4

[原创]CTF第六题没做出

Fpc 2017-6-13 11:23 749

没搭出调试环境,现搭来不及啊。。。

apk的代码作了混淆,很有迷惑性,那个check是空的,完全没思路,怎么回事呢?

后来偶然反了一下so文件,原来check在这里啊,是arm代码,并不熟悉,纯静态并没有帮助,可搭动态调试环境并不容易,等攻略吧。。。

验证点(前面还有一堆验证,静态看不明白),R0为1就是成功

.text:000038D0 loc_38D0                                ; CODE XREF: sub_391A+2Aj
.text:000038D0                 LDRB    R2, [R1,R4]
.text:000038D2                 LDRB    R3, [R0,R4]
.text:000038D4                 CMP     R3, R2
.text:000038D6                 BNE.W   sub_39B0
.text:000038DA                 ADDS    R4, #1
.text:00003942                 CMP     R4, #0x18
.text:00003944                 BNE     loc_38D0

.text:000039AC                 MOVS    R0, #1      ;set reg flag
.text:000039AE                 B       loc_3C28

          

去花指令idc,然而去了花指令,跳转标号还存在啊,去不掉

#include <idc.idc>
 static main()
 {        
         auto i,j,from,size,fromend,address; 
         from=0x1a00; //起始地址
        fromend=0x1b000;//结束地址
        while (from<fromend)
         { 
                 if ((Dword(from)==0x47f0e92d)&&(Dword(from+4)==0x47f0e8bd)) 
                 {
                                  for (i = 0;i<5;i++)
                                 {
                                         PatchWord(from,0xbf00);
                                         from=from+2;        
                                 }
                          continue;
                 }
                 if ((Dword(from)==0x47f0e8bd)&&(Dword(from+4)==0xf100e005)&&(Dword(from+8)==0xe00a0001)&&(Dword(from+0x2e)==0x40b1e8bd)&&(Word(from+0x32)==0xe7ed)) 
                 {
                                  for (i = 0;i<0x1a;i++)
                                 {
                                         PatchWord(from,0xbf00);
                                         from=from+2;        
                                 }
                          continue;
                 }
                 if ((Dword(from)==0xb082b5b1)&&(Dword(from+0x10)==0xe8bd461b)) 
                 {
                                  for (i = 0;i<0xf;i++)
                                 {
                                         PatchWord(from,0xbf00);
                                         from=from+2;        
                                 }
                          continue;
                 }
                 from=from+2; //
        }
         Message("\n" + "OK\n");
 }

          



快讯:[看雪招聘]十八年来,看雪平台输出了大量安全人才,影响三代安全人才!

最新回复 (0)
返回