强网杯 MIPS

https://www.ctfiot.com/213409.html#:~:text=3.%20Reverse-,3.1%20mips,-%E5%85%88%E9%80%86mips_bin

https://blog.xmcve.com/2024/11/04/%E5%BC%BA%E7%BD%91%E6%9D%AF2024-Writeup/#title-13

还是要断舍离，相信自己的能力才行（盯 bin 盯了老半天，还以为没看到东西，没想到是 emu 出问题了

have a emulator to run the bin

./emu ./mips_bin

cipher1 = "sxrujtv`labiVzbp`vpg|"
opcode = [0x814226, 0x3C080201, 0x35283A03, 0x240B0216, 0x240A0203,
          0x11610205, 0x10203, 0x21280202, 0x21090202, 0x214BFDFC,
          0x11410209, 0x10203, 0x18D6225, 0x1AC6A25, 0x812D0203,
          0x810C0203, 0x18B6225, 0x1AD6A25, 0x11A1FDF7, 0x10203,
          0x240A0202, 0x1611226, 0x3E1020B, 0x10203]

using fork to calc the data

try to patch the opcode:

from idaapi import *
 
base = 0x00430010
i = 0
while (True):
    addr = base+i
    byte = get_bytes(addr, 1)  
    byte = i & 3 ^ ord(byte)
    patch_byte(addr, byte) 
    i += 1
    if addr == 0x00430070:
        break
 

int __fastcall opcodes(char *a1)//input
{
  int v2; // $t1
  int v3; // $t2
  int v4; // $t3
 
  v2 = 145408;
  v3 = 21;
  v4 = 0;
  while ( !(*a1 ^ *(char *)v2 ^ v3) )
  {
    ++v2;
    ++a1;
    if ( !--v3 )
      return v4;
  }
  return 1;
}

cipher1 = "sxrujtv`labiVzbp`vpg|"
 
for i in range(len(cipher1)):
    print(chr(ord(cipher1[i])^(21-i)), end='')
// flag{dynamic_reverse}
 

发现是假 flag

用 qemu 跑发现能输出 correct 说明 emu 里面藏东西了

有两个思路，第一个 bindiff 看看

syscall:

用 bindiff 能跟踪到 syscall

或者 mmap 直接在固定位置分配内存，很诡异，所以直接在 emu 里搜常量 0x23000，直接锁定函数 0x33D8E0

__int64 __fastcall sub_7F41017F18E4(__int64 a1)
{
  __int64 result; // rax
  int v2; // [rsp+10h] [rbp-20h]
  int i; // [rsp+14h] [rbp-1Ch]
  int j; // [rsp+18h] [rbp-18h]
  __int64 v5; // [rsp+20h] [rbp-10h]
  __int64 v6; // [rsp+28h] [rbp-8h]
 
  v5 = *(_QWORD *)(a1 + 528);
  v2 = 0;
  result = *(unsigned int *)(v5 + 128);
  if ( *(_DWORD *)(v5 + 128) == (_DWORD)&unk_23000 )
  {
    result = (unsigned int)dword_7F41020E6318;
    if ( dword_7F41020E6318 )
    {
      v6 = sub_7F41017F148E((__int64)&unk_7F41020E7280);
      for ( i = 0; i <= 21; ++i )
        *(_BYTE *)(i + v6) ^= dword_7F41020E6324;
      sub_7F41017F1886(v6, 7, 11);
      result = sub_7F41017F1886(v6, 12, 16);
      for ( j = 0; j <= 21; ++j )
      {
        result = (unsigned int)dword_7F4102050A80[j];
        if ( *(unsigned __int8 *)(j + v6) != (_DWORD)result )
        {
          v2 = 1;
          break;
        }
      }
      if ( !v2 && j == 22 )
        dword_7F41020E631C = 1;
    }
  }
  return result;
}
 
//xref to dword_7F41020E6318
 
case 4003u:
      if ( *((_QWORD *)&v387 + 1) )
      {
        v521 = (_BYTE *)sub_3EB0C9(3LL, HIDWORD(v387), SDWORD2(v387), 0LL);
        if ( v521 )
        {
          v13 = sub_3C9EA1((unsigned int)which_clock, v521, SDWORD2(v387));
          rlim_cur = sub_3C9E33(v13);
          if ( (rlim_cur & 0x80000000) == 0 && sub_3C8B51((unsigned int)which_clock) )
          {
            v14 = (__int64 (__fastcall *)(_BYTE *, _QWORD))sub_3C8B51((unsigned int)which_clock);
            rlim_cur = v14(v521, (int)rlim_cur);
          }
          v683 = v521;
          if ( rlim_cur == 28
            && *v683 == 'f'
            && v683[1] == 'l'
            && v683[2] == 'a'
            && v683[3] == 'g'
            && v683[4] == '{'
            && v683[26] == '}' )
          {
            dword_C32318 = 1;
            sub_22E140(&unk_C33280, 0LL, 32LL);
            sub_22E0F0(&unk_C33280, v683, 27LL);
          }
          sub_3C8389(v521, HIDWORD(v387), (int)rlim_cur);
          result = rlim_cur;
        }
        else
        {
          result = 4294967282LL;
        }
      }
      else
      {
        v12 = sub_3C9EA1((unsigned int)which_clock, 0LL, 0LL);
        result = sub_3C9E33(v12);
      }
      goto LABEL_1534;

动调一直断不了，把 bin 的反调试关了也不行，只能硬看了

__int64 __fastcall rc4init(__int64 input)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]
 
  v5 = input;
  v17 = __readfsqword(0x28u);
  memset(v13, 0, sizeof(v13));
  v14 = 0;
  memset(sbox, 0, sizeof(sbox));
  v16 = 0;
  for ( i = 0; i <= 255; ++i )
    sbox[i] = i;
  v9 = 0;
  v7 = 0;
  v10 = 0;
  i_1 = 0;
  key = "6105t3";
  do
  {
    v9 = (unsigned __int8)sbox[i_1];
    v11 = 2 * (i_1 / 6 - (((2863311531u * (unsigned __int64)i_1) >> 32) & 0xFFFFFFFC));
    v10 = (unsigned __int8)(key++)[v11];
    v7 += v9 + v10;
    v1 = i_1++;
    sbox[v1] = sbox[(unsigned __int8)v7];
    v2 = (unsigned __int8)v7;
    sbox[(unsigned __int8)v7] = v9;
  }
  while ( i_1 != 256 );
  v4[0] = 3397240LL;
  return _InterlockedExchange64(v4, _InterlockedExchange64(v4, v2) + 13);
}

有栈上的花指令，nop 掉

const char *__fastcall rc4(char *input)
{
  int v1; // edx
  const char *result; // rax
  unsigned __int8 v3; // [rsp+15h] [rbp-17Bh]
  int i; // [rsp+18h] [rbp-178h]
  int v5; // [rsp+1Ch] [rbp-174h]
  unsigned int i_1; // [rsp+20h] [rbp-170h]
  int v7; // [rsp+24h] [rbp-16Ch]
  int v8; // [rsp+28h] [rbp-168h]
  int j; // [rsp+2Ch] [rbp-164h]
  int v10; // [rsp+30h] [rbp-160h]
  int v11; // [rsp+34h] [rbp-15Ch]
  int v12; // [rsp+3Ch] [rbp-154h]
  const char *key; // [rsp+40h] [rbp-150h]
  const char *res; // [rsp+48h] [rbp-148h]
  char sbox[128]; // [rsp+80h] [rbp-110h] BYREF
  __int16 v16; // [rsp+180h] [rbp-10h]
  unsigned __int64 v17; // [rsp+188h] [rbp-8h]
 
  v17 = __readfsqword(0x28u);
  *(_QWORD *)sbox = 0LL;
  *(_QWORD *)&sbox[8] = 0LL;
  memset(&sbox[16], 0, 0xF0uLL);
  v16 = 0;
  for ( i = 0; i <= 255; ++i )
    sbox[i] = i;
  v5 = 0;
  i_1 = 0;
  key = "6105t3";
  do
  {
    v10 = (unsigned __int8)sbox[i_1];
    v11 = (unsigned __int8)(key++)[(int)(2 * (i_1 / 6 - (((2863311531u * (unsigned __int64)i_1) >> 32) & 0xFFFFFFFC)))];
    v5 += v10 + v11;
    v1 = i_1++;
    sbox[v1] = sbox[(unsigned __int8)v5];
    sbox[(unsigned __int8)v5] = v10;
  }
  while ( i_1 != 256 );
  v7 = 0;
  v8 = 0;
  res = (const char *)malloc(256LL);
  for ( j = 0; j != 22; ++j )
  {
    v12 = (unsigned __int8)sbox[(unsigned __int8)++v7];
    v8 += v12;
    sbox[(unsigned __int8)v7] = sbox[(unsigned __int8)v8];
    sbox[(unsigned __int8)v8] = v12;
    v3 = ((((unsigned __int8)(input[j + 5] << 7) | ((unsigned __int8)input[j + 5] >> 1)) << 6) ^ 0xC0 | ((unsigned __int8)((input[j + 5] << 7) | ((unsigned __int8)input[j + 5] >> 1)) >> 2) ^ 0x3B) ^ 0xBE;
    res[j] = sbox[(unsigned __int8)(sbox[(unsigned __int8)v7] + v12)] ^ byte_B9CA60[j & 3] ^ (((unsigned __int8)(((16 * (((32 * v3) | (v3 >> 3)) ^ 0xAD)) | ((unsigned __int8)(((32 * v3) | (v3 >> 3)) ^ 0xAD) >> 4)) ^ 0xDE) >> 5) | (8 * (((16 * (((32 * v3) | (v3 >> 3)) ^ 0xAD)) | ((unsigned __int8)(((32 * v3) | (v3 >> 3)) ^ 0xAD) >> 4)) ^ 0xDE)));
  }
  result = res;
  if ( v17 != __readfsqword(0x28u) )
    sub_616930();
  return result;
}