DASCTF2024年10月赛留档

Thu, 07 Nov 2024 00:00:00 +0000

ezelf #

Drink the tea and go to find the fish！！

ollvm 平坦化过的控制流

使用 deflat 去平坦化

首先要过一个魔改过的 xxtea，这里的明文是密钥 DASCTF{dr1nk_te@_4nd_cont1nu3..}

然后过一个魔改过得 blowfish，粗略看了下用的似乎是 rc4 的 sbox，但无所谓，sbox 和 pbox 都调试 dump 出来

算法也魔改过，照着抄一个解密

from pwn import u32, p32
from Crypto.Cipher import Blowfish

xxtea_ct=b'\xb4\xb5ZB\xa6y\x0b\xac\x0e#x\xde\xe1-\xc6\x1d\xbb)\x8c\xe2\x94\xfe\x14\xd9\xaa\x03\xe3\x8a\x14\x92\x1cd'
#xxtea_key=[1234,2341,3412,4123]
xxtea_key=[11,45,14,777]

def shift(z, y, x, k, p, e):
    return ((((z >> 5) ^ (y << 2)) + ((y >> 3) ^ (z << 4))) ^ ((x ^ y) + (k[(p & 3) ^ e] ^ z)))

def decrypt(v, k):
    delta = 0x11451400
    n = len(v)
    rounds = 16
    x = (rounds * delta) & 0xFFFFFFFF
    y = v[0]
    for i in range(rounds):
        e = (x >> 2) & 3
        for p in range(n - 1, 0, -1):
            z = v[p - 1]
            v[p] = (v[p] - shift(z, y, x, k, p, e)) & 0xFFFFFFFF
            y = v[p]
        p -= 1
        z = v[n - 1]
        v[0] = (v[0] - shift(z, y, x, k, p, e)) & 0xFFFFFFFF
        y = v[0]
        x = (x - delta) & 0xFFFFFFFF
    return v

#xxtea_vec = [u32(xxtea_ct[i:i+4]) for i in range(0,32,4)]
#decrypt(xxtea_vec, xxtea_key)
#blowfish_key = b''.join(p32(xxtea_vec[i]) for i in range(8))

blowfish_key = b'DASCTF{dr1nk_te@_4nd_cont1nu3..}'
blowfish_ct = b'p\xb7\xf0\x8d\x8e\xb2\x1eK\x1c\\\xc6s\xfdH\xdeS4\xdf.\x98#\x91"\xd8\x82\x11\'\x90\xe7qB\x1f'

pbox = [
0x00000125,0x243f6a8b,0x243f6b5f,0x000000e0,
0x000001a4,0x243f6b08,0x243f6b6f,0x000001c9,
0x00000044,0x243f6b78,0x243f6b15,0x000000af,
0x000000be,0x243f6a3b,0x243f6ba7,0x00000026,
0x0000009a,0x243f6ba8
]

sbox=[
[],
[],
[],
[],
]

with open("ezelf.dump", "rb") as fp:
    buf = fp.read()

for i in range(256):
    sbox[0].append(u32(buf[i*4:i*4+4]))
    sbox[1].append(u32(buf[(i+256)*4:(i+256)*4+4]))
    sbox[2].append(u32(buf[(i+512)*4:(i+512)*4+4]))
    sbox[3].append(u32(buf[(i+768)*4:(i+768)*4+4]))

def swap(x,y):
    return y, x

def fes(v):
    a = (v>>24)&0xff
    b = (v>>16)&0xff
    c = (v>>8)&0xff
    d = v&0xff
    sa = sbox[0][a]
    sb = sbox[1][b]
    sc = sbox[2][c]
    sd = sbox[3][d]
    m = (sa+sb)&0xffff_ffff
    n = (sc+sd) &0xffff_ffff
    return m ^ n

def bfdec(L, R):
    L = L^(pbox[17])
    for i in range(17, 1, -1):
        R = R ^ fes(L)
        L, R = swap(L, R)
    
    L, R = swap(L, R)

    L = L ^ pbox[0]

    return L, R

flag = b''

for i in range(0,4):
    L = u32(blowfish_ct[i*8:i*8+4])
    R = u32(blowfish_ct[i*8+4:i*8+8])
    L, R = bfdec(L, R)
    flag += p32(L)
    flag += p32(R)
print(flag)
# DASCTF{Y0u_fin@l1y_f1nd_@nswer!}

EZRE #

Themida 保护的 exe

CFF on PseudorandomDog's Blog

DASCTF2024年10月赛留档

ezelf #

EZRE #