强网杯S8

Mon, 11 Nov 2024 00:00:00 +0000

mips #

Someone has found the mips binary, along with an emulator to execute it. What can you find in them?

USAGE：./emu ./mips_bin

32 位大端 mips 程序，拖到 IDA 里即可

程序会在 0x23000 处开辟一个可执行空间，写入解密的机器码，然后执行

这样得到的 flag 是 flag{dynamic_reverse}，是个假的 flag，交不上

一开始的想法是 emu 在加载时动态修改了程序，故修补程序使之在结束时打印字节码的内容，没有收获，但有个意外发现：在跳到 0x23000 前的 write 函数可以调用成功，之后的所有 patch 全都失效了

所以推测是 emu 在 0x23000 或那条 if 语句处下了钩子

IDA 打开 emu 直接搜索 0x23000 立即数

定位到 hook 的地方，这里有一个独立的检测，对 encrypt 的参数下交叉引用可以找到检测 flag 前缀的代码，推测出参数就是输入

encrypt 函数是一个稍微有点绕的魔改 RC4，KSA 部分使用乘以常数来优化了除法，实际上 KSA 和标准实现一致（见注释），PRGA 也一致，只是最后的加密多做了一些 XOR

GDGAlgiersCTF2022

Wed, 12 Oct 2022 00:00:00 +0000

Traditions #

假随机，种子 0x7E6

import ctypes
libc = ctypes.CDLL("libc.so.6")
libc.srand(0x7E6)
stream = [libc.rand() for i in range(47)]

Oldschool #

You'll probably recognize this format just by looking at the size of the binary file.

512 字节的 MBR 块

BIOS 会将 MBR 装载到 0x10000 的地址空间中，起始地址为 0x7C00

MBR 部分以程序指针被置零结束

这里使用 unicorn 加载并调试

from unicorn import *
from unicorn.x86_const import *
from capstone import *

base_addr = 0x7C00
entry_point = base_addr
mem_size = 0x10000

with open("oldschool", "rb") as fp:
    mbr = fp.read()

def emu(flag):
    mu = Uc(UC_ARCH_X86, UC_MODE_16)
    md = Cs(CS_ARCH_X86, CS_MODE_16)

    mu.mem_map(0, mem_size)
    mu.mem_write(base_addr, mbr[:512])

    mu_stdin = flag
    mu_stdout = []

    def hook_code(mu, address, size, user_data):
        nonlocal md

        code = mu.mem_read(address, size)
        insns = list(md.disasm(bytes(code), address, count=1))

        if len(insns) == 0:
            raise Exception(f"cant disasm insn at {address}")

        insn = insns[0]
        address = insn.address
        size = insn.size
        mnemonic = insn.mnemonic
        op_str = insn.op_str

        print("%.8x:\t%s\t%s" % (address, mnemonic, op_str))

        if address == 0x7c6a:
            ax = mu.reg_read(UC_X86_REG_AX)
            bx = mu.reg_read(UC_X86_REG_BX)
            dx = mu.reg_read(UC_X86_REG_DX)
            di = mu.reg_read(UC_X86_REG_DI)
            print("ax: %.4x\tbx: %.4x\tdx: %.4x\tdi: %.4x" % (ax, bx, dx, di))


    def hook_intr(mu, intno, user_data):
        nonlocal mu_stdin
        nonlocal mu_stdout

        ah = mu.reg_read(UC_X86_REG_AH)
        al = mu.reg_read(UC_X86_REG_AL)
        di = mu.reg_read(UC_X86_REG_DI)

        if intno == 0x10:
            if ah == 0x0E:  # print char
                mu_stdout.append(al)
        elif intno == 0x16:
            mu.reg_write(UC_X86_REG_AL, mu_stdin[di - 0x7D80])
        else:
            raise Exception("unk intr no: %xh" % intno)


    try:
        mu.hook_add(UC_HOOK_CODE, hook_code)
        mu.hook_add(UC_HOOK_INTR, hook_intr)
        mu.emu_start(begin=entry_point, until=0)
    except Exception as e:
        print(e)
        mu.emu_stop()

    return bytes(mu_stdout)

out=emu(b"0123456789ABCDEF")
print(bytes(out).decode())

上述模板将打印程序执行流，部分执行流如下

Sagemath on PseudorandomDog's Blog

强网杯S8

mips #

GDGAlgiersCTF2022

Traditions #

Oldschool #