VM虚拟机逆向 --- [NCTF 2018]wcyvm 复现

前言

第四题了，搞定，算是独立完成比较多的一题，虽然在还原汇编的时候还是很多问题。

---

题目分析

代码很简单，就是指令很多。

opcode在unk_6021C0处，解密的数据在dword_6020A0处

opcode = [0x08, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x00, 0x00,0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x03, 0x00, 0x00, 0x00,0x46, 0x00, 0x00, 0x00, 0x0E, 0x00, 0x00, 0x00, 0x15, 0x00,0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,0x09, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x0B, 0x00,0x00, 0x00, 0x0A, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,0x0A, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x09, 0x00,0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x11, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x03, 0x00, 0x00, 0x00, 0x0F, 0x00, 0x00, 0x00,0x08, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x08, 0x00, 0x00, 0x00,0x03, 0x00, 0x00, 0x00, 0x47, 0x00, 0x00, 0x00, 0x0E, 0x00,0x00, 0x00, 0x46, 0x00, 0x00, 0x00, 0x0A, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x1A, 0x00, 0x00, 0x00, 0x02, 0x00,0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x04, 0x00, 0x00, 0x00, 0x14, 0x00,0x00, 0x00, 0x02, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,0x19, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x02, 0x00,0x00, 0x00, 0x1B, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x1D, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x6E, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x63, 0x00, 0x00, 0x00, 0x15, 0x00,0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x74, 0x00, 0x00, 0x00,0x13, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x66, 0x00,0x00, 0x00, 0x1C, 0x00, 0x00, 0x00, 0x02, 0x00, 0x00, 0x00,0x01, 0x00, 0x00, 0x00, 0x09, 0x00, 0x00, 0x00, 0x01, 0x00,0x00, 0x00, 0x11, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00,0x0D, 0x00, 0x00, 0x00, 0x01, 0x00, 0x00, 0x00, 0x03, 0x00,0x00, 0x00, 0x0F, 0x00, 0x00, 0x00, 0x22, 0x00, 0x00, 0x00,0x64, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
# [8, 0, 1, 3, 70, 14, 21, 10, 9, 2, 11, 17, 13, 15, 71, 26, 6, 29, 4, 20, 25, 27, 110, 19, 99, 116, 102, 28, 34, 100]
i = 0
while opcode[i] != 0x64:match opcode[i]:case 8:print(f"{i} mov reg[%d], %d" % (opcode[i + 4] - 1, opcode[i + 8]))i += 12case 9:print(f"{i} pop reg[%d]" % (opcode[i + 4] - 1))i += 8case 10:print(f"{i} push reg[%d]" % (opcode[i + 4] - 1))i += 8case 11:print(f"{i} get")i += 4case 12:print(f"{i} put")i += 4case 13:print(f"{i} if reg[%d] == reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))print("          v4 = 128 ")print("     if  reg[%d] > reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))print("          v5 = 64 ")print("     if  reg[%d] < reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))print("          v6 = 32 ")i += 12case 14:print(f"{i} jmp %d" % (opcode[i + 4]*4))i += 8case 15:print(f"{i} jz %d" % (opcode[i + 4]*4))i += 8case 16:print(f"{i} jne %d" % (opcode[i + 4]*4))i += 8case 17:print(f"{i} inc reg[%d]" % (opcode[i + 4]))i += 8case 18:print(f"{i} dec reg[%d]" % (opcode[i + 4]))i += 8case 19:print(f"{i} add reg[%d], %d" % (opcode[i + 4] - 1, opcode[i + 8]))i += 12case 20:print(f"{i} sub reg[%d], reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))i += 12case 21:print(f"{i} xor reg[%d], %d" % (opcode[i + 4] - 1, opcode[i + 8]))i += 12case 22:print(f"{i} and reg[%d], reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))i += 12case 23:print(f"{i} or reg[%d], reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))i += 12case 25:print(f"{i} mov reg[%d], reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))i += 12case 26:print(f"{i} lea reg[%d], reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))i += 12case 27:print(f"{i} mov reg[%d], reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))i += 12case 28:print(f"{i} mov [reg[%d]], reg[%d]" % (opcode[i + 4] - 1, opcode[i + 8] - 1))i += 12case 29:print(f"{i} mul reg[%d], %d" % (opcode[i + 4] - 1, opcode[i + 8]))i += 12

指令很多，费劲。

打印出来就是，

0 mov reg[0], 0
12 mov reg[2], 70
24 jmp 84
32 push reg[0]
40 pop reg[1]
48 get
52 push reg[0]
60 push reg[1]
68 pop reg[0]
76 inc reg[1]
84 if reg[0] == reg[2]v4 = 128 if  reg[0] > reg[2]v5 = 64 if  reg[0] < reg[2]v6 = 32 
96 jz 32
104 mov reg[0], 0
116 mov reg[2], 71
128 jmp 280
136 push reg[0]
144 lea reg[1], reg[5]
156 mul reg[0], 4
168 sub reg[1], reg[0]
180 mov reg[0], reg[1]
192 mov reg[0], reg[0]
204 mul reg[0], 110
216 add reg[0], 99
228 xor reg[0], 116
240 add reg[0], 102
252 mov [reg[1]], reg[0]
264 pop reg[0]
272 inc reg[1]
280 if reg[0] == reg[2]v4 = 128 if  reg[0] > reg[2]v5 = 64 if  reg[0] < reg[2]v6 = 32 
292 jz 136

前面就是压入了 70个输入，后面对输入进行处理，分析出来是(((reg0*110)+99)^116+102) 这样一个操作。

然后就是找到解密数据，写个exp就好了

enc = [0xD3, 0x36, 0x00, 0x00, 0xFF, 0x2A, 0x00, 0x00, 0xCB, 0x2A,0x00, 0x00, 0x95, 0x2B, 0x00, 0x00, 0x95, 0x2B, 0x00, 0x00,0x95, 0x2B, 0x00, 0x00, 0x9F, 0x16, 0x00, 0x00, 0x6D, 0x18,0x00, 0x00, 0xD7, 0x18, 0x00, 0x00, 0x11, 0x16, 0x00, 0x00,0xD7, 0x18, 0x00, 0x00, 0x95, 0x2B, 0x00, 0x00, 0x23, 0x2C,0x00, 0x00, 0xA9, 0x2C, 0x00, 0x00, 0x11, 0x16, 0x00, 0x00,0x11, 0x16, 0x00, 0x00, 0xD7, 0x18, 0x00, 0x00, 0xFF, 0x2A,0x00, 0x00, 0x49, 0x18, 0x00, 0x00, 0xFB, 0x18, 0x00, 0x00,0xCB, 0x2A, 0x00, 0x00, 0x71, 0x2A, 0x00, 0x00, 0x35, 0x17,0x00, 0x00, 0xD7, 0x18, 0x00, 0x00, 0x11, 0x16, 0x00, 0x00,0xCB, 0x2A, 0x00, 0x00, 0xDD, 0x15, 0x00, 0x00, 0xD7, 0x18,0x00, 0x00, 0x23, 0x2C, 0x00, 0x00, 0x9F, 0x16, 0x00, 0x00,0xDD, 0x15, 0x00, 0x00, 0x95, 0x2B, 0x00, 0x00, 0x9F, 0x16,0x00, 0x00, 0x6B, 0x15, 0x00, 0x00, 0x6D, 0x18, 0x00, 0x00,0xFF, 0x2A, 0x00, 0x00, 0x11, 0x16, 0x00, 0x00, 0x11, 0x16,0x00, 0x00, 0xDD, 0x15, 0x00, 0x00, 0xFF, 0x2A, 0x00, 0x00,0x23, 0x2C, 0x00, 0x00, 0xCB, 0x2A, 0x00, 0x00, 0xDD, 0x15,0x00, 0x00, 0xDD, 0x15, 0x00, 0x00, 0x6D, 0x18, 0x00, 0x00,0x49, 0x18, 0x00, 0x00, 0x95, 0x2B, 0x00, 0x00, 0x6B, 0x15,0x00, 0x00, 0x35, 0x17, 0x00, 0x00, 0xFB, 0x18, 0x00, 0x00,0xFB, 0x18, 0x00, 0x00, 0x71, 0x2A, 0x00, 0x00, 0xFF, 0x2A,0x00, 0x00, 0x35, 0x17, 0x00, 0x00, 0x23, 0x2C, 0x00, 0x00,0xDD, 0x15, 0x00, 0x00, 0xD7, 0x18, 0x00, 0x00, 0x71, 0x2A,0x00, 0x00, 0xD7, 0x18, 0x00, 0x00, 0xD7, 0x18, 0x00, 0x00,0x23, 0x2C, 0x00, 0x00, 0xFF, 0x2A, 0x00, 0x00, 0x6B, 0x15,0x00, 0x00, 0x23, 0x2C, 0x00, 0x00, 0x9F, 0x16, 0x00, 0x00,0xAF, 0x35, 0x00, 0x00, 0xA9, 0x2C, 0x00, 0x00, 0xB5, 0x32,0x00, 0x00, 0xFF, 0x2A, 0x00, 0x00, 0x39, 0x30, 0x00, 0x00,0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00]
t = [enc[i] | (enc[i + 1] << 8) | (enc[i + 2] << 16) | (enc[i + 3] << 24) for i in range(0, len(enc), 4)]flag = []
for i in t[:70]:f = (((i - 102) ^ 116) - 99) // 110flag.append(f)
print(flag)
print(bytes(flag)[::-1])

需要对enc做一点处理。

woqu，写完发现其实好像没什么好讲的了，但是写的时候的确问题好多，不写不知道，，，，，a