Dragon

main反编译不全, 看到jmp rax寄存器混淆:

alt + b搜特征码去掉前三个混淆看到xxtea:

写脚本解密:

#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>
#include <string.h>

#define DELTA 0x87654321

void XXTEA_decrypt(uint32_t *v, int n, const uint32_t key[4]) {
    if (n < 2) return;  // At least two elements
    uint32_t y, z, sum, e;
    uint32_t p, q = 0x2a; // !
    sum = q * DELTA;
    y = v[0];
    do {
        e = (sum >> 2) & 3;
        for (p = n - 1; p > 0; p--) {
            z = v[p - 1];
            v[p] -= ((z >> 5) ^ (y << 4)) + ((y >> 5) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
            y = v[p];
        }
        z = v[n - 1];
        v[0] -= ((z >> 5) ^ (y << 4)) + ((y >> 5) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
        y = v[0];
        sum -= DELTA;
    } while (--q > 0);
}

int main()
{
    uint32_t key[] = {0x12345678, 0x9ABCDEF0, 0xFEDCBA98, 0x76543210};
    uint8_t cipher[] =
    {
        0xCE, 0xD6, 0xB4, 0x0E, 0x8B, 0xDE, 0x1D, 0x52, 0xFD, 0x24, 
        0xED, 0x21, 0x26, 0xEC, 0x10, 0xBA, 0x1C, 0x93, 0x39, 0x33, 
        0x7D, 0x0E, 0xDC, 0x46, 0x44, 0x9F, 0x46, 0xCC, 0x79, 0x70, 
        0xBA, 0x64, 0x77, 0x79, 0x77, 0x64, 0x98, 0x1C, 0x15, 0xB2, 
        0xA1, 0x5A, 0xCC, 0xDB
    };
    
    for (uint32_t index = 0; index < 4; ++index )
    {
        key[index] = key[index] ^ 0x13579BDF;
        key[index] = (key[index] >> 25) | (key[index] << 7);
    }

    int cipher_len_bytes = sizeof(cipher);
    int n = cipher_len_bytes / sizeof(uint32_t);

    XXTEA_decrypt((uint32_t *)cipher, n, (const uint32_t *)key);

    // Output
    printf("Decrypted data (as chars, %zu bytes):\n", cipher_len_bytes);
    for (size_t i = 0; i < cipher_len_bytes; i++)
    {
        if (cipher[i] >= 32 && cipher[i] <= 126) {
             printf("%c", cipher[i]);
        } else {
             printf("."); 
        }
    }
    return 0;
}
// flag{cbee3251-9cff-4542-bf15-337bb8df7f3f}

论文阅读: Harnessing the Power of LLM to Support Binary Taint Analysis

Fri, 15 Aug 2025 00:00:00 GMT

Introduction

General Idea. 文章使用LLMs协助人工对二进制文件进行污点分析, 与传统的污点分析 (源 → 污点传播 + Sanitizer → 汇) 的流程不同, 它从危险函数调用点sink (使用LLMs识别) 开始向反方向构建(函数; 参数)调用链, 然后修剪非外部可控的数据源source (也使用LLMs识别) 同时不使用Sanitizer以防止假阴性, 得到危险流 (Dangerous Flows, DFs), 这些危险流处理后成为LLMs的Prompt序列, 最后由LLMs负责完成漏洞判定. 此方法解决了传统人工二进制污点分析时对代码语义理解和漏洞模式识别的高要求难点.

Challenges. 提示词工程会严重影响LLMs的性能; 同时LLMs的上下文有限, 需要合理编码代码上下文, 一个静态二进制文件包含的上下文会一下把LLMs喂饱; 再加上超长上下文带来的幻觉问题, LLMs要接收的信息必须少而精.

LATTE. LLM-Powered Binary Taint Analyzer, 是首个将污点分析和LLMs结合的技术, 文章指明其核心通过代码切片构建Prompt序列, 整体流程大致如下:

研究人员使用来自Juliet Test Suite的数据集 (含有污点式漏洞的二进制文件, 去符号) 进行测试, 在准确率和F1分数上都表现很好, 准确率 (Accuracy) 和 F1 二者互补¹, 前者关注总体正确率; 后者只关注正类 (实际为正, 检测也为正) 的检测质量; 计算公式分别为:

\begin{gather*} Accuracy = \frac{TP+TN}{TP+TN+FP+FN} \\ Precision = \frac{TP}{TP+FP} \\ Recall = \frac{TP}{TP+FN} \\ F1 = \frac{2 \cdot Precision \cdot Recall}{Precision + Recall} \end{gather*}

Precision高表示多抓到; Recall高表示少报错, 都只关注正类的检测质量; 其在测试项目中识别sinks和sources实现全中; 实战测试嵌入式设备固件发现10个新高危CVE, 比同类竞品更优. ~~(论文前面一段说自己发现了119个独特bugs, 后面又说发现了117个独特bugs, 好奇怪).~~

Background

污点分析可有效发现由外界输入引发的漏洞, 我们叫它污点式漏洞. 文章想要根据CWE (Common Weakness Enumeration) 对其进行统一分类. CWE是个树状关系, 用来表示不同抽象级别的弱点类型, 抽象级别从高到低大致为PCBV, 具体来说: pillar > class > basic > variant. 举个例子:

要想按照CWE对漏洞贴标签/分类, 那么漏洞归类到CWE的哪个抽象层级是个问题, 为了避免一个漏洞被贴上多个标签, 造成重复分类, 作者规定三条”只给一个最合适的标签”的分类方案:

优先对齐CWE的基础层级 (basic), 次选变体层级 (variant), class粒度太大, variant粒度太细, basic 被设计为 概念上 相互独立, 自然选它.
如果一个漏洞同时属于两个base级别的CWE, 再具体的分类要基于漏洞触发点 (面向sinks), 不在乎污点数据源 (sources). 文章举了个例子: 如果有一个漏洞既可以归为 CWE-78, 也可以归为 CWE-76, 那就要这么看: 命令注入漏洞 (CWE-78) (sink) 是由未检查的输入数据——等效特殊元素的错误中和 CWE-76 (source) 造成, 那么该漏洞将会被归为CWE-78 (sink), 而不是 CWE-76 (source), 因为CWE-76 (source) 很泛, 同样造成重复分类.
第一个被触发的漏洞优先, 如果一整数溢出漏洞 (CWE-190) 导致缓冲区溢出 (CWE-680), 那将这个漏洞分类到CWE-190.

根据作者指定的分类规则, 下图展示了各大Analyzer支持检测的漏洞类型, LATTE技能点满:

污点引擎 (taint engine) 和污点规则 (taint rules) 是正交/解耦的, 意味着二者相互独立, 改变污点规则不会影响污点引擎, 反之亦然.

污点引擎: 具体实现污点跟踪的引擎.
污点规则: 让引擎识别污点, 及其传播, 清洗的规则集.

作者从引擎和规则两个维度讲传统分析的难处:

实现污点引擎分析二进制文件很麻烦, 因为二进制制文件通常缺少符号, 数据类型, 并且受不同编译器, 优化选项, 目标架构的影响大. 就算看反编译代码, 结构和语义都不清楚. 所以先前的技术只能做出特定的假设来实现污点引擎.
尽管有人使用过函数抽象和机器学习的方法来指定新污点规则, 但想要减少漏洞分析和后期分析的工作量, source, sanitization, sink的规则必然更加复杂的难点仍然不易解决. 总而言之, 高准度要求高复杂度.

LLMs在上游进行过大量广泛的数据训练, 要在下游使用LLMs去完成具体工作, 需要进行提示词工程或者微调, 二者任选其一. 比如 Cline, Curosr 用的就是提示词工程 (Agent 包括提示词工程, Agent ≈ Prompt + Tools + Iteration) 来完成编码的具体工作. 微调需要额外数据来训练模型, 费钱, 而且LLMs已经在大语料库上进行训练, 所以作者采用提示词工程的方式让LLMs具备执行具体任务的能力.

Motivation

显然, 源码漏洞分析工具的发展快于静态二进制文件分析工具, 因为反编译伪代码函数, 类, 变量名等信息都不全. SATC, FBI 使用人类专家和启发式算法来优化 Karonte 的规则, 降低了FN和FP, 但还是费时又费力, 为什么人工定义全面的污点传播规则和检查规则难? 文章下面列出了几个问题来让我们理解原因.

Problem 1. Determining Taint Sources and Initial Taint Labels

识别污点源²可不容易, 除了C标准库函数 (recv, fscanf, fgets), 还有第三方函数 (SLL_read, BIO_read, OpenSSL) 都能接收外部数据. 识别污点源之后就要给各种返回值和参数贴污点标签, 这就要有强大的语义理解能力, 例如下图的fscanf. 你要理解它是干啥的, 这几个参数都啥意思, 才能知道第三个参数&a是携带外部环境的输入数据的, 这样才能贴上污点标签. 第三方函数的相关文档往往并不完善, 甚至没有, 贴污点标签很难.

Problem 2: Defining Rules to Propagate Taint Labels

污点标签的传播通过赋值 (b = a), 计算 (e = b + 1)等等, 分析数据依赖可以获得传播路径. 在传播过程中还存在净化 (Sanitization):

当把安全数据赋值到污点数据所在内存区域时 (a = 1 line 5)进行净化.
有关语义的复杂净化, 一般的净化规则会导致污点标签在 line 10 处的传播终止, 没有考虑后续 line 17 的整数溢出.

Problem 3: Formulating Inspection Rules for Various Sinks and Vulnerabilities

首先需要识别sinks, 根据潜在的CWE制定检查规则, 比如 line 9 的printf是个sink, 它可能触发CWE-134或者CWE-190; 要看能不能触发CWE-134, 检查规则就要检查第一个参数(在这里是%d)是否被污染; 要看能不能触发CWE-190, 检查规则就要基于第一个参数看第二个(ulong)e是否被污染. 这只是一个简单的例子, 实际人工来做出准确全面的规则是很大的工作量.

Advantages of LLMs in Vulnerability Inspection

LLMs能像人一样进行语义理解, 作者用一个Prompt模板直观地展示了这一点:

Code Snippet without Vulnerabilities. Fig. 3 没有漏洞, GPT-4正确给出了分析结果:

Vulnerable Code Snippet with fgets. Fig. 4 有缓冲区溢出漏洞:

Vulnerable Code Snippet with recv.

Overview of LATTE

如何构建有效的Prompt来指示LLMs进行漏洞检查, 这里有两个挑战:

Challenge 1: Large Code Size and Complexity vs. Limited Token Context of LLMs.

—Solution to Challenge 1. 生成危险流 (Dangerous Flows/DF = 函数切片 + 数据依赖) 压缩上下文.

Challenge 2: Obscurity of Vulnerability Discovery vs. Generality of Instructions for LLMs. 漏洞发现天生就带有探索性质, 把一大堆漏洞模式都塞进Prompt里面是不合实际的. 如果使用few-shot方式, 新型漏洞不一定长得像示例, 容易漏掉. 所以给LLMs的Prompt要有普遍性, 即使漏洞类型改变也可以进行检查.

—Solution to Challenge 2. 作者从人工审计中获得灵感, 人工审计会首先审计每个在危险流中的函数, 不会根据具体的漏洞示例进行分析. 我们先有可疑数据流 (包括DF), 然后一步步让LLMs去检查每个数据流中的单个函数, 即把大任务拆成小任务, 第一性原理. 具体方式是Prompt Sequence, 每一轮都有明确输入, 目标, 与输出格式, 上一轮的结果会作为下一轮的上下文.

Workflow of LATTE

LATTE包括三个模块:

Preprocess: 使用反汇编和反编译得到函数 + 代码结构.
Code slicing: 从sink分析数据依赖, 倒着找出到达sink的函数调用链, 再找到source对上这些调用链, 得到DF.
Prompt construction: 取每条DF, 拆成正向提示序列 (source → … → sink), 一段函数一问, 这样可以减少上下文负担.

下面对应以上三个模块来讲:

Phase 1: Function Call Chain Extraction. 这个阶段, 首先利用LLMs识别危险程序点 (sinks), 即执行危险操作的外部函数和相关参数. 然后从sinks进行反向数据依赖性分析, 包括过程内 (intraprocedural) 和过程间 (interprocedural)分析, 得到一堆函数调用链:

Phase 2: Dangerous Flow Generation. 每个函数调用链都会有一个”头”, 但这些”头”不一定都是接收污点数据的, 它只是回溯自某个 sink 得到的一条调用路径; 同时也会有多个数据接收点 (recv, fgets, getenv)接收污点数据, 污点数据可能流入同一个sink.

这里解释下定义, 在这条调用链 $CC = [f1, f2, …, fn]$ 里, 起点函数 f1 的函数体中, 必须至少有一次对”污点源”API 的调用 (即把不可信外部数据读进来的地方, 如 recv/fgets/getenv). 这样保证危险流从真实的外部输入开始. 若整条链上没有任何 source 调用, 则这条链不会成为危险流.

Phase 3: Prompt Sequence Construction. 取每个危险流构造Prompt Sequence (函数粒度), 作者设计了三个Prompt模板:

Initiate a conversation: 绑定危险流的第一个函数 f1, 分析函数体明确哪一个是污点源/输入起点, 要求做数据别名, 数据依赖与污点分析.
Function-by-function progression template: 对危险流中的每个后续函数各问一轮, 递归构建用于数据流分析的Prompt, 一直干到末尾.
Final vulnerability analysis: LLM进行漏洞判定.

LATTE design

在使用Prompt Sequence让LLMs分析DF时 (phase 3.2) 并没有像传统污点分析那样进行Sanitize和检查漏洞, 这两个步骤留在了 Phase 3.3.

Phase 1: Function Call Chain Extraction

该过程分两步, 识别sinks (i.e., Vulnerable Destinations, VD) 和反向切片.

Identification of Vulnerable Destinations: 对于不同类型的函数, 有不同的处理方法, 作者分了三种:
- Externally linked: 放进 $F_{external}$ 列表.
- Dynamically linked: 动态链接会保留符号名, 直接把 函数名 丢给LLM.
- Statically linked: 把 函数名 换成 函数体 丢给LLM让它分析是否是sink.

现在开始利用LLM确定一个函数是否是sink—构建Prompt template = Analyst persona + one-shot + No additional explanation; 这里给出了一个例子:

得到的(𝑓; Para)会被存到一个名为 $sinks$ 集合内, 以便复用. 此分析只需要在 $sinks$ 没记录该函数的时候执行.

最后得到的是(sink, Para)的集合, 比如 {(printf; 1), (printf; 2), ...}. 由于函数间的调用关系复杂, 所以只记录了函数信息, 没有调用点信息. 确定sinks之后还要一步, 即对整个二进制文件遍历得到调用点, 形成VD列表, 比如Fig. 2 的VD列表为: {(9; printf; e), (15; printf; c), (18;printf; d)}.

Backward Slicing: 取VD列表内的每个三元组在函数调用图³上 根据数据流 进行反向深度优先遍历, 得到函数调用链 (Call Chains, CCs). 咱们首先看VD所在的函数, 姑且将它命名为 $f$ 吧. 作者制定的算法首先进行过程内 (intraprocedural) 数据依赖分析——即在函数 $f$ 内部使用流不敏感 + 路径不敏感 + 指针别名数据依赖分析, 如果有循环导致的路径重复, 直接退出. 如果VD的污点实参直接依赖于函数 $f$ 的形参 (说白了是来自上一个函数的调用传参 e.g., f(x){foo(x)}), 分析就直接转入过程间 (Interprocedural) 数据依赖分析——看谁调用了谁, 分析深度最大50 (实际二进制很少那么深). 作者又举了个例子让我们理解:

根据数据流, 这里是CCs = {[fun2, fun1], [· · · , fun3, fun1]}.

Phase 2: Dangerous Flow Generation

主要目标是找到可以让外部输入流入VD的CC, 分两步:

Source Identification: 使用了Sink Identification/Vulnerability Identification同样的方式让LLM识别:

识别之后的函数会被放到一个 $sources$ 集合, 以便复用. 当然LLM分析肯定会出错, 这里需要人工改成(fscanf; >2), 但是只需要 “slight expert experience.” ~~(是的, 是不是有点草台, 没错, 我也这么觉得).~~

Matching and Deduplication: 有了 $sources$ 集合 (i.e, {(source; Para), ... }), 我们可以把集合中的source (这玩意还是个函数, 我们还是叫他 $f$ 吧) 对应到刚刚分析的出来的CCs, 对应不到就说明这条CC没有能接收外部输入的函数, 舍去; 如果对应到那就继续分析Para的流向, 与CCs中的污点数据流向重合那就放入候选危险流 (Candidate Dangerous Flow, CDF). 由于一个拥有多个 $f$ 的CC可以产生多条CDF, 我们只保留最长的那条; 如果两个CC产生相同的CDF链或子链⁴, 我们合并相同的CDF链, 清除相应的子链, 最后得到DFs. 文中给了个例子, 这里直接翻译原文了:

我们使用 CCs = {[fun2, fun1], […, fun3, fun1]} 在Fig 8. 中说明上述过程. 在 fun2 中, 污点源 fgets 被调用, 并且第一个参数 a 与 func1 的参数 b 存在数据依赖关系 (图 8 的第 18 行中的 snprintf 将 a 存储在 b 中). 因此, [fun2, fun1] 是一个候选危险流 (CDF). 我们假设 CC = […, fun3, fun1] 在递归分析后形成了 {[fun5, fun4, fun3, fun1], [fun6, fun4, fun3, fun1]}. 如果污点源在 fun4 和 fun6 中被调用, 相应的 CDFs 是 {[fun4, fun3, fun1], [fun6, fun4, fun3, fun1]}. 但是 [fun4, fun3, fun1] 是 [fun6, fun4, fun3, fun1] 的子链, 因此前者被丢弃. 最终的危险流 (DFs) 是 {[fun2, fun1], [fun6, fun4, fun2, fun1]}.

Phase 3: Prompt Sequence Construction

作者设计Prompt时遵循的规则:

明确陈述分析任务
丰富Prompt内容
分析师角色设定
大任务分解成小任务
制定输出格式

下面是作者给出的 “三个可以实例化作用在每个DF上的Prompt模板”:

Start Template: 输入为危险流DF的上下文, 及其第一个函数(<function>, <parameter>), 和第一个函数的函数体代码 , 其中 <function> 为DF (如 [fun2, fun1]) 那么 fun2 的函数, 和函数体, 和参数就被作为输入. 输出被标记为tainted的参数, 或者是否净化.
Middle Template: 危险流DF的上下文, 以及当前所处位置, 当前函数哪些参数被标记为tainted, 当前函数体代码. 输出为被标记为tainted的参数, 或者是否净化. 如果当前函数体内有源函数, 那就加上括号的内容.
End Template: 输入为污点分析结果, 让LLM给出最终判定, 是不是漏洞, 属于什么CWE类型, 并给出理由.

特别地, 当DF只有一个函数的时候, 只留下 Start 和 End Template, 作者又举了个例子:

Evaluation

接下来是经典的评估环节, 在研究评估这一段, 作者使用问问题的方式来评估自己的研究成果 (Research Question):

RQ1: LATTE检查漏洞有多好? 从三个方面解释:

LATTE多有效? (Effectiveness)
LATTE多稳定? (Stability)
LATTE多高效? (Efficiency)

RQ2: LATTE识别sinks和sources多有效?

RQ3: LATTE提取DFs多有效?

RQ4: 提示词序列 (PS) 对LATTE的性能影响多大?

RQ5: LATTE能不能扩展到真实世界的二进制漏洞分析?

Evaluation setup

本段在于交代实验如何实施和复现, 评测数据来源, 评测环境等, 用来支撑前面提出的RQs.

Implementation. LATTE的实现基于两个东西: Ghidra, GPT-4.0. 把二进制分析掉分几步:

把二进制加载到Ghidra.
用Ghidra插件提取出必要信息.
LATTE提取出DFs.
LATTE用PSs指示LLM干活.
把生成的每个结果分别存放在一堆文件中.

Benchmarks. 使用了 Juliet Test Suite 和 Karonte 数据集中选取 Benchmark 来评估RQ1 - RQ4 (Juliet无CWE-120的基准, 所以加上了 Karonte); RQ5的评估进行在真实世界的来自 Karonte 的固件数据.

Baselines. 选择了同类竞品 Emtaint 和 Arbiter 作为基线分别在 Juliet 和 Karonte 数据集上进行比较, 数据集不同当然Baseline也不同, 所以有两个Baseline. 他们没有找CodeQL, QueryX, Joern这些工具, 因为这些工具的性能很大程度上由人决定⁵, 由于 Karonte 的固件数据没有绝对答案 (没人标注这个固件是否存在漏洞), 所以只能记录 TP, FP两项指标.

Metrics. Juliet Test Suite数据集的评估中使用了六个指标: TP, FN, TN, FP, Accuracy, F1 分数, 是不是很熟悉, 计算公式在文章开头有.

Running Environment. 所有实验都是在一个 Intel Core i7-8750H CPU, 64G RAM 的 Linux 工作站上进行.

Vulnerability inspection (RQ1)

1. Effectiveness

LATTE在从Juliet编译的, 去符号的二进制文件上进行漏洞检查因为CWE类型在同一个二进制文件上有重复 (树形结构), 作者只根据Juliet上面记载的CWE类型来看是否命中 ~~(这是不是会拉低准确率?)~~

这里作者说明了CWE-190的情况, Arbiter 依赖符号表, LATTE不依赖, 这导致LATTE在TP落后 318 个, 但是加上符号表后, LATTE能超过Arbiter 485 个.

Analysis of FNs and FPs. 作者说是生成DFs和GPT的创造性 (原文是 “Creativity of GPT-4.0”, 这里应该是幻觉?) 问题, 后面会细讲.

GPT-4.0 vs. GPT-3.5. 作者也用GPT-3.5测试了LATTE, 显然GPT-4.0更胜一筹, 结论是LATTE的检测漏洞的有效性随着LLM的能力提高而提高.

2. Stability

这段讲了LLM的temperature 参数的影响, 作者进行了两项实验, 分别评估LATTE的稳定性和temperature对检查结果的影响.

Analysis Stability at Temperature 0.5. 作者在temperature 0.5的条件下进行了五轮测试, 测试五轮得到的交集由蓝色条标出. 漏洞召回率 (计算公式开头有写) 分别为: 90.42%, 88.42%, 58.04%, 和 82.5%, CWE-190召回率低的原因与上面一致, 是由于数据类型判定错误 (LLMs creativity) 和没有函数名称 (Symbol Table) 造成的.

Impact of Temperature on Analytical Results. 下图给出了准确度在不同temperature下的箱线图:

以 0.4 为分界, 在0.4之前, 检查结果分布更加密集, 表明更稳定; 在0.4之后, 分布广, 检查结果更分散; 按中位数来看大致呈正态分布, 0.4 - 0.6 之间的准确度高; 所以最佳的temperature选择应该在0.4 - 0.6 之间, 兼顾准确率和稳定性.

3. Efficiency

这里看的是时间和钱, 在表2里有展示, 主要时间花在了与GPT-4.0的对话上; 关于钱, 作者说总比雇一个人工分析师来的好, 而且随着LLM进步, API cost 也会变得更低, 文章只给出了分析出DF所需的花费: 0.35刀.

Answer to RQ1. 平均准确率为77%, LATTE优于Emtaint 和 Arbiter. 此外平均召回率是79.85%, 说明LATTE的检查结果是稳定的.

Sink and Source Identification (RQ2)

Answer to RQ2. LATTE平均精确度为82.1%, 覆盖率 (召回率)为 100%. 这意味着所有sink & source pair都被召回, 其识别的所有sink & source pair中平均有82.1%为正确 (TP) 的

Dangerous Flow Extraction (RQ3)

Answer to RQ3. 平均精确度为100%, 平均召回率为95%. 这意味着LATTE提取出来的DFs有100%是真DF, 在所有实际存在的DFs中LATTE提取出了95%的DFs.

对于假阴性, 作者将原因归为:

Ghidra 反编译错误, 比如参数识别错误
纯虚函数调用, 虚函数没有函数体, 无法分析.

Prompt Sequence Construction (RQ4)

作者尝试了5种不同的方式来构建提示词序列, 改了两个参数:

代码切片的粒度
任务描述的细节程度/粒度

将这些修改参数后的5个方案所得到的准确度与原来的PS (Their best design) 进行比较

让代码切片为整个程序, 即把整个反编译出来的代码一次性丢给LLM
把整个DF丢给LLM
最小粒度的切片, 只保留有关参数的行
去掉角色指定
不要那么多Prompt模板了, 直接一把梭, 告诉我漏洞判定结果

Answer to RQ4. 与基于不同代码切片粒度和分析任务描述粒度构建的提示 (提示序列) 相比, LATTE 在检测二进制漏洞方面表现出更高的准确性.

Real-world Vulnerability Inspection (RQ5)

作者扫了49 个真实固件, 在255个alert当中有222是TP, 有119个独特bugs ~~(所以到底是117还是119)~~. 可怜的 Karonte 和 Arbiter 被拿来比较, TP和准度都比他俩高, 时间还短, 作者提到了 Karonte 和 Arbiter 依赖于符号执行, 所以时间长. Emtaint 的TP数量虽然多, 但是很多是同一个bug的重复的数据流, 虽然LATTE漏掉了16个 Emtaint 发现的独特bugs (作者给出的理由是指针别名识别不准导致的调用链缺失), 但LATTE发现的这119个bugs中有21个是Emtaint没发现的.

Answer to RQ5. LATTE发现了119个独特bugs ~~(所以是119喽)~~, 总体由于同类竞品

Discussion

LATTE不能有效检查逻辑, 竞态, 和复杂数学计算漏洞, 这会导致污点标记过多/过少, 复杂漏洞需要提取更多的上下文比如, 资源锁, 中断向量表, 共享内存地址, 如何让丢给LLMs的上下文更加有效是将来研究的一个方向; 二进制分析这块, 难点有三个, 指针别名 (两个指针引用同一内存), 虚函数/间接调用, 函数内联; 识别库函数这块, 大部分都是系统库函数 (glibc), 动态链接所以会保留符号, 降低了错误发生率; 评估指标这块, 精准度 (Precision) 和召回率 (Recall) 二者是个权衡, 分析严格 -> FPs降低, Pre提高, 反之, 分析不严格 -> Recall提高, Pre降低; 二进制文件的保护这块, 被混淆的, 加密的二进制文件需要额外操作. 有趣的是, 如果命名函数为 “no_vulnerability” 会干扰LLM的识别效果.

Conclusion

核心是使用友善的提示词工程让LLM协助人工分析, 效果也不错, 使用代码切片, 分解任务的方式解决了上下文的问题. LLM在根据我们给它的上下文”预测”漏洞的有无, 所以事后要人工检查, 它不是数据库或严格逻辑机, 所以更灵活, 而现在的Agent的工具调用可以让LLMs得到有效的反馈, 同时也优化了上下文, 单论提示词工程有局限性, 后续可以考虑加入实证性的工具类协助LLMs.

References

二者均考虑的原因: 显然, 在 1000 样本, 10 个真漏洞(正类), 990 个非漏洞(负类), 如果一个工具测出来全阴: $F1 = 0$ ; $Accuracy = 990 / 1000 = 99\%$ , 这种情况下就需要二者均考虑了.
Sources, 一个可以让危险数据进入程序运行状态的程序点, Program Points = API + Other Execution Location
论文里使用了Ghidra进行调用图分析. 具体来讲, 作者通过遍历Ghidra识别到的函数们得到了每个函数的内存地址
比如CC1 = {main, A, B, sink}, CC2 = {main, X, A, B, sink}, 产生的CDF可以是相同的: CDF = {A, B, sink}
CodeQL, QueryX和Joern等工具通过运行自定义的手写查询/规则来工作, 这些查询/规则由人编写, 用于查找特定的错误模式; 这意味着他们的结果由自定义的查询/规则的质量决定.

Notes on nju-pa

Sat, 09 Aug 2025 00:00:00 GMT

pa1: Perform value-based checks for macros, using a macro

If we want to check whether a macro exists, we can simply use #ifdef. Here, we want to test whether a macro exists and has a specific value using a function-like macro.

Let’s design a macro with the return value of 0 or 1:

// test if a boolean macro is defined
ISDEF(macro)

If we have:

#define FOO x
if(ISDEF(FOO)) {
	printf("FOO is a boolean value!");
}else { // otherwise
    printf("FOO is either undefined or not a boolean value");
}

The definition of ISDEF will be:

#define __P_DEF_0 X,
#define __P_DEF_1 X,

#define concat_temp(x, y) x ## y
#define concat(x, y) concat_temp(x, y)

#define choose_2nd(a, b, ...) b
#define MUX_TMP(p, a, b) choose_2nd(p a, b)
#define MUXDEF(macro, a, b) MUX_TMP(concat(__P_DEF_, macro), a, b)
#define ISDEF(macro) MUXDEF(macro, 1, 0)

The prerequisites for understanding the snippet are some rules as per the C standard:

Arguments passed to the “function” (function-like macro) are expanded first if the argument is a macro at the call site.
However, arguments will not be expanded if they are the operand of # (stringizing) or ## (token-pasting).

A macro for conditional compilation can also be implemented — “if a certain macro is defined, then keep a certain piece of code”:

#define __IGNORE(...)
#define __KEEP(...) __VA_ARGS__
#define IFDEF(macro, ...) MUXDEF(macro, __KEEP, __IGNORE)(__VA_ARGS__)

Note that __KEEP and __IGNORE won’t get expanded during the invocation of MUXDEF unless there are arguments passed to __KEEP and __IGNORE.

pa1: The CPU execution process

The core CPU execution process in NEMU is fetch, decode, and execute.

This consequently involves two structs: Decode and CPU_state:

// 'nemu/include/cpu/decode.h'
typedef struct Decode {
  vaddr_t pc;
  vaddr_t snpc; // static next pc
  vaddr_t dnpc; // dynamic next pc
  ISADecodeInfo isa;
  IFDEF(CONFIG_ITRACE, char logbuf[128]);
} Decode;

// '/nemu/src/isa/riscv32/include/isa-def.h'
typedef struct {
  word_t gpr[MUXDEF(CONFIG_RVE, 16, 32)]; // general purpose registers
  vaddr_t pc;
} MUXDEF(CONFIG_RV64, riscv64_CPU_state, riscv32_CPU_state);

// '/nemu/include/isa.h'
typedef concat(__GUEST_ISA__, _CPU_state) CPU_state;

Decode is the temporary context for each instruction; it defines snpc as the static next PC (pc + 4) and dnpc as the actual address of the next instruction—mainly due to branches and jumps.
CPU_state is the overall architectural state that gets changed after each call to exec_once().

pa1: Recursively evaluate an expression

This is a familiar topic: the key idea of recursion is to divide a big problem into smaller ones and solve them. The following steps are involved when orchestrating a recursive function:

Tackle the error cases.
Tackle the basic problem cases.
Tackle the non-basic problem cases; this is commonly done by calling the function itself to perform the division of the problem.

Put succinctly, the fundamental role of a recursive function is to handle different cases.

The cleverness of `check_parentheses`

static bool check_parentheses(int p, int q) {
  if (tokens[p].type != '(' || tokens[q].type != ')') return false;
  int balance = 0;
  for (int i = p + 1; i < q; i++) {
    if (tokens[i].type == '(') balance++;
    else if (tokens[i].type == ')') balance--;
    if (balance < 0) return false;
  }
  return balance == 0;
}

We assume the first and last tokens form a matching pair and check only the interior tokens from p + 1 to q - 1. If they are balanced (i.e., first ( then )), the assumption holds and the function returns true. If they are imbalanced (i.e., first ) then (), for example in (4 + 3) * (2 - 1), the function returns false. We therefore maintain a balance variable to implement the checking function. In the balanced case, balance will always be non-negative thourghout the scan.

Skip over parentheses

We should find the main operator (the operator with the lowest precedence) only outside the parentheses. Tokens inside () are not considered:

static int find_main_op(int p, int q) {
  int main_op = -1;
  int min_precedence = 100;
  int balance = 0;
  // Traverse all the tokens
  for (int i = p; i <= q; i++) {
    // Jump through the parentheses
    if (tokens[i].type == '(') {
      balance++;
      continue;
    }
    if (tokens[i].type == ')') {
      balance--;
      continue;
    }
    if (balance != 0) continue;

    // Find the operator with the lowest precedence
    int precedence;
    switch(tokens[i].type) {
      case '+': case '-': precedence = 1; break;
      case '*': case '/': precedence = 2; break;
      default: continue;
    }

    if (precedence <= min_precedence) {
      min_precedence = precedence;
      main_op = i;
    }
  }
  return main_op;
}

Handle errors in the recursion of eval()

The eval() function takes the boundaries of the expression and returns the evaluation result, but what if an error occurs?

A success boolean variable is used as a global error flag. eval() passes its pointer on each recursive call:

static word_t eval(int p, int q, bool *success){
    if( p > q ){ ... }
    else if ( p == q ) { ... }
    else if(check_parentheses(p, q) == true) { ... }
    else{
        int op = find_main_op(p, q);
        [ ... ]
        word_t val1 = eval(p, op - 1, success);
        if (!*success) return 0;
        word_t val2 = eval(op + 1, q, success);
        if (!*success) return 0;
        switch(tokens[op].type){
          case '+': return val1 + val2;
          case '-': return val1 - val2;
          case '*': return val1 * val2;
          [ ... ]
        }
    }
}

For instance, given the input 5 + (3 * zxcvbn):

eval(0, 6)  // "5 + (3 * zxcvbn)"
├── eval(0, 0)  // "5" → success = true, returns 5
└── eval(2, 6)  // "(3 * zxcvbn)"
    └── eval(3, 5)  // "3 * zxcvbn"
        ├── eval(3, 3)  // "3" → success = true, returns 3
        └── eval(5, 5)  // "zxcvbn" → success = false, returns 0

eval(3, 5) and eval(0, 6) terminate before completing evaluation. The error is successfully propagated to cmd_x:

word_t expr(char *e, bool *success) {
  [ ... ]
  *success = true;
  return eval(0, nr_token - 1, success);
}

static int cmd_x(char *args){
  [ ... ]
  bool success = true;
  paddr_t addr = expr(arg2, &success);
  if (!success) {
    printf("Invalid expression for address.\n");
    return 0;
  }
  [ ... ]
}

Conclusion

Of the three subsections above, two of them showed how a meticulously defined variable balance determines matching parentheses, and the last illustrated an error-handling method in recursive calls that avoids issues like silent failures, cascading errors, and unnecessary computation.

References

Utilities for debugging

// The upgraded version of `printf`
Log("Processing expression starting at position %d. Current substring: '%s'", position, e + position);
printf(ANSI_FMT("[expr] Error: Invalid register name '%s'.\n", ANSI_FG_RED), tokens[p].str);
// The upgraded version of `assert`
Assert(len < TOKEN_BUF_SIZE, "Token string too long! Length: %d, Max: %d", len, TOKEN_BUF_SIZE - 1);
assert(len < TOKEN_BUF_SIZE);
// The upgraded version of `Assert` that implies this line of code should not be executed
panic("Unexpected token type %d in expression evaluation. This should not happen!", type);

Mount shared folders on a virtual machine

Mon, 04 Aug 2025 00:00:00 GMT

The problem: `/mnt/hgfs` does not show shared folders

My newly installed Ubuntu-22.04 on VMware does not show shared folders in /mnt/hgfs directory, though the target folder Desktop has been set, so the current situation is:

Host OS: Windows 11
Guest OS: Ubuntu 22.04
The open-vm-tools and open-vm-tools-desktop (latest) are installed
Neither file nor directory exists (only . and ..) inside /mnt/hgfs (the mount point)

.host:/Desktop has been mounted to /mnt/hgfs using vmhgfs-fuse:

$ df -h
Filesystem      Size  Used Avail Use% Mounted on
vmhgfs-fuse 952G 428G 525G 45% /mnt/hgfs

Solution

Try to uninstall the existing mounts and remount all shared folders:

$ sudo fusermount -u /mnt/hgfs

There shouldn’t be any output from df -h | grep hgfs

$ sudo mount -t fuse.vmhgfs-fuse .host:/ /mnt/hgfs -o allow_other -o uid=1000 -o gid=1000 # use command `id` to adjust the uid and gid

$ sudo ls /mnt/hgfs # do as super user mode since there may have some permission issues
Desktop

Refresh the shared folder setting on the host side if it still doesn’t work.

Setting up auto-mount if needed:

$ echo ".host:/ /mnt/hgfs fuse.vmhgfs-fuse defaults,allow_other,uid=1000,gid=1000 0 0" | sudo tee -a /etc/fstab # -a to append a new line, same as `echo ' ... ' >> /etc/fstab`
$ sudo reboot

References

ELF sections, segments, and their mapping in memory

Sun, 20 Jul 2025 00:00:00 GMT

This article’s aim is to generally explain what sections and segments are in an ELF file on x86-64 GNU/Linux and how they are mapped to memory. It’s a good practice to understand ELF file structure and virtual memory mapping; this article also serves as my personal note.

Program headers and PT_LOAD segments

Program headers, preceded by ELF header, are essentially an array of structures that can be parsed to show the mapping between sections (within ELF file) and segments (loaded into memory).

ELF file structure diagram.

The diagram above shows a panoramic view of an ELF file structure. Now, I want to know exactly where program headers reside and what each header contains¹. It’s always a good way to start by compiling a simple program and examining it with tools like readelf, gdb, IDA, etc., to understand the file structure.

// test.c
#include <stdio.h>
int main(){
	printf("hello world!, this is function: %s\n", __FUNCTION__);
	return 0;
}
// Usage: gcc test.c -o test

; IDA View-A
[ ... ] skipping ELF header
LOAD:0000000000000040 ; ELF64 Program Header
[ ... ] skipping PHT entry 0 - 2
LOAD:00000000000000E8 ; PHT Entry 3
LOAD:00000000000000E8                 dd 1                    ; Type: LOAD
LOAD:00000000000000EC                 dd 5                    ; Flags
LOAD:00000000000000F0                 dq 1000h                ; File offset
LOAD:00000000000000F8                 dq offset _init_proc    ; Virtual address
LOAD:0000000000000100                 dq 1000h                ; Physical address
LOAD:0000000000000108                 dq 191h                 ; Size in file image
LOAD:0000000000000110                 dq 191h                 ; Size in memory image
LOAD:0000000000000118                 dq 1000h                ; Alignment
[ ... ] skipping staff

The IDA view shows the virtual memory layout as if it were loaded into memory with base_addr = 0x0000 and each program header contains metadata for one segment—including its type - Type, alignment boundary for segment- Alignment, access permissions - Flags, disk location - File offset , and runtime address - Virtual address.

These program headers (the binary data embedded from C structures) will be parsed by readelf. For the sake of illustrating the relation between each program header and associated segment, I’ve added an Idx column to Program Headers output below:

$ readelf -l test
[ ... ]
Program Headers:
  Idx  Type           Offset             VirtAddr           PhysAddr           FileSiz            MemSiz             Flags  Align
  00   PHDR           0x0000000000000040 0x0000000000000040 0x0000000000000040 0x00000000000002d8 0x00000000000002d8  R      0x8
  01   INTERP         0x0000000000000318 0x0000000000000318 0x0000000000000318 0x000000000000001c 0x000000000000001c  R      0x1    [Requesting program interpreter: /lib64/ld-linux-x86-64.so.2]
  02   LOAD           0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000628 0x0000000000000628  R      0x1000
  03   LOAD           0x0000000000001000 0x0000000000001000 0x0000000000001000 0x0000000000000191 0x0000000000000191  R E    0x1000
  04   LOAD           0x0000000000002000 0x0000000000002000 0x0000000000002000 0x0000000000000114 0x0000000000000114  R      0x1000
  05   LOAD           0x0000000000002db8 0x0000000000003db8 0x0000000000003db8 0x0000000000000258 0x0000000000000260  RW     0x1000
  06   DYNAMIC        0x0000000000002dc8 0x0000000000003dc8 0x0000000000003dc8 0x00000000000001f0 0x00000000000001f0  RW     0x8
  07   NOTE           0x0000000000000338 0x0000000000000338 0x0000000000000338 0x0000000000000030 0x0000000000000030  R      0x8
  08   NOTE           0x0000000000000368 0x0000000000000368 0x0000000000000368 0x0000000000000044 0x0000000000000044  R      0x4
  09   GNU_PROPERTY   0x0000000000000338 0x0000000000000338 0x0000000000000338 0x0000000000000030 0x0000000000000030  R      0x8
  10   GNU_EH_FRAME   0x0000000000002034 0x0000000000002034 0x0000000000002034 0x0000000000000034 0x0000000000000034  R      0x4
  11   GNU_STACK      0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000 0x0000000000000000  RW     0x10
  12   GNU_RELRO      0x0000000000002db8 0x0000000000003db8 0x0000000000003db8 0x0000000000000248 0x0000000000000248  R      0x1

 Section to Segment mapping:
  Segment Sections...
   00     
   01     .interp
   
   02     .interp .note.gnu.property .note.gnu.build-id .note.ABI-tag .gnu.hash .dynsym .dynstr .gnu.version .gnu.version_r .rela.dyn .rela.plt
   03     .init .plt .plt.got .plt.sec .text .fini
   04     .rodata .eh_frame_hdr .eh_frame
   05     .init_array .fini_array .dynamic .got .data .bss
   
   06     .dynamic
   07     .note.gnu.property
   08     .note.gnu.build-id .note.ABI-tag
   09     .note.gnu.property
   10     .eh_frame_hdr
   11     
   12     .init_array .fini_array .dynamic .got

Our focus is on the LOAD segments which have the p_type = PT_LOAD (1). These are the segments that will actually get loaded into memory². You are probably familiar with some of the sections—.text (RE) section in seg03, .rodata (R) section in seg04 , .data and .bss (RW) sections in seg05 . The primary distinction you will see compared to other segments is the value of Align; Unlike other segments, the LOAD segments always have an Align value of 0x1000.

Page alignment and its mapping

The p_align member of Phdr tells the ELF loader³, “When you are mapping each segment of ELF file to memory, please let the base address of these segments be a multiple of 0x1000⁴”. In other words, loadable segments are supposed to be page aligned.

The basic mapping unit is a page, with a size of 0x1000 on x86-64 GNU/Linux. We’ll draw a memory layout diagram for the ELF file based on readelf output²:

Memory layout diagram of ELF file based on readelf output.

The loader will map each file page (a page-sized data block from the ELF file) into virtual memory by means of mmap() ⁴ which requires the file offset to be a multiple of page size; The loader sequentially looks through the program headers and maps the corresponding segments into memory. Here’s the tricky part: as you see, seg05 is not page aligned. How will the loader deal with it?

First see the result:

pwndbg> vmmap
LEGEND: STACK | HEAP | CODE | DATA | WX | RODATA
             Start                End Perm     Size Offset File (set vmmap-prefer-relpaths on)
    0x555555554000     0x555555555000 r--p     1000      0 test
    0x555555555000     0x555555556000 r-xp     1000   1000 test
    0x555555556000     0x555555557000 r--p     1000   2000 test
    0x555555557000     0x555555558000 r--p     1000   2000 test
    0x555555558000     0x555555559000 rw-p     1000   3000 test
    0x7ffff7da4000     0x7ffff7dcc000 r--p    28000      0 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7dcc000     0x7ffff7f54000 r-xp   188000  28000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7f54000     0x7ffff7fa3000 r--p    4f000 1b0000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7fa3000     0x7ffff7fa7000 r--p     4000 1fe000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7fa7000     0x7ffff7fa9000 rw-p     2000 202000 /usr/lib/x86_64-linux-gnu/libc.so.6
    0x7ffff7fc5000     0x7ffff7fc6000 r--p     1000      0 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7fc6000     0x7ffff7ff1000 r-xp    2b000   1000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7ff1000     0x7ffff7ffb000 r--p     a000  2c000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7ffb000     0x7ffff7ffd000 r--p     2000  36000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffff7ffd000     0x7ffff7fff000 rw-p     2000  38000 /usr/lib/x86_64-linux-gnu/ld-linux-x86-64.so.2
    0x7ffffffde000     0x7ffffffff000 rw-p    21000      0 [stack]

Focusing on offset column, the file offset 0x2000 gets mapped twice? Does this result in memory waste, and why?

Addressing the first question. ELF loader sequentially scans through program headers.

It sees the first loadable segment:

The seg02 is page-aligned.
seg02 ranges 0x0000 - 0x0628, within 0x0000 - 0x1000; I only need to map 1 file page.
What I should do is to directly map the file page (0x0000 - 0x1000) into the memory.

Then the second loadable segment:

The seg03 is page-aligned.
seg03 ranges 0x1000 - 0x1191, within 0x1000 - 0x2000; I only need to map 1 file page.
What I should do is to directly map the file page (0x1000 - 0x2000) into the memory.

And the third:

The seg04 is page-aligned.
seg04 ranges 0x2000 - 0x2114, within 0x2000 - 0x3000; I only need to map 1 file page.
What I should do is to directly map the file page (0x2000 - 0x3000) into the memory.

The tricky part is seg05:

Its memory range in the file (0x2db8 - 0x3010) is not page-aligned.
Again, mmap() can only map a file page whose offset equals a multiple of the page-size.
So I decided first to map one file page the ranging 0x2000 - 0x3000 then the following file page ranging 0x3000 - 0x4000, 2 file pages in total.

Thus, here we are! The file page at offset 0x2000 gets mapped twice, leaving the virtual memory from 0x2114 to 0x3db8 unused.

Will it cause memory waste? No, these 2 pages (0x2000 - 0x4000 in virtual memory) share the same physical memory by virtue of demand paging implemented by mmap().

Side note #1: Why can’t seg05 be page-aligned?

Scrolling back to the diagram of ELF file memory layout on disk, seg05 mainly contains two parts:

Offset: 0x2db8 - 0x3000: .init_array .fini_array .dynamic .got with permission R.
Offset: 0x3000 - 0x3010: .data, .bss with permission RW

Obviously, these two parts require different permissions (R vs RW). Since each page can have only one permission setting, seg05 spans across two pages with different permission settings.

Side note #2: Why do `FileSiz` and `MemSiz` of seg05 differ?

FileSiz            MemSiz
0x0000000000000258 0x0000000000000260

When loaded, the size of seg05 got increased by 8 bytes. The uninitialized data section .bss also has 8 bytes and it won’t take up any space in file until it gets loaded into memory:

$ readelf -S test # examine the section headers
[Nr] Name      Type      Address              Offset             Size               EntSize            Flags Link Info Align
[25] .data     PROGBITS  0000000000004000     00003000           0000000000000010   0000000000000000   WA    0    0    8
[26] .bss      NOBITS	 0000000000004010     00003010           0000000000000008   0000000000000000   WA    0    0    1

pwndbg> x/24xb 0x555555558000
<.data>:
0x555555558000: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x555555558008: 0x08    0x80    0x55    0x55    0x55    0x55    0x00    0x00
<.bss>:
0x555555558010: 0x00    0x00    0x00    0x00    0x00    0x00    0x00    0x00 # initialized to zero

Side note #3: WTF is the output of `readelf`?

 Section to Segment mapping:
  Segment Sections...
[ ... ]
   05(RW) .init_array .fini_array .dynamic .got .data .bss (p_type = PT_LOAD)
   06(RW) .dynamic (p_type = PT_DYNAMIC)
[ ... ]
   12(R)  .init_array .fini_array .dynamic .got (p_type = PT_GNU_RELRO)

Leaving the seg06 aside for now⁵, why do the permission setting of seg05 and seg12 differ? Things may become clearer if we examine these sections one by one:

.init_array:0000000000003DB8 __frame_dummy_init_array_entry dq offset frame_dummy
.fini_array:0000000000003DC0 __do_global_dtors_aux_fini_array_entry dq offset __do_global_dtors_aux

$ readelf -d test
Dynamic section at offset 0x2dc8 contains 27 entries:
  Tag        Type                         Name/Value
 0x0000000000000001 (NEEDED)             Shared library: [libc.so.6]
 0x000000000000000c (INIT)               0x1000
 0x000000000000000d (FINI)               0x1184
 0x0000000000000019 (INIT_ARRAY)         0x3db8
 0x000000000000001b (INIT_ARRAYSZ)       8 (bytes)
 0x000000000000001a (FINI_ARRAY)         0x3dc0
 0x000000000000001c (FINI_ARRAYSZ)       8 (bytes)
 0x000000006ffffef5 (GNU_HASH)           0x3b0
 0x0000000000000005 (STRTAB)             0x480
 0x0000000000000006 (SYMTAB)             0x3d8
 0x000000000000000a (STRSZ)              143 (bytes)
 0x000000000000000b (SYMENT)             24 (bytes)
 0x0000000000000015 (DEBUG)              0x0
 0x0000000000000003 (PLTGOT)             0x3fb8
 0x0000000000000002 (PLTRELSZ)           24 (bytes)
 0x0000000000000014 (PLTREL)             RELA
 0x0000000000000017 (JMPREL)             0x610
 0x0000000000000007 (RELA)               0x550
 0x0000000000000008 (RELASZ)             192 (bytes)
 0x0000000000000009 (RELAENT)            24 (bytes)
 0x000000000000001e (FLAGS)              BIND_NOW
 0x000000006ffffffb (FLAGS_1)            Flags: NOW PIE
 0x000000006ffffffe (VERNEED)            0x520
 0x000000006fffffff (VERNEEDNUM)         1
 0x000000006ffffff0 (VERSYM)             0x510
 0x000000006ffffff9 (RELACOUNT)          3
 0x0000000000000000 (NULL)               0x0

.got:0000000000003FB8 dq offset _DYNAMIC
.got:0000000000003FC0 dq 0
.got:0000000000003FC8 dq 0
.got:0000000000003FD0 dq offset printf
.got:0000000000003FD8 dq offset __libc_start_main
.got:0000000000003FE0 dq offset _ITM_deregisterTMCloneTable
.got:0000000000003FE8 dq offset __gmon_start__
.got:0000000000003FF0 dq offset _ITM_registerTMCloneTable
.got:0000000000003FF8 dq offset __imp___cxa_finalize

All these sections have to be patched at load time.

.init_array and .fini_array are arrays of function pointers, which are initially set to relative virtual addresses; These functions will run before and after main(). The absolute virtual addresses will be resolved and replace the original addresses when loaded.
.dynamic section is the same as the two above. The relative address will be resolved and patched into absolute address.
The program uses eager binding instead of lazy binding, so the .got section needs to be patched first and then restricted to R permission by the dynamic linker (ld.so)³, same as the other segments.

Let’s do some examinations to verify:

# .init_array and .fini_array
.init_array:0000000000003DB8 40 11 00 00 00 00 00 00                         __frame_dummy_init_array_entry dq offset frame_dummy
.fini_array:0000000000003DC0 00 11 00 00 00 00 00 00                         __do_global_dtors_aux_fini_array_entry dq offset __do_global_dtors_aux

pwndbg> x/16b 0x0000000000003DB8 + 0x555555554000
0x555555557db8: 0x40    0x51    0x55    0x55    0x55    0x55    0x00    0x00
0x555555557dc0: 0x00    0x51    0x55    0x55    0x55    0x55    0x00    0x00

# .dynamic
LOAD:0000000000003E48 05 00 00 00 00 00 00 00 80 04 00 00 00 00 00 00                 Elf64_Dyn <5, 480h>     ; DT_STRTAB
LOAD:0000000000003E58 06 00 00 00 00 00 00 00 D8 03 00 00 00 00 00 00                 Elf64_Dyn <6, 3D8h>     ; DT_SYMTAB
pwndbg> x/32b 0x0000000000003E48 + 0x555555554000
0x555555557e48: 0x05    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x555555557e50: 0x80    0x44    0x55    0x55    0x55    0x55    0x00    0x00
0x555555557e58: 0x06    0x00    0x00    0x00    0x00    0x00    0x00    0x00
0x555555557e60: 0xd8    0x43    0x55    0x55    0x55    0x55    0x00    0x00

These addresses actually get patched at load-time!

References

Footnotes

Just copying and pasting the high-level C structure of program header (Phdr) to explain how it’s embedded and hard-coded in the program—and what it contains—is not enough. Instead, compare the C structure (from man elf), IDA view, and readelf output provided in the article for clearer understanding.
The segments other than PT_LOAD have an obvious overlap in sections (e.g., sections from seg12 (R) are a subset of sections from seg05 (RW)). These segments (or more accurately, the overlapped sections) will also get loaded. Additional note: Overlapping types like PT_GNU_RELRO are hints for the dynamic linker to post-process, so the loading sequence is that ELF loader of the kernel maps PT_LOAD, then user-space linker handles the rest.
There are some differences between ELF loader and dynamic linker.
ELF loader uses mmap() to load pages; it requires the base address of the file page it maps to be a multiple of the page size.
Why is there a dedicated program header for .dynamic ? From readelf -d output, the relative virtual addresses of .init_array, .fini_array and .got are included; It acts as the “headquarters” or “container” for load-time writable sections’ addresses, so a dedicated header lets the linker efficiently locate .dynamic’s virtual address via the program headers.

DN11接入笔记

Mon, 07 Jul 2025 00:00:00 GMT

有一台公网服务器接入DN11还是挺方便的, 主要用到的工具有两个:

Wireguard (创建安全隧道)
Bird2 (负责不同AS之间的路由)

前置知识

因特网 (Internet) 由很多独立的网络组成, 即自治域 (AS); 每个自治域由ISP管理, 我们说的 “上网” 就是接入了ISP, 让ISP给你分配一个公网IP地址, 你的数据包从你的路由器 (这里指家庭路由器) 出发, 经过ISP的边界网关, 到达其他ISP的边界网关, 再到达目标ISP的边界网关, 最后传递到目标主机.

BGP解决的是如何选择在不同AS之间跳跃的最优路径; 每个边界网关都存储了一个路由表, 边界网关会根据数据包的目的地址和路由表决定这个数据包的下一跳去哪个AS.

DN11可以看成因特网的缩小版, 每个接入DN11的成员都需要有独立的ASN和网段, 二者是对应关系, 在成员注册表统一管理. 比如我申请的网段和ASN分别为172.16.47.0/24, 4220085757; 我在Wireguard创建的虚拟内网¹中就扮演了因特网里面的ISP, 拥有独立网段和ASN.

可以看看DN11的实时拓扑图.

配置Wireguard

用来建立对等会话 (peer), 柏师傅的wg-quick-op丰富了原版wg-quick-go的功能, 先运行wg-quick-op install, 然后到配置文件 (/etc/wireguard.your_wg_interface_name.conf)进行虚拟网口和peer的配置, 如果配置没问题的话, 在运行wg-quick-op up <interface name>后, 脚本会自动帮你做以下几个事情:

在你的系统内创建一个虚拟网口
Wireguard开始监听0.0.0.0:port
执行PostUp指令, 分配我先前配置的地址172.16.47.254给这个网口, 现在这个网口有了一个IP地址
与对端peer握手, 建立连接

完成之后, 应该就可以ping通对端IP²了, 可以使用ifconfig查看刚刚建立的虚拟网口:

$ ifconfig
wg0: flags=209<UP,POINTOPOINT,RUNNING,NOARP>  mtu 1420
        inet 172.16.47.254  netmask 255.255.255.255  destination 172.16.26.253
        [ ... ] skipping stuff

eth0: flags=4163<UP,BROADCAST,RUNNING,MULTICAST>  mtu 1500
        inet 172.17.24.224  netmask 255.255.192.0  broadcast 172.17.63.255
    	[ ... ] skipping stuff

配置Bird2

DN11使用Bird2实现BGP, 按照柏师傅的wiki里面配置就好

使用birdc s p看到我的wg0网口为Established就代表已经接入DN11了:

$ sudo birdc s p
BIRD 2.17.1 ready.
Name       Proto      Table      State  Since         Info
device1    Device     ---        up     2025-07-05
kernel1    Kernel     master4    up     2025-07-05
static1    Static     BGP_table  up     2025-07-06
pipe1      Pipe       ---        up     2025-07-06    master4 <=> BGP_table
wg0        BGP        ---        up     2025-07-06    Established

探索

Wireguard为我们创建了一个虚拟局域网¹ , Bird2运行在此之上:

数据包通过BGP在不同AS之间穿梭; 从不同AS之间的跳跃由边界网关负责, 我们可以用traceroute <ip>看看目的地为172.16.4.1的数据包是怎么走的:

$ traceroute 172.16.4.1
traceroute to 172.16.4.1 (172.16.4.1), 30 hops max, 60 byte packets
 1  172.16.26.253 (172.16.26.253)  30.135 ms  30.076 ms  30.055 ms
 2  10.255.1.1 (10.255.1.1)  36.032 ms  35.785 ms  35.997 ms
 3  172.16.4.66 (172.16.4.66)  43.596 ms  43.547 ms  43.528 ms
 4  172.16.4.1 (172.16.4.1)  55.591 ms  55.422 ms  55.605 ms

除了172.16.4.1外, 经过的其他IP应该都是边界网关, 并且属于各自的AS. 经过的第一个IP: 172.16.26.253 就是我的peer, 同时也是网段172.16.26.0/24的边界网关.

现在有一个小问题: 我怎么知道要发送给172.16.4.1的数据包下一跳到哪里?

执行birdc进入bird命令行界面, 使用show route看看路由表, 有这么一行:

Table master4:
[ ... ] skipping stuff
172.16.4.0/24        unicast [wg0 15:37:51.246] * (100) [AS4220084444i]
        via 172.16.26.253 on wg0

即所有目的地IP在172.16.4.0/24网段内的数据包都要通过wg0网口发送, 到达另一个AS的边界网关172.16.26.253, 由于我和对面都是单一的公网服务器, 所以边界网关应该就是服务器本身.

Footnotes

可能并不准确, LAN应该在数据链路层, 而Wireguard是操作在网络层的; 但从用户的角度来看, 概念上是合理的.
即PostUp内的<another tunnel IP>

ACTF 2025

Tue, 20 May 2025 00:00:00 GMT

ezFPGA

Software is too slow… and hardware is too honest.

Dump cypher from .vcd file:

// Valid cypher values between 5500ns and 5860ns
uint8_t cypher_values[36] = {
    0xAD, 0x00, 0xC0, 0x9F, 0x16, 0x17, 0xEC, 0x25, 0x25, 0x1F, 0x12, 0xE2, 0x7F, 0x9F, 0x37, 0x53, 0x12, 0xBA, 0x8D, 0x38, 0x60, 0x14, 0x1B, 0x31, 0x8E, 0x13, 0xE2, 0x56, 0x0A, 0x1A, 0x25, 0xB9, 0x80, 0x73, 0x8A, 0x60
};

Write a script to decrypt.

Note

Event-Based: VCD doesn’t record the value of every signal at every tiny time step. Instead, it only records an entry when a signal’s value actually changes. This is more efficient than logging everything constantly.

import numpy as np
from sympy import Matrix, gcd
from z3 import *

"""

Step 1: RC4

"""

def rc4(key: bytes, l) -> bytes:
    
    # Key Scheduling Algorithm (KSA)
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]

    # Pseudo-Random Generation Algorithm (PRGA) 
    i = 0
    j = 0
    result = []
    for _ in range(l):
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        k = S[(S[i] + S[j]) % 256]
        result.append(k)
    return bytes(result)

cypher_values = [
    0xAD, 0x00, 0xC0, 0x9F, 0x16, 0x17, 0xEC, 0x25, 0x25, 0x1F,
    0x12, 0xE2, 0x7F, 0x9F, 0x37, 0x53, 0x12, 0xBA, 0x8D, 0x38,
    0x60, 0x14, 0x1B, 0x31, 0x8E, 0x13, 0xE2, 0x56, 0x0A, 0x1A,
    0x25, 0xB9, 0x80, 0x73, 0x8A, 0x60
]

key = bytes([ord(c) for c in "eclipsky"])
keystream = rc4(key, len(cypher_values))

ae = [(c - k) % 256 for c, k in zip(cypher_values, keystream)]

"""

# Step 2: Invert AD matrix modulo 256

"""

ad_columns = [
    [116, 11, 98, 31, 235, 15],
    [174, 193, 214, 30, 25, 191],
    [193, 115, 197, 117, 244, 119],
    [124, 4, 145, 15, 202, 140],
    [102, 127, 97, 230, 73, 94],
    [100, 139, 151, 179, 222, 32]
]

ad_matrix = np.array(ad_columns).T.tolist()
sympy_matrix = Matrix(ad_matrix)
det = sympy_matrix.det() % 256

if gcd(det, 256) != 1:
    raise ValueError("Matrix not invertible modulo 256")

inv_det = pow(int(det), -1, 256)
inv_matrix = (sympy_matrix.adjugate() * inv_det) % 256
inv_np = np.array(inv_matrix.tolist(), dtype=int) % 256

# Compute AC = AE * inv(AD) mod 256
ae_2d = np.array(ae).reshape(6, 6)
ac_2d = np.dot(ae_2d, inv_np) % 256
ac = ac_2d.flatten().tolist()

"""

Step 3: Set up Z3 solver with variable flag length constraints

"""

s = Solver()
aa = [BitVec(f'aa_{i}', 8) for i in range(39)]

# Fix the prefix "ACTF{"
prefix = [ord(c) for c in "ACTF{"]
for i in range(5):
    s.add(aa[i] == prefix[i])
    
# Enforce flag ends with '}' and is followed by zeros
s.add(Or([aa[i] == ord('}') for i in range(5, 39)]))  # At least one '}'
s.add(Sum([If(aa[i] == ord('}'), 1, 0) for i in range(5, 39)]) == 1)  # Exactly one '}'

# Convolution equations for AC (36 equations)
for i in range(36):
    term = (11 * aa[i] + 4 * aa[i + 1] + 5 * aa[i + 2] + 14 * aa[i + 3]) % 256
    s.add(ac[i] == term)

if s.check() == sat:
    model = s.model()
    flag_bytes = [model[aa[i]].as_long() for i in range(39)]
    print(bytes(flag_bytes))
else:
    print("No solution found")
# ACTF{RC4_4nd_FPGA_w4lk_1nt0_4_b4r}

Deepx

Simply reversing PTX assembly - basic, but annoying. Solving these large loops requires either OpenMP or CUDA.

Also, some little problems were encountered.

Analysis of Layer1

float accumulated_value = 0.0f;
if (tid < 241 && bid < 241) {
    for (unsigned int i = 0; i < 16; ++i) {
        unsigned int index = (i + bid) * bdm + tid;
        unsigned int motion_row = 240 - (i * 16);
        for (unsigned int j = 0; j < 16; ++j) {
            accumulated_value += MOTION[motion_row + j] * (float)input[index + j]
        }
    }
}

Analysis of Layer2

unsigned int bid = %ctaid.x;
unsigned int tid = %tid.x;
unsigned int bdm= %ntid.x;
int i = bdm * bid + tid;
output[ bdm * SBOX[tid]+ SBOX[bid] ] = input[i];
// output[SBOX[tid], SBOX[bid]] = input[bid, tid]

It’s a mapping of each coordinate. The process is as follows:

Forward mapping: swap → apply SBOX
Inverse mapping: apply INV_SBOX → swap

Analysis of Layer3

Part 1: XOR + TEA + XOR

// XOR step
const uint32_t tid = threadIdx.x; // Thread index within block (0-255)
const uint32_t bid = blockIdx.x;  // Block index within grid (0-255)
input[i] ^= bid | tid
bar.sync
// TEA step
const uint32_t K0 = 1386807340;
const uint32_t K1 = 2007053320;
const uint32_t K2 = 621668851;
const uint32_t K3 = -862448841
const uint32_t DELTA = -1708609273
uint32_t sum = 1786956040; // Initial sum
for (uint32_t i = 0; i < 3238567; ++i) {
    uint32_t term1 = (data0 << 4) + K0;
    uint32_t term2 = (data0 >> 5) + K1; // logical right shift
    uint32_t term3 = data0 + sum;
    data1 += (term1 ^ term2) ^ term3;   // Update data1

    uint32_t term4 = (data1 << 4) + K2;
    uint32_t term5 = sum + data1;
    uint32_t term6 = (data1 >> 5) + K3; // logical right shift
    data0 -= (term4 ^ term5) ^ term6;   // Update data0
    sum += DELTA;
}
bar.sync
// XOR step
input[i] ^= bid & tid
bar.sync

Part 2: Matrix multiplication

input \cdot mat_a = mat_b

uint8_t input[256 * 256];
uint8_t result = 0;
uint8_t *base = input + bid * 256;
uint8_t sum = SBOX[tid];
for (uint32_t i = 0; i < 256; ++i) {
    result += base[i] * TBOX[sum];
    sum = sum * 5 + 17;
}

Part 3: ROL + LCG + XOR + SBOX

// Layer_3_part_3
input[256 * 256];
uint8_t i = bid * 256 + tid;
uint8_t key = bid ^ tid;
uint8_t result_3= input[i];

for (uint32_t j = 8; j < 4137823; ++j) {
    uint8_t result_1 = (result_3 << 3) | (result_3>> 5); // rotate left 3
    uint8_t result_2 = result_1 * 13 + key;
    result_3 = cuda_sbox[cuda_tbox[j & 0xFF] ^ result_2];
}

output[i] = result_3;

Decrypt Script

L3 - Part 3: `ROL` + `LCG` + `XOR` + `SBOX`

// part_3.cpp
#include <cstdint>
#include <vector>
#include <fstream>
#include <omp.h>
#include <iostream>
#include <cassert>
#define DEBUG

uint8_t SBOX[256] = { ... };

uint8_t TBOX[256] = { ... };

uint8_t INVSBOX[256];
void compute_inv()
{
    for (int i = 0; i < 256; i++)
        INVSBOX[SBOX[i]] = i;
}

static uint8_t kernel(int i, uint8_t b3)
{
    uint8_t bid = i / 256;
    uint8_t tid = i % 256;
    uint8_t key = bid ^ tid;
    uint8_t b1, b2;

    for (int j = 4137822; j >= 8; j--)
    {
        b2 = INVSBOX[b3] ^ TBOX[j & 0xFF];
        b1 = (b2 - key) * 197;
        b3 = (b1 << 5) | (b1 >> 3); // rotate right 3
    }

    return b3;
}

int main()
{
    compute_inv();
    std::ifstream in_file("deep_flag.bin", std::ios::binary);

    #ifdef DEBUG
    assert(in_file.is_open());
    #endif

    in_file.seekg(0, std::ios::end);
    size_t file_size = in_file.tellg();

    #ifdef DEBUG
    assert(file_size == 256 * 256);
    #endif

    in_file.seekg(0, std::ios::beg);

    std::vector<uint8_t> input_data(file_size);
    in_file.read(reinterpret_cast<char *>(input_data.data()), file_size);
    in_file.close();

    const uint8_t *input = input_data.data();
    std::vector<uint8_t> output(256 * 256);

#pragma omp parallel for schedule(static)
    for (int i = 0; i < 256 * 256; ++i)
    {
        output[i] = kernel(i, input[i]);
    }

    std::ofstream out_file("part_3_in.bin", std::ios::binary);
    out_file.write(reinterpret_cast<const char *>(output.data()), output.size());
    out_file.close();

    return 0;
}
// Usage: g++ .\part_3.cpp -o part_3.exe -fopenmp -std=c++17 -O2 -Wall

Note

A little problem: g++ .\part_3.cpp -o part_3.exe -fopenmp. The executable compiled with this command do not reach full CPU utilization of each logical processors. However, g++ .\part_3.cpp -o part_3.exe -fopenmp -std=c++17 -O2 -Wall utilize CPU to 100%. Why?

Switching on –O2 –std=c++17 –Wall (or any –O2/–O3), the compiler:

• inlines kernel(…) into the hot OpenMP loop

• promotes b1,b2,b3,j,key into registers

• emits a single ROR instruction for the rotate

• hoists loads of the constant SBOX/TBOX/INVSBOX into contiguous register lookups

• unrolls/strength-reduces the loop and generally cleans out all of the stack traffic

So, be aware of using compiler optimizations for better CPU utilization.

L3 - Part 2: Matrix Multiplication

# part_2.sage
import functools as ft

import tqdm
from sage.all import *

# fmt: off
SBOX = bytes([ ... ])
# SBOX_INV = bytes(SBOX.index(i) for i in range(256))
TBOX = bytes([ ... ])
# TBOX_INV = bytes((TBOX.index(i) for i in range(256)))
# fmt: on

THREADS_PER_BLOCK = 256

Zmod256 = Integers(256)

# @ft.cache
def get_coeff(thread_id: int):
    s = SBOX[thread_id]
    coeffs = []
    for _ in range(THREADS_PER_BLOCK):
        coeffs.append(TBOX[s & 0xFF])
        s = ((s * 5) + 17) & 0xFF
    return vector(Zmod256, coeffs)


# @ft.cache
def get_coeff_mat():
    rows = []
    for j in range(THREADS_PER_BLOCK):
        rows.append(get_coeff(j))
    return Matrix(Zmod256, rows)


with open("part_3_in.bin", "rb") as f:
    in_buf = f.read()

assert len(in_buf) % THREADS_PER_BLOCK == 0

results = []
mat_a = get_coeff_mat()

for i in tqdm.tqdm(range(len(in_buf) // THREADS_PER_BLOCK)):
    vec_b = vector(Zmod256, in_buf[i * THREADS_PER_BLOCK : (i + 1) * THREADS_PER_BLOCK])
    vec_x = mat_a.solve_right(vec_b)
    results.extend(vec_x)

with open("part_2_in.bin", "wb") as f:
    f.write(bytes(results))

Let’s try to get a more intuitive understanding of this solution process, which is equivalent to solving $Ax = b$ 256 times, where $x$ is a 256-entry vector consisting each row of the original 256 * 256 input image:

for i in tqdm.tqdm(range(len(in_buf) // THREADS_PER_BLOCK)):
    vec_b = vector(Zmod256, in_buf[i * THREADS_PER_BLOCK : (i + 1) * THREADS_PER_BLOCK])
    vec_x = mat_a.solve_right(vec_b)
    results.extend(vec_x)

L3 - Part 1: `XOR` + `TEA` + `XOR`

// part_1.cpp
#include <stdio.h>
#include <cstdint>
#include <vector>
#include <iostream>
#include <fstream>
#include <cassert>
#define DEBUG

const uint32_t K0 = 1386807340;
const uint32_t K1 = 2007053320;
const uint32_t K2 = 621668851;
const uint32_t K3 = -862448841;

void tea_kernel(uint32_t v[2]) {
    uint32_t v0 = v[0], v1 = v[1], delta = -1708609273, sum = 1786956040 + delta * 3238567;
    for (int i = 0; i < 3238567; i++) {
        sum -= delta;
        v0 += ((v1 << 4) + K2) ^ (v1 + sum) ^ ((v1 >> 5) + K3);
        v1 -= ((v0 << 4) + K0) ^ (v0 + sum) ^ ((v0 >> 5) + K1);
    }
    v[0] = v0;
    v[1] = v1;
}

int main(){
    
    std::ifstream in_file("part_2_in.bin", std::ios::binary);

    #ifdef DEBUG
    assert(in_file.is_open());
    #endif

    in_file.seekg(0, std::ios::end);
    size_t file_size = in_file.tellg();
    in_file.seekg(0, std::ios::beg);

    #ifdef DEBUG
    assert(file_size == 256 * 256);
    assert(in_file.tellg() == 0);
    #endif

    std::vector<uint8_t> input(file_size);

    in_file.read(reinterpret_cast<char *>(input.data()), file_size);
    in_file.close();

    uint8_t *input_ptr = input.data();

// Granularity: BYTE
#pragma omp parallel for schedule(static)
    for(size_t i = 0; i < file_size; i++){
        uint8_t bid = i / 256;
        uint8_t tid = i % 256;
        input_ptr[i] ^= bid & tid;
    }

// Granularity: QWORD
#pragma omp parallel for schedule(static)
    for(size_t i = 0; i < file_size; i += 8){
        tea_kernel((uint32_t *)&input_ptr[i]);
    }

// Granularity: BYTE    
#pragma omp parallel for schedule(static)
    for(size_t i = 0; i < file_size; i++){
        uint8_t bid = i / 256;
        uint8_t tid = i % 256;
        input_ptr[i] ^= bid | tid;
    }

    std::ofstream out_file("part_1_in.bin", std::ios::binary);

    out_file.write(reinterpret_cast<char *>(input_ptr), file_size);

    return 0;
}

L2 - Mapping

# layer_2.py
import tqdm
SBOX = bytes([ ... ])

"""
input: value
output: index
"""

INV_SBOX = bytes([SBOX.index(i) for i in range(256)])

assert len(SBOX) == 256

BMP = bytes([0x42,0x4d,0x36,0x04,0x01,0x00,0x00,0x00,0x00,0x00,0x36,0x04,0x00,0x00,0x28,0x00,0x00,0x00,0x00,0x01,0x00,0x00,0x00,0x01,0x00,0x00,0x01,0x00,0x08,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x00,0x01,0x01,0x01,0x00,0x02,0x02,0x02,0x00,0x03,0x03,0x03,0x00,0x04,0x04,0x04,0x00,0x05,0x05,0x05,0x00,0x06,0x06,0x06,0x00,0x07,0x07,0x07,0x00,0x08,0x08,0x08,0x00,0x09,0x09,0x09,0x00,0x0a,0x0a,0x0a,0x00,0x0b,0x0b,0x0b,0x00,0x0c,0x0c,0x0c,0x00,0x0d,0x0d,0x0d,0x00,0x0e,0x0e,0x0e,0x00,0x0f,0x0f,0x0f,0x00,0x10,0x10,0x10,0x00,0x11,0x11,0x11,0x00,0x12,0x12,0x12,0x00,0x13,0x13,0x13,0x00,0x14,0x14,0x14,0x00,0x15,0x15,0x15,0x00,0x16,0x16,0x16,0x00,0x17,0x17,0x17,0x00,0x18,0x18,0x18,0x00,0x19,0x19,0x19,0x00,0x1a,0x1a,0x1a,0x00,0x1b,0x1b,0x1b,0x00,0x1c,0x1c,0x1c,0x00,0x1d,0x1d,0x1d,0x00,0x1e,0x1e,0x1e,0x00,0x1f,0x1f,0x1f,0x00,0x20,0x20,0x20,0x00,0x21,0x21,0x21,0x00,0x22,0x22,0x22,0x00,0x23,0x23,0x23,0x00,0x24,0x24,0x24,0x00,0x25,0x25,0x25,0x00,0x26,0x26,0x26,0x00,0x27,0x27,0x27,0x00,0x28,0x28,0x28,0x00,0x29,0x29,0x29,0x00,0x2a,0x2a,0x2a,0x00,0x2b,0x2b,0x2b,0x00,0x2c,0x2c,0x2c,0x00,0x2d,0x2d,0x2d,0x00,0x2e,0x2e,0x2e,0x00,0x2f,0x2f,0x2f,0x00,0x30,0x30,0x30,0x00,0x31,0x31,0x31,0x00,0x32,0x32,0x32,0x00,0x33,0x33,0x33,0x00,0x34,0x34,0x34,0x00,0x35,0x35,0x35,0x00,0x36,0x36,0x36,0x00,0x37,0x37,0x37,0x00,0x38,0x38,0x38,0x00,0x39,0x39,0x39,0x00,0x3a,0x3a,0x3a,0x00,0x3b,0x3b,0x3b,0x00,0x3c,0x3c,0x3c,0x00,0x3d,0x3d,0x3d,0x00,0x3e,0x3e,0x3e,0x00,0x3f,0x3f,0x3f,0x00,0x40,0x40,0x40,0x00,0x41,0x41,0x41,0x00,0x42,0x42,0x42,0x00,0x43,0x43,0x43,0x00,0x44,0x44,0x44,0x00,0x45,0x45,0x45,0x00,0x46,0x46,0x46,0x00,0x47,0x47,0x47,0x00,0x48,0x48,0x48,0x00,0x49,0x49,0x49,0x00,0x4a,0x4a,0x4a,0x00,0x4b,0x4b,0x4b,0x00,0x4c,0x4c,0x4c,0x00,0x4d,0x4d,0x4d,0x00,0x4e,0x4e,0x4e,0x00,0x4f,0x4f,0x4f,0x00,0x50,0x50,0x50,0x00,0x51,0x51,0x51,0x00,0x52,0x52,0x52,0x00,0x53,0x53,0x53,0x00,0x54,0x54,0x54,0x00,0x55,0x55,0x55,0x00,0x56,0x56,0x56,0x00,0x57,0x57,0x57,0x00,0x58,0x58,0x58,0x00,0x59,0x59,0x59,0x00,0x5a,0x5a,0x5a,0x00,0x5b,0x5b,0x5b,0x00,0x5c,0x5c,0x5c,0x00,0x5d,0x5d,0x5d,0x00,0x5e,0x5e,0x5e,0x00,0x5f,0x5f,0x5f,0x00,0x60,0x60,0x60,0x00,0x61,0x61,0x61,0x00,0x62,0x62,0x62,0x00,0x63,0x63,0x63,0x00,0x64,0x64,0x64,0x00,0x65,0x65,0x65,0x00,0x66,0x66,0x66,0x00,0x67,0x67,0x67,0x00,0x68,0x68,0x68,0x00,0x69,0x69,0x69,0x00,0x6a,0x6a,0x6a,0x00,0x6b,0x6b,0x6b,0x00,0x6c,0x6c,0x6c,0x00,0x6d,0x6d,0x6d,0x00,0x6e,0x6e,0x6e,0x00,0x6f,0x6f,0x6f,0x00,0x70,0x70,0x70,0x00,0x71,0x71,0x71,0x00,0x72,0x72,0x72,0x00,0x73,0x73,0x73,0x00,0x74,0x74,0x74,0x00,0x75,0x75,0x75,0x00,0x76,0x76,0x76,0x00,0x77,0x77,0x77,0x00,0x78,0x78,0x78,0x00,0x79,0x79,0x79,0x00,0x7a,0x7a,0x7a,0x00,0x7b,0x7b,0x7b,0x00,0x7c,0x7c,0x7c,0x00,0x7d,0x7d,0x7d,0x00,0x7e,0x7e,0x7e,0x00,0x7f,0x7f,0x7f,0x00,0x80,0x80,0x80,0x00,0x81,0x81,0x81,0x00,0x82,0x82,0x82,0x00,0x83,0x83,0x83,0x00,0x84,0x84,0x84,0x00,0x85,0x85,0x85,0x00,0x86,0x86,0x86,0x00,0x87,0x87,0x87,0x00,0x88,0x88,0x88,0x00,0x89,0x89,0x89,0x00,0x8a,0x8a,0x8a,0x00,0x8b,0x8b,0x8b,0x00,0x8c,0x8c,0x8c,0x00,0x8d,0x8d,0x8d,0x00,0x8e,0x8e,0x8e,0x00,0x8f,0x8f,0x8f,0x00,0x90,0x90,0x90,0x00,0x91,0x91,0x91,0x00,0x92,0x92,0x92,0x00,0x93,0x93,0x93,0x00,0x94,0x94,0x94,0x00,0x95,0x95,0x95,0x00,0x96,0x96,0x96,0x00,0x97,0x97,0x97,0x00,0x98,0x98,0x98,0x00,0x99,0x99,0x99,0x00,0x9a,0x9a,0x9a,0x00,0x9b,0x9b,0x9b,0x00,0x9c,0x9c,0x9c,0x00,0x9d,0x9d,0x9d,0x00,0x9e,0x9e,0x9e,0x00,0x9f,0x9f,0x9f,0x00,0xa0,0xa0,0xa0,0x00,0xa1,0xa1,0xa1,0x00,0xa2,0xa2,0xa2,0x00,0xa3,0xa3,0xa3,0x00,0xa4,0xa4,0xa4,0x00,0xa5,0xa5,0xa5,0x00,0xa6,0xa6,0xa6,0x00,0xa7,0xa7,0xa7,0x00,0xa8,0xa8,0xa8,0x00,0xa9,0xa9,0xa9,0x00,0xaa,0xaa,0xaa,0x00,0xab,0xab,0xab,0x00,0xac,0xac,0xac,0x00,0xad,0xad,0xad,0x00,0xae,0xae,0xae,0x00,0xaf,0xaf,0xaf,0x00,0xb0,0xb0,0xb0,0x00,0xb1,0xb1,0xb1,0x00,0xb2,0xb2,0xb2,0x00,0xb3,0xb3,0xb3,0x00,0xb4,0xb4,0xb4,0x00,0xb5,0xb5,0xb5,0x00,0xb6,0xb6,0xb6,0x00,0xb7,0xb7,0xb7,0x00,0xb8,0xb8,0xb8,0x00,0xb9,0xb9,0xb9,0x00,0xba,0xba,0xba,0x00,0xbb,0xbb,0xbb,0x00,0xbc,0xbc,0xbc,0x00,0xbd,0xbd,0xbd,0x00,0xbe,0xbe,0xbe,0x00,0xbf,0xbf,0xbf,0x00,0xc0,0xc0,0xc0,0x00,0xc1,0xc1,0xc1,0x00,0xc2,0xc2,0xc2,0x00,0xc3,0xc3,0xc3,0x00,0xc4,0xc4,0xc4,0x00,0xc5,0xc5,0xc5,0x00,0xc6,0xc6,0xc6,0x00,0xc7,0xc7,0xc7,0x00,0xc8,0xc8,0xc8,0x00,0xc9,0xc9,0xc9,0x00,0xca,0xca,0xca,0x00,0xcb,0xcb,0xcb,0x00,0xcc,0xcc,0xcc,0x00,0xcd,0xcd,0xcd,0x00,0xce,0xce,0xce,0x00,0xcf,0xcf,0xcf,0x00,0xd0,0xd0,0xd0,0x00,0xd1,0xd1,0xd1,0x00,0xd2,0xd2,0xd2,0x00,0xd3,0xd3,0xd3,0x00,0xd4,0xd4,0xd4,0x00,0xd5,0xd5,0xd5,0x00,0xd6,0xd6,0xd6,0x00,0xd7,0xd7,0xd7,0x00,0xd8,0xd8,0xd8,0x00,0xd9,0xd9,0xd9,0x00,0xda,0xda,0xda,0x00,0xdb,0xdb,0xdb,0x00,0xdc,0xdc,0xdc,0x00,0xdd,0xdd,0xdd,0x00,0xde,0xde,0xde,0x00,0xdf,0xdf,0xdf,0x00,0xe0,0xe0,0xe0,0x00,0xe1,0xe1,0xe1,0x00,0xe2,0xe2,0xe2,0x00,0xe3,0xe3,0xe3,0x00,0xe4,0xe4,0xe4,0x00,0xe5,0xe5,0xe5,0x00,0xe6,0xe6,0xe6,0x00,0xe7,0xe7,0xe7,0x00,0xe8,0xe8,0xe8,0x00,0xe9,0xe9,0xe9,0x00,0xea,0xea,0xea,0x00,0xeb,0xeb,0xeb,0x00,0xec,0xec,0xec,0x00,0xed,0xed,0xed,0x00,0xee,0xee,0xee,0x00,0xef,0xef,0xef,0x00,0xf0,0xf0,0xf0,0x00,0xf1,0xf1,0xf1,0x00,0xf2,0xf2,0xf2,0x00,0xf3,0xf3,0xf3,0x00,0xf4,0xf4,0xf4,0x00,0xf5,0xf5,0xf5,0x00,0xf6,0xf6,0xf6,0x00,0xf7,0xf7,0xf7,0x00,0xf8,0xf8,0xf8,0x00,0xf9,0xf9,0xf9,0x00,0xfa,0xfa,0xfa,0x00,0xfb,0xfb,0xfb,0x00,0xfc,0xfc,0xfc,0x00,0xfd,0xfd,0xfd,0x00,0xfe,0xfe,0xfe,0x00,0xff,0xff,0xff,0x00])

assert len(BMP) == 0x436

with open("part_1_in.bin", "rb") as in_file:
    input = in_file.read()

assert len(input) == 256 * 256

output = bytearray(256 * 256)
bdm = 256
with open("layer_2_in.bmp", "wb") as f:
    for i in tqdm.tqdm(range(256 * 256)):
        tid = i % 256
        bid = i // 256
        output[INV_SBOX[tid] * bdm + INV_SBOX[bid]] = input[bid * bdm + tid] # Swap and apply INV_SBOX

    f.write(BMP)
    f.write(output)

Extract the convolutional kernel for motion blur:

# format_IDA_data.py
import re
import struct

def parse_rodata_floats(data_string):
    """
    Parses a string containing .rodata definitions and extracts float values.

    Args:
        data_string: A multiline string containing the .rodata dump.

    Returns:
        A list of floats extracted from the data.
    """
    all_floats = []
    lines = data_string.strip().split('\n')

    for line_number, line in enumerate(lines, 1):
        # Look for lines containing 'dd ' which signifies data definition
        if 'dd ' not in line:
            continue

        try:
            # Split by 'dd ' and take the second part
            data_part = line.split(' dd ', 1)[1]
            
            # Remove comments if any (stuff after ';')
            if ';' in data_part:
                data_part = data_part.split(';', 1)[0]

            potential_floats = data_part.split(',')
            for val_str in potential_floats:
                cleaned_val_str = val_str.strip()
                if cleaned_val_str: 
                    try:
                        all_floats.append(float(cleaned_val_str))
                    except ValueError:
                        print(f"Warning (line {line_number}): Could not convert '{cleaned_val_str}' to float from: \"{line.strip()}\"")
        except IndexError:
            print(f"Warning (line {line_number}): Malformed line or unexpected structure after 'dd ': \"{line.strip()}\"")
            continue
            
    return all_floats

def save_floats_to_file(floats_list, output_filename):
    """
    Saves a list of floats to a text file, one float per line.

    Args:
        floats_list: A list of float numbers.
        output_filename: The name of the file to save the floats to.

    Returns:
        True if saving was successful, False otherwise.
    """
    write_buf = []
    with open(output_filename, 'w') as f:
        for item in floats_list:
            write_buf.append(str(item))
        f.write(', '.join(write_buf))
    print(f"Successfully saved {len(floats_list)} numbers to '{output_filename}'")
    return True

# The data provided by the user
rodata_input = """
.rodata:0000000000483020 _ZL6motion      dd 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.012483786, 0.042622309
...
.rodata:00000000004833E0                 dd 0.0, 0.0055596731, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0, 0.0
"""

if __name__ == "__main__":
    # Parse the data
    print("Parsing rodata input...")
    extracted_floats = parse_rodata_floats(rodata_input)
    
    if extracted_floats:
        print(f"Successfully parsed {len(extracted_floats)} numbers.")
        
        # Define the output filename
        output_file = "extracted_data.txt"
        
        # Save the floats to the text file
        save_floats_to_file(extracted_floats, output_file)
    else:
        print("No floats were extracted from the input.")

Using Wiener algorithm to deconvolute:

import numpy as np
import matplotlib.pyplot as plt
from skimage import io, restoration

# Load and reshape PSF to 16x16
psf = np.array([ ... ])

kernel = psf.reshape(16, 16)

assert(len(psf) == 256)

print(psf.sum())

psf = psf.reshape((16, 16))

# Load image as grayscale
image = io.imread('layer_2_in.bmp', as_gray=True)[15:255, 0:240]
print(len(image))

# Perform deconvolution
deconvolved = restoration.wiener(
    image=image,
    psf=psf,
    balance = 0.00001,
    clip=False
)
# Visualization (unchanged)
fig, ax = plt.subplots(1, 2, figsize=(12, 6))
ax[0].imshow(image, cmap='gray')
ax[0].set_title('Blurred Input')
ax[1].imshow(deconvolved, cmap='gray')
ax[1].set_title('Deconvolved Result')
plt.show()

ACTF{DeEptCUdAR1VQUZ}

unstoppable

Explore my previous post for detailed analysis.

Re VM challenges collection

Sat, 10 May 2025 00:00:00 GMT

Foreword

After tackling ~~some~~ virtual machine reverse engineering challenges (ACTF - miniLCTF), it’s time to write a rundown of my approaches in this post.

[NCTF 2024] gogo

A Turing-complete Virtual Machine (VM) implementing a TEA algorithm, which is closer to a Finite State Machine after regarding STRI and LDRI as input.

Instruction	Operands	Operand 1 (Byte `a10`)	Operand 2 (Byte `a11`)	Operand 3 (Byte `a12`)
ADD/SUB/MUL/XOR/AND	3	Rd (reg index)	Rn (reg index)	Rm (reg index)
LSL/LSR	3	Rd (reg index)	Rn (value reg)	Rm (shift amt reg)
MOV	2	Rd (reg index)	Immediate val (WORD little endian)
STRI/LDRI	2	Rd (reg index)	Must be `0x00`	Immediate val (addr)
LDR/STR	2	Rd (reg index)	Rn (addr)	Must be `0x00`

; --- VM1 Disassembly from DumpedByteCodes.bin ---
; Offset           Bytes        Instruction
0x00000000:  2A 00 37 9E  MOV   R0, #0x9e37
0x00000004:  2A 01 B9 79  MOV   R1, #0x79b9
0x0000000C:  2A 02 10 00  MOV   R2, #0x0010
0x00000010:  71 03 00 02  LSL   R3, R0, R2
0x0000001C:  41 01 01 03  ADD   R1, R1, R3
0x00000020:  16 01 00 1C  STRI  R1, [#0x1c] ; 0x9e3779b9
0x00000024:  2A 00 00 00  MOV   R0, #0x0000
0x00000034:  16 00 00 18  STRI  R0, [#0x18]
0x00000040:  2A 0E 00 00  MOV   R14, #0x0000
0x00000044:  12 02 00 04  LDRI  R2, [#0x04] ; y
0x0000004C:  12 03 00 10  LDRI  R3, [#0x10] ; z
0x00000050:  2A 00 02 00  MOV   R0, #0x0002
0x00000060:  2A 0F 05 00  MOV   R15, #0x0005
0x00000064:  71 04 02 00  LSL   R4, R2, R0  ; y << 2
0x0000006C:  73 05 03 0F  LSR   R5, R3, R15 ; z >> 5
0x00000070:  7A 06 04 05  XOR   R6, R4, R5  ; (z >> 5) ^ (y << 2)
0x00000080:  2A 00 03 00  MOV   R0, #0x0003
0x00000084:  2A 0F 04 00  MOV   R15, #0x0004
0x00000088:  73 04 02 00  LSR   R4, R2, R0  ; y >> 3
0x00000098:  71 05 03 0F  LSL   R5, R3, R15 ; z << 4
0x0000009C:  7A 07 04 05  XOR   R7, R4, R5  ; (y >> 3) ^ (z << 4)
0x000000A0:  41 08 06 07  ADD   R8, R6, R7  ; ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4))
0x000000A8:  2A 04 8C A7  MOV   R4, #0xa78c
0x000000AC:  2A 05 4F 0B  MOV   R5, #0x0b4f
0x000000BC:  2A 0F 10 00  MOV   R15, #0x0010
0x000000C4:  71 06 04 0F  LSL   R6, R4, R15
0x000000C8:  41 05 05 06  ADD   R5, R5, R6
0x000000CC:  16 05 00 28  STRI  R5, [#0x28] ; 0xa78c0b4f
0x000000D8:  2A 0F 02 00  MOV   R15, #0x0002
0x000000DC:  73 09 01 0F  LSR   R9, R1, R15 ; sum >> 2
0x000000E8:  7B 0D 09 00  AND   R13, R9, R0 ; (sum >> 2) & 3
0x000000EC:  7A 04 0D 0E  XOR   R4, R13, R14; p ^ ( (sum >> 2) & 3 )
0x000000F4:  7B 04 04 00  AND   R4, R4, R0  ; p ^ ( (sum >> 2) & 3 ) & 3
0x00000100:  2A 0C 04 00  MOV   R12, #0x0004
0x00000104:  47 04 04 0C  MUL   R4, R4, R12 ; idx * 4
0x00000108:  2A 0F 20 00  MOV   R15, #0x0020
0x00000110:  41 0A 04 0F  ADD   R10, R4, R15; (idx * 4) + 0x20
0x0000011C:  11 04 0A 00  LDR   R4, [R10]   ; key[p ^ ( (sum >> 2) & 3 ) & 3]
0x00000120:  7A 06 01 02  XOR   R6, R1, R2  ; sum ^ y
0x00000128:  7A 07 03 04  XOR   R7, R3, R4  ; z ^ key[p]
0x0000012C:  41 09 06 07  ADD   R9, R6, R7  ; (sum ^ y) + (z ^ key[p ^ e & 3])
0x0000013C:  7A 0A 08 09  XOR   R10, R8, R9 ; ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z))
0x00000144:  2A 04 63 6E  MOV   R4, #0x6e63
0x00000148:  2A 05 66 74  MOV   R5, #0x7466
0x0000014C:  2A 0F 10 00  MOV   R15, #0x0010
0x0000015C:  71 06 04 0F  LSL   R6, R4, R15
0x00000164:  41 05 05 06  ADD   R5, R5, R6
0x00000168:  16 05 00 20  STRI  R5, [#0x20] ; 0x6e637466
0x00000170:  12 0B 00 00  LDRI  R11, [#0x00]
0x00000180:  41 0C 0A 0B  ADD   R12, R10, R11
0x00000188:  16 0C 00 00  STRI  R12, [#0x00]
0x00000198:  2A 00 01 00  MOV   R0, #0x0001
0x0000019C:  41 0E 0E 00  ADD   R14, R14, R0
0x000001AC:  2A 04 2E 06  MOV   R4, #0x062e
0x000001B0:  2A 05 ED F0  MOV   R5, #0xf0ed
0x000001B8:  2A 0F 10 00  MOV   R15, #0x0010
0x000001C4:  71 06 04 0F  LSL   R6, R4, R15
0x000001C8:  41 05 05 06  ADD   R5, R5, R6
0x000001D8:  16 05 00 24  STRI  R5, [#0x24] ; 0x062ef0ed
0x000001DC:  12 02 00 08  LDRI  R2, [#0x08] ; y
0x000001E0:  12 03 00 00  LDRI  R3, [#0x00] ; z
0x000001F0:  2A 00 02 00  MOV   R0, #0x0002 ;
0x000001F4:  2A 0F 05 00  MOV   R15, #0x0005;
0x000001F8:  71 04 02 00  LSL   R4, R2, R0  ; << 2
0x00000208:  73 05 03 0F  LSR   R5, R3, R15 ; >> 5
0x00000218:  7A 06 04 05  XOR   R6, R4, R5
0x0000021C:  2A 00 03 00  MOV   R0, #0x0003 ;
0x00000220:  2A 0F 04 00  MOV   R15, #0x0004;
0x0000022C:  73 04 02 00  LSR   R4, R2, R0
0x00000230:  71 05 03 0F  LSL   R5, R3, R15
0x00000234:  7A 07 04 05  XOR   R7, R4, R5
0x00000244:  41 08 06 07  ADD   R8, R6, R7
0x00000248:  2A 04 30 32  MOV   R4, #0x3230
0x00000250:  2A 05 34 32  MOV   R5, #0x3234
0x00000254:  2A 0F 10 00  MOV   R15, #0x0010
0x00000258:  71 06 04 0F  LSL   R6, R4, R15
0x00000264:  41 05 05 06  ADD   R5, R5, R6
0x00000268:  16 05 00 2C  STRI  R5, [#0x2c] ; 0x32303234
.  .  .

[NCTF 2023] ezVM

This VM also implements a Turing-complete VM. Yet, its behavior is closer to a pushdown automaton (PDA = FSM + STACK) which can leak side channel info due to single-byte verification.

Acquire Side-channel Info

Using following script to count how many times the target instruction is executed.

# -*- coding: utf-8 -*-
import idaapi
import idc
import ida_kernwin
import ida_dbg

# --- Global Variables ---
# Stores the count for the single address being tracked during the CURRENT run
execution_counts = {}
# Stores the history of counts from PREVIOUS runs for the tracked address
run_history = {}
# Stores the address we are currently tracking
g_target_ea = idaapi.BADADDR
# Stores the instance of our debugger hook
g_debugger_hook = None

# --- Debugger Hook Class ---
class ExecutionCounterHook(ida_dbg.DBG_Hooks):
    """
    Debugger hook to detect process termination, record counts, and reset for the next run.
    """
    def dbg_process_exit(self, pid, tid, ea, code):
        """
        Called when the debugged process terminates.
        Records the count for the finished run and resets the counter.
        """
        print(f"[Debug Event] Process exited (PID: {pid}, Code: {code})")
        self._record_and_reset_count()
        return 0 # Important: Hooks should generally return 0

    def _record_and_reset_count(self):
        """
        Helper to record the count for the completed run, print history,
        and reset the counter for the next run.
        """
        global execution_counts, run_history, g_target_ea

        if g_target_ea != idaapi.BADADDR:
            current_count = execution_counts.get(g_target_ea, 0)

            # Record the count for this run in history
            history_list = run_history.setdefault(g_target_ea, [])
            history_list.append(current_count)

            print(f"--- Execution Count Report ({g_target_ea:#x}) ---")
            print(f"  Current Run: {current_count} times")
            print(f"  History: {history_list}")
            print(f"-----------------------------")

            # Reset count ONLY for the next run
            execution_counts[g_target_ea] = 0
            print(f"[INFO] Count for address {g_target_ea:#x} has been reset to 0, ready for the next run.")

        else:
            print("[INFO] No valid address is currently being tracked.")

# --- Core Functions ---
def set_counting_bpt(ea):
    """
    Sets a trace breakpoint at the specified address 'ea' to count
    the number of times this instruction is executed.
    The breakpoint will not suspend the program; it only executes the counting code.

    Args:
        ea (int): The effective address (EA) of the target instruction.

    Returns:
        bool: True if setting the breakpoint was successful, False otherwise.
    """
    global execution_counts

    # 1. Check if the address is valid
    if not idaapi.is_mapped(ea):
        print(f"[ERROR] Address {ea:#x} is invalid or not mapped.")
        return False

    # 2. Prepare Python condition code (return 0 to solve SWIG issues)
    #    Use f-string to embed the address, ensuring dictionary key is an integer
    python_condition = f"""
global execution_counts
addr = {ea}
execution_counts[addr] = execution_counts.get(addr, 0) + 1
# print(f"Hit count at {{addr:#x}}: {{execution_counts[addr]}}") # Uncomment for debugging
return 0
"""
    # Clean up newlines and indentation
    python_condition = "\n".join([line.strip() for line in python_condition.strip().splitlines()])

    # 3. Add or get breakpoint
    bpt = idaapi.bpt_t()
    # First, try to delete an old breakpoint at the same address (if any) to avoid configuration conflicts
    idaapi.del_bpt(ea)
    if not idaapi.add_bpt(ea, 0, idaapi.BPT_SOFT):
        print(f"[ERROR] Failed to add breakpoint at address {ea:#x}.")
        return False
    else:
        # Must re-fetch breakpoint info to modify it
        if not idaapi.get_bpt(ea, bpt):
            print(f"[ERROR] Failed to get breakpoint info at address {ea:#x} after adding it.")
            # Clean up failed breakpoint addition
            idaapi.del_bpt(ea)
            return False

    # 4. Configure breakpoint properties
    bpt.elang = 'Python'
    bpt.condition = python_condition
    bpt.flags |= idaapi.BPT_ENABLED
    bpt.flags &= ~idaapi.BPT_BRK   # Crucial: Do not suspend
    bpt.flags |= idaapi.BPT_TRACE  # Explicitly marking as trace breakpoint might help in some IDA versions

    # 5. Update breakpoint
    if not idaapi.update_bpt(bpt):
        print(f"[ERROR] Failed to update breakpoint at address {ea:#x}.")
        # Clean up failed breakpoint update
        idaapi.del_bpt(ea)
        return False

    # 6. Initialize count for the current run
    execution_counts[ea] = 0

    print(f"[SUCCESS] Execution counting tracepoint set at address {ea:#x}.")
    return True

def reset_all():
    """
    Complete reset: clears counts, history, removes breakpoints, and unhooks the debugger hook.
    """
    global execution_counts, run_history, g_target_ea, g_debugger_hook

    print("[ACTION] Performing a full reset...")

    # Remove breakpoint
    if g_target_ea != idaapi.BADADDR:
        print(f"  - Removing breakpoint at address {g_target_ea:#x}...")
        if idaapi.del_bpt(g_target_ea):
            print(f"  - Breakpoint removed.")
        else:
            print(f"[WARNING] Failed to remove breakpoint at address {g_target_ea:#x} (it might have been manually removed).")
    else:
        print("  - No breakpoint to remove (target address not set).")

    # Clear counts and history
    execution_counts.clear()
    run_history.clear()
    print(f"  - Execution counts and history cleared.")

    # Unhook and clear hook instance
    if g_debugger_hook:
        print("  - Unhooking debugger hook...")
        try:
            g_debugger_hook.unhook()
            print("  - Debugger hook unhooked.")
        except Exception as e:
            print(f"[ERROR] Error unhooking debugger hook: {e}")
        finally:
            g_debugger_hook = None # Clear reference
    else:
        print("  - No hook to unhook (not active).")

    # Reset target address
    g_target_ea = idaapi.BADADDR
    print("[DONE] All tracking states have been reset.")

# --- Main Execution Logic ---
def run_execution_counter_script():
    """
    Main function: gets an address, sets up the breakpoint and hook (if not already set).
    """
    global g_target_ea, g_debugger_hook, execution_counts, run_history

    # 0. Check if an address is already being tracked
    if g_target_ea != idaapi.BADADDR:
        print(f"[INFO] Currently tracking address {g_target_ea:#x}.")
        print(f"  - Current run count: {execution_counts.get(g_target_ea, 0)}")
        print(f"  - History: {run_history.get(g_target_ea, [])}")
        choice = ida_kernwin.ask_yn(1, f"Currently tracking {g_target_ea:#x}.\nDo you want to fully reset and choose a new address?\n(Select 'No' to continue tracking the current address)")
        if choice == 1: # Yes
            reset_all() # Full reset
        else:
            print("[Action Canceled] Continuing to track the current address. To stop, call reset_all().")
            return

    # --- If execution reaches here, there's no active tracking or user chose to reset ---

    # 1. Pop up window to request address
    prompt_msg = "Please enter the instruction address to count executions for (e.g., 0x401000):"
    default_addr = idc.here() # Default to current cursor address
    input_ea = ida_kernwin.ask_addr(default_addr, prompt_msg)

    # 2. Validate user input
    if input_ea is None or input_ea == idaapi.BADADDR:
        print("[INFO] User canceled or did not enter a valid address. Script terminated.")
        return

    if not idaapi.is_mapped(input_ea):
        print(f"[ERROR] The entered address {input_ea:#x} is invalid or not mapped. Script terminated.")
        return

    # Record the new target address
    g_target_ea = input_ea
    print(f"[INFO] New target address set to: {g_target_ea:#x}")

    # Clear any existing old counts and history for this address (just in case)
    execution_counts.pop(g_target_ea, None)
    run_history.pop(g_target_ea, None)
    # Initialize count and history containers for the new address
    execution_counts[g_target_ea] = 0
    run_history[g_target_ea] = []

    # 3. Set counting breakpoint
    if not set_counting_bpt(g_target_ea):
        print("[ERROR] Failed to set breakpoint. Script terminated.")
        g_target_ea = idaapi.BADADDR # Reset target address
        return

    # 4. Create and register debugger hook (only on first setup)
    if g_debugger_hook is None:
        try:
            print("[ACTION] Registering debugger hook to listen for process exit...")
            g_debugger_hook = ExecutionCounterHook()
            g_debugger_hook.hook()
            print("[SUCCESS] Debugger hook registered successfully.")
        except Exception as e:
            print(f"[ERROR] Failed to register debugger hook: {e}")
            # Attempt to clean up breakpoint
            idaapi.del_bpt(g_target_ea)
            g_target_ea = idaapi.BADADDR
            execution_counts.clear()
            run_history.clear()
            g_debugger_hook = None
            return
    else:
        print("[INFO] Debugger hook is already active.")

    print("-" * 40)
    print(f"Script setup complete. Tracking address {g_target_ea:#x}.")
    print("Please start the debugger (F9) and run the target program.")
    print("After the program finishes normally, the execution count for this address will be automatically printed and recorded.")
    print("You can run the program multiple times to accumulate history.")
    print("Use the reset_all() function to completely stop and clear all data.")
    print("-" * 40)

# --- Script Entry Point ---
if __name__ == "__main__":
    # Note: reset_all() is not called here anymore to preserve state when reloading the script.
    # If a completely clean start is needed, call reset_all() manually from the IDA Python command line.
    # reset_all() # Uncomment to force reset every time the script runs

    # Run main logic
    run_execution_counter_script()

# --- Helper Functions (can be called from IDA Python command line) ---
# reset_all()  # For manual full reset

Set a breakpoint using the script above:

Sample inputs:
input1: "aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
input2: "faaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
input3: "flaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa"
Execution counts:
[147, 208, 326]

Obviously, single-byte verification with flag structure: flag{ ... }.

The script below (Python + Frida) implements side-channel brute-force:

# PyScript.py
# -*- coding: UTF-8 -*-
import subprocess
import frida
import sys
import os # Added for checking hook file existence

# --- Configuration Constants ---
TARGET_EXE = "ezVm.exe"
HOOK_SCRIPT_FILE = "hook.js"
# Flag length including "flag{" and "}"
# Original script uses range(len(flag), 44) and ljust(43,"A")+"}"
# This implies total length is 44, content length is 44-len("flag{}") = 38
# Padding length is 43 (index 0 to 42)
FLAG_TOTAL_LENGTH = 44
FLAG_CONTENT_PAD_LENGTH = 43 # Length used for ljust padding
FLAG_KNOWN_PREFIX = "flag{O1SC_VM"
PADDING_CHAR = "a"
# Character set for bruteforce, starting with '`' for calibration
PRINTABLE_CHARS = r"`!\"#$%&'()*+,-./:;<=>?@[]^_{|}~0123456789abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ"
# Initial comparison value (last value assigned in original script)
INITIAL_NUMBER = 103833

# --- Global State for Frida Interaction ---
# 'number' stores the score of the best known prefix
# 'new_number' stores the score of the current attempt
number = INITIAL_NUMBER
new_number = 0

# --- Frida Callback Function ---
def on_message(message, data):
    """Callback function to handle messages from the Frida script."""
    global new_number
    if message['type'] == 'send':
        payload = message['payload']
        # print(f"[*] Frida Message Payload: {payload}", type(payload)) # Optional: more detailed debug
        try:
            # Assume payload is the number we need for comparison
            new_number = int(payload)
        except (ValueError, TypeError) as e:
            print(f"[!] Error parsing Frida payload: {payload} - {e}")
            # Decide how to handle parse errors, maybe reset new_number?
            new_number = -1 # Or some other indicator of failure
    elif message['type'] == 'error':
        print(f"[!] Frida Error: {message.get('description', 'No description')}")
        print(f"    Stack: {message.get('stack', 'No stack trace')}")
        print(f"    Details: File {message.get('fileName', 'N/A')}, Line {message.get('lineNumber', 'N/A')}, Col {message.get('columnNumber', 'N/A')}")
    else:
        print(f"[*] Frida Message: {message}")

# --- Helper Function ---
def is_right():
    """Compares the current attempt's score with the best known score."""
    global new_number, number
    if new_number > number:
        # print(f"[*] New best score found: {new_number} > {number}") # Optional debug
        number = new_number
        return True
    else:
        # print(f"[*] Score {new_number} is not better than {number}") # Optional debug
        return False

# --- Main Execution Logic ---
def main():
    global number, new_number # Allow modification of globals

    # Check if hook script exists
    if not os.path.exists(HOOK_SCRIPT_FILE):
        print(f"[!] Error: Hook script '{HOOK_SCRIPT_FILE}' not found.")
        sys.exit(1)

    # Load Frida JScode
    try:
        with open(HOOK_SCRIPT_FILE, "r", encoding="utf-8") as f:
            jscode = f.read()
    except Exception as e:
        print(f"[!] Error reading hook script '{HOOK_SCRIPT_FILE}': {e}")
        sys.exit(1)

    flag = FLAG_KNOWN_PREFIX
    print(f"[*] Starting bruteforce for flag (expected length: {FLAG_TOTAL_LENGTH})")
    print(f"[*] Initial known prefix: '{flag}'")

    # Bruteforce loop for characters from current length up to target content length
    # Example: if flag="flag{", len=5. Loop from 5 up to 43 (exclusive)
    # because the 44th char (index 43) is always "}"
    for index in range(len(flag), FLAG_TOTAL_LENGTH - 1):
        found_char_for_index = False
        print(f"\n[*] Trying index: {index}")

        # Iterate through possible characters for the current position
        for char_to_try in PRINTABLE_CHARS:
            # Reset new_number for each attempt
            new_number = 0

            # Construct the test flag: current_flag + guess + padding + "}"
            tmp_flag = (flag + char_to_try).ljust(FLAG_CONTENT_PAD_LENGTH, PADDING_CHAR) + "}"
            print(f"    Trying char: '{char_to_try}' -> Input: \"{tmp_flag}\"")

            process = None
            session = None
            try:
                # Start the target process for each guess
                process = subprocess.Popen(
                    [TARGET_EXE], # Pass exe name as a list for robustness
                    stdin=subprocess.PIPE,
                    stdout=subprocess.PIPE,
                    stderr=subprocess.PIPE,
                    universal_newlines=True # Use text mode for stdin/stdout/stderr
                )

                # Attach Frida to the newly started process
                # Add a small delay or retry logic if attachment fails immediately
                try:
                    session = frida.attach(process.pid)
                except frida.ProcessNotFoundError:
                    print(f"[!] Error: Could not find process {process.pid} immediately. Maybe it exited too quickly?")
                    # Clean up the zombie process if Popen succeeded but attach failed
                    if process and process.poll() is None:
                         process.terminate()
                         process.wait() # Ensure termination
                    continue # Skip to the next character
                except Exception as e:
                    print(f"[!] Error attaching Frida to PID {process.pid}: {e}")
                    if process and process.poll() is None:
                         process.terminate()
                         process.wait()
                    continue # Skip to the next character

                # Create and load the Frida script
                script = session.create_script(jscode)
                script.on('message', on_message)
                script.load()

                # Send the crafted input flag to the process
                # process.communicate handles writing, closing stdin, and waiting
                output, error = process.communicate(input=tmp_flag)

                # Script execution continues after communicate() finishes (process exits)

                # --- Decision Logic ---
                # Calibrate 'number' using the '`' character score on the first attempt for this index
                if char_to_try == PRINTABLE_CHARS[0]: # Check if it's the calibration char ('`')
                    print(f"    Calibration with '{char_to_try}': Setting base score to {new_number}")
                    number = new_number # Set the baseline score for this index

                # Check if the current character yielded a better score
                elif is_right():
                    flag += char_to_try
                    print(f"\n[+] Correct character found: '{char_to_try}'")
                    print(f"[+] Current Flag: {flag}\n")
                    found_char_for_index = True
                    # Detach Frida session cleanly (optional but good practice)
                    session.detach()
                    break # Move to the next index

                # Detach Frida session if it was successfully attached
                session.detach()

            except frida.InvalidOperationError as e:
                print(f"[!] Frida Error (e.g., process terminated before detach): {e}")
            except Exception as e:
                print(f"[!] An unexpected error occurred: {e}")
                # Ensure process is terminated if it's still running
                if process and process.poll() is None:
                    try:
                        process.terminate()
                        process.wait(timeout=1) # Wait briefly
                    except subprocess.TimeoutExpired:
                        process.kill() # Force kill if terminate fails
                    except Exception as term_err:
                        print(f"[!] Error during process cleanup: {term_err}")
                # Ensure session is detached if it exists
                if session:
                    try:
                        session.detach()
                    except Exception as detach_err:
                        print(f"[!] Error during session detach cleanup: {detach_err}")

            finally:
                 # Ensure the process is terminated, even if errors occurred
                 # Note: communicate() already waits for termination.
                 # terminate() here is mostly a safeguard.
                if process and process.poll() is None: # Check if still running
                    # print(f"    Terminating process {process.pid}...") # Optional debug
                    process.terminate()
                    try:
                        process.wait(timeout=1) # Wait briefly for termination
                    except subprocess.TimeoutExpired:
                        print(f"    Process {process.pid} did not terminate gracefully, killing.")
                        process.kill() # Force kill if necessary
                # else:
                    # print(f"    Process {process.pid} already terminated.") # Optional debug

        # If no character was found for the current index after trying all possibilities
        if not found_char_for_index:
            print(f"\n[!] Could not find correct character for index {index}.")
            print(f"[!] Exiting. Current flag guess: {flag}")
            sys.exit(1) # Exit if stuck

    # Final flag includes the closing brace (already added in tmp_flag construction)
    # We just need to ensure the loop completed successfully.
    final_flag = flag + "}" # Add the final brace if loop completed
    if len(final_flag) == FLAG_TOTAL_LENGTH:
        print("\n" + "="*20)
        print(f"[+] Bruteforce Complete!")
        print(f"[+] Final Flag: {final_flag}")
        print("="*20)
    else:
         print("\n[!] Bruteforce finished, but flag length is incorrect.")
         print(f"[!] Result: {final_flag} (Length: {len(final_flag)}, Expected: {FLAG_TOTAL_LENGTH})")

if __name__ == "__main__":
    main()

// hook.js
var number = 0
function main()
{
    var base =  Module.findBaseAddress("ezVM.exe")
    //console.log("inject success!!!")
    //console.log("base:",base)
    if(base){
        Interceptor.attach(base.add(0x1044), {
                onEnter: function(args) {
                   //console.log("number",number)
                    number+=1
                }
            });

            Interceptor.attach(base.add(0x0113f), {
                onEnter: function(args) {
                    // console.log("end!",number)
                    send(number)
                }

            });
    }
}
setImmediate(main);

The last verification does not leak side-channel info, so brute-force the last character to retrieve the flag.

import subprocess

base_flag = 'flag{O1SC_VM_1s_h4rd_to_r3v3rs3_#a78abffaa }'
executable = "ezVm.exe"

for i in range(32, 128):
    char = chr(i)
    test_flag = base_flag.replace(" ", char)

    process = subprocess.Popen(
        [executable],
        stdin=subprocess.PIPE,
        stdout=subprocess.PIPE,
        stderr=subprocess.PIPE,
        text=True
    )

    # Send inputs to receive outputs / errors; communicate will wait the process to complete
    output, error = process.communicate(input=test_flag)

    if "Invalid" not in output:
        print(f"Found potential flag: {test_flag}")
        print(f"Output: {output.strip()}")
        if error:
            print(f"Stderr: {error.strip()}")
        break

flag{O1SC_VM_1s_h4rd_to_r3v3rs3_#a78abffaa#}

Note

One Instruction Set Computer: One instruction, multi operations.

[miniL 2025] rbf

Reversing Brainfuck, two method:

Symbolic execution
Dump runtime memory and analyze

[ACTF 2025] unstoppable

This challenge implements a busy beaver problem, aiming to find all stoppable Turing machines.

In theoretical computer science, the busy beaver game aims to find a terminating program of a given size that (depending on definition) either produces the most output possible, or runs for the longest number of steps. Since an endlessly looping program producing infinite output or running for infinite time is easily conceived, such programs are excluded from the game. Rather than traditional programming languages, the programs used in the game are n-state Turing machines, one of the first mathematical models of computation.

The program takes 2703 integers as input. We must find all (2703) stoppable VMs.

Thus, it’s a crackme challenge that requires the user to input the correct sequence of numbers to retrieve the flag.

Key takeaways of main():

  while ( check_if_deref_not_equal(&VM.VM_number, &VM.max_VM) )
  {
    VM.VM_number_0 = take_offset_32_ret_ptr(&VM.VM_number);
    write_data_func(&VM, &bunch_of_bytes + 30 * *VM.VM_number_0);
    execution_count = VM_exec_loop(&VM);// The correct VM will be stoppable
    x = seed;
    base = offset_8x_plus_deref(base_addr, *VM.VM_number_0);// base_addr + offset * 8
    y = do_some_math(&unk_3DBC9, *base, execution_count);// _, base, exp
    seed = multi_mod(&unk_3DBC8, x, y);
    delete_VM(&VM);
    apply_Rb_tree_increment(&VM.VM_number);
  }
  check("Congratulations!", 0x18uLL, seed, output);

Reverse engineering VM_exec_loop():

uint64_t __fastcall VM_exec_loop(VMContext *VM_1)
{
  do
  {
    ++VM->instr_counter;
    if ( *add_two_args(&VM->tape_base_ptr, VM->read_write_head) != 0 )
    {
      ptr_1 = cal_op_offset(VM, LOBYTE(VM->IP)) + 3;// ptr_1 = code_base + 6*IP +3
      ptr_final = ptr_1;
    }
    else
    {
      ptr_2 = cal_op_offset(VM, LOBYTE(VM->IP));// ptr_2 = code_base + 6*IP
      ptr_final = ptr_2;
    }
    LO_WORD = *ptr_final;
    HI_BYTE = *(ptr_final + 2);
    LO_CHAR_1 = LO_WORD;
    *add_two_args(&VM->tape_base_ptr, VM->read_write_head) = LO_CHAR_1;// Write to tape
    if ( HIBYTE(LO_WORD) )                      // Determine which direction to move
    {
      offset = VM->read_write_head;
      if ( offset == get_data_buffer_size(&VM->tape_base_ptr) - 1 )
      {
        num = 0;
        expand_data(&VM->tape_base_ptr, &num);
      }
      ++VM->read_write_head;
    }
    else
    {
      if ( VM->read_write_head == 0 )
      {
        p_tape_base_ptr = &VM->tape_base_ptr;
        data_base_ptr = direct_ret(&VM->tape_base_ptr);
        direct_assign(&data_base_ptr_1, &data_base_ptr);
        num_1 = 0;
        alloc_and_insert_bytecode(p_tape_base_ptr, data_base_ptr_1, &num_1);
        ++VM->read_write_head;
      }
      --VM->read_write_head;
    }
    LOBYTE(VM->IP) = HI_BYTE;
  }
  while ( LOBYTE(VM->IP) != 0x19 );             // halt condition
  return VM->instr_counter;
}

Brief analysis of the logic:

After reversing the VM_exec_loop(), we can dump the bytecode (bunch_of_bytes) and write a script to brute-force all 5005 numbers of Turing machines, identifying stoppable machines (where execution_count <= 47176870)

// brute-force.cpp
#include <cstdio>
#include <vector>
#include <cstdint>
#include <omp.h>
#include "op.hpp" // VMs dumped -> uint8_t program[5005][30]

#define DEBUG
#undef DEBUG

#ifdef DEBUG
#include <cassert>
#endif

using namespace std;

int main()
{
    int ALLN = 5005;
    setvbuf(stdout, nullptr, _IONBF, 0);
#pragma omp parallel for schedule(static)
    for (int i = 0; i < ALLN; i++)
    {
        vector<uint8_t> tape(1024, 0);
        uint64_t read_write_header = 511;
        uint64_t now_count = 0;
        uint8_t IP = 0;

        while (now_count < 47176870)
        {
            now_count++;
            /*

            Different from the official writeup, but baed on my analysis, only this method can output exact 2703 stoppable VMs

            $ wc -w stoppable_VMs_official.txt
            3140 stoppable_VMs.txt

            $ wc -w stoppable_VMs_new.txt
            2703 stoppable_VMs_new.txt

            */
            uint8_t *operation = program[i] + 6 * IP  + 3 * (tape[read_write_header] != 0 ? 1 : 0);

            #ifdef DEBUG
            assert(6 * IP  + 3 * (tape[read_write_header] != 0 ? 1 : 0) < 30);
            #endif

            tape[read_write_header] = operation[0];
            if (operation[1])
            {
                read_write_header++;
                if (read_write_header == tape.size())
                {
                    tape.insert(tape.end(), tape.size(), 0);
                }
            }
            else
            {
                if (read_write_header == 0)
                {
                    read_write_header += tape.size();
                    tape.insert(tape.begin(), tape.size(), 0);
                }
                read_write_header--;
            }
            IP = operation[2];
            #ifdef DEBUG
            assert(IP < 5);
            #endif

            if (IP == 0x19)
            {
                printf("%d ", i);
                break;
            }
        }
    }
    return 0;
}

// Usage: g++ brute-force.cpp -o brute-force.exe -fopenmp

Finally, sort all VM numbers in ascending order to ensure the correct output:

with open('stoppable_VMs_new.txt', 'r') as file:
    numbers = []
    for line in file:
        # Split each line into individual numbers and convert to integers
        numbers.extend(int(num) for num in line.strip().split())
    # print(len(numbers))

numbers.sort() # ascending order

# Write the sorted numbers back to the file (one per line)
with open('stoppable_VMs_new.txt', 'w') as file:
    for number in numbers:
        file.write(f"{number} ")

$ cat stoppable_VMs_new.txt | ./unstoppable
ACTF{21568fc0e443ad5e5f80c51f83323250}

NCTF 2025

Fri, 04 Apr 2025 00:00:00 GMT

Note

For official writeup, here.

gogo

Input 40 bytes and create two coroutine (coroutVM), processing 20Bytes respectively

What we need: hash table & bytecodes

struct main_coroutVM // sizeof=0x158
{
    _16_uint32 reg;
    _256_uint8 mem;
    _chan_left_chan__4_uint8 instr;
    chan_bool checkres;
    map_uint8_main_handler instrSet;
};

Method 1 - Static Analysis

Find bytecode and hash table, then write a script to disassemble

Bytecode

Extract hash table

Each pair is set by:

runtime_mapassign(..., key_x[i], ...) + if(isGC)... + *variable = &handler[j];

Extract the hash table

{
    0x11: "main_LDR",
    0x12: "main_LDRI",
    0x15: "main_STR",
    0x16: "main_STRI",
    0x2A: "main_MOV",
    0x41: "main_ADD",
    0x42: "main_SUB",
    0x47: "main_MUL",
    0x71: "main_LSL",
    0x73: "main_LSR",
    0x7A: "main_XOR",
    0x7B: "main_AND",
    0xFE: "main_RET",
    0xFF: "main_HLT"
}

{
    0x13: main_LDR,
    0x14: main_LDRI,
    0x17: main_STR,
    0x18: main_STRI,
    0x2B: main_MOV,
    0x91: main_ADD,
    0x92: main_SUB,
    0x97: main_MUL,
    0xC1: main_LSL,
    0xC3: main_LSR,
    0xCA: main_XOR,
    0xCB: main_AND,
    0xFE: main_RET,
    0xFF: main_HLT
}

Disassembly

Based on the handler function for each opcode, we know:

Both VM emulate ARM32 instruction set
Both use the same set of handler functions
The bytecodes of two VM are mixed together, only the opcodes that match the respective VM will be executed

Info on hand:

Hash tables for different VM
Instruction structure: Opcode + Oprand * 3, total 4Bytes
Dumped bytecode (DumpedByteCodes.bin)

Instruction	Operands	Operand 1 (Byte `a10`)	Operand 2 (Byte `a11`)	Operand 3 (Byte `a12`)
ADD/SUB/MUL/XOR/AND	3	Rd (reg index)	Rn (reg index)	Rm (reg index)
LSL/LSR	3	Rd (reg index)	Rn (value reg)	Rm (shift amt reg)
MOV	2	Rd (reg index)	Immediate val (WORD little endian)
STRI/LDRI	2	Rd (reg index)	Must be `0x00`	Immediate val (addr)
LDR/STR	2	Rd (reg index)	Rn (addr)	Must be `0x00`

Based on the hash table & instruction set, write a script to read file DumpedByteCodes.bin and disassemble bytecode for two VM respectively, outputting to two .asm files.

Note

movzx edx, [rsp+10h+oprand_3] in STRI. Zero-extend this byte into the 32-bit edx register. The upper 24 bits of edx are set to 0.

Note that this implicitly zeros the upper 32 bits of rdx as well in x86-64). Let’s call the byte value val3. rdx becomes 0x00000000000000XX where XX is val3.

Disassembly script:

import struct
import os

# --- Configuration ---

# Define Opcode Mappings (Using simplified mnemonics for clarity)
VM1_OPS = {
    0x11: "LDR",   0x12: "LDRI",  0x15: "STR",   0x16: "STRI",
    0x2A: "MOV",   0x41: "ADD",   0x42: "SUB",   0x47: "MUL",
    0x71: "LSL",   0x73: "LSR",   0x7A: "XOR",   0x7B: "AND",
    0xFE: "RET",   0xFF: "HLT"
}

VM2_OPS = {
    0x13: "LDR",   0x14: "LDRI",  0x17: "STR",   0x18: "STRI",
    0x2B: "MOV",   0x91: "ADD",   0x92: "SUB",   0x97: "MUL",
    0xC1: "LSL",   0xC3: "LSR",   0xCA: "XOR",   0xCB: "AND",
    0xFE: "RET",   0xFF: "HLT"
}

INPUT_FILE = "DumpedByteCodes.bin"
OUTPUT_VM1_FILE = "vm1_disassembly.asm"
OUTPUT_VM2_FILE = "vm2_disassembly.asm"

INSTRUCTION_SIZE = 4 # bytes

# --- Operand Parsing Logic ---

def parse_operands(mnemonic, b1, b2, b3):
    """
    Parses operand bytes based on the instruction mnemonic.
    Returns a formatted string representation of the operands.
    """
    try:
        if mnemonic in ["ADD", "SUB", "MUL", "XOR", "AND", "LSL", "LSR"]:
            return f"R{b1}, R{b2}, R{b3}"
        elif mnemonic == "MOV":
            imm = (b3 << 8) | b2
            return f"R{b1}, #{imm:#06x}"
        elif mnemonic in ["LDRI", "STRI"]:
            if b2 != 0x00:
                print(f"Warning: Expected 0x00 for operand 2 in {mnemonic} (Opcode byte 2), got {b2:#04x}")
            return f"R{b1}, [#{b3:#04x}]"
        elif mnemonic in ["LDR", "STR"]:
            if b3 != 0x00:
                 print(f"Warning: Expected 0x00 for operand 3 in {mnemonic} (Opcode byte 3), got {b3:#04x}")
            return f"R{b1}, [R{b2}]"
        elif mnemonic in ["RET", "HLT"]:
            return ""
        else:
            print(f"Warning: Unknown mnemonic '{mnemonic}' during operand parsing.")
            return f"?? DB 0x{b1:02X}, 0x{b2:02X}, 0x{b3:02X}"
    except Exception as e:
        print(f"Error parsing operands for {mnemonic} with bytes {b1}, {b2}, {b3}: {e}")
        return f"!! PARSE ERROR !!"

# --- Main Disassembly Function ---

def disassemble():
    """
    Reads the bytecode file and performs disassembly for both VMs,
    including the raw bytes in the output.
    """
    if not os.path.exists(INPUT_FILE):
        print(f"Error: Input file '{INPUT_FILE}' not found.")
        return

    processed_instructions = 0
    unknown_opcodes = 0

    try:
        with open(INPUT_FILE, 'rb') as f_in, \\
             open(OUTPUT_VM1_FILE, 'w') as f_out1, \\
             open(OUTPUT_VM2_FILE, 'w') as f_out2:

            print(f"Starting disassembly of '{INPUT_FILE}'...")
            # Add header explaining the format
            header_format = "; Format: Offset   Bytes        Instruction\\n"
            f_out1.write(f"; --- VM1 Disassembly from {INPUT_FILE} ---\\n")
            f_out1.write(header_format)
            f_out2.write(f"; --- VM2 Disassembly from {INPUT_FILE} ---\\n")
            f_out2.write(header_format)

            offset = 0
            while True:
                chunk = f_in.read(INSTRUCTION_SIZE)
                if not chunk:
                    break

                if len(chunk) < INSTRUCTION_SIZE:
                    print(f"Warning: Trailing {len(chunk)} byte(s) at offset 0x{offset:08X}, ignored.")
                    break

                try:
                    b0, b1, b2, b3 = struct.unpack('<BBBB', chunk)
                except struct.error:
                     print(f"Error: Could not unpack 4 bytes at offset 0x{offset:08X}.")
                     break

                offset_str = f"0x{offset:08X}:"
                # Format the raw bytes as hex strings, separated by spaces
                byte_str = ' '.join(f"{byte:02X}" for byte in chunk)
                # Pad the byte string for alignment (4 bytes * 2 hex chars + 3 spaces = 11 chars)
                # Use padding of 12 for a bit extra space.
                padded_byte_str = f"{byte_str:<12}"

                vm1_mnemonic = VM1_OPS.get(b0)
                vm2_mnemonic = VM2_OPS.get(b0)

                instruction_part = "" # The mnemonic and operands part
                target_files = []

                if vm1_mnemonic and vm2_mnemonic: # Shared opcode
                    mnemonic = vm1_mnemonic
                    operands_str = parse_operands(mnemonic, b1, b2, b3)
                    instruction_part = f"{mnemonic:<5} {operands_str}".strip()
                    target_files.extend([f_out1, f_out2])
                elif vm1_mnemonic: # VM1 specific
                    mnemonic = vm1_mnemonic
                    operands_str = parse_operands(mnemonic, b1, b2, b3)
                    instruction_part = f"{mnemonic:<5} {operands_str}".strip()
                    target_files.append(f_out1)
                elif vm2_mnemonic: # VM2 specific
                    mnemonic = vm2_mnemonic
                    operands_str = parse_operands(mnemonic, b1, b2, b3)
                    instruction_part = f"{mnemonic:<5} {operands_str}".strip()
                    target_files.append(f_out2)
                else: # Opcode not found in either map
                    print(f"Warning: Unknown opcode 0x{b0:02X} at offset {offset_str}")
                    unknown_opcodes += 1
                    # Represent unknown opcodes clearly in the output
                    instruction_part = f"; --- UNKNOWN OPCODE {b0:#04x} ---"
                    # Write unknown lines to both files for completeness
                    target_files.extend([f_out1, f_out2])

                # Construct the final disassembled line including bytes
                disassembled_line = f"{offset_str}  {padded_byte_str} {instruction_part}"

                # Write the line to the determined target file(s)
                for f_out in target_files:
                    f_out.write(disassembled_line + "\\n")

                processed_instructions += 1
                offset += INSTRUCTION_SIZE

        print("-" * 30)
        print(f"Disassembly complete.")
        print(f"Processed {processed_instructions} instructions ({processed_instructions * INSTRUCTION_SIZE} bytes).")
        if unknown_opcodes > 0:
            print(f"Encountered {unknown_opcodes} unknown opcodes.")
        print(f"VM1 output saved to '{OUTPUT_VM1_FILE}'")
        print(f"VM2 output saved to '{OUTPUT_VM2_FILE}'")

    except IOError as e:
        print(f"Error handling files: {e}")
    except Exception as e:
        print(f"An unexpected error occurred: {e}")

# --- Run the Disassembler ---
if __name__ == "__main__":
    # Run the main function
    disassemble()

Key takeaways of the two disasm code:

; --- VM1 Disassembly from DumpedByteCodes.bin ---
; Offset           Bytes        Instruction
...
0x00000020:  16 01 00 1C  STRI  R1, [#0x1c] ; 0x9e3779b9
0x00000044:  12 02 00 04  LDRI  R2, [#0x04] ; y
0x0000004C:  12 03 00 10  LDRI  R3, [#0x10] ; z
0x00000064:  71 04 02 00  LSL   R4, R2, R0  ; y << 2
0x0000006C:  73 05 03 0F  LSR   R5, R3, R15 ; z >> 5
0x00000070:  7A 06 04 05  XOR   R6, R4, R5  ; (z >> 5) ^ (y << 2)
0x00000088:  73 04 02 00  LSR   R4, R2, R0  ; y >> 3
0x00000098:  71 05 03 0F  LSL   R5, R3, R15 ; z << 4
0x0000009C:  7A 07 04 05  XOR   R7, R4, R5  ; (y >> 3) ^ (z << 4)
0x000000A0:  41 08 06 07  ADD   R8, R6, R7  ; ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4))
0x000000CC:  16 05 00 28  STRI  R5, [#0x28] ; 0xa78c0b4f
0x000000DC:  73 09 01 0F  LSR   R9, R1, R15 ; sum >> 2
0x000000E8:  7B 0D 09 00  AND   R13, R9, R0 ; (sum >> 2) & 3
0x000000EC:  7A 04 0D 0E  XOR   R4, R13, R14; p ^ ( (sum >> 2) & 3 )
0x000000F4:  7B 04 04 00  AND   R4, R4, R0  ; p ^ ( (sum >> 2) & 3 ) & 3
0x00000104:  47 04 04 0C  MUL   R4, R4, R12 ; idx * 4
0x00000110:  41 0A 04 0F  ADD   R10, R4, R15; (idx * 4) + 0x20
0x0000011C:  11 04 0A 00  LDR   R4, [R10]   ; key[p ^ ( (sum >> 2) & 3 ) & 3]
0x00000120:  7A 06 01 02  XOR   R6, R1, R2  ; sum ^ y
0x00000128:  7A 07 03 04  XOR   R7, R3, R4  ; z ^ key[p]
0x0000012C:  41 09 06 07  ADD   R9, R6, R7  ; (sum ^ y) + (z ^ key[p ^ e & 3])
0x0000013C:  7A 0A 08 09  XOR   R10, R8, R9 ; ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z))
0x00000168:  16 05 00 20  STRI  R5, [#0x20] ; 0x6e637466
0x000001D8:  16 05 00 24  STRI  R5, [#0x24] ; 0x062ef0ed
0x000001DC:  12 02 00 08  LDRI  R2, [#0x08] ; y
0x000001E0:  12 03 00 00  LDRI  R3, [#0x00] ; z
0x000001F8:  71 04 02 00  LSL   R4, R2, R0  ; << 2
0x00000208:  73 05 03 0F  LSR   R5, R3, R15 ; >> 5
0x00000268:  16 05 00 2C  STRI  R5, [#0x2c] ; 0x32303234

; --- VM2 Disassembly from DumpedByteCodes.bin ---
; Offset           Bytes        Instruction
0x0000002C:  91 01 01 03  ADD   R1, R1, R3  ;0x9e3779b9
0x00000048:  2B 0E 00 00  MOV   R14, #0x0000; p = 0
0x00000054:  14 02 00 04  LDRI  R2, [#0x04] ; y
0x00000058:  14 03 00 10  LDRI  R3, [#0x10] ; z
0x00000074:  C3 04 02 00  LSR   R4, R2, R0  ; y >> 2
0x00000078:  C1 05 03 0F  LSL   R5, R3, R15 ; z << 5
0x0000007C:  CA 06 04 05  XOR   R6, R4, R5  ; (z << 5) ^ (y >> 2)
0x00000094:  C1 04 02 00  LSL   R4, R2, R0  ; y << 3
0x000000A4:  C3 05 03 0F  LSR   R5, R3, R15 ; z >> 4
0x000000B0:  CA 07 04 05  XOR   R7, R4, R5  ; (y << 3)(z >> 4)
0x000000B4:  91 08 06 07  ADD   R8, R6, R7  ; (z << 5) ^ (y >> 2) + (y << 3) ^ (z >> 4)
0x000000E4:  18 05 00 28  STRI  R5, [#0x28] ; 0x9f1cf72e
0x000000F8:  C3 09 01 0F  LSR   R9, R1, R15 ; sum >> 2
0x000000FC:  CB 0D 09 00  AND   R13, R9, R0 ; (sum >> 2) & 3
0x0000010C:  CA 04 0D 0E  XOR   R4, R13, R14; (sum >> 2) & 3 ^ p
0x00000114:  CB 04 04 00  AND   R4, R4, R0  ; idx = (p & 3) ^ ( (sum >> 2) & 3 )
0x00000124:  97 04 04 0C  MUL   R4, R4, R12 ; idx * 4
0x00000134:  91 0A 04 0F  ADD   R10, R4, R15; 0x20 + idx * 4
0x00000138:  13 04 0A 00  LDR   R4, [R10]   ; mem[0x20 + idx * 4]
0x00000140:  CA 06 01 02  XOR   R6, R1, R2  ; sum ^ y
0x00000150:  CA 07 03 04  XOR   R7, R3, R4  ; mem[0x20 + idx * 4] ^ z
0x00000154:  91 09 06 07  ADD   R9, R6, R7  ; (sum ^ y) + (mem[0x20 + idx * 4] ^ z)
0x00000158:  CA 0A 08 09  XOR   R10, R8, R9 ; (z << 5) ^ (y >> 2) + (y << 3) ^ (z >> 4) + (sum ^ y) + (mem[0x20 + idx * 4] ^ z)
0x00000184:  18 05 00 20  STRI  R5, [#0x20] ; 0x32303234
0x000001D0:  18 05 00 24  STRI  R5, [#0x24] ; 0xd6eb12c3
0x00000270:  18 05 00 2C  STRI  R5, [#0x2c] ; 0x4e435446

Memory layout of the two VM:

Decrypt script:

#include <stdint.h>
#include <stdlib.h>
#include <stdio.h>

#define DELTA 0x9e3779b9

void XXTEA_decrypt1(uint32_t *v, int n, const uint32_t key[4]) {
    if (n < 2) return;
    uint32_t y, z, sum, e;
    int p, q = 6 + 52 / n;
    sum = q * DELTA;
    y = v[0];
    do {
        e = (sum >> 2) & 3;
        for (p = n - 1; p > 0; p--) {
            z = v[p - 1];
            v[p] -= ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
            y = v[p];
        }
        z = v[n - 1];
        v[0] -= ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
        y = v[0];
        sum -= DELTA;
    } while (--q > 0);
}

void XXTEA_decrypt2(uint32_t *v, int n, const uint32_t key[4]) {
    if (n < 2) return;
    uint32_t y, z, sum, e;
    int p, q = 6 + 52 / n;
    sum = q * DELTA;
    y = v[0];
    do {
        e = (sum >> 2) & 3;
        for (p = n - 1; p > 0; p--) {
            z = v[p - 1];
            v[p] -= ((z << 5) ^ (y >> 2)) + ((y << 3) ^ (z >> 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
            y = v[p];
        }
        z = v[n - 1];
        v[0] -= ((z << 5) ^ (y >> 2)) + ((y << 3) ^ (z >> 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
        y = v[0];
        sum -= DELTA;
    } while (--q > 0);
}

int main()
{
    uint32_t key1[] = {0x6e637466, 0x062ef0ed, 0xa78c0b4f, 0x32303234};
    unsigned char cipher1[] =
    {
      0x5D, 0x45, 0xD5, 0xB9, 0x8C, 0x95, 0x9C, 0x38, 0x3B, 0xB1,
      0x3E, 0x1E, 0x5F, 0xC8, 0xE8, 0xBB, 0x64, 0x38, 0x48, 0x69
    };

    size_t cipher_len_bytes = sizeof(cipher1);
    int n = cipher_len_bytes / sizeof(uint32_t);

    XXTEA_decrypt1((uint32_t *)cipher1, n, (const uint32_t *)key1);

    // output
    printf("\\nDecrypted data (as chars, %zu bytes):\\n", cipher_len_bytes);
    for (size_t i = 0; i < cipher_len_bytes; i++)
    {
        if (cipher1[i] >= 32 && cipher1[i] <= 126) {
             printf("%c", cipher1[i]);
        } else {
             printf(".");
        }
    }

    uint32_t key2[] = {0x32303234, 0xd6eb12c3, 0x9f1cf72e, 0x4e435446};
    unsigned char cipher2[] =
    {
      0xDE, 0x81, 0xD8, 0xAD, 0xC2, 0xC4, 0xA6, 0x32, 0x1C, 0xAB,
      0x61, 0x3E, 0xCB, 0xFF, 0xEF, 0xF1, 0x27, 0x30, 0x7A, 0x16
    };

    XXTEA_decrypt2((uint32_t *)cipher2, n, (const uint32_t *)key2);

    // output
    printf("\\nDecrypted data (as chars, %zu bytes):\\n", cipher_len_bytes);
    for (size_t i = 0; i < cipher_len_bytes; i++)
    {
        if (cipher2[i] >= 32 && cipher2[i] <= 126) {
             printf("%c", cipher2[i]);
        } else {
             printf(".");
        }
    }

    return 0;
}

/*
std TEA
void XXTEA_encrypt(uint32_t *v, int n, const uint32_t key[4]) {
    if (n < 2) return;  // At least two elements
    uint32_t y, z, sum = 0, e;
    int p, q = 6 + 52 / n;  // Rounds
    z = v[n - 1];   // |  z(>>5  <<4)  |  v[p]  |  y(>>3  <<2) |
    do {
        sum += DELTA;
        e = (sum >> 2) & 3;
        for (p = 0; p < n - 1; p++) {
            y = v[p + 1];
            v[p] += ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
            z = v[p];
        }
        y = v[0];
        v[n - 1] += ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
        z = v[n - 1];
    } while (--q > 0);
}
*/

NCTF{H4rd_VM_with_Gor0ut1n3_5fc4b0be7ad}

Method 2 - IDAPython

Instruction set:

Each handler function’s oprands are stack passing:

Oprand 1	`^0.1`
Oprand 2	`^1.1`
Oprand 3	`^2.1`

Write IDA python script to set “trace” breakpoint and hook registers:

import idaapi
import idc

def set_python_bpt(ea, cond):
    ''' 设置跟踪断点：触发时执行 Python 代码并继续执行 '''
    # 检查地址是否有效
    if not idaapi.is_mapped(ea):
        print(f"[错误] 地址 {ea:x} 不在当前加载的模块中")
        return

    # 添加断点（类型：软件断点，默认行为）
    if not idaapi.add_bpt(ea, 0, idaapi.BPT_SOFT):
        print(f"[错误] 无法在地址 {ea:x} 添加断点")
        return

    # 配置断点属性
    bpt = idaapi.bpt_t()
    if not idaapi.get_bpt(ea, bpt):
        print(f"[错误] 无法获取地址 {ea:x} 的断点信息")
        return

    bpt.elang = 'Python'  # 使用 Python 条件
    bpt.condition = cond  # 条件表达式
    bpt.flags |= idaapi.BPT_ENABLED  # 启用断点
    bpt.flags &= ~idaapi.BPT_BRK  # 触发后不暂停程序（关键修改）

    if not idaapi.update_bpt(bpt):
        print(f"[错误] 无法更新地址 {ea:x} 的断点")
        return
    print(f"[成功] 在地址 {ea:x} 设置跟踪断点")

# ------------------------- 钩子函数定义 -------------------------
def hook_shr():
    rbx = idc.get_reg_value("rbx")
    cl = idc.get_reg_value("cl")
    val1 = rbx
    val2 = cl
    print(f"{val1:x} >> {val2:x} = {(val1 >> val2) & 0xFFFFFFFFFFFFFFFF:x}")

def hook_shl():
    rbx = idc.get_reg_value("rbx")
    cl = idc.get_reg_value("cl")
    val1 = rbx
    val2 = cl
    print(f"{val1:x} << {val2:x} = {(val1 << val2) & 0xFFFFFFFFFFFFFFFF:x}")

def hook_add():
    rdx = idc.get_reg_value("rdx")
    rax = idc.get_reg_value("rax")
    rbx = idc.get_reg_value("rbx")
    val1 = rdx
    val2 = idc.get_qword(rax + rbx*4)
    print(f"{val1:x} + {val2:x} = {(val1 + val2) & 0xFFFFFFFFFFFFFFFF:x}")

def hook_xor():
    rdx = idc.get_reg_value("rdx")
    rax = idc.get_reg_value("rax")
    rbx = idc.get_reg_value("rbx")
    val1 = rdx
    val2 = idc.get_qword(rax + rbx*4)
    print(f"{val1:x} ^ {val2:x} = {(val1 ^ val2) & 0xFFFFFFFFFFFFFFFF:x}")

def hook_sub():
    rdx = idc.get_reg_value("rdx")
    rax = idc.get_reg_value("rax")
    rbx = idc.get_reg_value("rbx")
    val1 = rdx
    val2 = idc.get_qword(rax + rbx*4)
    print(f"{val1:x} - {val2:x} = {(val1 - val2) & 0xFFFFFFFFFFFFFFFF:x}")

def hook_mul():
    rdx = idc.get_reg_value("rdx")
    rbx = idc.get_reg_value("rbx")
    val1 = rdx
    val2 = rbx
    print(f"{val1:x} * {val2:x} = {(val1 * val2) & 0xFFFFFFFFFFFFFFFF:x}")

def hook_and():
    rdx = idc.get_reg_value("rdx")
    rax = idc.get_reg_value("rax")
    rbx = idc.get_reg_value("rbx")
    val1 = rdx
    val2 = idc.get_qword(rax + rbx*4)
    print(f"{val1:x} & {val2:x} = {(val1 & val2) & 0xFFFFFFFFFFFFFFFF:x}")

# ------------------------- 设置断点 -------------------------
# 设置跟踪断点列表（地址需根据实际情况调整）
trace_bpts = [
    (0x0000000000848860, 'hook_shr()'),
    (0x0000000000848820, 'hook_shl()'),
    (0x000000000084871D, 'hook_add()'),
    (0x00000000008487DD, 'hook_xor()'),
    (0x000000000084875D, 'hook_sub()'),
    (0x00000000008487A0, 'hook_mul()'),
    (0x000000000084889D, 'hook_and()')
]

for ea, cond in trace_bpts:
    set_python_bpt(ea, cond)

ezDOS

MS-DOS on Intel 8086. old but classic architecture

Directly examine the assembly code, a heavily modified RC4 and junk code are inspected. Don’t care about its internal implementation, the final XOR step remains unmodified. Hence extract the XOR Key in the proccess.

Junk code:

Debug:

Note

Input buffer structure in 8086 dos: 0x40(maxLength) + actualLength+ data

# 0x26 'a' chars: aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa，XORed
53 1C 38 1B 92 6C D2 1A 05 ED 8A 49 A5 C5 31 51 C1 8C 46 0B 82 17 08 6D BB 49 99 69 DB C7 76 5F 73 38 24 67 2F 90

# Key
32 7d 59 7a f3 0d b3 7b 64 8c eb 28 c4 a4 50 30 a0 ed 27 6a e3 76 69 0c da 28 f8 08 ba a6 17 3e 12 59 45 06 4e f1

# Cipher
7C 3E 0D 3C 88 54 83 0E 3B B8 99 1B 9B E5 23 43 C5 80 45 5B 9A 29 24 38 A9 5C CB 7A E5 93 73 0E 70 6D 7C 31 2B 8C

Cyberchef

NCTF{Y0u_4r3_Assemb1y_M4st3r_5d0b497e}

SafeProgram

The program monitors everything you do. So it reminds you: “DONOT DEBUG ME!”. But really?

The main function implements SM4 encryption without modifying S-Box. Note that one dummy thread is continuously spawned / terminated, which triggers TLS each time.

TLS then triggers CRC self-validation whenever a thread is created. By using a hardware breakpoint to bypass this validation, we can obtaining the hacked S-Box.

If we set software breakpoint, then 0xE0000001 exception occurred:

No(discard), F8 step over:

Now the callback functions were found:

Tip

DLL_PROCESS_ATTACH (1): Process initialization
DLL_THREAD_ATTACH (2): Thread creation
DLL_THREAD_DETACH (3): Thread exit
DLL_PROCESS_DETACH (0): Process termination

Divide by 0 exception:

The decrypted keySource array orchestrates a sequential substitution on SBox.

Extract necessary data, and write a decrypt script:

import struct

# 系统参数
FK = [0xA3B1BAC6, 0x56AA3350, 0x677D9197, 0xB27022DC]

# 固定参数CK
CK = [
    0x00070e15, 0x1c232a31, 0x383f464d, 0x545b6269,
    0x70777e85, 0x8c939aa1, 0xa8afb6bd, 0xc4cbd2d9,
    0xe0e7eef5, 0xfc030a11, 0x181f262d, 0x343b4249,
    0x50575e65, 0x6c737a81, 0x888f969d, 0xa4abb2b9,
    0xc0c7ced5, 0xdce3eaf1, 0xf8ff060d, 0x141b2229,
    0x30373e45, 0x4c535a61, 0x686f767d, 0x848b9299,
    0xa0a7aeb5, 0xbcc3cad1, 0xd8dfe6ed, 0xf4fb0209,
    0x10171e25, 0x2c333a41, 0x484f565d, 0x646b7279
]

# 自定义S盒
SBox = [
    0xD1, 0x90, 0xE9, 0xFE, 0xCC, 0xE1, 0x3D, 0xB7, 0x16, 0xB6,
    0x14, 0xC2, 0x28, 0xFB, 0x2C, 0x05, 0x2B, 0x67, 0x9A, 0x76,
    0x2A, 0xBE, 0x04, 0xC3, 0xAA, 0x44, 0x13, 0x26, 0x49, 0x86,
    0x06, 0x99, 0x9C, 0x42, 0x50, 0xF4, 0x91, 0xEF, 0x98, 0x7A,
    0x33, 0x54, 0x0B, 0x43, 0xED, 0xCF, 0xAC, 0x62, 0xE4, 0xB3,
    0x17, 0xA9, 0x1C, 0x08, 0xE8, 0x95, 0x80, 0xDF, 0x94, 0xFA,
    0x75, 0x8F, 0x3F, 0xA6, 0x47, 0x07, 0xA7, 0x4F, 0xF3, 0x73,
    0x71, 0xBA, 0x83, 0x59, 0x3C, 0x19, 0xE6, 0x85, 0xD6, 0xA8,
    0x68, 0x6B, 0x81, 0xB2, 0xFC, 0x64, 0xDA, 0x8B, 0xF8, 0xEB,
    0x0F, 0x4B, 0x70, 0x56, 0x9D, 0x35, 0x1E, 0x24, 0x0E, 0x78,
    0x63, 0x58, 0x9F, 0xA2, 0x25, 0x22, 0x7C, 0x3B, 0x01, 0x21,
    0xC9, 0x87, 0xD4, 0x00, 0x46, 0x57, 0x5E, 0xD3, 0x27, 0x52,
    0x4C, 0x36, 0x02, 0xE7, 0xA0, 0xC4, 0xC8, 0x9E, 0xEA, 0xBF,
    0x8A, 0xD2, 0x40, 0xC7, 0x38, 0xB5, 0xA3, 0xF7, 0xF2, 0xCE,
    0xF9, 0x61, 0x15, 0xA1, 0xE0, 0xAE, 0x5D, 0xA4, 0x9B, 0x34,
    0x1A, 0x55, 0xAD, 0x93, 0x32, 0x30, 0xF5, 0x8C, 0xB1, 0xE3,
    0x1D, 0xF6, 0xE2, 0x2E, 0x82, 0x66, 0xCA, 0x60, 0xC0, 0x29,
    0x23, 0xAB, 0x0D, 0x53, 0x4E, 0x6F, 0xD5, 0xDB, 0x37, 0x45,
    0xDE, 0xFD, 0x8E, 0x2F, 0x03, 0xFF, 0x6A, 0x72, 0x6D, 0x6C,
    0x5B, 0x51, 0x8D, 0x1B, 0xAF, 0x92, 0xBB, 0xDD, 0xBC, 0x7F,
    0x11, 0xD9, 0x5C, 0x41, 0x1F, 0x10, 0x5A, 0xD8, 0x0A, 0xC1,
    0x31, 0x88, 0xA5, 0xCD, 0x7B, 0xBD, 0x2D, 0x74, 0xD0, 0x12,
    0xB8, 0xE5, 0xB4, 0xB0, 0x89, 0x69, 0x97, 0x4A, 0x0C, 0x96,
    0x77, 0x7E, 0x65, 0xB9, 0xF1, 0x09, 0xC5, 0x6E, 0xC6, 0x84,
    0x18, 0xF0, 0x7D, 0xEC, 0x3A, 0xDC, 0x4D, 0x20, 0x79, 0xEE,
    0x5F, 0x3E, 0xD7, 0xCB, 0x39, 0x48
]

def left_rotate(n, b):
    return ((n << b) | (n >> (32 - b))) & 0xFFFFFFFF

def tau(b):
    a = b.to_bytes(4, 'big')
    a = [SBox[x] for x in a]
    return int.from_bytes(bytes(a), 'big')

def L(b):
    return b ^ left_rotate(b, 2) ^ left_rotate(b, 10) ^ left_rotate(b, 18) ^ left_rotate(b, 24)

def T(b):
    return L(tau(b))

def L_prime(b):
    return b ^ left_rotate(b, 13) ^ left_rotate(b, 23)

def T_prime(b):
    return L_prime(tau(b))

def sm4_key_expansion(key):
    MK = struct.unpack('>4I', key)
    K = [0] * 36
    K[0] = MK[0] ^ FK[0]
    K[1] = MK[1] ^ FK[1]
    K[2] = MK[2] ^ FK[2]
    K[3] = MK[3] ^ FK[3]
    rk = [0] * 32
    for i in range(32):
        tmp = K[i+1] ^ K[i+2] ^ K[i+3] ^ CK[i]
        tmp = T_prime(tmp)
        K[i+4] = K[i] ^ tmp
        rk[i] = K[i+4]
    return rk

def sm4_decrypt(ciphertext, rk):
    x = list(struct.unpack('>4I', ciphertext))
    for i in range(32):
        rk_i = rk[i]
        tmp = x[i+1] ^ x[i+2] ^ x[i+3] ^ rk_i
        tmp = T(tmp)
        x.append(x[i] ^ tmp)
    return struct.pack('>4I', x[35], x[34], x[33], x[32])

# 输入数据
key = bytes([0x4E, 0x43, 0x54, 0x46, 0x32, 0x34, 0x6E, 0x63, 0x74, 0x66,
  0x4E, 0x43, 0x54, 0x46, 0x32, 0x34])
cipher = bytes([0xFB, 0x97, 0x3C, 0x3B, 0xF1, 0x99, 0x12, 0xDF, 0x13, 0x30,
  0xF7, 0xD8, 0x7F, 0xEB, 0xA0, 0x6C, 0x14, 0x5B, 0xA6, 0x2A,
  0xA8, 0x05, 0xA5, 0xF3, 0x76, 0xBE, 0xC9, 0x01, 0xF9, 0x36,
  0x7B, 0x46])

# 生成轮密钥并反转
rk = sm4_key_expansion(key)
dec_rk = rk[::-1]

# 分块解密
block1 = cipher[:16]
block2 = cipher[16:]
plain1 = sm4_decrypt(block1, dec_rk)
plain2 = sm4_decrypt(block2, dec_rk)
plain = plain1 + plain2

print("Decrypted:", plain)

NCTF{58cb925e0cd823c0d0b54fd06b820b7e}

Appendix

Standard SBox for SM4：

0   1   2   3   4   5   6   7   8   9   A   B   C   D   E   F
00 | D6 90 E9 FE CC E1 3D B7 16 B6 14 C2 28 FB 2C 05
10 | 2B 67 9A 76 2A BE 04 C3 AA 44 13 26 49 86 06 99
20 | 9C 42 50 F4 91 EF 98 7A 33 54 0B 43 ED CF AC 62
30 | E4 B3 1C A9 C9 08 E8 95 80 DF 94 FA 75 8F 3F A6
40 | 47 07 A7 FC F3 73 17 BA 83 59 3C 19 E6 85 4F A8
50 | 68 6B 81 B2 71 64 DA 8B F8 EB 0F 4B 70 56 9D 35
60 | 1E 24 0E 5E 63 58 D1 A2 25 22 7C 3B 01 21 78 87
70 | D4 00 46 57 9F D3 27 52 4C 36 02 E7 A0 C4 C8 9E
80 | EA BF 8A D2 40 C7 38 B5 A3 F7 F2 CE F9 61 15 A1
90 | E0 AE 5D A4 9B 34 1A 55 AD 93 32 30 F5 8C B1 E3
A0 | 1D F6 E2 2E 82 66 CA 60 C0 29 23 AB 0D 53 4E 6F
B0 | D5 DB 37 45 DE FD 8E 2F 03 FF 6A 72 6D 6C 5B 51
C0 | 8D 1B AF 92 BB DD BC 7F 11 D9 5C 41 1F 10 5A D8
D0 | 0A C1 31 88 A5 CD 7B BD 2D 74 D0 12 B8 E5 B4 B0
E0 | 89 69 97 4A 0C 96 77 7E 65 B9 F1 09 C5 6E C6 84
F0 | 18 F0 7D EC 3A DC 4D 20 79 EE 5F 3E D7 CB 39 48

Structure I used

typedef struct _EXCEPTION_POINTERS {
  PEXCEPTION_RECORD ExceptionRecord;
  PCONTEXT ContextRecord;
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

void NTAPI TlsCallback(
    PVOID DllHandle,
    DWORD Reason,
    PVOID Reserved
);

Hgame 2025 week 2

Wed, 05 Mar 2025 00:00:00 GMT

Alias: Sh10l (个人赛事)
Status: re -1; crypto 1; misc 2;
Rank: 2

硬件断点反调试

CRC校验——分别生成从main开始的四块CRC值：

输入flag长度43，取36字节为FlagBody传入XXTEA

不断调试：

这四个CRC值作为Key传入XXTEA
sum应该永远等于0

要正确CRC值，要下两处硬件****断点，才能不改变代码块内容，一处下在这里：

一处下在这里：

通过改ZF过反调试

取出CRC值——dword_7FF765C7B2A0：

97A25FB5h, 0E1756DBAh, 0A143464Ah, 5A8F284Fh

#include <stdio.h>
#include <stdint.h>

// 解密函数
void XXTEA_decrypt(uint32_t *v, int n, const uint32_t key[4]) {
    if (n < 2) return;  // At least two elements
    uint32_t y, z, sum, e;
    int p = 8;
    int q = 11;
    sum = 0;
    y = v[0];  // |  z(>>5  <<4)  |  v[p]  |  y(>>3  <<2) |
    do {
        e = (sum >> 2) & 3;
        for (p = n - 1; p > 0; p--) {
            z = v[p - 1];
            v[p] -= ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
            y = v[p];
        }
        z = v[n - 1];
        v[0] -= ((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4)) ^ ((sum ^ y) + (key[(p & 3) ^ e] ^ z));
        y = v[0];
        sum -= 0;
    } while (--q > 0);
}

int main() {
    // 密钥（注意字节序转换）
    uint32_t key[4] = {
        0x97A25FB5,
        0xE1756DBA,
        0xA143464A,
        0x5A8F284F
    };

    // 密文（注意小端序转换）
    unsigned char cipher[] = {
        0x23,0xEA,0x50,0x30,0x00,0x4C,0x51,0x47,0xEE,0x9C,
        0x76,0x2B,0xD5,0xE6,0x94,0x17,0xED,0x2B,0xE4,0xB3,
        0xCB,0x36,0xD5,0x61,0xC0,0xC2,0xA0,0x7C,0xFE,0x67,
        0xD7,0x5E,0xAF,0xE0,0x79,0xC5
    };

    // 将字节数组转换为DWORD数组（假设为小端序）
    uint32_t *data = (uint32_t*)cipher;
    int data_len = sizeof(cipher)/4;

    // 执行解密
    XXTEA_decrypt(data, data_len, key);

    // 输出解密结果（字符串形式）
    printf("Decrypted Data:\n");
    for(int i=0; i<sizeof(cipher); i++) {
        printf("%c", cipher[i]);
    }
    printf("\n");

    return 0;
}

Computer cleaner plus

想：

可能恶意进程还在运行

有定时设定启动恶意文件

有奇怪的服务启动恶意文件

恶意文件很可能在进程中运行，但文件本体不存在

使用top或者ps查看可疑进程

挨个排查，top看运行时进程没什么问题，但在使用ps时返回Permission denied

ls -lah /bin/ps发现没有执行权限 chmod +x /bin/ps手动恢复使用ps，出现后门文件：

hgame{B4ck_D0_oR}

Fast and frustrating

HKDF（HAMC-Based Key Derivation Function）是一种基于HMAC的密钥派生（扩展）算法

.NET程序能够根据Locale(语言环境)的不同加载不同的程序集资源:

主程序集资源：FastAndFrustrating.Resources.resources

卫星程序集资源：FastAndFrustdating.Resources.vt.resources

程序将UsrInput（27Bytes）作为ikm（Input Key Meterial）传入HKDF算法来扩展出Key + IV 最后使用AES_CBC算法解密EncryptedFlag 算法到底是AES-128还是AES-256不能确定，所以Key + IV可能是32 + 16 Bytes或者16 + 16 Bytes

整体流程：加载Constrs → b64decode → GZip解压 → Json文件反序列化 → 求解方程组 $Ax = b$ → 解向量 $x$ 与UsrInput比较判断对错（猜出来的）

UsrInput → HKDF(SHA256, ikm, TargetLength, Salt, Keyinfo)→ 分割派生密钥为Key + IV → AES_CBC(AESInstance, Cipher, Key, IV)

有一个Locale(语言环境)校验：

./FastAndFrustrating.exe
No way! You must be a Vidar-Team member to run this app.

要求语言为”vt”才能进入Give me your key:>阶段

在b46Decoded = FromBase64(*(_QWORD *)(__GCSTATICS_Program_ + 8)); 下断点，再次F8步进时出现如下错误：

Give me your key:> U29tZVRoaW5nYWFhYWFhYWFhYWE=
Unhandled Exception: System.FormatException: The input is not a valid Base-64 string as it contains a non-base 64 character, more than two padding characters, or an illegal character among the padding characters.
   at System.Convert.FromBase64CharPtr(Char*, Int32) + 0xd0
   at System.Convert.FromBase64String(String) + 0x30
   at FastAndFrustrating.Program.Main(String[] args) + 0xfb
   at FastAndFrustrating!<BaseAddress>+0x1762c0

GCSTATICS_Program是：

.data:00007FF71FF647A8 GCSTATICS_Program dq 2C78B000068h

2C78B000068h该地址只有在动态调试下才有效

所以动调进入地址2C78B000068h：

debug050:000002C78B000068                 dq offset __GCStaticEEType_0111
debug050:000002C78B000070                 dq offset unk_2C78D810128
debug050:000002C78B000078                 dq offset unk_2C78D8101F8
debug050:000002C78B000080                 dq offset unk_2C78D810230

2C78D810128、2C78D8101F8、2C78D810230分别是：

FakeConstrs
Flag is not here!
no_such_thing_go_somewhere_else

2C78D810128的fakeConstrs并不是base64编码，所以应该我无论怎么调试都会出现错误

而在：

  if ( *(&___NONGCSTATICS_FastAndFrustrating_FastAndFrustrating_Program__ - 1) )
    _GetGCStaticBase_FastAndFrustrating_FastAndFrustrating_Program();

是从staticbase里按照locale提取数据的，我想，在静态数据初始化时，正确的Base64字符串只有在正确的Culture下才会被加载到GCSTATICS_Program的位置。

根据不同CurrentUICulture加载不同资源，非vt会加载假的

所以要找到正确的”vt”资源，，在Strings搜索FakeConstrs，往下找，离正确数据不远：

Constrs`+ `EncryptedFlag`+ `KeyInfo

或者搜索.resources文件的特征头 CE CA EF BE：

b64decode + 解压

import base64
import gzip
from io import BytesIO

def decode_and_extract(b64_str):
    try:
        # Base64解码
        compressed_data = base64.b64decode(b64_str)
        
        # Gzip解压
        with gzip.GzipFile(fileobj=BytesIO(compressed_data)) as f:
            decompressed_data = f.read()
            
        return decompressed_data.decode('utf-8')  # 根据实际情况调整编码
    
    except Exception as e:
        print(f"处理过程出错: {str(e)}")
        return None

# 原始数据
base64_str = """
H4sIABh9j2cC/21Wy47bMAz8lWDPESBS7/7KYrHYFj32VvRS9N+rGVKynQSIZUtiOCI5JPX37dfX78+vt2+393e53+L6vfzW+y3YJMzPjNl8S7UdFQxjLuAjtfstze84xep8ZOjH/fZu6mSpk/WD3mSv9QAm2WsiSJ96AAApLSZtkHOikCjc1+E44WwDDmzYuuAXXLVPnJeQ2SZlTsbAPkzKDVtUlAmaeKYOLLMgcWzblGxQjl0NKHR/+3+KSwBUcIo6V9p8woBkgdiYOntyo56Dsl1oFkJz3i6VwwGwD6vwUqNyDBLntBCZ8Tk5P15CcXZm3MFJZo7GFQycY7hGWNfGiplUkGRQa9bDnBXqJ9CQz2ELyWaFqraBmOZpSCcbsdGxiSUSI7Qn2oUL6YDi7oF6UtytsmgTAx4FApUXEiA2hAx/Mdo4N06GHQHRK6urJY8xRgxJmELwZTOhwtMXj9rIllczjaYI5ObSi4BdkTbjD5udhErn+g4mlUbDPJ6k8OSdI3BTOwy7pI+R3QLj/kvbvzCnrN0AMiKZpkaklH0y3TTTA4xhHVcXBg+++nQteQnIlnmWbdUjppZ/oajHLDHnIIVDKNOtT3wnvV6YWOzwbsqiIT4HIeAgz+PubFzlKx/pzXcafqI55GfO64Ekm+V1b4jZ2BxEnTescyUvphIDgyS4SR+idUnZXXijhcRxrGaQ/yRP27Y2hjnGRXvL502R2l/UpbBT7UgzvWaberkjUrGakVepqNnlzbMoI2ecXR8e4qS2FA3FaJdOpNF8MJLAdGGb8ngqsUCYHF877/zbTcQqETUOq+ewojRPJiYVcx0k7eReBwmrN44X0Xn044kh6+2JRmLs5eSzXCyMkvoqEPHSUeUhk7xtGbvUyZ0sVTzx0PNgGHuRwSYvT9L0XGZfNqhryT2KhxrP1PMyZA55JT177jxMa/Abj6z1KOc7FHoimytf1encNaIVBuMhN1bhplhxeVb22aPG6/vKxm47hYLnUDquKuLFATi8MEhmQg8rcWtUo7gebAiXJrWC7qS+3MTUK0PeEV0XsLyuLZVRZCFCm2+PpMsnfXm1B69jkha14Tiwm4codjOadKOV1do5F4a3Jxn90XXngHkxlU3GejR4Me91vz34bW9YeapgDFBZlFo87l7nVvfMdZt1N0s9G9O+AACoJ2+BQjQQDjxkwFr7mFBvf37++PyOi3KSRs5LjZ3ZLmCqjBjtEqJUnWJjyEdkk5hTuEaLcFpSZ7Q6rypaxyBrW4H0ZKA5NqZiTh9260VMUypoANKyuV0KylcYIxZe6nhTLaOwIaiS9IO1u0Jw/n167t9/pH9jSPgLAAA=
"""

if __name__ == "__main__":
    # 清理输入字符串（移除换行和空格）
    cleaned_str = base64_str
    
    # 执行解码解压
    result = decode_and_extract(cleaned_str)
    
    if result:
        print("解码解压结果：")
        print(result)  # 防止过长输出
        # 若要保存到文件：with open('output.txt', 'w') as f: f.write(result)
#{"mat_a": [[1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 2, -1, 0, -2, 4, -12, 16, 2, -21, -29, 11, -37, 3, 104, 64, 192], [0, 1, 1, 0, 2, 1, 1, 1, -1, 3, -1, -1, -1, 0, -3, 0, -6, 18, 6, -23, -25, 3, -21, -25, 26, 156, -229], [0, -1, 0, 0, 0, -2, 0, 1, 2, 1, 0, 3, -1, -6, 3, -7, 30, -34, -7, 50, 99, -69, 147, -30, -241, -236, 188], [1, 1, 3, 1, 7, -1, 3, 4, 2, 10, -2, 6, -6, -8, -6, -1, 1, 35, 10, -34, 13, -65, 75, -98, -51, 197, 83], [0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 2, 0, -1, 4, 1, -1, 10, 0, 0, -7, 31, -56, 78, -58, -106, 53, -62], [-1, -1, 0, 0, -1, -1, 0, 1, 0, 0, 0, 0, 0, -3, 3, -6, 20, -21, -1, 29, 53, -35, 79, -23, -162, -90, -142], [0, 0, -1, 0, -1, 0, 0, -1, -1, -4, -2, 0, 1, -3, -2, 5, -16, 1, -1, 5, -48, 84, -116, 86, 148, -25, -72], [0, 1, 1, 0, -1, 1, 1, -1, -4, 0, -7, -2, 2, -13, -6, 0, -24, 5, 4, 14, -86, 151, -207, 132, 230, -30, -241], [0, 0, -2, 0, -1, 2, -1, -1, 0, -6, 4, -3, 1, 16, 0, 12, -26, 27, 0, -55, -75, 31, -94, 11, 192, 226, -94], [-1, -1, 0, 0, -2, -1, -1, 0, 0, 1, 2, -1, 1, 1, 6, -8, 24, -22, -1, 24, 63, -66, 112, -50, -180, -111, 37], [0, 0, 1, 0, 3, -1, 1, 3, 2, 5, 2, 2, -3, 1, 1, -6, 25, 2, 5, -10, 69, -119, 169, -134, -240, 124, -169], [0, 0, -2, -1, -3, 2, -2, -2, -1, -5, 3, -4, 3, 14, 2, 6, -24, 23, 4, -52, -86, 36, -114, 10, 234, 189, 62], [-2, 0, -1, 0, -5, 1, -2, -3, -4, -2, 3, -9, 6, 12, 8, -6, 8, -16, -1, 3, -4, -6, -1, -6, -39, -24, -244], [0, 0, -1, 0, -2, 1, -2, -1, 1, -3, 6, -2, 1, 15, 3, 7, -16, 26, 4, -56, -54, -13, -39, -39, 133, 221, 37], [0, 0, 0, 0, 0, 0, -1, 0, 2, 0, 5, -2, 1, 11, 4, -2, 21, -17, -9, 6, 73, -100, 151, -79, -212, -50, 68], [0, 0, 0, 0, 1, -1, 1, 0, 1, 1, -1, 2, -1, -4, 0, -2, 13, -17, -5, 29, 49, -23, 64, 2, -116, -135, 68], [0, 0, -1, -1, -5, 1, -2, -3, -2, -5, 0, -4, 5, 2, 3, -2, -2, -24, -6, 25, -17, 54, -70, 70, 66, -152, 40], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 1, 0, 6, 1, 5, -19, 35, 9, -57, -66, 3, -64, -33, 180, 238, 106], [1, 0, 0, 0, 0, -1, 0, 0, 0, 1, -1, 1, 1, -2, -1, -2, -1, 2, 2, -7, -11, -2, -13, -11, 45, 21, 138], [-1, 0, -1, 0, -3, 1, -2, -2, -1, -1, 7, -6, 4, 22, 8, -3, 10, 3, 2, -41, 9, -97, 87, -113, -75, 172, -72], [0, 0, 0, 0, 1, 0, 0, 1, -1, 1, 1, -1, 0, 3, -1, 2, -9, 24, 10, -40, -44, -1, -37, -38, 77, 232, -226], [0, 1, 0, 0, 2, 2, 0, 1, 1, 0, 3, -3, -1, 13, -2, 5, -10, 23, -1, -43, -20, -30, 13, -51, 13, 207, -149], [0, 1, 1, 0, 2, 1, 0, 1, 0, 7, 5, -2, -1, 11, 3, -6, 18, 16, 8, -43, 41, -141, 159, -169, -169, 216, -12], [1, 0, -1, 0, -1, 1, -1, -2, 0, -4, 1, 0, 0, 2, -2, 7, -14, 1, -2, 1, -29, 49, -69, 63, 106, -36, 57], [1, 0, 0, 0, 4, 0, 0, 2, 4, 1, 6, 3, -4, 13, 1, 5, 10, 19, 0, -45, 50, -138, 166, -142, -139, 192, 198], [0, 1, 1, 0, 0, 1, 0, 0, -2, 3, 1, -3, 1, 6, 1, -3, -1, 18, 8, -35, -23, -29, 4, -61, 28, 173, -70], [1, 1, 0, 0, 1, 2, 0, -1, 0, -3, 1, -1, 0, 8, -4, 12, -33, 31, -1, -45, -83, 63, -129, 47, 244, 159, 77]], "vec_b": [31772, -16089, -5137, 19004, -11231, -30741, 1908, -13072, 12518, -15381, -28148, 26993, -37508, 20766, -10350, -4593, -2569, 33556, 17442, -11570, -9905, -5847, -5959, 13220, 23951, -670, 33570]}

Mat_a是个27×27的矩阵
vec_b是个27维向量
把数据丢给AI分析下：

再回去看伪代码：

应该如此，试一下求解 $Ax = b$ ：

import numpy as np

data = {
"mat_a": [[1, 0, 0, 0, 1, 0, 0, 0, 1, 0, 0, 2, -1, 0, -2, 4, -12, 16, 2, -21, -29, 11, -37, 3, 104, 64, 192], [0, 1, 1, 0, 2, 1, 1, 1, -1, 3, -1, -1, -1, 0, -3, 0, -6, 18, 6, -23, -25, 3, -21, -25, 26, 156, -229], [0, -1, 0, 0, 0, -2, 0, 1, 2, 1, 0, 3, -1, -6, 3, -7, 30, -34, -7, 50, 99, -69, 147, -30, -241, -236, 188], [1, 1, 3, 1, 7, -1, 3, 4, 2, 10, -2, 6, -6, -8, -6, -1, 1, 35, 10, -34, 13, -65, 75, -98, -51, 197, 83], [0, 0, 0, 0, 1, 0, 0, 1, 1, 1, 2, 0, -1, 4, 1, -1, 10, 0, 0, -7, 31, -56, 78, -58, -106, 53, -62], [-1, -1, 0, 0, -1, -1, 0, 1, 0, 0, 0, 0, 0, -3, 3, -6, 20, -21, -1, 29, 53, -35, 79, -23, -162, -90, -142], [0, 0, -1, 0, -1, 0, 0, -1, -1, -4, -2, 0, 1, -3, -2, 5, -16, 1, -1, 5, -48, 84, -116, 86, 148, -25, -72], [0, 1, 1, 0, -1, 1, 1, -1, -4, 0, -7, -2, 2, -13, -6, 0, -24, 5, 4, 14, -86, 151, -207, 132, 230, -30, -241], [0, 0, -2, 0, -1, 2, -1, -1, 0, -6, 4, -3, 1, 16, 0, 12, -26, 27, 0, -55, -75, 31, -94, 11, 192, 226, -94], [-1, -1, 0, 0, -2, -1, -1, 0, 0, 1, 2, -1, 1, 1, 6, -8, 24, -22, -1, 24, 63, -66, 112, -50, -180, -111, 37], [0, 0, 1, 0, 3, -1, 1, 3, 2, 5, 2, 2, -3, 1, 1, -6, 25, 2, 5, -10, 69, -119, 169, -134, -240, 124, -169], [0, 0, -2, -1, -3, 2, -2, -2, -1, -5, 3, -4, 3, 14, 2, 6, -24, 23, 4, -52, -86, 36, -114, 10, 234, 189, 62], [-2, 0, -1, 0, -5, 1, -2, -3, -4, -2, 3, -9, 6, 12, 8, -6, 8, -16, -1, 3, -4, -6, -1, -6, -39, -24, -244], [0, 0, -1, 0, -2, 1, -2, -1, 1, -3, 6, -2, 1, 15, 3, 7, -16, 26, 4, -56, -54, -13, -39, -39, 133, 221, 37], [0, 0, 0, 0, 0, 0, -1, 0, 2, 0, 5, -2, 1, 11, 4, -2, 21, -17, -9, 6, 73, -100, 151, -79, -212, -50, 68], [0, 0, 0, 0, 1, -1, 1, 0, 1, 1, -1, 2, -1, -4, 0, -2, 13, -17, -5, 29, 49, -23, 64, 2, -116, -135, 68], [0, 0, -1, -1, -5, 1, -2, -3, -2, -5, 0, -4, 5, 2, 3, -2, -2, -24, -6, 25, -17, 54, -70, 70, 66, -152, 40], [0, 0, 0, 0, 0, 0, 0, 0, 0, 0, 2, 1, 0, 6, 1, 5, -19, 35, 9, -57, -66, 3, -64, -33, 180, 238, 106], [1, 0, 0, 0, 0, -1, 0, 0, 0, 1, -1, 1, 1, -2, -1, -2, -1, 2, 2, -7, -11, -2, -13, -11, 45, 21, 138], [-1, 0, -1, 0, -3, 1, -2, -2, -1, -1, 7, -6, 4, 22, 8, -3, 10, 3, 2, -41, 9, -97, 87, -113, -75, 172, -72], [0, 0, 0, 0, 1, 0, 0, 1, -1, 1, 1, -1, 0, 3, -1, 2, -9, 24, 10, -40, -44, -1, -37, -38, 77, 232, -226], [0, 1, 0, 0, 2, 2, 0, 1, 1, 0, 3, -3, -1, 13, -2, 5, -10, 23, -1, -43, -20, -30, 13, -51, 13, 207, -149], [0, 1, 1, 0, 2, 1, 0, 1, 0, 7, 5, -2, -1, 11, 3, -6, 18, 16, 8, -43, 41, -141, 159, -169, -169, 216, -12], [1, 0, -1, 0, -1, 1, -1, -2, 0, -4, 1, 0, 0, 2, -2, 7, -14, 1, -2, 1, -29, 49, -69, 63, 106, -36, 57], [1, 0, 0, 0, 4, 0, 0, 2, 4, 1, 6, 3, -4, 13, 1, 5, 10, 19, 0, -45, 50, -138, 166, -142, -139, 192, 198], [0, 1, 1, 0, 0, 1, 0, 0, -2, 3, 1, -3, 1, 6, 1, -3, -1, 18, 8, -35, -23, -29, 4, -61, 28, 173, -70], [1, 1, 0, 0, 1, 2, 0, -1, 0, -3, 1, -1, 0, 8, -4, 12, -33, 31, -1, -45, -83, 63, -129, 47, 244, 159, 77]], 
"vec_b": [31772, -16089, -5137, 19004, -11231, -30741, 1908, -13072, 12518, -15381, -28148, 26993, -37508, 20766, -10350, -4593, -2569, 33556, 17442, -11570, -9905, -5847, -5959, 13220, 23951, -670, 33570]
}

A = np.array(data['mat_a'])
b = np.array(data['vec_b'])

# Solve the linear system using least squares method
x = np.linalg.lstsq(A, b, rcond=None)[0]

# Convert numerical solutions to Unicode characters
solution = ''.join([chr(int(round(num))) for num in x])

print("Decoded Message:", solution)

已知：ikm、EncryptedFlag、Keyinfo、其中salt为零：

ikm = 'CompressedEmbeddedResources'
EncryptedFlag = '@GFxmVucV6MVUXiWCMAnWpyvzXoLdHc5CmFeim+JjUBszB8HFX8Ku8NMc201AGZ9X'
# base64编码，需要解码出Cipher
Keyinfo = 'HGAME2025'

解密流程：

/*
Key_IV_Length = 32 或者 48 Bytes
Key_derived 结构为：Key + IV
*/
Key_derived = (ConmmonStr *)HKDF__DeriveKey((unsigned int)&_Str_SHA256,(_DWORD)ikm,
Key_IV_Length,
0,
Keyinfo);
/*
AES有可能为128 或 256
可以都试一下
*/
Result = AESDecCBC((__int64)AES, (__int64)&Cipher, &IV, 2u);

import base64
from cryptography.hazmat.primitives import hashes
from cryptography.hazmat.primitives.kdf.hkdf import HKDF
from cryptography.hazmat.primitives.ciphers import Cipher, algorithms, modes
from cryptography.hazmat.backends import default_backend
from cryptography.hazmat.primitives.padding import PKCS7

# 给定参数
ikm = 'CompressedEmbeddedResources'
EncryptedFlag = '@GFxmVucV6MVUXiWCMAnWpyvzXoLdHc5CmFeim+JjUBszB8HFX8Ku8NMc201AGZ9X'
Keyinfo = 'HGAME2025'
ciphertext = base64.b64decode(EncryptedFlag)

def decrypt_with_params(key_length_type, derived_key, iv):
    try:
        # 选择AES算法
        if key_length_type == 128:
            algorithm = algorithms.AES(derived_key) # 传入16字节密钥自动识别为AES-128
        elif key_length_type == 256:
            algorithm = algorithms.AES(derived_key) # 传入32字节密钥自动识别为AES-256
        
        # 创建解密器
        cipher = Cipher(algorithm, modes.CBC(iv), backend=default_backend())
        decryptor = cipher.decryptor()
        
        # 执行解密并去除填充
        decrypted_padded = decryptor.update(ciphertext) + decryptor.finalize()
        unpadder = PKCS7(128).unpadder()
        decrypted = unpadder.update(decrypted_padded) + unpadder.finalize()
        
        return decrypted.decode('utf-8')
    
    except Exception as e:
        return f"解密失败：{str(e)}"

# 尝试两种可能性组合
def try_combinations():
    # 组合1：Key_IV_Length=32（AES-128）
    hkdf_32 = HKDF(
        algorithm=hashes.SHA256(),
        length=32,
        salt=b'',
        info=Keyinfo.encode(),
    )
    key_iv_32 = hkdf_32.derive(ikm.encode())
    result_128 = decrypt_with_params(128, key_iv_32[:16], key_iv_32[16:32])

    # 组合2：Key_IV_Length=48（AES-256）
    hkdf_48 = HKDF(
        algorithm=hashes.SHA256(),
        length=48,
        salt=b'',
        info=Keyinfo.encode(),
    )
    key_iv_48 = hkdf_48.derive(ikm.encode())
    result_256 = decrypt_with_params(256, key_iv_48[:32], key_iv_48[32:48])

    # 验证结果
    flag_prefix = "hgame{"
    valid_results = []
    for name, result in [("AES-128-CBC", result_128), ("AES-256-CBC", result_256)]:
        if flag_prefix in result:
            valid_results.append(f"[成功] 使用{name}解密\nFlag: {result}")
    
    return "\n\n".join(valid_results) if valid_results else "所有组合尝试均失败"

# 执行解密
print(try_combinations())

Ancient Recall

原矩阵：

计算逆矩阵，左乘250次，求出的索引再处理下大阿卡那正逆向，得出原始索引：

from fractions import Fraction

# 塔罗牌配置（与题设相同）
Major_Arcana = ["The Fool", "The Magician", "The High Priestess","The Empress", "The Emperor", "The Hierophant","The Lovers", "The Chariot", "Strength","The Hermit", "Wheel of Fortune", "Justice","The Hanged Man", "Death", "Temperance","The Devil", "The Tower", "The Star","The Moon", "The Sun", "Judgement","The World"]
wands = ["Ace of Wands", "Two of Wands", "Three of Wands", "Four of Wands", "Five of Wands", "Six of Wands", "Seven of Wands", "Eight of Wands", "Nine of Wands", "Ten of Wands", "Page of Wands", "Knight of Wands", "Queen of Wands", "King of Wands"]
cups = ["Ace of Cups", "Two of Cups", "Three of Cups", "Four of Cups", "Five of Cups", "Six of Cups", "Seven of Cups", "Eight of Cups", "Nine of Cups", "Ten of Cups", "Page of Cups", "Knight of Cups", "Queen of Cups", "King of Cups"]
swords = ["Ace of Swords", "Two of Swords", "Three of Swords", "Four of Swords", "Five of Swords", "Six of Swords", "Seven of Swords", "Eight of Swords", "Nine of Swords", "Ten of Swords", "Page of Swords", "Knight of Swords", "Queen of Swords", "King of Swords"]
pentacles = ["Ace of Pentacles", "Two of Pentacles", "Three of Pentacles", "Four of Pentacles", "Five of Pentacles", "Six of Pentacles", "Seven of Pentacles", "Eight of Pentacles", "Nine of Pentacles", "Ten of Pentacles", "Page of Pentacles", "Knight of Pentacles", "Queen of Pentacles", "King of Pentacles"]
Minor_Arcana = wands + cups + swords + pentacles
tarot = Major_Arcana + Minor_Arcana

# 原变换矩阵的逆矩阵（使用分数精确表示）
M_inv = [
    [Fraction(1,2), Fraction(-1,2), Fraction(1,2), Fraction(-1,2), Fraction(1,2)],
    [Fraction(1,2), Fraction(1,2), Fraction(-1,2), Fraction(1,2), Fraction(-1,2)],
    [Fraction(-1,2), Fraction(1,2), Fraction(1,2), Fraction(-1,2), Fraction(1,2)],
    [Fraction(1,2), Fraction(-1,2), Fraction(1,2), Fraction(1,2), Fraction(-1,2)],
    [Fraction(-1,2), Fraction(1,2), Fraction(-1,2), Fraction(1,2), Fraction(1,2)]
]

# 加密后的最终数值
final_values = [
    2532951952066291774890498369114195917240794704918210520571067085311474675019,
    2532951952066291774890327666074100357898023013105443178881294700381509795270,
    2532951952066291774890554459287276604903130315859258544173068376967072335730,
    2532951952066291774890865328241532885391510162611534514014409174284299139015,
    2532951952066291774890830662608134156017946376309989934175833913921142609334
]

# 转换数值类型为分数并应用逆变换
current = [Fraction(v) for v in final_values]
for _ in range(250):
    current = [
        sum(M_inv[i][j] * current[j] for j in range(5))
        for i in range(5)
    ]

# 转换回整数并处理牌面
original_values = [int(x) for x in current]
flag_parts = []

for vi in original_values:
    # 处理大阿卡那正逆向
    reversed_idx = vi ^ (-1)
    if 0 <= reversed_idx < len(Major_Arcana):
        flag_parts.append(f"re-{Major_Arcana[reversed_idx]}")
    elif 0 <= vi < len(Major_Arcana):
        flag_parts.append(Major_Arcana[vi])
    else:
        idx = vi % len(tarot)
        flag_parts.append(tarot[idx])

flag = "hgame{" + "&".join(flag_parts).replace(" ", "_") + "}"
print(flag)
hgame{re-The_Moon&re-The_Sun&Judgement&re-Temperance&Six_of_Cups}

Nop’d

模拟了一个半主机(SemiHosting)系统：

Host System：launcher

Target System：game

奇特的NOP调用约定：

game内部采用包裹在syscall周围的多字节的NOP指令传参

SIB.Scale == 0（rax无缩放）：REX.B + SIB.Base 获取基址寄存器编号，按照launcher内的switch表查表取值，这里表是正常的，直接看就行

SIB.Scale > 0（rax有缩放）：那么就按照rsp + 8 * SIB.Base从栈上传参

最后一个字节为：参数编号，从1开始，编号1的参数是Call_Number, 也就是调用Host System的函数索引

例如：48 0F 1F 44 41 03 nop qword ptr [rcx+rax*2+3] 其中变址寄存器rax乘了2，即有rax缩放，lacuncher读取game的栈上数据作为参数，参数编号为3

例如：49 0F 1F 44 01 02 nop qword ptr [r9+rax+2] 其中变址寄存器rax没乘，即没有rax缩放，lacuncher读取game的r9数据作为参数，参数编号为2
**launcher**中的检验逻辑：
  if ( (byte[0] & 0xFC) != 0x48   // REX字节
      || byte[1] != 0x0F          // NOP 操作码部分
      || byte[2] != 0x1F          // NOP 操作码部分
      || (byte[3] & 0xC7) != 0x44 // ModR/M
        //byte[4]                 // SIB 字节 
      || byte[5] != 0x7F) {      // 偏移量检查
      // 非目标指令，跳过处理
  }
**launcher**提供的服务（接口函数）：
  0. Sub_0_return_0
  1. UsrInput_fgets_1
  2. What_s_your_name_?_puts_2
  3. Sub_ChaChaQR_20_return_0_3
  4. Shuffle_4
  5. state_init_5
  6. Addstate_6
  7. Check_7
  8. return_A_number_8
  9. reutrn_0_set_rcx_9
**Chacha20**需要：

0x61707865, 0x3320646e, 0x79622d32, 0x6b206574(16Bytes)(ASCII “expand 32-byte k”)

Key(32 Bytes)

Counter(4 Bytes)

Nounce(12 Bytes) 常数

奇妙的20层：

完整轮次（Double Round）

ChaCha20 共执行 20 轮（10 次双轮） 操作，每双轮包含：

列轮（Column Round）：对矩阵的 4 列 应用 QR。

行轮（Diagonal Round）：对矩阵的 4 条对角线 应用 QR。

列轮：对每列（0,4,8,12、1,5,9,13 等）应用 QR。

行轮：对对角线（0,5,10,15、1,6,11,12 等）应用 QR。

在”trust NOTHING but your OWN EYES.”之后便是是校验逻辑：

Note: Launcher的main函数没有什么问题，通过动调发现进入了一个满是ptrace的函数，就是Host System

或者看init_array段内有一个atexit函数注册了exit执行后的操作：

Key[32] = "It's all written in the Book of HGAME...\n"
Nounce[12] = "What's your name?> "
unsigned char RAND_POOL[51] =
{
  0x64, 0x6A, 0x50, 0x17, 0x81, 0x7D, 0x6F, 0x1A, 0x87, 0xB1, 
  0xA4, 0x00, 0x09, 0x03, 0xF8, 0x8D, 0xF8, 0x6B, 0xDF, 0x32, 
  0x5F, 0x40, 0x90, 0x9C, 0xB8, 0x3D, 0x86, 0x13, 0x26, 0xB7, 
  0x63, 0xF7, 0x74, 0xE8, 0x53, 0xED, 0x58, 0x20, 0x4F, 0xD9, 
  0x99, 0x26, 0x21, 0x37, 0xDE, 0x35, 0x76, 0xC8, 0xBC, 0xD0, 
  0x6E
};

ebp初始值 = 0x46

程序流程：

ChaCha20没有魔改：
- 使用Key[32]、Nounce[12]、初始化矩阵

用得到的密钥流块（state）,进行：(RAND_POOL[i] ^ ebp) ^ state_0[i]：

  loop_start:
      lea     rcx, _end
      lea     rax, [rcx-40h]        ; Input buffer start
      
      movzx   edx, byte ptr [rax]   ; Load byte
      xor     dl, [r12]             ; XOR with key byte
      xor     ebp, edx              ; Additional XOR
      mov     [rax], bpl            ; Store modified byte
      add     rax, 1                ; Move buffer pointer
      add     r12, 1                ; Move key pointer
      cmp     rax, rcx              ; Check end of buffer
      jnz     short loop_start

最后和对比RAND_POOL，判断对错
编写解密脚本解密正确flag：

## 解密脚本
from Crypto.Cipher import ChaCha20

# 定义密钥、计数器和Nonce
key = bytes([0x49, 0x74, 0x27, 0x73, 0x20, 0x61, 0x6C, 0x6C, 0x20, 0x77, 
             0x72, 0x69, 0x74, 0x74, 0x65, 0x6E, 0x20, 0x69, 0x6E, 0x20, 
             0x74, 0x68, 0x65, 0x20, 0x42, 0x6F, 0x6F, 0x6B, 0x20, 0x6F, 
             0x66, 0x20])
nonce = bytes([0x57, 0x68, 0x61, 0x74, 0x27, 0x73, 0x20, 0x79, 0x6F, 0x75, 0x72, 0x20])

# 初始化ChaCha20并生成密钥流
cipher = ChaCha20.new(key=key, nonce=nonce)
state_0 = cipher.encrypt(bytes(64))[:51]  # 生成64字节块后取前51字节

# 目标密文数据
RAND_POOL = bytes([
  0x64, 0x6A, 0x50, 0x17, 0x81, 0x7D, 0x6F, 0x1A, 0x87, 0xB1, 
  0xA4, 0x00, 0x09, 0x03, 0xF8, 0x8D, 0xF8, 0x6B, 0xDF, 0x32, 
  0x5F, 0x40, 0x90, 0x9C, 0xB8, 0x3D, 0x86, 0x13, 0x26, 0xB7, 
  0x63, 0xF7, 0x74, 0xE8, 0x53, 0xED, 0x58, 0x20, 0x4F, 0xD9, 
  0x99, 0x26, 0x21, 0x37, 0xDE, 0x35, 0x76, 0xC8, 0xBC, 0xD0, 
  0x6E
])

# 逆向异或操作
ebp_mask = 0x46  # 初始掩码
flag = []
for i, c in enumerate(RAND_POOL):
    # 解密流程 (逆向运算)
    decrypted = (c ^ ebp_mask) ^ state_0[i]
    flag.append(decrypted)
    
    # 更新掩码 (必须模拟加密时的掩码生成过程)
    ebp_mask = (ebp_mask ^ (decrypted ^ state_0[i])) & 0xFF

print(bytes(flag))

两个问题：

再launcher的调试下，sys_write不管用了，因为强制了syscall返回-1
最后的汇编有一个hlt，我看见了调用编号为9的函数内：

如何跳过玩家HP校验，让game一直进行到21层的？

invest in hint

将二进制反转

二进制里面的每一个‘1’都对应那行字符串的一个字符（从左到右顺序）（因为每行二进制的‘1’的个数正好是对应字符串的长度）

设二进制里的‘1’为有效位

编写脚本：将所有二进制行的有效位对应的字符存入flag数组（长度为71）中，注意存入的位置要与该行二进制位的位置一样，若flag数组的目标位置已经有字符，则不存

Exp:

## 二进制数据
binary_hints = [
    "00100011110110000000000000000000101110001001000000001011110010100110000",
    "00000011001110001001000000000110110010000100010100000000011011100010110",
    "00000000000010001101010111010110001000010110010001100011010000000100101",
    "11100000111010000011100110100100001000000100001100100001001000001010000",
    "00010000000110100011110000011001101011000000000000000000100100101001110",
    "00000111001000010011001000100010010111011110111101001000010010000101110",
    "00011000100010001001101100000101101010010100110000011000000001010100001",
    "00000101110110000010100001100001100000100100110000010010000010111100000",
    "10101010100001000100011010000000000000101110010010000000010010010110010",
    "11110000100010010101001001110000100100110011001000111011001100101001001",
    "00101000100010000110100000010001110001011000000000010000011000100010010",
    "10110010010110001000111100010000000010001000001110100011100001000010100",
    "00000010000000000000001000100100011010001010000101000000001011101000010",
    "00101010000011110101000110100011101100010100000111010010011000000000110",
    "00001101001111010100111011011101100001101101010110000001001010000010000",
    "00001000000101010110011100010000101101000010001111011100000000101001010"
]

## 对应字符串
string_lines = [
    "aAug5MkyAzq6Dr2mCALwmH",
    "AuYMk9CKay2q9NCADLEwH42",
    "k99C7r0gSKaAi91Nxu2mAm4}",
    "hgag5YkACir0QKA9lCumDdH",
    "mMk3ACi7SCWyAq3C5wda42",
    "{AuYoACLQa2zq3i691hNlCxrALma42",
    "megk9CiLrKWyAqi9hN8rELm}",
    "{ug5MkAigQWyt9hN82LwLdm",
    "haeAgf97L0t691NbALLmH2",
    "hgamgko9CLgQSyzti1Dlu8r2mD5wda}",
    "aegk9AiSWy23i68ADwH2",
    "hamA5Mk9i7LrSq6lCbu2mCEH4",
    "ALQK2Aq61CxDLEwd2",
    "aeAkf3o9Cr0QaWyAzi9Cbx82AD42",
    "e{uYMkfo9i7L0gSCKWy3t69DNCbmDLH",
    "eMfo9A7LrSyAz31lCbx8rRwda2"
]

## 初始化flag数组
flag = [None] * 71

## 处理每个二进制-字符串对
for bin_str, s in zip(binary_hints, string_lines):
    # 获取所有有效位（'1'的位置索引）
    active_indices = [idx for idx, bit in enumerate(bin_str) if bit == '1']
    
    # 验证字符串长度与有效位数匹配
    if len(active_indices) != len(s):
        print(f"Error: 有效位数量 ({len(active_indices)}) 与字符串长度 ({len(s)}) 不匹配")
        continue
    
    # 填充flag数组（跳过已填充的位）
    for pos, char in zip(active_indices, s):
        if flag[pos] is None:
            flag[pos] = char

## 组合最终结果并输出
final_flag = ''.join([c if c is not None else '?' for c in flag])
print(final_flag)
hgame{Aug5YMkf3o99ACi7Lr0gQSCKaWy2Azq3ti691DhNlCbxu8rR2mCAD5LEwLdmHa42}

Middlemen

找ucontext_t结构体

先UsrInput[8:16] XOR 'Sevenlikeseccmop'

后AES_ECB.encrypt(UsrInput) == Cipher

缺UsrInput[8:16]

seccomp过滤器能够拦截特定的syscall，其规则由BPF字节码撰写，由BPF虚拟机运行

既然有虚拟机，那就一定有额外的校验逻辑能够约束得到这后八字节

使用seccomp-tools反汇编过滤规则（BPF字节码）

syscall被拦截，进入信号处理函数：

缺Usrinput后八字节，看seccomp的过滤规则：

字节码：

seccomp-tools反汇编：

// 小端序,该算法可逆，应该可以解出args[2] args[3]
unsigned int args[6];
int nr = 0xAC
args[0] = *(_QWORD *)Str
args[1] = *(_QWORD *)&Str[4]
args[2] = *(_QWORD *)&Str[8]
args[3] = *(_QWORD *)&Str[12]
args[4] = 0x221221LL

mem0 = args[2];                
mem1 = args[3];          

mem2 = (args[3] << 4) + 0x65766573; 
temp = args[3] + 0x22122122;       
tmp = mem2 ^ temp; 
mem0 + tmp == 0x93cd6340 // 条件 1

mem0 = mem0 + tmp;
mem2 = (mem0 >> 5) + 0x6e6e6e6e;
temp2 = mem0 + 0x22122122; 
tmp2 = mem2 ^ temp2;  
mem1 + tmp2 == 0xb5f40d3f // 条件 2

GPT反编译：

function filter(arch, sys_number, args):
{
    // --- 检查架构
    if ( arch != 0xc00000b7 )            // 0xc00000b7 表示 ARCH_AARCH64
        return ALLOW;                   // 跳转到 0040：返回 ALLOW

    // --- 从参数中取出数据
    mem0 = args[2];                     // 对应指令 0002~0003
    mem1 = args[3];                     // 对应指令 0004~0005

    // --- 第一阶段计算（指令 0006~0019）
    // 计算 mem2 = (args[3] << 4) + 0x65766573
    // 其中 0x65766573 对应 ASCII “seve”（或“eves”，视大小端排列而定）
    mem2 = (args[3] << 4) + 0x65766573;  // 指令 0006~0008

    // 取 args[3]，加上常量 0x22122122（即 571613474），存入临时变量 temp
    temp = args[3] + 0x22122122;         // 指令 0009~0012

    // 令 X = temp，然后计算：XOR 运算
    // 即：tmp = mem2 XOR temp
    tmp = mem2 ^ temp;                   // 指令 0014~0016（X 先保存了 temp 的值，经 mem2 异或后成为 tmp）

    // 将 mem0 与 tmp 相加，结果必须等于 0x93cd6340
    // 0x93cd6340 == 2479711040
    if ( mem0 + tmp != 0x93cd6340 )      // 指令 0017~0019
        return ALLOW;                  // 检测不符则跳转到 0040

    // 更新 mem0 为：mem0 = mem0 + tmp
    mem0 = mem0 + tmp;                   // 指令 0020

    // --- 第二阶段计算（指令 0021~0034）
    // 计算新 mem2 = (mem0 >> 5) + 0x6e6e6e6e
    // 0x6e6e6e6e 对应 ASCII "nnnn"
    mem2 = (mem0 >> 5) + 0x6e6e6e6e;      // 指令 0021~0023

    // 再次取 mem0，加上常量 0x22122122，得到 temp2
    temp2 = mem0 + 0x22122122;           // 指令 0024~0027（先将 mem0 取出，再加常量）

    // 令 tmp2 = mem2 XOR temp2
    tmp2 = mem2 ^ temp2;                 // 指令 0029~0031

    // 计算 mem1 + tmp2，结果必须等于 0xb5f40d3f
    // 0xb5f40d3f == 3052670271
    if ( mem1 + tmp2 != 0xb5f40d3f )     // 指令 0032~0034
        return ALLOW;                  // 不符则返回 ALLOW

    // --- 检查系统调用号和额外参数（指令 0035~0038）
    if ( sys_number != 0xac )           // 0xac 表示 aarch64.getpid 的 syscall 编号
        return ALLOW;                  // 指令 0035~0036

    if ( args[4] != 0x221221 )           // 指令 0037~0038
        return ALLOW;

    // --- 所有检测均通过
    return TRAP;                       // 指令 0039返回 TRAP

    // 注意：后面两个 return 指令（0040 返回 ALLOW、0041 返回 ERRNO(0)）是作为跳转目标，
    //       当检测失败时跳转到 0040，从而返回 ALLOW；而 0041 则永远不会被执行。
}

Exp1:

def decrypt():
    # 常量定义（均为32位无符号整数运算）
    CONST1   = 0x65766573        # mem2第一部分常量
    CONST2   = 0x22122122        # 加法常量
    TARGET1  = 0x93cd6340        # 条件1： args[2] + tmp == TARGET1
    CONST3   = 0x6e6e6e6e        # mem2第二部分常量
    TARGET2  = 0xb5f40d3f        # 条件2： args[3] + tmp2 == TARGET2

    mem2_2 = ((TARGET1 >> 5) + CONST3) & 0xffffffff
    temp2  = (TARGET1 + CONST2) & 0xffffffff
    tmp2   = mem2_2 ^ temp2
    y = (TARGET2 - tmp2) & 0xffffffff

    # 根据条件1反推 x
    mem2_1 = ((y << 4) + CONST1) & 0xffffffff
    temp   = (y + CONST2) & 0xffffffff
    tmp    = mem2_1 ^ temp
    x = (TARGET1 - tmp) & 0xffffffff

    return x, y

if __name__ == "__main__":
    x, y = decrypt()
    print("解密结果:")
    print("args[2] = 0x{:08X}".format(x))
    print("args[3] = 0x{:08X}".format(y))
"""
args[2] = 0x4D19D88C
args[3] = 0xEF20AF55
"""

Exp2:

from Crypto.Cipher import AES

# 题目给出的 16 字节密文
cipher_bytes = bytes([
    0xB7, 0x62, 0x40, 0x6A, 0xEB, 0x70, 0xB9, 0xED,
    0x81, 0x71, 0xDB, 0x9D, 0xAC, 0x82, 0xFF, 0x94
])

# 给定字符串
s = "Sevenlikeseccmop"  # 长度 16

args2 = int.to_bytes(0x4D19D88C, length=4, byteorder='little') # 8cd81965
args3 = int.to_bytes(0xEF20AF55, length=4, byteorder='little') # 55af20d7 
combine = args2 + args3
print(combine)

aes_key = bytes(combine[i % 8] ^ ord(s[i]) for i in range(16))

cipher = AES.new(aes_key, AES.MODE_ECB)
plaintext = cipher.decrypt(cipher_bytes)

print("解密结果（Hex 表示）  :", plaintext.hex())
# hgame{34ae7f8b-6059-4587-8cd8-194d55af20ef}

附录

逆出来的`.NET`主函数

__int64 FastAndFrustrating_FastAndFrustrating_Program__Main()
{
  Class *SomeClass; // rbx
  __int64 v1; // rsi
  _UNKNOWN **Line; // rdx
  unsigned __int64 Input; // rax
  __int64 MemStream; // rsi
  GCSTATICS *GCSTATICS; // rdi
  __int64 b46Decoded; // rax
  __int64 GZipDecompressedStream; // r14
  void **ConstrsContext; // rax
  unsigned __int64 CorrectInputJsonObject; // rax
  JsonObject *JsonObject; // rcx
  SomeStr_1 *mat_a; // rsi
  __int64 DelInstance; // r15
  JsonObject *temp; // rsi
  SomeStr_2 *vec_b; // r15
  SomeStr_1 *Mat_a; // rsi
  __int64 DelInst; // r13
  __int64 res; // rsi
  AESInstance *AES; // rsi
  ConmmonStr *ikm; // r13
  int IV_Size; // r12d
  int Key_IV_Length; // ebx
  __int64 v22; // r12
  __int64 Keyinfo; // rax
  ConmmonStr *Key_derived; // rbx
  int KeySize; // eax
  __int64 SubArray_UInt8; // rax
  ConmmonStr *Cipher; // rax
  _BYTE *CipherContent; // rdi
  int CipherLen; // r13d
  unsigned int Key_Length; // r15d
  unsigned int IVLength; // ecx
  _BYTE *IV_Str; // rcx
  unsigned int IV_length; // edx
  unsigned int v34; // eax
  __int64 Result; // rax
  __int64 String; // rax
  __int128 IV; // [rsp+40h] [rbp-68h] BYREF
  __int128 cipher; // [rsp+50h] [rbp-58h] BYREF
  __int64 Size; // [rsp+60h] [rbp-48h]

  IV = 0LL;
  cipher = 0LL;
  SomeClass = (Class *)RhpNewFast(&FastAndFrustrating_FastAndFrustrating_Program___c__DisplayClass3_0::`vftable');
  System_Console_System_Console__Write_15(&_Str_Give_me_your_key____D0E89D1A9D72C2840D5ED16F3F9B221A4D37C237A4202F7E37B797AC4245CDAD);
  if ( *(&___NONGCSTATICS_S_P_CoreLib_System_Text_ASCIIEncoding__ - 1) )
    _GetGCStaticBase_S_P_CoreLib_System_Text_ASCIIEncoding();
  v1 = *(_QWORD *)(___GCSTATICS_S_P_CoreLib_System_Text_ASCIIEncoding__ + 8);
  Line = (_UNKNOWN **)System_Console_System_Console__ReadLine();
  if ( !Line )
    Line = &_Str_;
  Input = (*(__int64 (__fastcall **)(__int64, _UNKNOWN **))(*(_QWORD *)v1 + 120LL))(v1, Line);
  RhpAssignRefAVLocation((unsigned __int64 *)&SomeClass->UsrInput, Input);
  MemStream = RhpNewFast(&S_P_CoreLib_System_IO_MemoryStream::`vftable');
  if ( *(&___NONGCSTATICS_FastAndFrustrating_FastAndFrustrating_Program__ - 1) )
    _GetGCStaticBase_FastAndFrustrating_FastAndFrustrating_Program();
  GCSTATICS = (GCSTATICS *)GCSTATICS_Program;
  b46Decoded = S_P_CoreLib_System_Convert__FromBase64String(*(_QWORD *)(GCSTATICS_Program + 8));
  S_P_CoreLib_System_IO_MemoryStream___ctor_2(MemStream, b46Decoded, 1LL);
  GZipDecompressedStream = RhpNewFast(&System_IO_Compression_System_IO_Compression_GZipStream::`vftable');
  System_IO_Compression_System_IO_Compression_GZipStream___ctor_0(GZipDecompressedStream, MemStream, 0LL, 0LL);
  if ( *(&___NONGCSTATICS_FastAndFrustrating_FastAndFrustrating_ConstrsJsonContext__ - 1) )
    _GetGCStaticBase_FastAndFrustrating_FastAndFrustrating_ConstrsJsonContext();
  ConstrsContext = FastAndFrustrating_FastAndFrustrating_ConstrsJsonContext__get_Constrs(*(_QWORD *)(___GCSTATICS_FastAndFrustrating_FastAndFrustrating_ConstrsJsonContext__ + 16));
  CorrectInputJsonObject = JsonSerializer__Deserialize(
                             &_GenericDict_System_Text_Json_System_Text_Json_JsonSerializer__Deserialize_21_FastAndFrustrating_FastAndFrustrating_Constrs_,
                             GZipDecompressedStream,
                             ConstrsContext);
  RhpAssignRefAVLocation((unsigned __int64 *)&SomeClass->JsonObject, CorrectInputJsonObject);
  JsonObject = SomeClass->JsonObject;
  if ( JsonObject )
  {
    mat_a = JsonObject->mat_a;
    if ( mat_a )
    {
      if ( mat_a->Length > 0 && mat_a->Length == JsonObject->vec_b->Length )// Check Length
      {
        DelInstance = RhpNewFast(&S_P_CoreLib_System_Func_2___Array_Int32___Bool_::`vftable');
        _DelegateCtor_S_P_CoreLib_System_Delegate__InitializeClosedInstance__FastAndFrustrating_FastAndFrustrating_Program___c__DisplayClass3_0___Main_b__0(
          DelInstance,
          (__int64)SomeClass);
        if ( (unsigned int)System_Linq_System_Linq_Enumerable__All_System___Canon_(
                             &_GenericDict_System_Linq_System_Linq_Enumerable__All___Array_Int32__,
                             mat_a,
                             DelInstance) )
        {
          temp = SomeClass->JsonObject;
          vec_b = temp->vec_b;
          if ( LODWORD(SomeClass->UsrInput->Length) != vec_b->Length
            || (Mat_a = temp->mat_a,
                DelInst = RhpNewFast(&S_P_CoreLib_System_Func_2_S_P_CoreLib_System_ValueTuple_2___Array_Int32___Int32___Bool_::`vftable'),
                res = System_Linq_System_Linq_Enumerable__Zip_0_System___Canon__Int32_(
                        &_GenericDict_System_Linq_System_Linq_Enumerable__Zip_0___Array_Int32___Int32_,
                        Mat_a,
                        vec_b),                 // Caculate Ax = b
                _DelegateCtor_S_P_CoreLib_System_Delegate__InitializeClosedInstance__FastAndFrustrating_FastAndFrustrating_Program___c__DisplayClass3_0___Main_b__1(
                  DelInst,
                  (__int64)SomeClass),
                !(unsigned int)System_Linq_System_Linq_Enumerable__All_S_P_CoreLib_System_ValueTuple_2_System___Canon__Int32__(
                                 (__int64)&_GenericDict_System_Linq_System_Linq_Enumerable__All_S_P_CoreLib_System_ValueTuple_2___Array_Int32___Int32__,
                                 res,
                                 DelInst)) )    // compare(result_x, UsrInput)
          {
            System_Console_System_Console__WriteLine_12(&_Str_Try_again__9A6F7D76B5372DD9138EB55694976E1F946617CC48B7F18BECFC267CE0E4BAA0);
            return _InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_FastAndFrustrating_FastAndFrustrating_Program__Main(GZipDecompressedStream);
          }
          AES = (AESInstance *)RhpNewFast(&System_Security_Cryptography_System_Security_Cryptography_AesImplementation::`vftable');
          System_Security_Cryptography_System_Security_Cryptography_Aes___ctor(AES);
          ikm = SomeClass->UsrInput;
          IV_Size = ((__int64 (__fastcall *)(AESInstance *))AES->Methods->GetKeySize)(AES);
          Key_IV_Length = (int)(AES->Methods->GetIvSize(AES) + IV_Size) / 8;
          if ( *(&___NONGCSTATICS_S_P_CoreLib_System_Text_UTF8Encoding__ - 1) )
            _GetGCStaticBase_S_P_CoreLib_System_Text_UTF8Encoding();
          v22 = ___GCSTATICS_S_P_CoreLib_System_Text_UTF8Encoding__;
          Keyinfo = GetBytes(*(_QWORD *)(___GCSTATICS_S_P_CoreLib_System_Text_UTF8Encoding__ + 8), GCSTATICS->KeyInfo);
          Key_derived = (ConmmonStr *)HKDF__DeriveKey((__int64)&_Str_SHA256, (__int64)ikm, Key_IV_Length, 0LL, Keyinfo);
          KeySize = ((__int64 (__fastcall *)(AESInstance *))AES->Methods->GetKeySize)(AES);
          if ( KeySize / 8 < 0 )
            S_P_CoreLib_System_Index__ThrowValueArgumentOutOfRange_NeedNonNegNumException((unsigned int)(KeySize / 8));
          LODWORD(Size) = 0;
          HIDWORD(Size) = KeySize / 8;
          SubArray_UInt8 = S_P_CoreLib_System_Runtime_CompilerServices_RuntimeHelpers__GetSubArray_UInt8_(
                             Key_derived,
                             Size);
          AES->Methods->GetKey(AES, SubArray_UInt8);// Pass the Key
          Cipher = (ConmmonStr *)S_P_CoreLib_System_Convert__FromBase64String(GCSTATICS->Encrypted_Flag);
          if ( Cipher )
          {
            CipherContent = Cipher->StrContent;
            CipherLen = Cipher->Length;
          }
          else
          {
            CipherContent = 0LL;
            CipherLen = 0;
          }
          Key_Length = ((int (__fastcall *)(AESInstance *))AES->Methods->GetKeySize)(AES) / 8;
          IVLength = (int)AES->Methods->GetIvSize(AES) / 8;
          if ( Key_derived )
          {
            if ( IVLength + (unsigned __int64)Key_Length <= LODWORD(Key_derived->Length) )
            {
              v34 = IVLength;
              IV_Str = &Key_derived->StrContent[Key_Length];// Get IV
              IV_length = v34;
              goto LABEL_29;
            }
          }
          else if ( !(Key_Length | IVLength) )
          {
            IV_Str = 0LL;
            IV_length = 0;
LABEL_29:
            *(_QWORD *)&cipher = CipherContent;
            DWORD2(cipher) = CipherLen;
            *(_QWORD *)&IV = IV_Str;
            DWORD2(IV) = IV_length;
            Result = AESDecCBC((__int64)AES, (__int64)&cipher, &IV, 2u);// AES Decrypt
            String = S_P_CoreLib_System_Text_UTF8Encoding_UTF8EncodingSealed__GetString(*(_QWORD *)(v22 + 8), Result);
            System_Console_System_Console__WriteLine_13(
              &_Str_Good_job__Here_is_your_flag____B54570A8B75960258647708972072AECA79CAD4FF75EB8CCEC82836A136BFB03,
              String);
            _InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_FastAndFrustrating_FastAndFrustrating_Program__Main(AES);
            return _InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_FastAndFrustrating_FastAndFrustrating_Program__Main(GZipDecompressedStream);
          }
          S_P_CoreLib_System_ThrowHelper__ThrowArgumentOutOfRangeException();
        }
      }
    }
  }
  System_Console_System_Console__WriteLine_12(&_Str_An_error_has_occured__58E42DDA92A22882359DDD4568D3BCE30A8B18043B88DBE9437ED44D45B6C43E);
  return _InterfaceDispatchCell_S_P_CoreLib_System_IDisposable__Dispose_FastAndFrustrating_FastAndFrustrating_Program__Main(GZipDecompressedStream);
}

逆出来的`launcher`

__int64 __fastcall sub_555555555B9B(unsigned int pid)
{
  unsigned int PID; // ebx
  char i; // bl
  int Index; // ebx
  unsigned __int64 REG; // rax
  __int64 v5; // r15
  char Idx; // dl
  unsigned __int64 Funcret; // r15
  int (__fastcall *Func)(); // rax
  unsigned int pida; // [rsp+4h] [rbp-64h]
  __int64 regster; // [rsp+18h] [rbp-50h] BYREF
  _BYTE NOPInstruction[4]; // [rsp+22h] [rbp-46h] BYREF
  unsigned __int8 SIB_BYTE; // [rsp+26h] [rbp-42h]
  unsigned __int8 NOPInstruction_5; // [rsp+27h] [rbp-41h]
  unsigned __int64 v15; // [rsp+28h] [rbp-40h]

  PID = pid;
  v15 = __readfsqword(0x28u);
  waitpid(pid, 0LL, 0);
  ptrace(PTRACE_SETOPTIONS, pid, 0LL, 0x100000LL); // PTRACE_O_EXITKILL 
  while ( ptrace(PTRACE_SYSCALL, PID, 0LL, 0LL) >= 0 )
  {
    // RIP 寄存器会指向 SYSCALL 指令的下一条指令

    // **等待syscall-enter通知**
    waitpid(PID, 0LL, 0); 
    ptrace(PTRACE_GETREGS, PID, 0LL, &regs);
    Ptrace_Peektext(PTRACE_PEEKTEXT, PID, (__int64)ripData, regs.rip - 8, 6uLL);// rip - 8 取到了NOP调用的头
    
    // **检查头**
    if ( (ripData[0] & 0xFC) != 0x48
      || ripData[1] != 0xF
      || ripData[2] != 0x1F
      || (ripData[3] & 0xC7) != 0x44
      || ripData[5] != 0x7F )
    {
      regster = regs.rip;
      goto LABEL_41;
    }
    memset(IsEffective, 0, sizeof(IsEffective));
    Offset = 0LL;
    pida = PID;

    // **取参开始**
    for ( i = 0; ; i = 1 )
    {
      v5 = Offset;
      Ptrace_Peektext(PTRACE_PEEKTEXT, pida, (__int64)NOPInstruction, regs.rip + 6 * Offset, 6uLL); // 向后取
      // 读取参数和CALL_NUMBER
      if ( (NOPInstruction[0] & 0xFC) != 0x48
        || NOPInstruction[1] != 0xF
        || NOPInstruction[2] != 0x1F
        || (NOPInstruction[3] & 0xC7) != 0x44
        || NOPInstruction_5 == 0x7E )
      {
        // 检查尾
        break;
      }
      Index = (NOPInstruction_5 - 1) % 128;
      if ( SIB_BYTE > 0x3Fu ) // 是否存在放缩（SIB最高2为是否 > 0）
      {
        PtracePeekData(
          pida,
          (__int64)&regster,                    // REX.B + SIB.Base
          regs.rsp + ((8 * (SIB_BYTE & 7 | (unsigned __int8)(8 * (NOPInstruction[0] & 1)))) & 0x78),// 参数通过栈传递
          8uLL);
        Params[(unsigned __int8)Index] = regster;
      }
      else
      {
        switch ( SIB_BYTE & 7 | (unsigned __int8)(8 * (NOPInstruction[0] & 1)) )// 参数通过寄存器传递
        {
        // 查表取值
          case 0:
            REG = regs.orig_rax;
            break;
          case 1:
            REG = regs.rcx;
            break;
          case 2:
            REG = regs.rdx;
            break;
          case 3:
            REG = regs.rbx;
            break;
          case 4:
            REG = regs.rsp;
            break;
          case 5:
            REG = regs.rbp;
            break;
          case 6:
            REG = regs.rsi;
            break;
          case 7:
            REG = regs.rdi;
            break;
          case 8:
            REG = regs.r8;
            break;
          case 9:
            REG = regs.r9;
            break;
          case 10:
            REG = regs.r10;
            break;
          case 11:
            REG = regs.r11;
            break;
          case 12:
            REG = regs.r12;
            break;
          case 13:
            REG = regs.r13;
            break;
          case 14:
            REG = regs.r14;
            break;
          case 15:
            REG = regs.r15;
            break;
        }
        Params[(unsigned __int8)Index] = REG;
      }
      // 参数有效
      IsEffective[(unsigned __int8)Index] = 1;
      Offset = v5 + 1;
    }
    // **取参结束**

    // **调用函数与返回值**
    Idx = i;
    PID = pida;
    regster = regs.rip;
    if ( Idx )
    {
      Funcret = -38LL;
      if ( IsEffective[0] )
      {
        if ( Params[0] <= 9uLL )                // If the CALL_NUMBER_IS_EFFECTIVE
        {
          Func = (int (__fastcall *)())funcs_1DBD[Params[0]];
          if ( Func )
            Funcret = Func();
        }
        regs.orig_rax = -1LL;                   // 直接导致内核返回 ENOSYS 错误（功能未实现）
        ptrace(PTRACE_SETREGS, pida, 0LL, &regs);
      }
      ptrace(PTRACE_SYSCALL, pida, 0LL, 0LL);   // 允许继续执行
      // **等待syscall-exit通知**
      waitpid(pida, 0LL, 0);                    
      ptrace(PTRACE_GETREGS, pida, 0LL, &TempReg); // 转入返回值
      TempReg.rax = Funcret;
      TempReg.rip = regster;
      ptrace(PTRACE_SETREGS, pida, 0LL, &TempReg);
    }
    else
    {
LABEL_41:
      ptrace(PTRACE_SYSCALL, PID, 0LL, 0LL);
      waitpid(PID, 0LL, 0);
    }
    // **一套Semihosting Call结束**
    // **继续下一个**
  }
  return 0LL;
}

做题用到的结构体

/*
ptrace(PTRACE_GETREGS, PID, 0LL, &regs);中的regs是定义在定义在 <sys/user.h> 中的结构体
*/
struct user_regs_struct {
    unsigned long r15;
    unsigned long r14;
    unsigned long r13;
    unsigned long r12;
    unsigned long rbp;
    unsigned long rbx;
    unsigned long r11;
    unsigned long r10;
    unsigned long r9;
    unsigned long r8;
    unsigned long rax;       // Index = 10
    unsigned long rcx;
    unsigned long rdx;
    unsigned long rsi;
    unsigned long rdi;
    unsigned long orig_rax;  // 系统调用号
    unsigned long rip;       // 指令指针 Index = 16
    unsigned long cs;        // 代码段寄存器
    unsigned long eflags;    // 标志寄存器
    unsigned long rsp;       // 栈指针
    unsigned long ss;        // 栈段寄存器
    unsigned long fs_base;   // FS 段基址
    unsigned long gs_base;   // GS 段基址
    unsigned long ds;        // 数据段寄存器
    unsigned long es;        // 附加段寄存器
    unsigned long fs;
    unsigned long gs;
};
struct ucontext_t{
    unsigned long (uc_flags);
    struct ucontext_t *uc_link;
    stack_t uc_stack;
    sigset_t uc_sigmask;
    mcontext_t uc_mcontext;
};
struct mcontext_t{
    unsigned long long int (fault_address);
    unsigned long long int (regs)[31];
    unsigned long long int (sp);
    unsigned long long int (pc);
    unsigned long long int (pstate);
    /* This field contains extension records for additional processor
       state such as the FP/SIMD state.  It has to match the definition
       of the corresponding field in the sigcontext struct, see the
       arch/arm64/include/uapi/asm/sigcontext.h linux header for details.  */
    unsigned char __reserved[4096] __attribute__ ((__aligned__ (16)));
};
struct sock_fprog {
    unsigned short len;    // 本应是16位，但显示为64位0x2A
    struct sock_filter *filter;  // 应当是指针值
};

struct sock_filter {    /* Filter block */
    __u16   code;      // 2字节操作码
    __u8    jt;        // 1字节条件为真跳转步长
    __u8    jf;        // 1字节条件为假跳转步长
    __u32   k;         // 4字节通用参数
};
struct seccomp_data {
    int   nr;         // 系统调用号 (offset 0x00)
    __u32 arch;       // 架构标识 (offset 0x04)
    __u64 instruction_pointer; // 触发系统调用的指令地址 (offset 0x08)
    __u64 args[6];    // 系统调用的参数数组 (offset 0x10)
};

REX 字节的结构

REX 字节的二进制格式为 0100WRXB，共 4 个控制位：

SIB 字节的结构

SIB 字节由以下三部分组成（共 8 位）：

Scale（缩放因子，2 位）指定变址寄存器的缩放因子，可能的取值为：
1. 00b = 1 倍（无缩放）
2. 01b = 2 倍
3. 10b = 4 倍
4. 11b = 8 倍
Index（变址寄存器，3 位）通过 3 位编码指定变址寄存器（如 RAX, RBX 等），具体编码与寄存器编号一致：
1. 000b = RAX
2. 001b = RCX
3. 010b = RDX
4. 011b = RBX
5. 100b = RSP（通常禁用）
6. 101b = RBP（通常禁用）
7. 110b = RSI
8. 111b = RDI
在 64 位模式下，若存在 REX 前缀的 X 位（扩展变址寄存器），则支持扩展寄存器（如 R8-R15）。
Base（基址寄存器，3 位）通过 3 位编码指定基址寄存器（如 RBP, RDI 等），编码规则与 Index 类似：
1. 000b = RAX
2. 001b = RCX
3. 010b = RDX
4. 011b = RBX
5. 100b = RSP
6. 101b = RBP（若 Mod=00b 表示无基址）
7. 110b = RSI
8. 111b = RDI
在 64 位模式下，若存在 REX 前缀的 B 位（扩展基址寄存器），则支持扩展寄存器（如 R8-R15）。

ModR/M 字节结构

| 7 6 | 5 4 3 | 2 1 0 |
| --- | ----- | ----- |
| Mod | Reg   | R/M   |

Mod（模式，2 位）决定操作数的类型和寻址模式：
1. 00b: 内存寻址（无位移）或特殊寄存器操作。
2. 01b: 内存寻址（8 位位移）。
3. 10b: 内存寻址（16/32 位位移，取决于模式）。
4. 11b: 寄存器直接寻址（无内存操作）。
Reg（寄存器，3 位）指定源或目的寄存器，或作为操作码扩展：
1. 寄存器编码（如 000b = RAX/EAX/AX/AL，具体取决于操作数大小）。
2. 若指令无需 Reg 字段，则用于扩展操作码。
R/M（寄存器/内存，3 位）与 Mod 字段共同决定操作数的寻址模式：
1. 若 Mod=11b，R/M 直接编码寄存器。
2. 若 Mod≠11b，R/M 结合 SIB 字节描述内存地址。

Hgame 2025 week 1

Tue, 04 Mar 2025 00:00:00 GMT

Alias: Sh10l (个人赛事)
Status: re ak; crypto 2; misc 4

Compress dot new

了解下哈夫曼编码, 使用脚本解压：

import json

class HuffmanDecoder:
    def __init__(self, tree_json):
        self.root = json.loads(tree_json)
        self.current_node = self.root

    def decode_bit(self, bit):
        self.current_node = self.current_node['a'] if bit == '0' else self.current_node['b']
        if 's' in self.current_node:
            char = chr(self.current_node['s'])
            self.current_node = self.root  # 重置到根节点
            return char
        return None

def main():
    # 读取加密文件
    with open('enc.txt', 'r') as f:
        tree_json, encoded_bits = f.read().split('\n', 1)

    # 初始化解码器
    decoder = HuffmanDecoder(tree_json)
    
    # 执行解码
    result = []
    for bit in encoded_bits.strip():
        char = decoder.decode_bit(bit)
        if char:
            result.append(char)

    print("解密结果:", ''.join(result))

if __name__ == "__main__":
    main()

Turtle

手脱UPX，魔改RC4：

#include <stdio.h>
#include <string.h>
#include <stdint.h>

typedef uint8_t u8;

void ksa(const u8* key, int key_len, u8 S[256]) {
    int j = 0;
    for (int i = 0; i < 256; i++) S[i] = i;
    
    for (int i = 0; i < 256; i++) {
        j = (j + S[i] + key[i % key_len]) % 256;
        u8 temp = S[i];
        S[i] = S[j];
        S[j] = temp;
    }
}

void prga(u8 S[256], int length, u8 keystream[]) {
    int i = 0, j = 0;
    u8 S_copy[256];
    memcpy(S_copy, S, 256);
    
    for (int k = 0; k < length; k++) {
        i = (i + 1) % 256;
        j = (j + S_copy[i]) % 256;
        u8 temp = S_copy[i];
        S_copy[i] = S_copy[j];
        S_copy[j] = temp;
        keystream[k] = S_copy[(S_copy[i] + S_copy[j]) % 256];
    }
}

void another_prga(u8 S[256], int length, u8 keystream[]) {
    int idx = 0, j = 0;
    u8 S_copy[256];
    memcpy(S_copy, S, 256);
    
    for (int k = 0; k < length; k++) {
        idx = (idx + 1) % 256;
        j = (S_copy[idx] + j) % 256;
        u8 temp = S_copy[idx];
        S_copy[idx] = S_copy[j];
        S_copy[j] = temp;
        keystream[k] = S_copy[(S_copy[idx] + S_copy[j]) % 256];
    }
}

int main() {
    // Step 1: 解密输入密钥
    u8 yekyek[] = "yekyek";
    u8 enc_key[] = {0xCD, 0x8F, 0x25, 0x3D, 0xE1, 0x51, 0x4A};
    u8 S[256];
    
    // 生成yekyek的S盒
    ksa(yekyek, 6, S);
    
    // 生成PRGA密钥流
    u8 prga_keystream[7];
    prga(S, 7, prga_keystream);
    
    // 解密得到inputKey_1
    u8 inputKey_1[7];
    for (int i = 0; i < 7; i++) {
        inputKey_1[i] = enc_key[i] ^ prga_keystream[i];
    }
    
    // Step 2: 解密flag
    u8 encrypted_flag[] = {
        0xF8, 0xD5, 0x62, 0xCF, 0x43, 0xBA, 0xC2, 0x23,
        0x15, 0x4A, 0x51, 0x10, 0x27, 0x10, 0xB1, 0xCF,
        0xC4, 0x09, 0xFE, 0xE3, 0x9F, 0x49, 0x87, 0xEA,
        0x59, 0xC2, 0x07, 0x3B, 0xA9, 0x11, 0xC1, 0xBC,
        0xFD, 0x4B, 0x57, 0xC4, 0x7E, 0xD0, 0xAA, 0x0A
    };
    int flag_len = sizeof(encrypted_flag);
    
    // 生成flag解密用的S盒
    u8 flag_S[256];
    ksa(inputKey_1, 7, flag_S);
    
    // 生成特殊PRGA密钥流
    u8 flag_keystream[40];
    another_prga(flag_S, flag_len, flag_keystream);
    
    // 解密flag
    u8 flag[41] = {0};
    for (int i = 0; i < flag_len; i++) {
        flag[i] = (encrypted_flag[i] + flag_keystream[i]) % 256;
    }
    
    printf("Decrypted Flag: %s\n", flag);
    return 0;
}

Hakuya Want A Girl Friend

正着看ZIP文件，有密码

倒着看PNG文件，UTF-8编码，写脚本解码

拖入随波逐流工具修改高得密码，解压得flag

def fix_ctf_data(byte_data):
    i = 0
    output = bytearray()
    while i < len(byte_data):
        # 检测双字节UTF-8序列 (0xC2-0xDF 开头)
        if 0xC2 <= byte_data[i] <= 0xDF and i+1 < len(byte_data):
            b1 = byte_data[i]
            b2 = byte_data[i+1]
            if 0x80 <= b2 <= 0xBF:
                # 计算原始单字节值
                decoded = ((b1 & 0x1F) << 6) | (b2 & 0x3F)
                output.append(decoded)
                i += 2
                continue
        # 非双字节序列直接保留
        output.append(byte_data[i])
        i += 1
    return bytes(output)

# 示例用法
with open('download.png', 'rb') as f:
    data = f.read()

fixed_data = fix_ctf_data(data)
with open('fixed_image.png', 'wb') as f:
    f.write(fixed_data)

Computer cleaner

Flag1:

Flag2:

Flag3:

hgame{y0u_hav3_cleaned_th3_c0mput3r!}

Level 314 线性走廊中的双生实体

法一：老老实实构造输入

给了entity.pt用binwalk解压出torch.py & Linear1变换的文件

分析这俩文件内部代码

发现需要构造特定张量输入使输入张量经过线性变换（Linear1）

之后得到的值x0能够通过:

torch.allclose(torch.mean(x), torch.tensor(0.31415000000000004), 1.0000000000000001e-05, 0.0001)

校验，调用forward方法自解码出hidden flag

Linear1内部10 x 10矩阵可提取，所以——权重与偏置已知

构造正确张量输入：

import torch

# 解决PyTorch 2.6+的安全加载限制
try:
    model = torch.load("entity.pt", weights_only=False)
except RuntimeError as e:
    print(f"加载错误: {e}")
    print("请确保信任模型来源后使用以下方式加载：")
    model = torch.load("entity.pt", weights_only=False)

# 提取关键参数
linear1 = model.linear1
W = linear1.weight.data.detach().clone()  # 权重矩阵 [10,10]
b = linear1.bias.data.detach().clone()    # 偏置向量 [10]

# 计算关键参数
sum_rows_W = W.sum(dim=0)        # 行向量和 [10]
sum_b = b.sum().item()           # 偏置总和
target_sum = 0.31415000000000004 * 10  # 精确目标值

# 验证矩阵可解性
norm_sq = (sum_rows_W @ sum_rows_W).item()
if abs(norm_sq) < 1e-8:
    raise ValueError("权重矩阵行向量和模长为0，无解")

# 计算缩放系数
k = (target_sum - sum_b) / norm_sq

# 构造输入张量
x = k * sum_rows_W.unsqueeze(0)  # 形状 [1,10]

# 验证前向传播
with torch.no_grad():
    x0 = torch.nn.functional.linear(x, W, b)
    actual_mean = x0.mean().item()
    print(f"计算均值: {actual_mean:.7f} (误差: {abs(actual_mean - 0.31415):.2e})")

# 触发flag解码
output = model(x)

法二：直接直接提取`model.security.flag`然后与85异或一把梭

import torch

# 加载模型（需关闭安全模式）
model = torch.load("entity.pt", weights_only=False)

# 提取加密flag
encrypted_flag = model.security.flag

# 异或解密
flag = "".join(chr(byte ^ 85) for byte in encrypted_flag)
print(f"解密Flag: {flag}")

Erro0000ors

加载了msdelta.dll ，程序要求输出hgame{…36Bytes…}的flag，才能“正常”地触发异常进入Seven eats the hash 隐藏关卡

触发异常后要求用户输入修补的MD5，这个MD5用于Target数据的Hash校验，ApplydeltaB Hash校验失败返回0 成功1

如果输入MD5正确，则执行加密逻辑，并输出：Flag is error!!或者Great

程序用函数ApplydeltaB巧妙地patch掉了整个FlagBody输入 → 生成Target——即密钥

ApplydeltaB最后有个MD5校验环节，找到这个环节提取出正确MD5

只有输入正确的MD5，ApplydeltaB才会放心地把其生成的Target数据放出来

然后异或解密即可

异或逻辑：

动调发现我输入的MD5塞到了这里：

在InputMD5这个地方下硬件断点，然后一顿F9到达：

提出MD5：

44D292FFE2E91730AE69EB50AE11D04A

测试MD5是否正确：

正确！

现在就差Target：

拿下Target：

Seven says you're right!!!!

与Cipher异或得到flag：

#include <stdio.h>
#include <string.h>

int main() {
    // 密文数据（十六进制字节数组）
    unsigned char ciphertext[] = {
        0x3B, 0x02, 0x17, 0x08, 0x0B, 0x5B, 0x4A, 0x52, 0x4D, 0x11,
        0x11, 0x4B, 0x5C, 0x43, 0x0A, 0x13, 0x54, 0x12, 0x46, 0x44,
        0x53, 0x59, 0x41, 0x11, 0x0C, 0x18, 0x17, 0x37, 0x30, 0x48,
        0x15, 0x07, 0x5A, 0x46, 0x15, 0x54, 0x1B, 0x10, 0x43, 0x40,
        0x5F, 0x45, 0x5A
    };
    
    // 密钥字符数组
    char key[] = "Seven says you're right!!!!";
    const int key_len = strlen(key); // 计算密钥长度（24字节）
    const int cipher_len = sizeof(ciphertext); // 密文长度（43字节）

    // 解密过程
    unsigned char plaintext[cipher_len + 1]; // +1给终止符
    memset(plaintext, 0, sizeof(plaintext));

    for (int i = 0; i < cipher_len; i++) {
        // 取模运算实现密钥循环使用
        int key_index = i % 0x1C; //注意这里
        // 异或解密：明文 = 密文 ^ 密钥
        plaintext[i] = ciphertext[i] ^ key[key_index]; 
    }

    // 添加字符串终止符
    plaintext[cipher_len] = '\0';

    // 输出解密结果
    printf("Decrypted Flag: %s\n", plaintext);
    return 0;
}

尊嘟假嘟

UsrInput为0.o 和o.0 的随机组合，题目规定以0.o 或o.0 为”一组“，且要求我“输入”的总组数小于等于12组

分析libcheck.so文件发现有日志输出，使用adb logcat -s Native:I *:S看看log：

结论先行，分析出的程序加密流程：

InputStr → encode(inputStr) → Key ，encode函数已知

Cipher(已知) → RC4(Cipher, Key) → 中间数据 → XOR+ b64encode → Result

Cipher不变，UsrInput变，“中间数据”也跟着变

根据提示Try decrypto it，you will get flag！But realy?，”中间数据“就是我要的Flag

copyDexFromAssets解密出来的dex文件转瞬即逝（被delete）所以，在delete之前下断点：

找到dex文件加载位置/data/data/com.nobody.zunjia/cache/dex ：

pull出解密的zunjia.dex文件:

adb pull /data/data/com.nobody.zunjia/cache/dex C:\\YourPath

拖入JADX分析，发现有encode：

找字符串表，callDexMethod调用的func1就是encode

UsrInput最多12组，可以爆破解出flag:

import itertools
CUSTOM_ALPHABET = "3GHIJKLMNOPQRSTUb=cdefghijklmnopWXYZ/12+406789VaqrstuvwxyzABCDEF5"
b64_encode_table = {i: char for i, char in enumerate(CUSTOM_ALPHABET)}
b64_decode_table = {char: i for i, char in enumerate(CUSTOM_ALPHABET) if i < 65}
def custom_b64encode(data):
    encoded = []
    for i in range(0, len(data), 3):
        chunk = data[i:i+3]
        if len(chunk) < 3:
            chunk += b'\\x00' * (3 - len(chunk))
        a, b, c = chunk
        combined = (a << 16) | (b << 8) | c
        indices = [
            (combined >> 18) & 0x3F,
            (combined >> 12) & 0x3F,
            (combined >> 6) & 0x3F,
            combined & 0x3F,
        ]
        for idx in indices:
            encoded.append(b64_encode_table[idx])
    return ''.join(encoded)
def encode_input(input_str):
    input_bytes = input_str.encode('latin-1')
    xor_bytes = bytearray()
    for i, byte in enumerate(input_bytes):
        xor_bytes.append(byte ^ i)
    return custom_b64encode(xor_bytes)
def rc4_decrypt(cipher, key):
    S = list(range(256))
    j = 0
    for i in range(256):
        j = (j + S[i] + key[i % len(key)]) % 256
        S[i], S[j] = S[j], S[i]
    i = j = 0
    plain = []
    for byte in cipher:
        i = (i + 1) % 256
        j = (j + S[i]) % 256
        S[i], S[j] = S[j], S[i]
        k = S[(S[i] + S[j]) % 256]
        plain.append(byte ^ k)
    return bytes(plain)
cipher = bytes([
    0x7A, 0xC7, 0xC7, 0x94, 0x51, 0x82, 0xF5, 0x99, 0x0C, 0x30,
    0xC8, 0xCD, 0x97, 0xFE, 0x3D, 0xD2, 0xAE, 0x0E, 0xBA, 0x83,
    0x59, 0x87, 0xBB, 0xC6, 0x35, 0xE1, 0x8C, 0x59, 0xEF, 0xAD,
    0xFA, 0x94, 0x74, 0xD3, 0x42, 0x27, 0x98, 0x77, 0x54, 0x3B,
    0x46, 0x5E, 0x95
])
def reverse_input(parts):
    return tuple('o.0' if element == '0.o' else '0.o' for element in parts)
# InputStr → encode(inputStr) → Key ，encode函数已知
# Cipher(已知) → 标准RC4(Cipher, Key) → 中间数据 → XOR + b64encode → Result
for n in range(1, 13):
    for parts in itertools.product(['0.o', 'o.0'], repeat=n):
        input_str = ''.join(parts)
        key_str = encode_input(input_str)
        key_bytes = key_str.encode('latin-1')
        middle_data = rc4_decrypt(cipher, key_bytes)
        '''
        new_input_str = ''.join(reverse_input(parts))
        new_key_str = encode_input(new_input_str)
        new_key_bytes = new_key_str.encode('latin-1')
        new_cipher = rc4_decrypt(middle_data,new_key_bytes)
        '''

        flag_candidate = bytearray()
        for i, byte in enumerate(middle_data):
            flag_candidate.append(byte)
        try:
            flag = flag_candidate.decode('Latin-1')

            if 'hgame{' in flag:
                print(f"Flag: {flag}")
                print(f"Input String: {input_str}")
                exit()

        except UnicodeDecodeError:
            continue

Two wires

AVR架构是小端序，Counter要求以大端字节序传入SHA1计算

例如0x0000000000000005传入SHA1计算的字节序列为：00 00 00 00 00 00 00 05 而其在AVR架构下的实际存储为小端序：05 00 00 00 00 00 00 00

步骤如下：

提取波形数据，能看出来Key和Counter都是哪个

看固件regen_opt取了1000000模，所以密码是6位：

看固件反序列化部分，发现魔数是0xcafebabe

上位机交互的HOTP

X1 = 283942
因为Key是20Bytes，Counter是8Bytes，看波形数据很容易看出来：

Key和Counter取出来，写脚本得到X2

counter+32

Y1 = 431432
要原始Key和Counter，那就逆固件 + EEPROM

序列化****部分：

对比EEPROM：

现在要知道**Key和Counter是怎么存储的，看regen_otp**怎么读取密钥

程序取Counter：

端序转换：

复制Key ：

把Key XOR ipad传入SHA1：

Counter最后加1再存回去：

交叉引用**state**看反序列化：

所以在EEPROM中的存储结构是：0xcafebabe+ Counter + Key
另法直接看波形数据，先写入计数器再写入密钥，能猜出来固件存**Key和Counter**的结构, counter + 64同理

exp：

import hmac
import hashlib
import struct

def hotp(key, counter, digits=6):
    """
    根据 RFC 4226 生成 HOTP (HMAC-Based One-Time Password) 值.
    """
    # 1. 将计数器值转换为 8 字节的网络字节顺序整数
    counter_bytes = struct.pack('>Q', counter)
    print(counter_bytes)

    # 2. 使用 HMAC-SHA-1 算法计算 HMAC 值
    hmac_hash = hmac.new(key, counter_bytes, hashlib.sha1).digest()

    # 3. 动态截取 (Dynamic Truncation)
    offset = hmac_hash[19] & 0xf  # 取最后一个字节的低 4 位作为偏移量
    binary = struct.unpack('>I', hmac_hash[offset:offset+4])[0] & 0x7fffffff  # 从偏移量处取 4 字节，并去除最高位

    # 4. 计算 HOTP 值
    hotp_value = binary % (10 ** digits)

    # 5. 将 HOTP 值格式化为指定位数的字符串
    return str(hotp_value).zfill(digits)

# 示例用法
if __name__ == "__main__":
    # 你的共享密钥 (必须是字节形式)
    your_secret_key = bytes.fromhex("6b694f7e0354f6c66ab51a04021b1c6d7d455802")

    # 计数器值
    counter_value = 0x0dcd7e9300000001

    # 生成一个 6 位数的 HOTP
    hotp_code = hotp(your_secret_key, counter_value, digits=6)

    print(f"HOTP Code: {hotp_code}")
# 283942
your_secret_key = bytes.fromhex("6b694f7e0354f6c66ab51a04021b1c6d7d455802")

# 计数器值
counter_value = 0x0dcd7e9300000001 + 9
# 633153
your_secret_key = bytes.fromhex("321c31d49454854244de86cc4ab6ddf435429052")

# 计数器值
counter_value = 0x3a92cd1700000592 + 32
# 431432
your_secret_key = bytes.fromhex("321c31d49454854244de86cc4ab6ddf435429052")

# 计数器值
counter_value = 0x3a92cd1700000592 + 64
# 187457
hgame{283942_633153_431432_187457}

suprimeRSA

p和q的结构高度相似：

直接分解：

from Crypto.Util.number import long_to_bytes

n = 669040758304155675570167824759691921106935750270765997139446851830489844731373721233290816258049
enc = 487207283176018824965268172307888245763817583875071008869370172565777230514379236733742846575849
e = 0x10001

# Factored using external tool
p = 796688410951167236263039235508020180383351898113
q = 839777194079410698093279448382785381699926556673

phi = (p - 1) * (q - 1)
d = pow(e, -1, phi)
m = pow(enc, d, n)
print(long_to_bytes(m))
# hgame{ROCA_ROCK_and_ROll!}

sieve

有：

$\pi(k$ 计算的是小于等于 $k$ 的素数的个数

$tric$ 每次都要计算阶乘，计算欧拉函数，时间复杂度高

$\pi(k$ 可以使用sympy的primepi求

对第一项使用分块 + 动态规划筛法：

分块筛子：

在给定区间[i , j], n//i保持不变，可以一次性处理区间[i, j]内的summatory_phi(n // i)

DP****筛子：

定义cache不重复计算

exp：

#!/usr/bin/env python3
import sys
sys.setrecursionlimit(10000)

from sympy import nextprime, primepi
from Crypto.Util.number import long_to_bytes

# 题目中给出的参数
e = 65537
# 注意这里“^”在 Sage 中是幂运算，故有：
#   e^2 = 65537^2 = 4295098369,  e^2//6 = 715849728
N_arg = 715849728

# 我们有： trick(N_arg) = (sum_{k=1}^{N_arg} φ(k)) + π(N_arg)
# 下面实现一个递归算法计算 ∑_{k=1}^n φ(k)
cache = {}
def summatory_phi(n):
    if n in cache:
        return cache[n]
    # 初值：∑_{k=1}^{n} φ(k) = n(n+1)/2  减去“重叠部分”
    res = n*(n+1)//2
    i = 2
    while i <= n:
        # 当 floor(n/i) 保持不变时，可以一次性处理区间 [i, j]
        j = n // (n // i)
        res -= (j - i + 1) * summatory_phi(n // i)
        i = j + 1
    cache[n] = res
    return res

print("[*] 计算 ∑φ(k)  ...")
S = summatory_phi(N_arg)
print(f"    ∑φ(k) for k=1..{N_arg} = {S}")

print("[*] 计算 π(n) ...")
P = primepi(N_arg)
print(f"    π({N_arg}) = {P}")

# 计算 trick(N_arg) = S + P
X = S + P
print(f"[*] trick({N_arg}) = {X}")

# 按位左移128位，相当于乘以 2^128
candidate = X << 128
print(f"[*] candidate = trick({N_arg}) << 128 = {candidate}")

# p = nextprime(candidate)
p = nextprime(candidate)
print(f"[*] p = {p}")

# 注意密钥构造中 p = q，故 n = p^2
n = p * p
print(f"[*] n = p^2 = {n}")

# 题目中给出的密文
enc = 2449294097474714136530140099784592732766444481665278038069484466665506153967851063209402336025065476172617376546
print(f"[*] enc = {enc}")

# 计算 φ(n) = p*(p-1)
phi_n = p * (p - 1)

# 求出 d，使得 d * e ≡ 1 (mod φ(n))
d = pow(e, -1, phi_n)
print(f"[*] d = {d}")

# 解密：m = enc^d mod n
m_int = pow(enc, d, n)
print("[*] 解密得到的整数 m =", m_int)

# 将整数 m 转回字节串
flag = long_to_bytes(m_int)
print("[*] FLAG =", flag)
# hgame{sieve_is_n0t_that_HArd}

Mathematical modeling collection

Sun, 01 Sep 2024 00:00:00 GMT

Shiori's Coffee Nook

软件系统安全赛

1.re3

5.re2

6.re1

DASCTF 2025

ezmac

login

羊城杯 2025

ez_py

Tauri

关于Bash和Linux

Bourne Again SHell

了解Bash

一些问题

最后

Footnotes

陇剑杯

Lesscommon

Prover

Dragon

论文阅读: Harnessing the Power of LLM to Support Binary Taint Analysis

Introduction

Background

Motivation

Problem 1. Determining Taint Sources and Initial Taint Labels

Problem 2: Defining Rules to Propagate Taint Labels

Problem 3: Formulating Inspection Rules for Various Sinks and Vulnerabilities

Advantages of LLMs in Vulnerability Inspection

Overview of LATTE

Workflow of LATTE

LATTE design

Phase 1: Function Call Chain Extraction

Phase 2: Dangerous Flow Generation

Phase 3: Prompt Sequence Construction

Evaluation

Evaluation setup

Vulnerability inspection (RQ1)

1. Effectiveness

2. Stability

3. Efficiency

Sink and Source Identification (RQ2)

Dangerous Flow Extraction (RQ3)

Prompt Sequence Construction (RQ4)

Real-world Vulnerability Inspection (RQ5)

Discussion

Conclusion

References

Footnotes

Notes on nju-pa

pa1: Perform value-based checks for macros, using a macro

pa1: The CPU execution process

pa1: Recursively evaluate an expression

The cleverness of check_parentheses

Skip over parentheses

Handle errors in the recursion of eval()

Conclusion

References

Utilities for debugging

Mount shared folders on a virtual machine

The problem: /mnt/hgfs does not show shared folders

Solution

References

ELF sections, segments, and their mapping in memory

Program headers and PT_LOAD segments

Page alignment and its mapping

Side note #1: Why can’t seg05 be page-aligned?

Side note #2: Why do FileSiz and MemSiz of seg05 differ?

Side note #3: WTF is the output of readelf?

References

Footnotes

Footnotes

DN11接入笔记

前置知识

配置Wireguard

配置Bird2

探索

Footnotes

Footnotes

ACTF 2025

The cleverness of `check_parentheses`

The problem: `/mnt/hgfs` does not show shared folders

Side note #2: Why do `FileSiz` and `MemSiz` of seg05 differ?

Side note #3: WTF is the output of `readelf`?

L3 - Part 3: `ROL` + `LCG` + `XOR` + `SBOX`

L3 - Part 1: `XOR` + `TEA` + `XOR`

逆出来的`.NET`主函数

逆出来的`launcher`

法二：直接直接提取`model.security.flag`然后与85异或一把梭