6. 2016年第16题

⋮

课件

16题.pdf 下载次数（1021）下载

大家好，我是胡一米。这期视频是关于2016年看雪CTF第16题解题资料。

一、简介

1.1 录制说明

视频是基于其他大佬文字Writeup录制的，所以在视频操作之前就已知了该题中的各种坑，如反调试等，所以不再演示踩坑过程。

1.2 录制参考

第16题主要参看了HighHand、风间仁以及daiweizhi的Writeup，链接如下：

HighHand:

https://bbs.pediy.com/thread-214418.htm

daiweizhi:

https://bbs.pediy.com/thread-214359.htm

风间仁：

https://bbs.pediy.com/thread-214358.htm

1.3 内容简介

在本期中，主要讨论3个问题。这3个问题可能与最终的Key没有太大的联系，但题目中既然出现了，还是说一说。此3个问题分别是：

a. 调试虚拟机保护

b run trace用法

c. nor门和xor门

二、视频操作

2.1 静态分析定位关键点

结合其他大佬的分析过程，可以直接定位到关键点。.

2.2 动态调试其加密过程

通过动态调试，理解程序内存加载过程。

vm_code: ESI

0043E565 1B 01 00 00 00 1B 00 00 00 00 26 01 04 00 18 1B

0043E575 18 00 00 00 17 17 11 FC 0D 0F 18 12 05 17 16 1F ...?

0043E585 1B 01 00 00 00 1B 00 00 00 00 26 01 04 00 27 FC .'?

0043E595 1B 01 00 00 00 17 17 11 F4 1B 01 00 00 00 1B 00 ...?....

0043E5A5 00 00 00 26 01 04 00 27 F8 1B 00 00 00 00 17 17 .'?....

0043E5B5 11 F8 1B 01 00 00 00 1B 00 00 00 00 26 01 04 00 .

0043E5C5 27 FC 1B 00 00 00 00 17 17 0E 1E F8 24 01 40 24 '?....‑?@$

0043E5D5 02 84 C9 1B F5 E5 43 00 1B B7 E5 43 00 27 00 14 勆蹂C.峰C.'.

0043E5E5 19 1B 40 00 00 00 14 19 19 1B 06 00 00 00 02 1C @......

0043E5F5 27 FC 27 F4 05 09 16 11 FC 27 FC 0F 0D 12 05 09 '??.??..

0043E605 16 01 04 00 1B 26 E6 43 00 1B D5 EA 43 00 27 00 贞C.'.

0043E615 14 19 1B 40 00 00 00 14 19 19 1B 06 00 00 00 02 @......

0043E625 1C 1B 01 00 00 00 1B 00 00 00 00 26 01 04 00 18

Dispatcher : 421224

004210BD    主 xor    ax, 0BF77 FL=S, EAX=0000E851
004210C2    主 jmp    short 004210C6
004210C6    主 lea    eax, dword ptr [edi+40] EAX=0012FAF8
004210C9    主 jmp    short 004210CC
004210CC    主 cmp    ebp, eax FL=PA
004210CE    主 jmp    short 004210D1
004210D1    主 ja    00421208
00421208    主 movzx eax, byte ptr [esi] EAX=0000001B
0042120B    主 jmp    0042123A
0042123A    主 lea    esi, dword ptr [esi+1] ESI=0043E5D9
0042123D    主 jmp    0042121E
0042121E    主 popfd FL=A, ESP=0012FA78
0042121F    主 jmp    short 00421224
00421224    主 jmp    dword ptr [eax*4+42271B] ;这里跳转到每个handler

2.3 完成分析

理解每个handler，完成分析。

1B :

00421224 jmp dword ptr ds:[eax*4+0x42271B]

00421928 and eax,0xED825741 ; FL=0, EAX=00000001

0042192E mov ax,word ptr ds:[edi+0x8] ; EAX=0000C5EC

00421936 jmp short CrackMe_.0042193B

0042193B sbb eax,0xED82D59D ; FL=CA, EAX=127DF04F

00421941 jmp CrackMe_.00421D12

00421D12 add eax,dword ptr ds:[esi+0x2] ; FL=0, EAX=1298F04F

00421D19 jmp CrackMe_.004219F6

004219F6 mov eax,dword ptr ds:[esi] ; EAX=00000001

004219F8 jmp short CrackMe_.004219FE

004219FE add esi,0x4 ; FL=P, ESI=0043E56A

00421A01 jmp short CrackMe_.00421A05

00421A05 sub ebp,0x4 ; FL=A, EBP=0018FBBC

00421A08 jmp short CrackMe_.00421A0B

00421A0B mov dword ptr ss:[ebp],eax

00421A0E jmp CrackMe_.00421810

00421810 jmp CrackMe_.0042126B

vm_push_imm32

EBP : stack

26 :

00421224 jmp dword ptr ds:[eax*4+0x42271B]

004213F9 nop dword ptr ss:[esp+0xc]

00421401 jmp CrackMe_.00421CFB

00421CFB bt ax,cx

00421CFF jmp CrackMe_.004216A9

004216A9 bswap eax ; EAX=26000000

004216AB mov eax,dword ptr ss:[ebp+0x4] ; EAX=00000001

004216AE btr dx,0x4B

004216B3 jmp CrackMe_.00421675

00421675 movzx edx,word ptr ss:[ebp+0x4] ; EDX=00000001

0042167D jmp short CrackMe_.0042167F

0042167F mov dx,sp ; EDX=0000FA58

00421682 jmp CrackMe_.0042136B

0042136B movsx edx,byte ptr ss:[esp+0x6] ; EDX=FFFFFFE3

00421373 jmp short CrackMe_.00421375

00421375 bt dx,cx ; FL=CP

00421379 btr edx,0x3E ; EDX=BFFFFFE3

0042137D rol edx,0xc3 ; EDX=FFFFFF1D

00421380 movzx edx,dl ; EDX=0000001D

00421383 jmp CrackMe_.0042170C

0042170C ror dl,0xd4 ; EDX=000000D1

0042170F jmp short CrackMe_.00421713

00421713 mov edx,dword ptr ss:[ebp] ; EDX=00000000

00421716 imul edx ; FL=P, EAX=00000000

00421718 jmp short CrackMe_.0042171D

0042171D mov dword ptr ss:[ebp+0x4],eax

00421720 mov dword ptr ss:[ebp],edx

00421723 jmp CrackMe_.0042157A

0042157A jmp CrackMe_.0042126B

vm_imul

01：

00421224 jmp dword ptr ds:[eax*4+0x42271B]

00421582 movzx eax,word ptr ds:[esi] ; EAX=00000004

00421585 add esi,0x2 ; FL=0, ESI=0043E573

00421588 jmp short CrackMe_.0042158A

0042158A add ebp,eax ; EBP=0018FBBC

0042158C jmp short CrackMe_.0042158F

0042158F jmp CrackMe_.0042126B

vm_add_stk

18：

00421224 jmp dword ptr ds:[eax*4+0x42271B]

004219D0 shr ax,cl ; FL=PZ, EAX=00000000

004219D3 jmp CrackMe_.0042194C

0042194C xor al,byte ptr ss:[ebp+0xA]

00421953 jmp short CrackMe_.00421957

00421957 lea eax,dword ptr ss:[ebp+0x4] ; EAX=0018FBC0

0042195A jmp CrackMe_.00421553

00421553 sub ebp,0x4 ; FL=P, EBP=0018FBB8

00421556 mov dword ptr ss:[ebp],eax

00421559 jmp short CrackMe_.0042155C

0042155C jmp CrackMe_.0042126B

vm_push_esp

11：

00421224 jmp dword ptr ds:[eax*4+0x42271B]

00421B83 xor dx,0x5A ; EDX=0000005A

00421B87 jmp short CrackMe_.00421B8C

00421B8C mov dx,dx

00421B8F jmp CrackMe_.00421B2F

00421B2F sbb dx,0xFFBF ; FL=CA, EDX=0000009B

00421B33 jmp short CrackMe_.00421B39

00421B39 movzx edx,bx ; EDX=0000E000

00421B3C movsx eax,byte ptr ds:[esi] ; EAX=FFFFFFFC

00421B3F and dx,cx ; FL=PZ, EDX=00000000

00421B42 shl dx,0xe4

00421B46 jmp CrackMe_.00421510

00421510 shr dx,cl

00421513 jmp short CrackMe_.00421518

00421518 add esi,0x1 ; FL=P, ESI=0043E57D

0042151B or dx,word ptr ss:[esp+0xB] ; FL=PS, EDX=0000E277

00421523 jmp short CrackMe_.00421525

00421525 movzx dx,byte ptr ss:[esp+0x2] ; EDX=000000E8

0042152E or dx,cx ; FL=P, EDX=000013F9

00421531 jmp CrackMe_.0042200F

0042200F or edx,0x23 ; FL=0, EDX=000013FB

00422012 jmp CrackMe_.00421E42

00421E42 mov edx,dword ptr ss:[ebp] ; EDX=0018FBD8

00421E45 jmp CrackMe_.00421C2E

00421C2E add ebp,0x4 ; FL=PA, EBP=0018FBC0

00421C31 mov dword ptr ds:[edi+eax],edx

00421C34 jmp short CrackMe_.00421C36

00421C36 jmp CrackMe_.0042126B

vm_pop_reg32

EDI: context

19：

00421224 jmp dword ptr ds:[eax*4+0x42271B]

00421C3B sub edx,0xED9C6B39 ; EDX=126392C4

00421C41 btc ax,bx ; FL=C, EAX=00000018

00421C45 jmp CrackMe_.00421F7E

00421F7E dec dx ; FL=CPS, EDX=126392C3

00421F81 jmp short CrackMe_.00421F85

00421F85 xor dx,0xBBE ; FL=PS, EDX=1263997D

00421F8A jmp CrackMe_.00421AC8

00421AC8 sub al,0xC3 ; FL=CP, EAX=00000055

00421ACB jmp short CrackMe_.00421AD0

00421AD0 ???

00421AD8 jmp CrackMe_.0042185F

0042185F ???

00421868 jmp short CrackMe_.0042186A

0042186A movsx ax,byte ptr ss:[esp+0x9] ; EAX=00000000

00421873 jmp short CrackMe_.00421875

00421875 mov eax,dword ptr ss:[ebp] ; EAX=00000080

00421878 jmp short CrackMe_.0042187C

0042187C or dx,0xFFF2 ; FL=PS, EDX=1263FFFF

00421880 jmp short CrackMe_.00421885

00421885 mov edx,dword ptr ss:[ebp+0x4] ; EDX=00000080

00421888 jmp CrackMe_.004216C6

004216C6 not eax ; EAX=FFFFFF7F

004216C8 jmp short CrackMe_.004216CE

004216CE not edx ; EDX=FFFFFF7F

004216D0 jmp short CrackMe_.004216D2

004216D2 add ebp,0x4 ; FL=P, EBP=0018FACC

004216D5 jmp short CrackMe_.004216DB

004216DB and eax,edx ; FL=S

004216DD jmp short CrackMe_.004216E0

004216E0 mov dword ptr ss:[ebp],eax

004216E3 jmp CrackMe_.00421D66

00421D66 jmp CrackMe_.0042126B

vm_nor32

（图片请看pdf，这里不弄格式了）

三、小结

题目很好。

附录：

录制顺序：29-28-7-19-22-16-？

问答

标题

雪币悬赏（剩余0雪币）

内容

请扫码订阅

有回复时将及时提醒您

其他问答

暂无记录