AntCTF-D3CTF2023 RE Writeup

Mon, 22 May 2023 00:00:00 +0000

d3sky #

Beautiful sky~

main 函数很简单，sub_401190 是 RC4

数据的位宽是两字节，XOR 时只解密最低字节
每次调用加密函数 i 和 j 都会重新设置，但 sbox 的状态是继承的

对 sbox 做交叉引用可以找到一个 TLS 回调函数 sub_401050

该函数里引用了 RC4 的密钥，并通过除零异常触发 SEH 拼接最终的密钥 YunZh1JunAlkaid

回看 main 函数可以看到 data 数组其实是一个状态机，这个状态机除了输入、输出之外只有一种指令 NAND

回顾一下 NAND 的自足性：

$\neg A \equiv \neg(A \land A)$
$A \land B \equiv \neg (\neg (A \land B))$
$A \lor B \equiv \neg(\neg A \land \neg B)$

所以实际上作者的设计就是一个单指令的虚拟机

手动打 log

from pwn import u16
from Crypto.Util.number import long_to_bytes
import z3

fp = open("data.bin", "rb")
data = fp.read()
fp.close()

state = [u16(data[i : i + 2]) for i in range(0, len(data), 2)]

def rc4_ksa(key):
    sbox = bytearray(range(256))
    j = 0
    for i in range(256):
        j = (j + sbox[i] + ord(key[i % len(key)])) % 256
        sbox[i], sbox[j] = sbox[j], sbox[i]
    return sbox

def rc4(sbox, msg, idx, length):
    i = j = 0
    for k in range(length):
        i = (i + 1) % 256
        j = (j + sbox[i]) % 256
        sbox[i], sbox[j] = sbox[j], sbox[i]
        x = sbox[(sbox[i] + sbox[j]) % 256]
        msg[idx + k] ^= x

box = rc4_ksa("YunZh1JunAlkaid")
rc4(box, state, 2772, 74)

def play():
    global flags
    global state

    cnt = 0
    while state[0] != 0xFFFF:
        if state[2] == 1:
            state[2] = 0
            print(f"Says: {chr(state[3])}")
        if state[7] == 1:
            state[7] == 0
            print("Reads one byte from stdin")
            cnt += 1
            if cnt == 37 and state[8] != 126:
                print(f"Says: Wrong! (But I don't care)")
        if state[19] != 0:
            print(f"Says: Wrong! (But I don't care)")
            state[19] = 0
        idx = state[0]
        rc4(box, state, idx, 3)
        t0, t1, t2 = state[idx], state[idx + 1], state[idx + 2]
        state[0] = idx + 3
        rc4(box, state, idx, 3)
        state[t2] = (~(state[t0] & state[t1])) & 0xFFFF
        print(f"{idx}:\tnand\t[{t2}], [{t0}], [{t1}]")

play()
exit(0)

下面是输出截取的一部分，可以看到 519 到 528 是在转储位于地址 8 的输入到地址 2807；531 到 579 是地址 2772, 2773, 2774, 2775 的 XOR；582 到 594 是把上一步的结果和地址 2809 比较

GDGAlgiersCTF2022

Wed, 12 Oct 2022 00:00:00 +0000

Traditions #

假随机，种子 0x7E6

import ctypes
libc = ctypes.CDLL("libc.so.6")
libc.srand(0x7E6)
stream = [libc.rand() for i in range(47)]

Oldschool #

You'll probably recognize this format just by looking at the size of the binary file.

512 字节的 MBR 块

BIOS 会将 MBR 装载到 0x10000 的地址空间中，起始地址为 0x7C00

MBR 部分以程序指针被置零结束

这里使用 unicorn 加载并调试

from unicorn import *
from unicorn.x86_const import *
from capstone import *

base_addr = 0x7C00
entry_point = base_addr
mem_size = 0x10000

with open("oldschool", "rb") as fp:
    mbr = fp.read()

def emu(flag):
    mu = Uc(UC_ARCH_X86, UC_MODE_16)
    md = Cs(CS_ARCH_X86, CS_MODE_16)

    mu.mem_map(0, mem_size)
    mu.mem_write(base_addr, mbr[:512])

    mu_stdin = flag
    mu_stdout = []

    def hook_code(mu, address, size, user_data):
        nonlocal md

        code = mu.mem_read(address, size)
        insns = list(md.disasm(bytes(code), address, count=1))

        if len(insns) == 0:
            raise Exception(f"cant disasm insn at {address}")

        insn = insns[0]
        address = insn.address
        size = insn.size
        mnemonic = insn.mnemonic
        op_str = insn.op_str

        print("%.8x:\t%s\t%s" % (address, mnemonic, op_str))

        if address == 0x7c6a:
            ax = mu.reg_read(UC_X86_REG_AX)
            bx = mu.reg_read(UC_X86_REG_BX)
            dx = mu.reg_read(UC_X86_REG_DX)
            di = mu.reg_read(UC_X86_REG_DI)
            print("ax: %.4x\tbx: %.4x\tdx: %.4x\tdi: %.4x" % (ax, bx, dx, di))


    def hook_intr(mu, intno, user_data):
        nonlocal mu_stdin
        nonlocal mu_stdout

        ah = mu.reg_read(UC_X86_REG_AH)
        al = mu.reg_read(UC_X86_REG_AL)
        di = mu.reg_read(UC_X86_REG_DI)

        if intno == 0x10:
            if ah == 0x0E:  # print char
                mu_stdout.append(al)
        elif intno == 0x16:
            mu.reg_write(UC_X86_REG_AL, mu_stdin[di - 0x7D80])
        else:
            raise Exception("unk intr no: %xh" % intno)


    try:
        mu.hook_add(UC_HOOK_CODE, hook_code)
        mu.hook_add(UC_HOOK_INTR, hook_intr)
        mu.emu_start(begin=entry_point, until=0)
    except Exception as e:
        print(e)
        mu.emu_stop()

    return bytes(mu_stdout)

out=emu(b"0123456789ABCDEF")
print(bytes(out).decode())

上述模板将打印程序执行流，部分执行流如下

Unicorn-Engine on PseudorandomDog's Blog

AntCTF-D3CTF2023 RE Writeup

d3sky #

GDGAlgiersCTF2022

Traditions #

Oldschool #