攻防世界--csaw2013reversing2

测试文件：https://adworld.xctf.org.cn/media/task/attachments/3f35642056324371b913687e770e97e6.exe

1.准备

打开测试文件，flag内容为乱码。

检测文件信息

获得信息

1. 32位文件
2. OllyDbg打开

2.IDA打开

将main函数反编译为C语言文件后，得到

int __cdecl __noreturn main(int argc, const char **argv, const char **envp)
{
  int v3; // ecx
  CHAR *lpMem; // [esp+8h] [ebp-Ch]
  HANDLE hHeap; // [esp+10h] [ebp-4h]

  hHeap = HeapCreate(0x40000u, 0, 0);
  lpMem = (CHAR *)HeapAlloc(hHeap, 8u, MaxCount + 1);
  memcpy_s(lpMem, MaxCount, &unk_409B10, MaxCount);
  if ( sub_40102A() || IsDebuggerPresent() )
  {
    __debugbreak();
    sub_401000(v3 + 4, lpMem);
    ExitProcess(0xFFFFFFFF);
  }
  MessageBoxA(0, lpMem + 1, "Flag", 2u);
  HeapFree(hHeap, 0, lpMem);
  HeapDestroy(hHeap);
  ExitProcess(0);
}

2.1 代码分析

1.看到第16行代码，输出flag，lpMem中保存着flag值。

2.第8行代码，为lpMen申请内存空间。

3.第9行代码，为lpMem赋值。其中&unk_409B10的值为

.data:00409B10 unk_409B10      db 0BBh                 ; DATA XREF: _main+33↑o
.data:00409B11                 db 0CCh
.data:00409B12                 db 0A0h
.data:00409B13                 db 0BCh
.data:00409B14                 db 0DCh
.data:00409B15                 db 0D1h
.data:00409B16                 db 0BEh
.data:00409B17                 db 0B8h
.data:00409B18                 db 0CDh
.data:00409B19                 db 0CFh
.data:00409B1A                 db 0BEh
.data:00409B1B                 db 0AEh
.data:00409B1C                 db 0D2h
.data:00409B1D                 db 0C4h
.data:00409B1E                 db 0ABh
.data:00409B1F                 db  82h
.data:00409B20                 db 0D2h
.data:00409B21                 db 0D9h
.data:00409B22                 db  93h
.data:00409B23                 db 0B3h
.data:00409B24                 db 0D4h
.data:00409B25                 db 0DEh
.data:00409B26                 db  93h
.data:00409B27                 db 0A9h
.data:00409B28                 db 0D3h
.data:00409B29                 db 0CBh
.data:00409B2A                 db 0B8h
.data:00409B2B                 db  82h
.data:00409B2C                 db 0D3h
.data:00409B2D                 db 0CBh
.data:00409B2E                 db 0BEh
.data:00409B2F                 db 0B9h
.data:00409B30                 db  9Ah
.data:00409B31                 db 0D7h
.data:00409B32                 db 0CCh
.data:00409B33                 db 0DDh

4. 从第13行代码我们知道，第10~15行代码在对lpMem操作，又因为 ExitProcess(0xFFFFFFFF);所以猜测，这段if结构没有执行（执行的话，就会直接退出，不会有跳出MessageBox对话框）

3.OllyDbg打开

00111307 > $  E8 531A0000   call 00112D5F
0011130C   .^ E9 95FEFFFF   jmp 001111A6
00111311   >  8BFF          mov edi,edi
00111313  /.  55            push ebp
00111314  |.  8BEC          mov ebp,esp
00111316  |.  81EC 28030000 sub esp,0x328
0011131C  |.  A3 589C1100   mov dword ptr ds:[0x119C58],eax
00111321  |.  890D 549C1100 mov dword ptr ds:[0x119C54],ecx
00111327  |.  8915 509C1100 mov dword ptr ds:[0x119C50],edx
0011132D  |.  891D 4C9C1100 mov dword ptr ds:[0x119C4C],ebx
00111333  |.  8935 489C1100 mov dword ptr ds:[0x119C48],esi
00111339  |.  893D 449C1100 mov dword ptr ds:[0x119C44],edi
0011133F  |.  66:8C15 709C1>mov word ptr ds:[0x119C70],ss
00111346  |.  66:8C0D 649C1>mov word ptr ds:[0x119C64],cs
0011134D  |.  66:8C1D 409C1>mov word ptr ds:[0x119C40],ds
00111354  |.  66:8C05 3C9C1>mov word ptr ds:[0x119C3C],es
0011135B  |.  66:8C25 389C1>mov word ptr ds:[0x119C38],fs
00111362  |.  66:8C2D 349C1>mov word ptr ds:[0x119C34],gs
00111369  |.  9C            pushfd
0011136A  |.  8F05 689C1100 pop dword ptr ds:[0x119C68]
00111370  |.  8B45 00       mov eax,dword ptr ss:[ebp]
00111373  |.  A3 5C9C1100   mov dword ptr ds:[0x119C5C],eax
00111378  |.  8B45 04       mov eax,dword ptr ss:[ebp+0x4]
0011137B  |.  A3 609C1100   mov dword ptr ds:[0x119C60],eax
00111380  |.  8D45 08       lea eax,[arg.1]
00111383  |.  A3 6C9C1100   mov dword ptr ds:[0x119C6C],eax
00111388  |.  8B85 E0FCFFFF mov eax,[local.200]
0011138E  |.  C705 A89B1100>mov dword ptr ds:[0x119BA8],0x10001
00111398  |.  A1 609C1100   mov eax,dword ptr ds:[0x119C60]
0011139D  |.  A3 5C9B1100   mov dword ptr ds:[0x119B5C],eax
001113A2  |.  C705 509B1100>mov dword ptr ds:[0x119B50],0xC0000409
001113AC  |.  C705 549B1100>mov dword ptr ds:[0x119B54],0x1
001113B6  |.  A1 04901100   mov eax,dword ptr ds:[0x119004]
001113BB  |.  8985 D8FCFFFF mov [local.202],eax
001113C1  |.  A1 08901100   mov eax,dword ptr ds:[0x119008]
001113C6  |.  8985 DCFCFFFF mov [local.201],eax
001113CC  |.  FF15 14601100 call dword ptr ds:[<&KERNEL32.IsDebugger>; [IsDebuggerPresent
001113D2  |.  A3 A09B1100   mov dword ptr ds:[0x119BA0],eax
001113D7  |.  6A 01         push 0x1
001113D9  |.  E8 1C1A0000   call 00112DFA
001113DE  |.  59            pop ecx
001113DF  |.  6A 00         push 0x0                                 ; /pTopLevelFilter = NULL
001113E1  |.  FF15 34601100 call dword ptr ds:[<&KERNEL32.SetUnhandl>; SetUnhandledExceptionFilter
001113E7  |.  68 3C611100   push 0011613C                            ; /pExceptionInfo = pro3.0011613C
001113EC  |.  FF15 30601100 call dword ptr ds:[<&KERNEL32.UnhandledE>; UnhandledExceptionFilter
001113F2  |.  833D A09B1100>cmp dword ptr ds:[0x119BA0],0x0
001113F9  |.  75 08         jnz X00111403
001113FB  |.  6A 01         push 0x1
001113FD  |.  E8 F8190000   call 00112DFA
00111402  |.  59            pop ecx
00111403  |>  68 090400C0   push 0xC0000409                          ; /ExitCode = C0000409 (-1073740791.)
00111408  |.  FF15 2C601100 call dword ptr ds:[<&KERNEL32.GetCurrent>; |[GetCurrentProcess
0011140E  |.  50            push eax                                 ; |hProcess
0011140F  |.  FF15 28601100 call dword ptr ds:[<&KERNEL32.TerminateP>; TerminateProcess
00111415  |.  C9            leave
00111416  .  C3            retn

右键查找全部字符串，找到“Flag”的位置

001110A5   .  6A 02         push 0x2                                 ; /Style = MB_ABORTRETRYIGNORE|MB_APPLMODAL
001110A7   .  68 20781100   push 00117820                            ; |Title = "Flag"
001110AC   .  FF75 F4       push dword ptr ss:[ebp-0xC]              ; |Text
001110AF   .  6A 00         push 0x0                                 ; |hOwner = NULL
001110B1   .  FF15 E4601100 call dword ptr ds:[<&USER32.MessageBoxA>>; MessageBoxA
001110B7   .  EB 14         jmp X001110CD
001110B9   >  6A 02         push 0x2                                 ; /Style = MB_ABORTRETRYIGNORE|MB_APPLMODAL
001110BB   .  68 20781100   push 00117820                            ; |Title = "Flag"
001110C0   .  8B45 F4       mov eax,dword ptr ss:[ebp-0xC]           ; |
001110C3   .  40            inc eax                                  ; |
001110C4   .  50            push eax                                 ; |Text
001110C5   .  6A 00         push 0x0                                 ; |hOwner = NULL
001110C7   .  FF15 E4601100 call dword ptr ds:[<&USER32.MessageBoxA>>; MessageBoxA

通过设置断点调试，我们可以了解到，if结构和第1个“Flag”处没有执行。

if结构对应汇编代码：

00111083   .  E8 A2FFFFFF   call 0011102A
00111088   .  85C0          test eax,eax
0011108A   .  75 0A         jnz X00111096
0011108C   .  FF15 14601100 call dword ptr ds:[<&KERNEL32.IsDebugger>; [IsDebuggerPresent
00111092   .  85C0          test eax,eax
00111094      74 23         je X001110B9
00111096   >  41            inc ecx
00111097   .  41            inc ecx
00111098   .  41            inc ecx
00111099   .  41            inc ecx
0011109A   .  CC            int3
0011109B   .  8B55 F4       mov edx,dword ptr ss:[ebp-0xC]
0011109E   .  E8 5DFFFFFF   call 00111000
001110A3   .  EB 4A         jmp X001110EF

3.1 代码分析

既然这个if结构中有对flag值的操作，而且还跳过了，秉承“偷鸡摸狗，必定有内幕”的侦探心理，在OD修改代码，使得程序执行if结构，再跳转到第二个MessageBox处。

3.2 代码修改

00111083   .  E8 A2FFFFFF   call 0011102A
00111088   .  85C0          test eax,eax
0011108A   .  75 0A         jnz X00111096
0011108C   .  FF15 14601100 call dword ptr ds:[<&KERNEL32.IsDebugger>; [IsDebuggerPresent
00111092   .  85C0          test eax,eax
00111094      90            nop
00111095      90            nop
00111096   >  41            inc ecx
00111097   .  41            inc ecx
00111098   .  41            inc ecx
00111099   .  41            inc ecx
0011109A      90            nop
0011109B   .  8B55 F4       mov edx,dword ptr ss:[ebp-0xC]
0011109E   .  E8 5DFFFFFF   call 00111000
001110A3      EB 14         jmp X001110B9

3.3 运行获取flag

设置断点，之后调试。

4. get flag！

flag{reversing_is_not_that_hard!}