2024qwb

mips

作者用qemu模拟器加载mips_bin文件并手动实现了hook

我们只解mips_bin文件的话会解出一个假的flag

ida,alt+t直接搜索 23000，定位到关键函数的位置

交叉引用的话，可以发现程序对flag头与flag的长度进行了检查

之后程序对字符串进行了一个魔改的rc4加密，同时进行了一个异或操作

给出解密脚本:

#include <stdio.h>
#include <malloc.h>
#include "h_IDA.h"
unsigned char N_str[] = {0xDE, 0xAD, 0xBE, 0xEF};
unsigned char map1[256] ;
unsigned char map2[256] ;
void swap(unsigned char *inp, int x, int y) {
  unsigned char ch = inp[x];
  inp[x] = inp[y];
  inp[y] = ch;
}
void init(){
    for (int i = 0; i < 256; i++) {
            unsigned char v3 = ((((unsigned char)(i << 7) | (i >> 1)) << 6) ^ 0xC0 |((unsigned char)((i << 7) | (i >> 1)) >> 2) ^ 0x3B) ^0xBE;
            unsigned char out =(((unsigned char)(((16 * (((32 * v3) | (v3 >> 3)) ^ 0xAD)) | ((unsigned char)(((32 * v3) | (v3 >> 3)) ^ 0xAD) >>4)) ^ 0xDE) >>5) | (8 * (((16 * (((32 * v3) | (v3 >> 3)) ^ 0xAD)) |((unsigned char)(((32 * v3) | (v3 >> 3)) ^ 0xAD) >> 4)) ^ 0xDE)));
            map1[out] = i;
            map2[i] = out;
    }
//    for(int i=0;i<256;i++){
//      printf("0x%x ",map1[i]);
//  }
//  puts("");
//    for(int i=0;i<256;i++){
//      printf("0x%x ",map2[i]);
//  }
//  puts("");
}
unsigned char *__fastcall en_rc4(unsigned __int8 *inp)
{
  int x_1; // edx
  unsigned __int8 v3; // [rsp+15h] [rbp-17Bh]
  int i; // [rsp+18h] [rbp-178h]
  int y; // [rsp+1Ch] [rbp-174h]
  unsigned int i_1; // [rsp+20h] [rbp-170h]
  int x; // [rsp+24h] [rbp-16Ch]
  int v8; // [rsp+28h] [rbp-168h]
  int j; // [rsp+2Ch] [rbp-164h]
  int a; // [rsp+30h] [rbp-160h]
  int j_1; // [rsp+34h] [rbp-15Ch]
  int aa; // [rsp+3Ch] [rbp-154h]
  char *key; // [rsp+40h] [rbp-150h]
  unsigned __int8 *output; // [rsp+48h] [rbp-148h]
  unsigned __int8 m[256]; // [rsp+80h] [rbp-110h] BYREF
  __int16 v16; // [rsp+180h] [rbp-10h]
  unsigned __int64 v17; // [rsp+188h] [rbp-8h]
  memset(m, 0, sizeof(m));
  v16 = 0;
  for ( i = 0; i <= 255; ++i )
    m[i] = i;
  y = 0;
  i_1 = 0;
  key = "6105t3";
  do
  {
    a = m[i_1];
    j_1 = (unsigned __int8)(key++)[(int)(2 * (i_1 / 6 - (((0xAAAAAAAB * (unsigned __int64)i_1) >> 32) &amp; 0xFFFFFFFC)))];
    y += a + j_1;
    x_1 = i_1++;
    m[x_1] = m[(unsigned __int8)y];
    m[(unsigned __int8)y] = a;
  }
  while ( i_1 != 256 );
  x = 0;
  v8 = 0;
  output = (unsigned __int8 *)malloc(256LL);
  for ( j = 0; j != 22; ++j )
  {
    aa = m[(unsigned __int8)++x];
    v8 += aa;
    m[(unsigned __int8)x] = m[(unsigned __int8)v8];
    m[(unsigned __int8)v8] = aa;
    output[j] = m[(unsigned char)(m[x] + m[v8])] ^ N_str[j &amp; 3] ^ map2[inp[j + 5]];
  }
  return output;
}
unsigned char *__fastcall de_rc4(unsigned __int8 *inp)
{
  int x_1; // edx
  unsigned __int8 v3; // [rsp+15h] [rbp-17Bh]
  int i; // [rsp+18h] [rbp-178h]
  int y; // [rsp+1Ch] [rbp-174h]
  unsigned int i_1; // [rsp+20h] [rbp-170h]
  unsigned char x; // [rsp+24h] [rbp-16Ch]
  unsigned char v8; // [rsp+28h] [rbp-168h]
  int j; // [rsp+2Ch] [rbp-164h]
  int a; // [rsp+30h] [rbp-160h]
  int j_1; // [rsp+34h] [rbp-15Ch]
  int aa; // [rsp+3Ch] [rbp-154h]
  char *key; // [rsp+40h] [rbp-150h]
  unsigned __int8 *output; // [rsp+48h] [rbp-148h]
  unsigned __int8 m[256]; // [rsp+80h] [rbp-110h] BYREF
  __int16 v16; // [rsp+180h] [rbp-10h]
  unsigned __int64 v17; // [rsp+188h] [rbp-8h]
  memset(m, 0, sizeof(m));
  v16 = 0;
  for ( i = 0; i <= 255; ++i )
    m[i] = i;
  y = 0;
  i_1 = 0;
  key = "6105t3";
  do
  {
    a = m[i_1];
    j_1 = (unsigned __int8)(key++)[(int)(2 * (i_1 / 6 - (((0xAAAAAAAB * (unsigned __int64)i_1) >> 32) &amp; 0xFFFFFFFC)))];
    y += a + j_1;
    x_1 = i_1++;
    m[x_1] = m[(unsigned __int8)y];
    m[(unsigned __int8)y] = a;
  }
  while ( i_1 != 256 );
    for(int i=0;i<256;i++){
    printf("0x%x ",m[i]);
  }
  puts("");
  x = 0;
  v8 = 0;
  output = (unsigned __int8 *)malloc(256LL);
  for ( j = 0; j != 22; ++j )
  {
    aa = m[(unsigned __int8)++x];
    v8 += aa;
    m[(unsigned __int8)x] = m[(unsigned __int8)v8];
    m[(unsigned __int8)v8] = aa;
    output[j] = map1[ m[(unsigned char)(m[x] + m[v8])] ^ N_str[j &amp; 3]  ^ inp[j]];   
//  printf("0x%x - 0x%x - 0x%x", m[(unsigned char)(m[x] + m[v8])], N_str[j &amp; 3],inp[j]);
  }
  puts("");
  return output;
}
int main(){
    init();
    unsigned char cip[] = {0x000000C4, 0x000000EE, 0x0000003C, 0x000000BB, 0x000000E7, 0x000000FD, 0x00000067, 0x0000001D, 0x000000F8, 0x00000097, 0x00000068, 0x0000009D, 0x0000000B, 0x0000007F, 0x000000C7, 0x00000080, 0x000000DF, 0x000000F9, 0x0000004B, 0x000000A0, 0x00000046, 0x00000091};
      swap(cip, 12, 16);
      swap(cip, 7, 11);
  for (int i = 0; i < 22; i++) {
    cip[i] ^= 0xa;
  }
    unsigned char *m = de_rc4(cip);
    printf("flag{");
    for (int i = 0; i < 22; i++) {
      printf("%c", (unsigned char)m[i]);
    }
    return 0;
}
// flag{QeMu_r3v3rs3in9_h@ck6}

其中 异或的值有反调试，调试或者attach状态下都拿不到，我们可以尝试爆破、patch、epbftrace等方法拿到

patch的话，就像这样:

patch出一个write系统调用

bpbftrace命令如下：

sudo bpftrace -e '
watchpoint:0x0007FFFF76FF942:8:x 
{ 
    $addr = 0x0007FFFF7FF4324;
    printf("before rc4 watch n_STR and input \n");
    @i = 0;
    printf("n_STR: ");
    unroll (4) {
        printf("%02x,", *(uint8*)($addr + @i));
        @i++;
    }
    printf("\n");
}
' -p pid

remem

先修elf文件，之后调试程序，注意到程序每次都会mmap，并且把shellcode放入mmap内存中执行，之后销毁，在固定基址后，mmap申请的位置是固定的，我们可以获取到每个mmap的shellcode片段，整理下来如下:

0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 61626364h
0x7F722B88300C: mul rax
0x7F722B88300F: leaveq
0x7F722B883011: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 250BB52207267F10h
0x7F722B88300F: mov rbx, 3
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 61626364h
0x7F722B88300C: mov rbx, 65666768h
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 2692C5C033CD9CA0h
0x7F722B88300F: mov rbx, 6
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 65666768h
0x7F722B88300C: mov rbx, 52h ; ‘R’
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 65666768h
0x7F722B88300C: mov rbx, 6
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 61626364h
0x7F722B88300C: mul rax
0x7F722B88300F: leaveq
0x7F722B883011: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 250BB52207267F10h
0x7F722B88300F: mov rbx, 2
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 65666768h
0x7F722B88300C: mov rbx, 0Dh
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 61626364h
0x7F722B88300C: mov rbx, 11h
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 61626364h
0x7F722B88300C: mov rbx, 696A6B6Ch
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 2819D65E6074BA30h
0x7F722B88300F: mov rbx, 5
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 696A6B6Ch
0x7F722B88300C: mul rax
0x7F722B88300F: leaveq
0x7F722B883011: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 2B68785BBA837590h
0x7F722B88300F: mov rbx, 5
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 696A6B6Ch
0x7F722B88300C: mov rbx, 58h ; ‘X’
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 6D6E6F70h
0x7F722B88300C: mov rbx, 696A6B6Ch
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 2D0FC95A678AD340h
0x7F722B88300F: mov rbx, 4
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 696A6B6Ch
0x7F722B88300C: mul rax
0x7F722B88300F: leaveq
0x7F722B883011: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 2B68785BBA837590h
0x7F722B88300F: mov rbx, 5
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 6D6E6F70h
0x7F722B88300C: mov rbx, 0E8h
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 6D6E6F70h
0x7F722B88300C: mul rax
0x7F722B88300F: leaveq
0x7F722B883011: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 2EC73A8954C25100h
0x7F722B88300F: mov rbx, 23h ; ‘#’
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 71727374h
0x7F722B88300C: mov rbx, 8
0x7F722B883013: mul rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 71727374h
0x7F722B88300C: mul rax
0x7F722B88300F: leaveq
0x7F722B883011: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 32463D176F616C90h
0x7F722B88300F: mov rbx, 10h
0x7F722B883016: mul rbx
0x7F722B883019: leaveq
0x7F722B88301B: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 38B939BA0h
0x7F722B88300F: mov rbx, 2463D176F616C900h
0x7F722B883019: add rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 2463D17A81AA64A0h
0x7F722B88300F: mov rbx, 653D00C696911300h
0x7F722B883019: sub rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 0BF26D0B3EB1951A0h
0x7F722B88300F: mov rbx, 5E2F4391h
0x7F722B883016: xor rdx, rdx
0x7F722B883019: div rbx
0x7F722B88301C: mov rax, rdx
0x7F722B88301F: leaveq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 0D90A59CAA4914BD0h
0x7F722B88300F: mov rbx, 632C14FD80h
0x7F722B883019: add rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 0D90A5A2DD0A64950h
0x7F722B88300F: mov rbx, 0B43F25699E2B4D00h
0x7F722B883019: sub rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 24CB34C4327AFC50h
0x7F722B88300F: mov rbx, 5E2F4391h
0x7F722B883016: xor rdx, rdx
0x7F722B883019: div rbx
0x7F722B88301C: mov rax, rdx
0x7F722B88301F: leaveq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 0D90A59CAA4914BD0h
0x7F722B88300F: mov rbx, 243C94ED20h
0x7F722B883019: add rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 0D90A59EEE12638F0h
0x7F722B88300F: mov rbx, 0C8812FD7E247A2F0h
0x7F722B883019: sub rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 10892A16FEDE9600h
0x7F722B88300F: mov rbx, 5E2F4391h
0x7F722B883016: xor rdx, rdx
0x7F722B883019: div rbx
0x7F722B88301C: mov rax, rdx
0x7F722B88301F: leaveq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 526334048h
0x7F722B88300F: mov rbx, 6778899A4h
0x7F722B883019: add rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 4A176A440E4CFE20h
0x7F722B88300F: mov rbx, 0B9DBBD9ECh
0x7F722B883019: add rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 4A176A4FAC08D80Ch
0x7F722B88300F: mov rbx, 5E2F4391h
0x7F722B883016: xor rdx, rdx
0x7F722B883019: div rbx
0x7F722B88301C: mov rax, rdx
0x7F722B88301F: leaveq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 207ACD1F50h
0x7F722B88300F: mov rbx, 260666C70h
0x7F722B883019: add rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 0E770A28136D1ABC0h
0x7F722B88300F: mov rbx, 22DB338BC0h
0x7F722B883019: add rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 0E770A2A412053780h
0x7F722B88300F: mov rbx, 6F231F6615737D30h
0x7F722B883019: sub rax, rbx
0x7F722B88301C: leaveq
0x7F722B88301E: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 784D833DFC91BA50h
0x7F722B88300F: mov rbx, 5E2F4391h
0x7F722B883016: xor rdx, rdx
0x7F722B883019: div rbx
0x7F722B88301C: mov rax, rdx
0x7F722B88301F: leaveq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 286A77D6h
0x7F722B88300C: mov rbx, 42DB9F06h
0x7F722B883013: xor rax, rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 5E867B43h
0x7F722B88300C: mov rbx, 35368926h
0x7F722B883013: xor rax, rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 3AB4599Bh
0x7F722B88300C: mov rbx, 509A3978h
0x7F722B883013: xor rax, rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 43D5705Dh
0x7F722B88300C: mov rbx, 1EBFA92Fh
0x7F722B883013: xor rax, rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​
0x7F722B883000: push rbp
0x7F722B883002: mov rbp, rsp
0x7F722B883005: mov rax, 464560F0h
0x7F722B88300C: mov rbx, 555CC98Ch
0x7F722B883013: xor rax, rbx
0x7F722B883016: leaveq
0x7F722B883018: retnq
​

之后编写vm解析器:

from capstone import *
opcode=[0x0F2,0x0,0x0F2,0x3,0x0F7,0x0F2,0x3,0x0F2,0x3,0x0F7,0x0F2,
3,0x0F7,0x0F2,0x3,0x0F7,0x0F2,0x0,0x0F2,0x3,0x0F7,0x0F2,
3,0x0F7,0x0F2,0x3,0x0F7,0x0F2,0x3,0x0F2,0x3,0x0F7,0x0F2,
0,0x0F2,0x3,0x0F7,0x0F2,0x3,0x0F7,0x0F2,0x3,0x0F2,0x3,0x0F7,
0x0F2,0x0,0x0F2,0x3,0x0F7,0x0F2,0x3,0x0F7,0x0F2,0x0,0x0F2,
3,0x0F7,0x0F2,0x3,0x0F7,0x0F2,0x0,0x0F2,0x3,0x0F7,0x0F0,
0,0x3,0x0F1,0x0,0x3,0x0F6,0x3,0x0F0,0x0,0x3,0x0F1,0x0,0x3,0x0F6,
3,0x0F0,0x0,0x3,0x0F1,0x0,0x3,0x0F6,0x3,0x0F0,0x0,0x3,0x0F0,
0,0x3,0x0F6,0x3,0x0F0,0x0,0x3,0x0F0,0x0,0x3,0x0F1,0x0,0x3,0x0F6,
3,0x0F7,0x0F3,0x0,0x3,0x0F3,0x0,0x3,0x0F3,0x0,0x3,0x0F3,0x0,
3,0x0F3,0x0,0x3,0x0F8]
arr=[0]*11
arr[0] = 0x61626364
arr[1] = 0x65666768
arr[2] = 0x69707172
arr[3] = 0x73747576
arr[4] = 0x7778797A
arr[5] = 0x5E2F4391
arr[6] = 0x42DB9F06
arr[7] = 0x35368926
arr[8] = 0x509A3978
arr[9] = 0x1EBFA92F
arr[10] = 0x555CC98C
v16=[0]*18
v16[0] = arr[0]
v16[1] = arr[0]
v16[2] = arr[1]
v16[3] = arr[1]
v16[4] = arr[0]
v16[5] = arr[1]
v16[6] = arr[0]
v16[7] = arr[0]
v16[8] = arr[2]
v16[9] = arr[2]
v16[10] = arr[3]
v16[11] = arr[2]
v16[12] = arr[3]
v16[13] = arr[3]
v16[14] = arr[4]
v16[15] = arr[4]
v16[16] = 0
v16[17] = 0
v15=[0]*6
ptr=[0]*9
v13 = 1
v14 = arr[0]
v10 = 0
v11 = 0
rip=0
while True:
    if opcode[rip] == 0xF0:
        v10-=1
        # v0 = v16[v10 + 18]
        print(f'{rip} v0 = v16[{v10+18}]')
        v10-=1
        # v1 = func0(v16[v10 + 18], v0)
        print(f'{rip} v1=func0(v16[{v10+18},v0])')
        # v16[v10 + 18] = v1
        print(f'{rip} v16[{v10+18}] = v1')
        v10+=1
        rip += 3
        # print('F0',end=' ')
#         
    elif opcode[rip] == 0xF1:
        v10-=1
#         v2 = v16[v10 + 18]
        print(f'{rip} v2 = v16[{v10+18}]')
        v10-=1
#         v3 = func1(v16[v10 + 18], v2)
        print(f'{rip} v3=func1(v16[{v10+18},v2])')
#         v16[v10 + 18] = v3
        print(f'{rip} v16[{v10+18}] = v3')
        v10+=1
        rip += 3
        # print('F1',end=' ')
#         
    if opcode[rip] == 0xF2:
        # v14=func2(v14)  
        print(f'{rip} v14=func2(v14)')                  
        rip += 2
        # print('F2',end=' ')
    elif opcode[rip] == 0xF3:
        v11-=1
#         v14 = func3(v14 ^ v15[v11])
        print(f'{rip} v14=func3(v14^v15[{v11}])')
        rip += 3
        # print('F3',end=' ')
#         
    elif opcode[rip] == 0xF5:
        v10-=1
#         v4 = v16[v10 + 18]
        print(f'{rip} v4 = v16[{v10+18}]')
        v10-=1
#         v14 = func4(v16[v10 + 18], v4)
        print(f'{rip} v14=func5(v16[{v10+18},v4])')
        rip += 3
        # print('F5',end=' ')
#         
    elif opcode[rip] == 0xF6:
        v10-=1
        print(f'{rip} v5=func5(v16[{v10+18},{hex(arr[5])}])')
        print(f'{rip} v15[{v11}] = v5')
#         v5 = func5(v16[v10 + 18], arr[5]%0xffffffff)
#         v15[v11] = v5
        rip += 2
        v11+=1
        # print('F6',end=' ')
#         
    elif opcode[rip] == 0xF7:
        v6 = v10
        v10+=1
        # v16[v6 + 18] = v14
        print(f"{rip} v16[{v6+18}] = v14")
        v7 = v13
        v13+=1
        # v14 = v16[v7]
        print(f"{rip} v14 = v16[{v7}]")
        rip+=1
    elif opcode[rip] == 0xF8:
        print('F8',end=' ')
        break
#         if v14!=0:
#             print('fail!')
# F2 F2 F7 F2 F2 F7 F2 F7 F2 F7 F2 F2 F7 F2 F7 F2 F7 F2 F2 F7 F2 F2 F7 F2 F7 F2 F2 F7 F2 F2 F7 F2 F7 F2 F2 F7 F2 F7 F2 F2 F7 F0 F1 F6 F0 F1 F6 F0 F1 F6 F0 F0 F6 F0 F0 F1 F6 F7 F3 F3 F3 F3 F3 F8

得到:

0 v14=func2(v14)                // v14 = part1 * part1
2 v14=func2(v14)                // v14 = v14 * 3
4 v16[18] = v14                        // v16[18] = v14                    ==> 0x6f231f6615737d30
4 v14 = v16[1]                        // v14 = part1
5 v14=func2(v14)                // v14 = part1 * part2
7 v14=func2(v14)                // v14 = v14 * 6
9 v16[19] = v14                        // v16[19] = v14
9 v14 = v16[2]                        // v14 = part2
10 v14=func2(v14)                // v14 = part2 * 0x52
12 v16[20] = v14                // v16[20] = v14
12 v14 = v16[3]                        // v14 = part2
13 v14=func2(v14)                // v14 = part2*6
15 v16[21] = v14                // v16[21] = v14
15 v14 = v16[4]                        // v14 = v16[4]
16 v14=func2(v14)                // v14 = part1 * part1
18 v14=func2(v14)                // v14 = v14 * 2
20 v16[22] = v14                // v16[22] = v14
20 v14 = v16[5]                        // v14 = v16[5]
21 v14=func2(v14)                // v14 = part2 * 0xd
23 v16[23] = v14                // v16[23] = v14
23 v14 = v16[6]                        // v14 = v16[6]        
24 v14=func2(v14)                // v14 = part1 * 0x11
26 v16[24] = v14                // v16[24] = v14
26 v14 = v16[7]                        // v14 = v16[7]
27 v14=func2(v14)                // v14 = part1 * part3 
29 v14=func2(v14)                // v14 = v14 * 5
31 v16[25] = v14                // v16[25] = v14
31 v14 = v16[8]                        // v14 = v16[8]
32 v14=func2(v14)                // v14 = part3 * part3
34 v14=func2(v14)                // v14 = v14 * 5
36 v16[26] = v14                // v16[26] = v14
36 v14 = v16[9]                        // v14 = v16[9]        
37 v14=func2(v14)                // v14 = part3 * 0x58
39 v16[27] = v14                // v16[27] = v14
39 v14 = v16[10]                // v14 = v16[10]
40 v14=func2(v14)                // v14 = part3 * part4
42 v14=func2(v14)                // v14 *= 4;
44 v16[28] = v14                // v16[28] = v14
44 v14 = v16[11]                // v14 = v16[11]
45 v14=func2(v14)                // v14 = part3 * part3
47 v14=func2(v14)                // v14 *= 5
49 v16[29] = v14                // v16[29] = v14
49 v14 = v16[12]                // v14 = v16[12]
50 v14=func2(v14)                // v14 = part4 * 0xE8
52 v16[30] = v14                // v16[30] = v14        
52 v14 = v16[13]                // v14 = v16[13]
53 v14=func2(v14)                // v14 = part4 * part4
55 v14=func2(v14)                // v14 = v14 * 0x23
57 v16[31] = v14                //  v16[31] = v14
57 v14 = v16[14]                // v14 = v16[14]
58 v14=func2(v14)                // v14 = part5 * 8
60 v16[32] = v14                // v16[32] = v14
60 v14 = v16[15]                // v14 = v16[15]
61 v14=func2(v14)                // v14 = part5*part5
63 v14=func2(v14)                // v14 = v14 * 0x10
65 v16[33] = v14                // v16[33] = v14
65 v14 = v16[16]                // v14 = v16[16]
66 v0 = v16[33]                        // v0 = v16[33]        
66 v1=func0(v16[32,v0])        // v1 = v16[32] + v16[33]
66 v16[32] = v1                        // v16[32] = v1        
69 v2 = v16[32]                        // v2 = v16[32]
69 v3=func1(v16[31,v2])                                // v3=v16[32] - v16[31]        
69 v16[31] = v3                                                // v16[31] = v3
72 v5=func5(v16[31,0x5e2f4391])                // v5 = v16[31] % 0x5e2f4391
72 v15[0] = v5                                                // v15[0] = v5
74 v0 = v16[30]                                                // v0 = v16[30]
74 v1=func0(v16[29,v0])                                // v1 = v16[29]  +v16[30]
74 v16[29] = v1                                                // v16[29] = v1
77 v2 = v16[29]                                                // v2 = v16[29]        
77 v3=func1(v16[28,v2])                                // v3 =v16[29]        -v16[28] 
77 v16[28] = v3                                                // v16[28] = v3                        
80 v5=func5(v16[28,0x5e2f4391])                // v5 = v3 % 0x5e2f4391
80 v15[1] = v5                                                // v15[1] = v5                
82 v0 = v16[27]                                                // v0 = v16[27]
82 v1=func0(v16[26,v0])                                // v1 = v16[26] + v16[27]
82 v16[26] = v1                                                // v16[26] = v1                
85 v2 = v16[26]                                                // v2 = v16[26]        
85 v3=func1(v16[25,v2])                                // v3 = v16[26] - v16[25]
85 v16[25] = v3                                                // v16[25] = v3
88 v5=func5(v16[25,0x5e2f4391])                        // v5 =v16[25] %  0x5e2f4391
88 v15[2] = v5                                                        // v15[2] = v5
90 v0 = v16[24]                                                        // v0 = v16[24]
90 v1=func0(v16[23,v0])                                        // v1 = v16[23] + v16[24]
90 v16[23] = v1                                                        // v16[23] = v1        
93 v0 = v16[23]                                                        // v0 = v16[23]        
93 v1=func0(v16[22,v0])                                        // v1 = v16[22] + v16[23]
93 v16[22] = v1                                                        // v16[22] = v1
96 v5=func5(v16[22,0x5e2f4391])                        // v5 = v16[22] % 0x5e2f4391
96 v15[3] = v5                                                        // v15[3] = v5        
98 v0 = v16[21]                                                        // v0 = v16[21]
98 v1=func0(v16[20,v0])                                        // v1 = v16[21] + v16[20]
98 v16[20] = v1                                                        // v16[20] = v1        
101 v0 = v16[20]                                                // v0 = v16[20]                
101 v1=func0(v16[19,v0])                                // v1 = v16[19] + v16[20]
101 v16[19] = v1                                                // v16[19] = v1        
104 v2 = v16[19]                                                // v2 = v16[19]        
104 v3=func1(v16[18,v2])                                // v3 = v16[19] - v16[18]
104 v16[18] = v3                                                // v16[18] = v3                
107 v5=func5(v16[18,0x5e2f4391])                // v5 = v16[18] % 0x5e2f4391
107 v15[4] = v5                                                        // v15[4] = v5                
109 v16[18] = v14                                                // v16[18] = v14
109 v14 = v16[17]                                                // v14 = v16[17]        
110 v14=func3(v14^v15[4])                                // v14 = v16[17] ^ v15[4] ^ 0x42DB9F06
113 v14=func3(v14^v15[3])                                // v14 = v14 ^ v15[3] ^ 0x35368926
116 v14=func3(v14^v15[2])                                // v14 = v14 ^ v15[2] ^ 0x509A3978
119 v14=func3(v14^v15[1])                                // v14 = v14 ^ v15[1] ^ 0x1EBFA92F
122 v14=func3(v14^v15[0])                                // v14 = v14 ^ v15[0] ^ 0x555CC98C

分析写出c语言代码:

#include <stdio.h>
unsigned char inp[100] = {0};
unsigned long long int part1,part2,part3,part4,part5;
unsigned long long int v14;
unsigned long long int v16[100];
unsigned long long int v0,v1,v2,v3,v4,v5,v6;
unsigned long long int v15[10];
int main(){                  
        // 0x61626364 0x65666768 0x696A6B6C 0x6D6E6F70 0x71727374
//        scanf("%s",inp);                            
        scanf("%x",&amp;part1);
        scanf("%x",&amp;part2);
        scanf("%x",&amp;part3);
        scanf("%x",&amp;part4);
        scanf("%x",&amp;part5);
//        printf("0x%x\n",part1);
//        printf("0x%x\n",part2);
//        printf("0x%x\n",part3);
//        printf("0x%x\n",part4);
//        printf("0x%x\n",part5);
//        part1 = inp
        v14 = part1 * part1;                                 ;
        v14 = v14 * 3;                                       ;
        v16[18] = v14;                                       ;
        v14 = part1;                                         ;
        v14 = part1 * part2;                                 ;
        v14 = v14 * 6;                                       ;
        v16[19] = v14;                                       ;
        v14 = part2;                                         ;
        v14 = part2 * 0x52;                                  ;
        v16[20] = v14;                                       ;
        v14 = part2                                          ;
        v14 = part2*6                                        ;
        v16[21] = v14                                        ;
        v14 = v16[4]                                         ;
        v14 = part1 * part1                                  ;
        v14 = v14 * 2                                        ;
        v16[22] = v14                                        ;
        v14 = v16[5]                                         ;
        v14 = part2 * 0xd                                    ;
        v16[23] = v14                                        ;
        v14 = v16[6]                                             ;
        v14 = part1 * 0x11                                   ;
        v16[24] = v14                                        ;
        v14 = v16[7]                                         ;
        v14 = part1 * part3                                  ;
        v14 = v14 * 5                                        ;
        v16[25] = v14                                        ;
        v14 = v16[8]                                         ;
        v14 = part3 * part3                                  ;
        v14 = v14 * 5                                        ;
        v16[26] = v14                                        ;
        v14 = v16[9]                                             ;
        v14 = part3 * 0x58                                   ;
        v16[27] = v14                                        ;
        v14 = v16[10]                                        ;
        v14 = part3 * part4                                  ;
        v14 *= 4;                                            ;
        v16[28] = v14                                        ;
        v14 = v16[11]                                        ;
        v14 = part3 * part3                                  ;
        v14 *= 5                                             ;
        v16[29] = v14                                        ;
        v14 = v16[12]                                        ;
        v14 = part4 * 0xE8                                   ;
        v16[30] = v14                                             ;
        v14 = v16[13]                                        ;
        v14 = part4 * part4                                  ;
        v14 = v14 * 0x23                                     ;
         v16[31] = v14                                       ;
        v14 = v16[14]                                        ;
        v14 = part5 * 8                                      ;
        v16[32] = v14                                        ;
        v14 = v16[15]                                        ;
        v14 = part5*part5                                    ;
        v14 = v14 * 0x10                                     ;
        v16[33] = v14                                        ;
        v14 = v16[16]                                        ;
        v0 = v16[33]                                             ;
        v1 = v16[32] + v16[33]                               ;
        v16[32] = v1                                             ;
        v2 = v16[32]                                         ;
        v3=v16[32] - v16[31]                                     ;
        v16[31] = v3                                         ;
        v5 = v16[31] % 0x5e2f4391                            ;
        v15[0] = v5                                          ;
        v0 = v16[30]                                         ;
        v1 = v16[29]  +v16[30]                               ;
        v16[29] = v1                                         ;
        v2 = v16[29]                                             ;
        v3 =v16[29]        -v16[28]                                 ;
        v16[28] = v3                                                     ;
        v5 = v3 % 0x5e2f4391                                 ;
        v15[1] = v5                                                     ;
        v0 = v16[27]                                         ;
        v1 = v16[26] + v16[27]                               ;
        v16[26] = v1                                                 ;
        v2 = v16[26]                                             ;
        v3 = v16[26] - v16[25]                               ;
        v16[25] = v3                                         ;
        v5 =v16[25] %  0x5e2f4391                            ;
        v15[2] = v5                                          ;
        v0 = v16[24]                                         ;
        v1 = v16[23] + v16[24]                               ;
        v16[23] = v1                                             ;
        v0 = v16[23]                                             ;
        v1 = v16[22] + v16[23]                               ;
        v16[22] = v1                                         ;
        v5 = v16[22] % 0x5e2f4391                            ;
        v15[3] = v5                                                 ;
        v0 = v16[21]                                         ;
        v1 = v16[21] + v16[20]                               ;
        v16[20] = v1                                             ;
        v0 = v16[20]                                                 ;
        v1 = v16[19] + v16[20]                               ;
        v16[19] = v1                                             ;
        v2 = v16[19]                                             ;
        v3 = v16[19] - v16[18]                               ;
        v16[18] = v3                                                 ;
        v5 = v16[18] % 0x5e2f4391                            ;
        v15[4] = v5                                                     ;
        v16[18] = v14                                        ;
        v14 = v16[17]                                             ;
        v14 = v16[17] ^ v15[4] ^ 0x42DB9F06                  ;
        v14 = v14 ^ v15[3] ^ 0x35368926                      ;
        v14 = v14 ^ v15[2] ^ 0x509A3978                      ;
        v14 = v14 ^ v15[1] ^ 0x1EBFA92F                      ;
        v14 = v14 ^ v15[0] ^ 0x555CC98C                      ;
//        printf("0x%x\n",v14);
        printf("0x%x\n",v15[0]);
        printf("0x%x\n",v15[1]);
        printf("0x%x\n",v15[2]);
        printf("0x%x\n",v15[3]);
        printf("0x%x\n",v15[4]);
        if(v15[0] != 0x555CC98C &amp;&amp; v15[1] != 0x1EBFA92F &amp;&amp; v15[2] != 0x509A3978 &amp;&amp; v15[3] != 0x35368926 &amp;&amp; v15[4] != 0x42DB9F06){
                printf("error\n");
        }else{
                printf("success\n");
        }
//        for(int i=0;i<34;i++){
//                printf("%d : 0x%llx\n",i,v16[i]);
//        }
//        puts("");
//        printf("v14 : 0x%x",v14);
}

gcc编译并开O3优化;

整理出来，实际是一个求同余式问题:

( (16 * part5 * part5 + 8 * part5) - 35 * part4 * part4)           % 1580155793 == 1432144268;               
((( 5 * part3 * part3) + 232 * part4) - 4 * part3 * part4)        % 1580155793 == 515877167;                
( (88 * part3 +  (5 * part3 * part3) ) - 5 * part1 * part3)         % 1580155793 == 1352284536;             
 ( 2 * part1 * part1 + ( 13 * part2 + 17 * part1))                   % 1580155793 == 892766502;             
( (0x58 * part2 + 6 * part2 * part1) - 3 * part1 * part1)                 % 1580155793 == 1121689350;

其中第四个与第五个等式只含part1与part2变量，并且第四个等式的part2可以用part1来表示:

part2 = (892766502 - 2 * part1 * part1  - 17 * part1) * 13^(-1) (mod 1580155793)  // 这里的13^(-1) 是13关于1580155793的逆元

那么我们直接尝试爆破:

爆破part1,2:
for part1 in range(0x20202020,0x80808080):
    part2 = ((0x35368926 - 2 * part1 * part1  - 17 * part1) * 0x39f5b36d)% 0x5e2f4391
    if ((0x58 * part2 + 6 * part2 * part1) - 3 * part1 * part1) % 0x5e2f4391 == 0x42DB9F06:
        print(hex(part1),hex(part2));
得到:
part1 = 0x33636662
part2 = 0x336f1d5 + 0x5e2f4391
爆破 part3:
part1 = 0x33636662
for part3 in range(0x20202020,0x80808080):
    if ( (88 * part3 +  (5 * part3 * part3) ) - 5 * part1 * part3)         % 1580155793 == 1352284536:
        print(hex(part3))
爆破part4:
for part4 in range(0x20202020,0x80808080):
    if ((( 5 * part3 * part3) + 232 * part4) - 4 * part3 * part4) % 1580155793 == 515877167 :
        print(hex(part4))

for part1 in range(0x20202020,0x80808080):
    part2 = ((0x35368926 - 2 * part1 * part1  - 17 * part1) * 0x39f5b36d)% 0x5e2f4391
    if ((0x58 * part2 + 6 * part2 * part1) - 3 * part1 * part1) % 0x5e2f4391 == 0x42DB9F06:
        print(hex(part1),hex(part2));
        break
part1 = 0x33636662
part2 = 0x336f1d5 + 0x5e2f4391
part1 = 0x33636662
for part3 in range(0x30303030,0x80808080):
    if ( (88 * part3 +  (5 * part3 * part3) ) - 5 * part1 * part3)  % 1580155793 == 1352284536:
        print(hex(part3))
        break
part3 = 0x39613138
for part4 in range(0x20202020,0x80808080):
    if ((( 5 * part3 * part3) + 232 * part4) - 4 * part3 * part4) % 1580155793 == 515877167 :
        print(hex(part4))
        break
part4 = 0x33383261
for part5 in range(0x20202020,0x80808080):
    if ( (16 * part5 * part5 + 8 * part5) - 35 * part4 * part4)         % 1580155793 == 1432144268:
        print(hex(part5))
from struct import pack
flag = pack(">I",0x33636662) +  pack(">I",0x336f1d5 + 0x5e2f4391) +pack(">I",0x39613138) + pack(">I",0x33383261) + pack(">I",0x6132337d)

最后得到flag:

flag{3cfbaf5f9a18382aa23}

ez_vm

这道题被队友开局直接秒了，tql，下面说说我的思路

这里存在系统调用，我们对照着这张表可以恢复一些符号.

https://j00ru.vexillium.org/syscalls/nt/64/

之后手动定义结构体:

struct context{
    _QWORD res_opcode;
    _QWORD new_rsp;
    _QWORD rax;
    _QWORD rcx;
    _QWORD rdx;
    _QWORD rbx;
    _QWORD rsp;
    _QWORD rbp;
    _QWORD rsi;
    _QWORD rdi;
    _QWORD r8;
    _QWORD r9;
    _QWORD r10;
    _QWORD r11;
    _QWORD r12;
    _QWORD r13;
    _QWORD r14;
    _QWORD r15; //  mov     [rax+88h], r15
    _QWORD empty1   ;
    _QWORD empty2   ;
    _QWORD empty3   ;
    _QWORD empty4   ;
    _QWORD empty5   ;
    _QWORD empty6   ;
    _QWORD empty7   ;
    _QWORD empty8   ;
    _QWORD empty9   ;
    _QWORD empty10  ;
    _QWORD empty11  ;
    _QWORD empty12  ;
    _QWORD empty13  ;
    _QWORD empty14  ;
    _QWORD empty15  ;
    _QWORD empty16  ;
    _QWORD empty17  ;
    _QWORD empty18  ;
    _QWORD empty19  ;
    _QWORD empty20  ;
    _QWORD empty21  ;
    _QWORD empty22  ;
    _QWORD empty23  ;
    _QWORD empty24  ;
    _QWORD empty25  ;
    _QWORD empty26  ;
    _QWORD empty27  ;
    _QWORD empty28  ;
    _QWORD empty29  ;
    _QWORD empty30  ;
    _QWORD empty31  ;
    _QWORD empty32  ;
    _QWORD empty33  ;
    _QWORD empty34  ;
    _QWORD empty35  ;
    _QWORD empty36  ;
    _QWORD empty37  ;
    _QWORD empty38  ;
    _QWORD empty39  ;
    _QWORD empty40  ;
    _QWORD empty41  ;
    _QWORD empty42  ;
    _QWORD empty43  ;
    _QWORD empty44  ;
    _QWORD empty45  ;
    _QWORD empty46  ;
    _QWORD empty47  ;
    _QWORD empty48  ;
    _QWORD  cntBaseAddr ;               // +0x210
    _QWORD  stackBaseAddr ;         // size: 0x8000
    _QWORD  what3 ;                 // 0i64
    _QWORD  what4 ;                 // 0x1000i64
    _QWORD  base_addr2_rwx ;        // size: 0x1000
    _QWORD  what6 ;                 // 0i64
    _QWORD  what7 ;
}

就像这样

下面我们可以开始分析这个vm题目了

我们对输入下内存访问断点，不断的跟踪输入流的流向，并手动打log

跟踪的过程中，发现了存储输入的地址，其中的数据发生了这样的变化:

11 22 33 44 55 66 77 88 99 aa bb cc dd ee ff
\===>
11 66 bc ef 55 aa ff 44 99 ef 33 88 de 22 77

类似于AES的行移位

之后继续打log:

x = inp[0] << 2;
add x , 0x0000000140013000
add x, 0
x1 = x[0]

\==>

x = inp[0] << 2;
x1 = 0x0000000140013000[x+0]; ==> 0x000000009662140C
y[0] = x1

x = inp[1] << 2;
x1 = 0x0000000140013400[x+0] ==>0x000000006E600A75
y[1] = x1;

\====> 000000000014FCA0

x = inp[3] << 2;
x1 = 0x0000000140013800[x+0] => 140013AEC[0] ==> 0x00000000103DCFB3
y[2] = x[1];

4、3701215Bh
y[3]=x[1];

x = y[0]; //0x000000009662140C
x /= 2; // 0x000000004B310A06
x /= 2; // 0x0000000025988503
x /= 2; // 0x0000000012CC4281
x /= 2; // 0x0000000009662140
x /=2 ; //0x0000000004B310A0
x /= 2; //0x0000000002598850;
x /=2; // 0x00000000012CC428
x /=2; // 0x0000000000966214
x /= 2; // 0x00000000004B310A
x /= 2; //0x0000000000259885
x /= 2; // 0x000000000012CC42
x /=2; // 0x0000000000096621
x /=2 ; //0x000000000004B310
x /=2 ; //0x0000000000025988
x /=2 ; //0x0000000000012CC4
x /=2 ; //0x0000000000009662
x /=2 ; //0x0000000000004B31
x /=2 ; //0x0000000000002598
x /=2 ; //0x00000000000012CC
x /=2 ; //0x0000000000000966
x /=2 ; //0x00000000000004B3
x /=2 ; //0x0000000000000259
x /=2 ; //0x000000000000012C
x /=2 ; //0x0000000000000096

x /=2 ; //0x000000000000004B
x /=2 ; //0x0000000000000025
x /=2 ; //0x0000000000000012
x /=2 ; //0x0000000000000009
x = 0xf & x

x <<= 4;
x1 = &0x000000014005F000[x] , 14005F090h =====> 0000000000907CC0
x1 = x1[0]

x = y[1]
x = 0xf & x
x = x << 0
…

随着log的不断增加，我们可以发现这个算法用了很多关于表，并且可以发现AES白盒的特征。其实这个vm就是实现的aes白盒，明白这个之后，我们用常规的差分故障分析即可求出flag(上文有讲)

snake

贪吃蛇脚本:

注意 输入的序列最少！！！ 这是重点！

import hashlib
import copy
lpAddress = [0xBD, 0xBD, 0xBD, 0xBD, 0xBD, 0xBD, 0xBD, 0xBD, 0xBD, 0xBD, 0xBD, 0x38, 0x4C, 0xB0, 0x38, 0x6D, 0xEE, 0x3F, 0xC4, 0xB4, 0xB4, 0x09, 0x6A, 0xF0, 0x38, 0x2C, 0x79, 0xF6, 0x34, 0xE9, 0x89, 0x38, 0xAC, 0x7F, 0x35, 0xD4, 0xB4, 0xB4, 0x38, 0x6D, 0x77, 0xF6, 0xB6, 0x38, 0x6D, 0x78, 0xF6, 0xB6, 0x2B, 0x18, 0xB4, 0xB4, 0xB4, 0x3B, 0x81, 0x81, 0x81, 0x81, 0xEF, 0x4E, 0x38, 0x4C, 0x7D, 0xF6, 0x33, 0xD4, 0xB4, 0xB4, 0xB0, 0xE8, 0xF4, 0xB4, 0xB4, 0xB4, 0xB4, 0xB0, 0xE8, 0xF6, 0x2B, 0x27, 0xA3, 0x1D, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xB4, 0xB0, 0xF8, 0x04, 0x38, 0x89, 0xE3, 0xC3, 0xCA, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xC4, 0xB0, 0xF8, 0x04, 0x38, 0xB3, 0x67, 0xE3, 0x16, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xD4, 0xB0, 0xF8, 0x04, 0x38, 0xB6, 0xD3, 0xB6, 0xA9, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xE4, 0xB0, 0xF8, 0x04, 0x38, 0x89, 0xD8, 0xC7, 0x33, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xB4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xB4, 0x38, 0x4C, 0xED, 0xB5, 0xD4, 0xB4, 0xB4, 0x4C, 0xF4, 0xD4, 0x2C, 0xF8, 0x85, 0x37, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xC4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xC4, 0x38, 0x4C, 0xED, 0xB5, 0xD4, 0xB4, 0xB4, 0x4C, 0xF4, 0xD4, 0x2C, 0xF8, 0x85, 0x37, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xD4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xD4, 0x38, 0x4C, 0xED, 0xB5, 0xD4, 0xB4, 0xB4, 0x4C, 0xF4, 0xD4, 0x2C, 0xF8, 0x85, 0x37, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xE4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xE4, 0x38, 0x4C, 0xED, 0xB5, 0xD4, 0xB4, 0xB4, 0x4C, 0xF4, 0xD4, 0x2C, 0xF8, 0x85, 0x37, 0xB0, 0xEC, 0xFE, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0x6F, 0x14, 0x4C, 0xEC, 0xFE, 0xB4, 0xB4, 0xB4, 0x2F, 0xC0, 0x2C, 0xEC, 0xFE, 0xB4, 0xB4, 0xB4, 0xCC, 0x6C, 0xFE, 0xB4, 0xB4, 0xB4, 0xB6, 0x24, 0xCC, 0x72, 0xB4, 0xB4, 0xB4, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xB4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xC4, 0x4C, 0x79, 0x85, 0x37, 0xD0, 0xD2, 0xF4, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xC4, 0x4C, 0xF9, 0x05, 0x37, 0xD0, 0x62, 0x04, 0xE3, 0x60, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xC4, 0xE4, 0x79, 0x05, 0x37, 0x4C, 0xE9, 0xF4, 0xCC, 0xE2, 0xE4, 0x4C, 0xE1, 0x4C, 0xF9, 0xED, 0x38, 0xF8, 0x4C, 0xE8, 0xF4, 0xF8, 0xE4, 0xE0, 0xA8, 0x4C, 0xC1, 0xE3, 0x60, 0xE4, 0x79, 0x04, 0x37, 0x4C, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xB4, 0x2C, 0xF8, 0x85, 0x37, 0x4C, 0xE8, 0xF6, 0x4C, 0x69, 0xF4, 0xE4, 0x40, 0x4C, 0xD0, 0x2C, 0xE8, 0xF4, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xC4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xB4, 0x4C, 0x79, 0x85, 0x37, 0xD0, 0xD2, 0xF4, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xB4, 0x4C, 0xF9, 0x05, 0x37, 0xD0, 0x62, 0x04, 0xE3, 0x60, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xB4, 0xE4, 0x79, 0x05, 0x37, 0x4C, 0xE9, 0xF4, 0xD0, 0x62, 0x64, 0xCC, 0xE2, 0xE4, 0x4C, 0xE1, 0x4C, 0xF9, 0xED, 0x38, 0xF8, 0x4C, 0xE8, 0xF4, 0xF8, 0xE4, 0xE0, 0xA8, 0x4C, 0xC1, 0xE3, 0x60, 0xE4, 0x79, 0x04, 0x37, 0x4C, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xC4, 0x2C, 0xF8, 0x85, 0x37, 0x52, 0x54, 0x2F, 0x2F, 0x2F, 0xB0, 0xEC, 0x00, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0x6F, 0x14, 0x4C, 0xEC, 0x00, 0xB4, 0xB4, 0xB4, 0x2F, 0xC0, 0x2C, 0xEC, 0x00, 0xB4, 0xB4, 0xB4, 0xCC, 0x6C, 0x00, 0xB4, 0xB4, 0xB4, 0xB6, 0x24, 0xCC, 0x72, 0xB4, 0xB4, 0xB4, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xD4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xE4, 0x4C, 0x79, 0x85, 0x37, 0xD0, 0xD2, 0xF4, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xE4, 0x4C, 0xF9, 0x05, 0x37, 0xD0, 0x62, 0x04, 0xE3, 0x60, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xE4, 0xE4, 0x79, 0x05, 0x37, 0x4C, 0xE9, 0xF4, 0xCC, 0xE2, 0xE4, 0x4C, 0xE1, 0x4C, 0xF9, 0xED, 0x38, 0xF8, 0x4C, 0xE8, 0xF4, 0xF8, 0xE4, 0xE0, 0xA8, 0x4C, 0xC1, 0xE3, 0x60, 0xE4, 0x79, 0x04, 0x37, 0x4C, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xD4, 0x2C, 0xF8, 0x85, 0x37, 0x4C, 0xE8, 0xF6, 0x4C, 0x69, 0xF4, 0xE4, 0x40, 0x4C, 0xD0, 0x2C, 0xE8, 0xF4, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xE4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xD4, 0x4C, 0x79, 0x85, 0x37, 0xD0, 0xD2, 0xF4, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xD4, 0x4C, 0xF9, 0x05, 0x37, 0xD0, 0x62, 0x04, 0xE3, 0x60, 0x5B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xE1, 0xD4, 0xE4, 0x79, 0x05, 0x37, 0x4C, 0xE9, 0xF4, 0xD0, 0x62, 0x64, 0xCC, 0xE2, 0xE4, 0x4C, 0xE1, 0x4C, 0xF9, 0xED, 0x38, 0xF8, 0x4C, 0xE8, 0xF4, 0xF8, 0xE4, 0xE0, 0xA8, 0x4C, 0xC1, 0xE3, 0x60, 0xE4, 0x79, 0x04, 0x37, 0x4C, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xE4, 0x2C, 0xF8, 0x85, 0x37, 0x52, 0x54, 0x2F, 0x2F, 0x2F, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xB4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xD4, 0x4C, 0x79, 0x85, 0x37, 0x4C, 0xF8, 0x04, 0x37, 0xE3, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xB4, 0x2C, 0xF8, 0x85, 0x37, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xC4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xE4, 0x4C, 0x79, 0x85, 0x37, 0x4C, 0xF8, 0x04, 0x37, 0xE3, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xC4, 0x2C, 0xF8, 0x85, 0x37, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xE4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xB4, 0x4C, 0x79, 0x85, 0x37, 0x4C, 0xF8, 0x04, 0x37, 0xE3, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xE4, 0x2C, 0xF8, 0x85, 0x37, 0x3B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0xC0, 0xC4, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xD4, 0x4C, 0x79, 0x85, 0x37, 0x4C, 0xF8, 0x04, 0x37, 0xE3, 0xD0, 0x2B, 0xF4, 0xB4, 0xB4, 0xB4, 0x38, 0x4A, 0x50, 0xD4, 0x2C, 0xF8, 0x85, 0x37, 0xA0, 0xEC, 0x42, 0xB4, 0xB4, 0xB4, 0x3D, 0xA0, 0xEC, 0x52, 0xB4, 0xB4, 0xB4, 0xBE, 0xA0, 0xEC, 0x62, 0xB4, 0xB4, 0xB4, 0x51, 0xA0, 0xEC, 0x6F, 0xB4, 0xB4, 0xB4, 0x3D, 0xA0, 0xEC, 0x7F, 0xB4, 0xB4, 0xB4, 0x5B, 0xA0, 0xEC, 0x12, 0xB4, 0xB4, 0xB4, 0x8D, 0xA0, 0xEC, 0x22, 0xB4, 0xB4, 0xB4, 0x65, 0xA0, 0xEC, 0x32, 0xB4, 0xB4, 0xB4, 0xA7, 0xA0, 0xEC, 0xBF, 0xB4, 0xB4, 0xB4, 0x4D, 0xA0, 0xEC, 0xCF, 0xB4, 0xB4, 0xB4, 0xAC, 0xA0, 0xEC, 0xDF, 0xB4, 0xB4, 0xB4, 0xF8, 0xA0, 0xEC, 0xEF, 0xB4, 0xB4, 0xB4, 0x06, 0xA0, 0xEC, 0xFF, 0xB4, 0xB4, 0xB4, 0xE9, 0xA0, 0xEC, 0x8F, 0xB4, 0xB4, 0xB4, 0x3B, 0xA0, 0xEC, 0x9F, 0xB4, 0xB4, 0xB4, 0xA3, 0xA0, 0xEC, 0xAF, 0xB4, 0xB4, 0xB4, 0x31, 0xB0, 0xEC, 0xF5, 0xC4, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0xB4, 0x6F, 0x14, 0x4C, 0xEC, 0xF5, 0xC4, 0xB4, 0xB4, 0x2F, 0xC0, 0x2C, 0xEC, 0xF5, 0xC4, 0xB4, 0xB4, 0xCC, 0x6C, 0xF5, 0xC4, 0xB4, 0xB4, 0xB5, 0x68, 0xE6, 0x38, 0xCA, 0xEC, 0xF5, 0xC4, 0xB4, 0xB4, 0x24, 0x1B, 0xF8, 0x04, 0x37, 0x38, 0xCA, 0x6D, 0xF5, 0xC4, 0xB4, 0xB4, 0x24, 0x1B, 0x7D, 0x85, 0x42, 0xB4, 0xB4, 0xB4, 0x63, 0xD0, 0xF7, 0xF4, 0xD3, 0xC0, 0x6F, 0xF4, 0x6F, 0x00, 0xBB, 0xC4, 0x38, 0x4C, 0x3F, 0xBD, 0xBD, 0xBD, 0xBD, 0xBD]
def left(inp=None):                 # 向左,low-1
    if inp==None:
        global lpAddress
        v7 = lpAddress[:]
        for i in range(1152):
            lpAddress[i] = v7[(i + 6) % 1152];
    else:
        for lpaddr in inp:
            v7 = lpaddr[:]
            for i in range(1152):
                lpaddr[i] = v7[(i + 6) % 1152];
def right(inp=None):                  # 向右,low+1
    if inp == None:
        global lpAddress
        for i in range(1152):
            lpAddress[i] += 30
            lpAddress[i] &= 0xff
    else:
        for lpaddr in inp:
            for i in range(1152):
                lpaddr[i] += 30
                lpaddr[i] &= 0xff
def reright(inp=None):                  # 向右,low+1
    if inp == None:
        global lpAddress
        for i in range(1152):
            lpAddress[i] -= 30
            lpAddress[i] &= 0xff
    else:
        for lpaddr in inp:
            for i in range(1152):
                lpaddr[i] -= 30
                lpaddr[i] &= 0xff
def up(inp=None):                  # 向上，high-1
    if inp ==None:
        global lpAddress
        for i in range(1152):
            lpAddress[i] -= 0x66;
            lpAddress[i] &= 0xff
    else:
        for lpaddr in inp:
            for i in range(1152):
                lpaddr[i] -= 0x66;
                lpaddr[i] &= 0xff
def down(inp=None):                # 向下,high+1
    if inp == None:
        global lpAddress
        for i in range(1152):
            lpAddress[i] = ((lpAddress[i] >> 5) | (lpAddress[i] << 3)) &amp; 0xff
    else:
        for lpaddr in inp:
            for i in range(1152):
                lpaddr[i] = ((lpaddr[i] >> 5) | (lpaddr[i] << 3)) &amp; 0xff
low_now = low_begin = 0xa
high_now = high_begin = 0xa
low_list = [0x11,0xc,0x3,0xf,0xd,0x4,0xc,0xe,0x3,0x13,0xa,0x0,0x10,0x0,0xd,0x11,0xf,0x10,0x3,0xd,0x12,0xa,0x9,0xc,0x6,0x3,0x3,0x10,0x0,0x7,0x10,0xd,0x4,0xa,0x4,0x0,0x6,0x10,0x10,0x5,0x0,0x1,0xa,0x2,0xa,0x6,0x12,0x13,0xa,0x12,0x6,0x11,0xc,0xa,0xe,0x2,0x2,0x12,0x5,0x8,0x1,0xa,0xf,0x12,0xb,0x1,0x10,0x6,0xf,0x1,0xb,0x5,0x0,0xd,0x11,0xe,0xa,0xa,0x2,0xf,0x8,0x6,0x4,0x12,0x8,0x10,0xf,0x9,0x2,0xa,0x6,0xa,0x11,0x6,0x8,0x8,0x10,0x12,0x10,0xd,0x3,0x13,0x6,0xa,0x0,0xe,0x10,0xe,0x6,0x2,0x12,0x3,0x11,0x4,0x5,0x8,0x10,0x13,0x10,0x1,0x9,0xc,0x12,0x6,0x9,0xf,0x9,0x8,0x9,0xc,0x13,0x6,0xe,0x13,0x8,0x1,0xa,0xc,0x5,0x4,0xd,0x8,0x0,0x2,0x2,0xe,0x12,0xb,0x7,0x3,0x7,0x12,0x10,0xb,0x9,0x2,0x3,0x1,0xa,0x5,0x11,0xf,0x1,0x3,0x5,0x10,0xd,0x1,0x0,0x4,0x2,0x13,0x10,0xb,0x2,0x1,0xd,0xe,0xe,0x3,0x5,0x5,0x12,0xd,0x1,0xb,0xc,0x4,0x1,0x11,0x9,0x2,0x9,0x13,0xb,0x2,0x7,0x12,0x11,0xe,0xe,0x0,0x7,0x8,0x11,0x7,0xf,0x9,0x0,0xf,0x9,0x9,0xa,0x13,0x0,0x5,0xa,0x0,0x2,0x7,0x7,0x12,0x10,0x2,0x3,0x11,0x3,0xb,0x10,0xd,0x1,0xd,0xe,0x6,0xe,0x1,0x6,0x11,0x10,0xf,0xf,0x5,0x3,0x0,0x3,0xb,0x11,0x2,0x6,0x13,0xf,0x13,0xb,0xc,0xe,0x2,0x1,0x8,0xf,0xc,0x10,0x12,0x8,0x10,0x6,0xe,0x1,0x4,0x6,0x10,0x3,0x12,0x8,0x5,0x5,0x10,0x13,0x4,0x12,0x10,0x9,0x3,0x7,0x5,0x13,0x10,0x3,0xc,0x7,0x8,0x3,0x13,0x13,0xb,0x6,0x1,0x11,0xe,0x7,0x1]
high_list = [0x0,0xa,0xb,0x9,0x12,0xa,0xa,0x10,0x7,0xe,0xb,0xf,0xb,0x10,0x3,0xc,0x3,0xe,0x13,0x11,0x9,0x11,0x8,0x4,0x3,0xb,0x6,0x5,0x1,0x4,0xa,0x7,0x13,0x8,0xd,0xc,0xf,0x7,0x6,0x10,0x9,0xc,0xc,0x9,0x8,0xf,0xd,0xa,0x0,0xb,0x4,0xc,0x13,0x9,0x4,0x10,0x3,0xf,0xe,0x4,0xf,0xd,0x4,0x1,0x9,0x13,0x10,0xe,0x1,0xd,0xd,0x4,0xd,0x12,0x7,0x4,0xc,0x6,0x12,0x9,0x7,0x4,0x7,0x3,0x12,0x1,0xe,0x10,0x4,0x3,0xd,0x3,0xb,0x2,0x13,0x10,0x9,0x6,0xa,0x11,0x2,0x13,0x12,0x5,0x10,0x10,0x4,0x7,0x9,0x11,0x10,0xf,0xc,0xd,0x4,0xe,0x9,0x11,0xe,0x1,0x0,0xf,0x1,0x2,0x12,0x7,0xd,0x7,0x8,0x6,0x12,0x8,0x1,0x12,0xa,0x5,0x1,0x3,0x10,0xb,0x1,0x1,0x9,0xa,0xc,0x3,0x7,0x11,0x1,0xd,0xd,0xa,0x2,0xb,0x8,0x9,0x6,0x5,0x5,0x12,0x10,0x1,0x1,0x8,0x13,0x8,0x13,0xe,0x8,0xd,0x6,0x2,0x3,0xc,0x11,0x9,0xe,0xd,0xc,0xd,0x3,0x2,0x6,0xb,0xe,0x4,0x11,0x1,0x2,0xb,0x4,0x11,0x3,0x11,0x11,0xc,0x12,0x13,0x3,0x8,0x11,0x4,0x12,0x2,0x7,0xc,0xa,0x0,0xe,0x13,0x8,0x1,0x8,0xb,0x9,0x8,0xd,0x9,0xc,0xd,0xb,0xd,0x4,0x8,0x10,0x9,0x0,0xc,0x0,0xa,0xe,0x1,0x9,0x13,0x8,0x2,0x11,0x10,0x12,0xc,0x8,0x11,0xe,0xd,0x3,0x10,0xa,0x6,0x6,0x13,0x12,0x5,0x6,0x7,0x7,0x10,0x10,0xa,0x9,0xc,0x0,0xe,0x12,0x3,0xf,0x13,0x5,0xa,0x12,0x1,0xc,0x4,0x10,0xf,0x12,0x1,0x8,0xa,0x6,0x10,0x9,0x10,0x2,0xe,0xc,0xa,0x10,0x8,0xd,0x6,0x9,0x10,0x13,0xd,0x5,0x9,0xf,0xe,0x8,0xf]
md5_cip = "9c06c08f882d7981e91d663364ce5e2e"
def pan_md5(inp=None):
    global md5_cip
    if inp==None:
        global lpAddress
        md5 = hashlib.md5()
        md5.update(bytes(lpAddress))
        encrypted_string = md5.hexdigest()
        return encrypted_string == md5_cip
    else:
        for lpaddr in inp:
            md5 = hashlib.md5()
            md5.update(bytes(lpaddr))
            encrypted_string = md5.hexdigest()
            if encrypted_string == md5_cip:
                return 1
        return 0
shellcode_list = []
shellcode_list.append(copy.deepcopy(lpAddress) )
last_dir = ["","right"]     # 给定初始方向
for i in range(300):
    dy = high_list[i] - high_now
    dx = low_list[i] - low_now
    print(f"before <=> ({last_dir[0]},{last_dir[1]})")
    print(f"({low_now},{high_now}) ==> ({low_list[i]},{high_list[i]})  === ({dx},{dy}) ")
    if dx == 0 and dy == 0:
        continue
    elif dx == 0 or dy == 0:
        if dx == 0:
            if dy > 0:      # down
                if last_dir[1] == "down":
                    pass
                elif last_dir[1] == "up":
                    assert 0        # 情况比较复杂，先不考虑
                elif last_dir[1] == "left":
                    down(shellcode_list)
                    last_dir[1] = "down"
                elif last_dir[1] == "right":
                    down(shellcode_list)
                    last_dir[1] = "down"
            else:
                if last_dir[1] == "down":
                    assert 0        # 情况比较复杂，先不考虑
                elif last_dir[1] == "up":
                    up(shellcode_list)
                    last_dir[1] = "up"
                elif last_dir[1] == "left":
                    up(shellcode_list)
                    last_dir[1] = "up"
                elif last_dir[1] == "right":
                    up(shellcode_list)
                    last_dir[1] = "up" 
        elif dy == 0:
            if dx > 0:
                if last_dir[1] == "right":
                    pass
                elif last_dir[1] == "left":
                    assert 0    # 情况比较复杂，先不考虑
                elif last_dir[1] == "up":
                    right(shellcode_list)
                    last_dir[1] = "right"
                elif last_dir[1] == "down":
                    right(shellcode_list)
                    last_dir[1] = "right"
            else:
                if last_dir[1] == "right":
                    assert 0       #          情况比较复杂，先不考虑
                elif last_dir[1] == "left":
                    pass
                elif last_dir[1] == "up":
                    left(shellcode_list)
                    last_dir[1] = "left"
                elif last_dir[1] == "down":
                    left(shellcode_list)
                    last_dir[1] = "left"  
        high_now = high_list[i] 
        low_now = low_list[i]   
    elif dx > 0 and dy > 0:          # 向右 + 向下
        print(f"round: {i} | high_now: {high_now} | low_now: {low_now}")
        print(f"          | high_list[i]:{high_list[i]} | low_list[i]: {low_list[i]}")
        if "right" == last_dir[1]:  # 上右，下右，左下，右下
            down(shellcode_list)
            last_dir = ["right","down"]
        elif "down" == last_dir[1]:
            right(shellcode_list)
            last_dir = ["down","right"]
        else:      
            if last_dir[1] == "left":       
                down(shellcode_list)
                right(shellcode_list)
                last_dir = ["down","right"]
            elif last_dir[1] == "up":       
                right(shellcode_list)
                down(shellcode_list)
                last_dir = ["right","down"]
        high_now = high_list[i] 
        low_now = low_list[i]
    elif dx > 0 and dy < 0:              # 向右 + 向上
        if "right" == last_dir[1]:
            up(shellcode_list)
            last_dir = ["right","up"]
        elif "up" == last_dir[1]:
            right(shellcode_list)
            last_dir = ["up","right"]
        else:       # 之前是左下/下左方向,那我们只能按照右上/上右的顺序来到达终点
            if last_dir[1] == "left":
                last_dir = ["up","right"]
            elif last_dir[1] == "down":
                last_dir = ["right","up"]
            right(shellcode_list)
            up(shellcode_list)
        high_now = high_list[i] 
        low_now = low_list[i]
    elif dx < 0 and dy > 0:         # 向左 + 向下
        if "left" == last_dir[1]:
            down(shellcode_list)
            last_dir = ["left","down"]
        elif "down" == last_dir[1]:
            left(shellcode_list)
            last_dir = ["down","left"]
        else:      
            if last_dir[1] == "right":
                last_dir = ["down","left"]
            elif last_dir[1] == "up":
                last_dir = ["left","down"]
            left(shellcode_list)
            down(shellcode_list)
        high_now = high_list[i] 
        low_now = low_list[i]
    elif dx < 0 and dy < 0:         # 向左 + 向上
        if "left" == last_dir[1]:
            up(shellcode_list)
            last_dir = ["left","up"]
        elif "up" == last_dir[1]:
            left(shellcode_list)
            last_dir = ["up","left"]
        else:      
            if last_dir[1] == "right":
                last_dir = ["up","left"]
            elif last_dir[1] == "down":
                last_dir = ["left","up"]
            left(shellcode_list)
            up(shellcode_list)
        high_now = high_list[i]
        low_now = low_list[i]
    if pan_md5(shellcode_list):
        fp = open("./xcode.bin","wb")
        fp.write(bytes(shellcode_list[0]))
        fp.close()
        assert 0