#include "stdafx.h"

#ifdef __cplusplus
extern "C" {
#endif

int __cdecl Add3(int, int);									// proc in asm obj
char * __cdecl very2();										// right verify proc, in asm obj, @413131

#ifdef __cplusplus
} /* extern "C" */
#endif

inline void G(){ printf("You get it!\n");}					// show good msg, will not have a chance to run
inline void B(){ printf("Bad register-code, keep trying.\n");}	// show err msg

char * InputKey();											// get register code, in stack
void very1();												// fake verify proc 1
void very3();												// fake verify proc 3
int Flag=0x21;												// register flag, 21 is a bad-guy
extern "C" int cFlag=0x11;									// anti-wrong jump flag



int main(int argc, char* argv[])
{
	printf("\n Crackme for CTF2017 @Pediy.\n");				// show welcome msg
	char Key0[10];											// local var, never use
	char *p1;												// pointor to stack var, useless
	cFlag=2;
	p1=InputKey();											// get register code, it must over-flow to very2()
	//printf("%s\n", p1);
	very1();												// useless
	very3();												// useless
	if(cFlag==0)
		G();
	else
		B();										// boom! bad cracker, just wonder where to verify it???
	//getch();
	return 0;
}


char * InputKey()											// get register code, it must over-flow to very2(), which is coded in ASM, with junk-code
															// dword1 dword2 dword3 11A (address of very2, @413131 )
{
	char Key[10];
	char *p2;
	p2=(char *)&Key;
	printf(" Coded by Fpc.\n\n");
	printf(" Please input your code: ");
	scanf("%s", Key);
	return p2;
}

void __declspec(naked) very3()												// useless
{
	long int x, y, z;
	__asm
	{
		push	ebp
		mov		ebp, esp
		mov		ecx, [ebp-4]
		test		ecx, ecx
		jz		end1
		mov		edx, [ebp-8]
		test		edx, edx
		jz		end1
		mov		eax, ecx
		sub		eax, edx
		jz		end1
		mov		[ebp-0x0c], eax
		imul		eax,  17
		add		ecx, eax
		cmp		ecx, 0x0f3a94883
		jnz		end1
		mov		eax, [ebp-0x0c]
		imul		eax, 7
		add		edx, eax
		cmp		edx, 0x033a94883
		jnz		end1
		mov		edx, 0x543f30
		xor		edx, 0x158f04
		mov		eax, [edx]
		dec		eax
		mov		[edx], eax
end1:
		mov		esp, ebp
		pop		ebp
		ret
	}
}

public	c very2		;声明引出的proc

extern  cFlag:near

.code
	db 10000 dup(0)				; pushing addr of very2 to 413131 in exe-file
	db 2000h  dup(0)

	db 0c3					; ret, give some sign for crackerz
						;
very2	proc	near c				; right verify proc here, at 413131
	add esp, -10				; restore esp, crack must input:0c bytes regcode and addr of very2 
	xor eax, eax
	mov DWORD ptr cFlag, eax
	;
	; check register code
	; correct register code at stack:
	;		Just_for_fun + 11A(addr of very2)
	;
	;解个三元一次方程
	;5x-4y+z=A
	;4x-3y+z=B
	;4x-3y-z=C
	;
	pop eax
	mov ecx, eax		;eax=x		7473754a
	pop eax			;eax=y		726f6630
	mov ebx, eax
	pop eax			;z		6e756630
	mov edx, eax
	mov eax, ecx		;x
	sub eax, ebx		;x-y		2040f1a
	shl eax, 2		;4(x-y)		8103c68
	add eax, ecx		;x=x+4(x-y)	7c83b1b2
	add eax, edx		;x=x+4(x-y)+z	eaf917e2
	sub eax, 0eaf917e2	;A
	jnz bad_boy
	add eax, ecx
	sub eax, ebx		;x-y
	mov ebx, eax
	shl eax, 1
	add eax, ebx		;3(x-y)		60c2d4e	
	add eax, ecx		;x+3(x-y)
	mov ecx, eax		;x+3(x-y)	7a7fa298
	add eax, edx		;x+3(x-y)+z	e8f508c8
	sub eax, 0e8f508c8	;B
	jnz bad_boy
	mov eax, ecx
	sub eax, edx		;x+3(x-y)-z	c0a3c68
	sub eax, 0c0a3c68	;C
	jnz bad_boy
	;
	;eax=0
	;ebx=02040f1a
	;ecx=7a7fa298
	;edx=6e756630
	pop eax			; balance stack, eax=413131
	;set flag to 0, show good cracker msg
	xor eax, 8101		;eax=41b030, addr of flag
	mov edi, eax
	xor eax, eax
	stosd			;set flag
	call @f
	;buffer for good message: "You get it!", in 3 dwords
	dd 0050600e8, 1702,1702
@@:
	; recover good message in code segment
	pop eax
	push eax
	mov edi, eax
	;push 20756f59
	push 4e000969			;first dword
	pop eax
	;use ebx,edx value
	xor eax, edx
	stosd
	;push 20746567
	xor eax, 10a3e			;second dword
	stosd
	;push 217469
	xor eax, ebx			;22706b8c, third dword
	xor eax, 22511e14
	stosd
	;mov eax, 401044
	xor eax, 61642d
	jmp ret1
bad_boy:
	;mov eax, 40103f
	pop eax			;eax=413131, addr of very2
	xor eax, 1210e
ret1:
	xor eax, DWORD ptr cFlag
	jmp eax
	nop
	;ret

very2	endp