【Reverse】level2_very_success writeup

因为题目还可以做所以不放比赛名称，做个备忘吧～

首先上IDA，前面401000处第一条指令跳过，修复栈平衡。

然后发现验证的函数如下，可以看出这里主要是要逆算法了。

当时室友也在做这题，晚了10分钟解出来，卡在我分析的地方，以后一定记住所见即所得。

把算法捋一下，同时用ollydbg跑，即可看出算法的大致端倪。

----------------------------------code------------------------------------------------

int __usercall [email protected]<eax>(int [email protected]<eax>, int v_0x11, int str, signed int len)

{

__int16 sum; // [email protected]

signed int lenval; // [email protected]

int ptr; // [email protected]

int v7; // [email protected]

char chr; // [email protected]

unsigned int v9; // [email protected]

char v10; // [email protected]

char v11; // [email protected]

__int16 tmprs; // [email protected]

bool equal; // [email protected]

int unuse; // [email protected]

int result_2; // [sp+0h] [bp-Ch]@3

sum = 0;

lenval = 37;

if ( len >= 37 )                              // len > 37

{

ptr = str;                                  // v7 = 35 at first

v7 = v_0x11 + 36;

while ( 1 )

{

LOWORD(result) = 455;

result_2 = result;

chr = *(_BYTE *)ptr++;

v9 = __readeflags();                      // pushf

v10 = __ROL1__(1, sum & 3);

__writeeflags(v9);                        // popf

tmprs = (unsigned __int8)(v10 + v11 + (result_2 ^ chr));

sum += tmprs;

equal = *(_BYTE *)v7 == (_BYTE)tmprs;     // key

unuse = v7 + 1;

if ( !equal )

LOWORD(lenval) = 0;

result = result_2;

if ( !lenval )

break;

v7 = unuse - 2;                           // v7 = v7 - 1

--lenval;

if ( !lenval )

return result;

}

}

return 0;

}

-----------------------------------------code---------------------------------

len=37

[email protected]

sum=0

while(1){

chr = str(ptr)

tmprs = (__ROL1__(1, sum & 3) + xxxtmprs_low_bitxxx 应该是1！ + (455 ^ chr));

sum += tmprs; //we known the value of tmprs and sum

if(*value != tmprs) break;

value--

ptr++

len--

if(!j) return 1

}

接下来算法就好写了。

-------------------------------------code--------------------------

sumv = 0

lenv = 37

rolv = 1

flag = 1

result = ‘‘

values = [0xa8,0x9a,0x90,0xb3,0xb6,0xbc,0xb4,0xab,0x9d,0xae,0xf9,0xb8,0x9d,0xb8,0xaf,0xba,0xa5,0xa5,0xba,0x9a,0xbc,0xb0,0xa7,0xc0,0x8a,0xaa,0xae,0xaf,0xba,0xa4,0xec,0xaa,0xae,0xeb,0xad,0xaa,0xaf,]

for i in range(37):

rolv = (1 << (sumv & 3)) % 256

code = (455 ^ (values[i] - rolv - flag)% 256) %256

result = result + chr(code)

sumv = sumv + values[i]

print result