Capstone-Keystone on PseudorandomDog's Blog

AmateursCTF2023 RE Writeup

Fri, 21 Jul 2023 00:00:00 +0000

大部分比较水，有几题有点价值，所以贴一下

volcano #

Inspired by recent "traumatic" events.
nc amt.rs 31010

过关要求输入 b, v, p 使得：

b % 22890 == 18476
17 <= binary_ones(v) <= 26
p % 2 == 1
digit_len(b) == digit_len(v)
digit_sum(b) == digit_sum(v)
4919^b % p == 4919^v % p

建立 z3 方程组并爆破条件 2，取条件 4 的十进制长度为 10

这个模板也可以用来排除 z3 的多解

def fn(m):
    n=m[vv].as_long()
    cnt=0
    while n:
        n&=(n-1)
        cnt+=1
    print(f"Tried {m[vv].as_long()=}, {cnt=}")
    return cnt>16 and cnt<=26

def z3gen(conds,fn):
    s=z3.Solver()
    s.add(conds)
    result=s.check()
    while result==z3.sat:
        m=s.model()
        if fn(m) is True:
            yield m
        # exclude the previous result by 'AND' a 'NOT'
		# 'NOT AND' is implemented by 'OR NEQ'
        extra=[var()!=m[var] for var in m]
        s.add(z3.Or(extra))
        result=s.check()

求出一组解 (b, v) = (1080403586, 9422911007)

GDGAlgiersCTF2022

Wed, 12 Oct 2022 00:00:00 +0000

Traditions #

假随机，种子 0x7E6

import ctypes
libc = ctypes.CDLL("libc.so.6")
libc.srand(0x7E6)
stream = [libc.rand() for i in range(47)]

Oldschool #

You'll probably recognize this format just by looking at the size of the binary file.

512 字节的 MBR 块

BIOS 会将 MBR 装载到 0x10000 的地址空间中，起始地址为 0x7C00

MBR 部分以程序指针被置零结束

这里使用 unicorn 加载并调试

from unicorn import *
from unicorn.x86_const import *
from capstone import *

base_addr = 0x7C00
entry_point = base_addr
mem_size = 0x10000

with open("oldschool", "rb") as fp:
    mbr = fp.read()

def emu(flag):
    mu = Uc(UC_ARCH_X86, UC_MODE_16)
    md = Cs(CS_ARCH_X86, CS_MODE_16)

    mu.mem_map(0, mem_size)
    mu.mem_write(base_addr, mbr[:512])

    mu_stdin = flag
    mu_stdout = []

    def hook_code(mu, address, size, user_data):
        nonlocal md

        code = mu.mem_read(address, size)
        insns = list(md.disasm(bytes(code), address, count=1))

        if len(insns) == 0:
            raise Exception(f"cant disasm insn at {address}")

        insn = insns[0]
        address = insn.address
        size = insn.size
        mnemonic = insn.mnemonic
        op_str = insn.op_str

        print("%.8x:\t%s\t%s" % (address, mnemonic, op_str))

        if address == 0x7c6a:
            ax = mu.reg_read(UC_X86_REG_AX)
            bx = mu.reg_read(UC_X86_REG_BX)
            dx = mu.reg_read(UC_X86_REG_DX)
            di = mu.reg_read(UC_X86_REG_DI)
            print("ax: %.4x\tbx: %.4x\tdx: %.4x\tdi: %.4x" % (ax, bx, dx, di))


    def hook_intr(mu, intno, user_data):
        nonlocal mu_stdin
        nonlocal mu_stdout

        ah = mu.reg_read(UC_X86_REG_AH)
        al = mu.reg_read(UC_X86_REG_AL)
        di = mu.reg_read(UC_X86_REG_DI)

        if intno == 0x10:
            if ah == 0x0E:  # print char
                mu_stdout.append(al)
        elif intno == 0x16:
            mu.reg_write(UC_X86_REG_AL, mu_stdin[di - 0x7D80])
        else:
            raise Exception("unk intr no: %xh" % intno)


    try:
        mu.hook_add(UC_HOOK_CODE, hook_code)
        mu.hook_add(UC_HOOK_INTR, hook_intr)
        mu.emu_start(begin=entry_point, until=0)
    except Exception as e:
        print(e)
        mu.emu_stop()

    return bytes(mu_stdout)

out=emu(b"0123456789ABCDEF")
print(bytes(out).decode())

上述模板将打印程序执行流，部分执行流如下

ByteCTF2022 maze6d 复盘

Sat, 01 Oct 2022 00:00:00 +0000

main 函数反编译失败，原因是撞到了 __stack_chk_fail，而这个函数是 __noreturn 的

但是调试可以发现，__stack_chk_fail 的 got 项在运行时被换成了 sub_403608，这个函数就是异或 0xdeadbeef

补丁打法：mov eax, xxx; xor eax, 0xdeadbeef，正好也是 8 字节

F5 可以看到平坦化，每次状态转换后都将状态变量异或 0xdeadbeef

除了平坦化之外这题还有一个 trick：从一个偏移表中动态加载函数指针，偏移是 0x13371337

可以观察到函数指针都是预先计算出来存储的，打补丁比较容易

唯一需要注意的是函数指针最终存储的地点，有时是寄存器，有时是栈上，这里将 add 全部换成 mov imm，忽略加载表项的 mov，存回栈上的 mov 予以保留

import idaapi
import ida_bytes
import ida_ua
import idc
from keystone import Ks, KS_ARCH_X86, KS_MODE_64

ks = Ks(KS_ARCH_X86, KS_MODE_64)

def patch_dyn_resolv(fake_got=0x6E6390, off=0x13371337):
    insn = idaapi.insn_t()
    buffer = []

    begin = idc.read_selection_start()
    end = idc.read_selection_end()

    ea = begin
    while ea < end:
        idaapi.decode_insn(insn, ea)
        mnem = insn.get_canon_mnem()
        assert mnem == "mov" or mnem == "add"

        if insn.Op2.type == ida_ua.o_displ or insn.Op2.type == ida_ua.o_phrase:
            assert insn.Op1.type == ida_ua.o_reg

            reg = idaapi.get_reg_name(insn.Op1.reg, 8)
            disp = insn.Op2.addr
            value = idaapi.get_qword(disp + fake_got) - off
            asm = f"mov {reg}, {hex(value)}"
            print(asm)
            buffer.extend(ks.asm(asm)[0])
        elif mnem == "mov":
            buffer.extend(idaapi.get_bytes(ea, insn.size))

        ea += insn.size

    pb = bytes(buffer + (end - begin - len(buffer)) * [0x90])
    idaapi.patch_bytes(begin , pb)
    ida_bytes.del_items(begin, ida_bytes.DELIT_SIMPLE, end - begin)
    idaapi.create_insn(begin, insn)

选中需要打补丁的地方，运行上述脚本，现在 main 函数可以 F5 了