首页
论坛
课程
招聘
KCTF2021签到_拜师学艺
2021-11-20 13:46 898

KCTF2021签到_拜师学艺

2021-11-20 13:46
898

KCTF_拜师学艺

日常Exeinfo一下

 

没有壳,直接IDA打开F5

 

逻辑很清晰,用GetDlgItemTextA来读取输入的用户名和序列号

 

查看一下sub_9A1260函数

诶发现了0xEDB88320,google一下发现是CRC校检算法

 

再看一下sub_9A307F函数

 

 

诶很关键发现__crt_strtox,猜测一下是atoi函数,动调验证了一下确实是

 

程序的验证过程就是先将输入的序列号字符串转位数字后存入v3

 

v2是输入用户名生成的CRC校检码

 

v1v5分别是stringStr的位数,v5小于10

 

unknown_libname_13函数可以用题目给的样例序列码直接过,因为v6的值是固定的,16也是固定的,我们只需要确定v2^v3的值也相同即可

 

先用题目给的样例动调一下

 

 

可以直接用这里的v2v3值得出v2^v3的值

 

即可求出序列号,用C写一下

 

先用CRC算法得出KCTF的校检值,即v2

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
#include <stdio.h>
#include <stdlib.h>
#include <string.h>
int main() {
    int v2; // ecx
    unsigned int v3; // eax
    unsigned int v4; // eax
    unsigned int v5; // eax
    unsigned int v6; // eax
    unsigned int v7; // eax
    unsigned int v8; // eax
    unsigned int v9; // eax
    unsigned int v10; // eax
    int v11; // edx
    unsigned int i; // ecx
    char v14; // al
    int v16[256]; // [esp+0h] [ebp-404h]
    char a1[] = "KCTF";
    v11 = 4;
    v2 = 0;
    do
    {
        v3 = (unsigned int)v2 >> 1;
        if ( (v2 & 1) != 0 )
            v3 ^= 0xEDB88320;
        if ( (v3 & 1) != 0 )
            v4 = (v3 >> 1) ^ 0xEDB88320;
        else
            v4 = v3 >> 1;
        if ( (v4 & 1) != 0 )
            v5 = (v4 >> 1) ^ 0xEDB88320;
        else
            v5 = v4 >> 1;
        if ( (v5 & 1) != 0 )
            v6 = (v5 >> 1) ^ 0xEDB88320;
        else
            v6 = v5 >> 1;
        if ( (v6 & 1) != 0 )
            v7 = (v6 >> 1) ^ 0xEDB88320;
        else
            v7 = v6 >> 1;
        if ( (v7 & 1) != 0 )
            v8 = (v7 >> 1) ^ 0xEDB88320;
        else
            v8 = v7 >> 1;
        if ( (v8 & 1) != 0 )
            v9 = (v8 >> 1) ^ 0xEDB88320;
        else
            v9 = v8 >> 1;
        if ( (v9 & 1) != 0 )
            v10 = (v9 >> 1) ^ 0xEDB88320;
        else
            v10 = v9 >> 1;
        v16[v2++] = v10;
    }
    while ( v2 < 256 );
    int j = 0;
    for ( i = -1; v11; --v11 )
    {
        v14 = a1[j++];
        i = v16[(unsigned __int8)(i ^ v14)] ^ (i >> 8);
    }
    printf("%d\n%#x\n", ~i, ~i);
    //v2 = 0x5ee54f4c

之后即可用这里的v2v3值以及v2^v3的固定值用itoa函数求出序列号

1
2
3
4
int x = 0x5ee54f4c ^ 0x26EFF19D ^ 0x744E1CC7;
char tmp[10];
itoa(x, tmp, 10);
printf("%s",tmp);

[2022夏季班]《安卓高级研修班(网课)》月薪三万班招生中~

最后于 2021-11-21 18:38 被WATCHERR编辑 ,原因:
上传的附件:
收藏
点赞0
打赏
分享
最新回复 (0)
游客
登录 | 注册 方可回帖
返回