这是一个win32的VM逆向。
这是第一次做VM逆向，简单的说一下思路：
1.找出主要的虚拟机逻辑片段。
2.找出指令集、堆栈、寄存器。
3.找出要执行的虚拟指令。
4.具体分析。
这次的主函数加了花指令混淆，去除掉以后创建函数然后f5：
同时找到了字符串和虚拟寄存器的地址：
大概的流程摸清楚了，开始分析指令：
指令分析： 0 : 'nop', 1 : 'mov i(寄存器编号), j', 2 : 'push x', 3 : 'push i(寄存器编号)', 4 : 'pop i(寄存器编号)', 5 : 'print', 6 : 'add i(寄存器编号),j(寄存器编号?)'， 7 : 'sub', 8 : 'mul', 9 : 'div', 10 : 'xor', 11 : 'jmp', 12 : 'subcmp', 13 : 'je', 14 : 'jne', 15 : 'jg', 16 : 'jl', 17 : 'input', 18 : 'clr?', 19 : 'loadstack', 20 : 'loadstring', 0xff : 'quit',
此处后半部分参考了这篇文章的分析过程(https://blog.csdn.net/weixin_43876357/article/details/108488762)
下面把command给提出来：
command: 01 03 03 05 00 00 11 00 00 01 01 11 0C 00 01 0D 0A 00 01 03 01 05 00 00 FF 00 00 01 02 00 01 00 11 0C 00 02 0D 2B 00 14 00 02 01 01 61 0C 00 01 10 1A 00 01 01 7A 0C 00 01 0F 1A 00 01 01 47 0A 00 01 01 01 01 06 00 01 0B 24 00 01 01 41 0C 00 01 10 24 00 01 01 5A 0C 00 01 0F 24 00 01 01 4B 0A 00 01 01 01 01 07 00 01 01 01 10 09 00 01 03 01 00 03 00 00 01 01 01 06 02 01 0B 0B 00 02 07 00 02 0D 00 02 00 00 02 05 00 02 01 00 02 0C 00 02 01 00 02 00 00 02 00 00 02 0D 00 02 05 00 02 0F 00 02 00 00 02 09 00 02 05 00 02 0F 00 02 03 00 02 00 00 02 02 00 02 05 00 02 03 00 02 03 00 02 01 00 02 07 00 02 07 00 02 0B 00 02 02 00 02 01 00 02 02 00 02 07 00 02 02 00 02 0C 00 02 02 00 02 02 00 01 02 01 13 01 02 04 00 00 0C 00 01 0E 5B 00 01 01 22 0C 02 01 0D 59 00 01 01 01 06 02 01 0B 4E 00 01 03 00 05 00 00 FF 00 00 01 03 01 05 00 00 FF 00 00 00
然后写个脚本来还原伪汇编代码：
1 cmd = [0x01,0x03,0x03,0x05,0x00,0x00,0x11, 2 0x00,0x00,0x01,0x01,0x11,0x0C,0x00,0x01,0x0D, 3 0x0A,0x00,0x01,0x03,0x01,0x05,0x00,0x00,0xFF, 4 0x00,0x00,0x01,0x02,0x00,0x01,0x00,0x11,0x0C, 5 0x00,0x02,0x0D,0x2B,0x00,0x14,0x00,0x02,0x01, 6 0x01,0x61,0x0C,0x00,0x01,0x10,0x1A,0x00,0x01, 7 0x01,0x7A,0x0C,0x00,0x01,0x0F,0x1A,0x00,0x01, 8 0x01,0x47,0x0A,0x00,0x01,0x01,0x01,0x01,0x06, 9 0x00,0x01,0x0B,0x24,0x00,0x01,0x01,0x41,0x0C, 10 0x00,0x01,0x10,0x24,0x00,0x01,0x01,0x5A,0x0C, 11 0x00,0x01,0x0F,0x24,0x00,0x01,0x01,0x4B,0x0A, 12 0x00,0x01,0x01,0x01,0x01,0x07,0x00,0x01,0x01, 13 0x01,0x10,0x09,0x00,0x01,0x03,0x01,0x00,0x03, 14 0x00,0x00,0x01,0x01,0x01,0x06,0x02,0x01,0x0B, 15 0x0B,0x00,0x02,0x07,0x00,0x02,0x0D,0x00,0x02, 16 0x00,0x00,0x02,0x05,0x00,0x02,0x01,0x00,0x02, 17 0x0C,0x00,0x02,0x01,0x00,0x02,0x00,0x00,0x02, 18 0x00,0x00,0x02,0x0D,0x00,0x02,0x05,0x00,0x02, 19 0x0F,0x00,0x02,0x00,0x00,0x02,0x09,0x00,0x02, 20 0x05,0x00,0x02,0x0F,0x00,0x02,0x03,0x00,0x02, 21 0x00,0x00,0x02,0x02,0x00,0x02,0x05,0x00,0x02, 22 0x03,0x00,0x02,0x03,0x00,0x02,0x01,0x00,0x02, 23 0x07,0x00,0x02,0x07,0x00,0x02,0x0B,0x00,0x02, 24 0x02,0x00,0x02,0x01,0x00,0x02,0x02,0x00,0x02, 25 0x07,0x00,0x02,0x02,0x00,0x02,0x0C,0x00,0x02, 26 0x02,0x00,0x02,0x02,0x00,0x01,0x02,0x01,0x13, 27 0x01,0x02,0x04,0x00,0x00,0x0C,0x00,0x01,0x0E, 28 0x5B,0x00,0x01,0x01,0x22,0x0C,0x02,0x01,0x0D, 29 0x59,0x00,0x01,0x01,0x01,0x06,0x02,0x01,0x0B, 30 0x4E,0x00,0x01,0x03,0x00,0x05,0x00,0x00,0xFF, 31 0x00,0x00,0x01,0x03,0x01,0x05,0x00,0x00,0xFF, 32 0x00,0x00,0x00] 33 34 opcode = {0 : 'nop', 35 1 : 'mov i(寄存器编号), j', 36 2 : 'push x', 37 3 : 'push i(寄存器编号)', 38 4 : 'pop i(寄存器编号)', 39 5 : 'print', 40 6 : 'add i(寄存器编号),j(寄存器编号?)', 41 7 : 'sub', 42 8 : 'mul', 43 9 : 'div', 44 10 : 'xor', 45 11 : 'jmp', 46 12 : 'subcmp', 47 13 : 'je', 48 14 : 'jne', 49 15 : 'jg', 50 16 : 'jl', 51 17 : 'input', 52 18 : 'clr?', 53 19 : 'loadstack', 54 20 : 'loadstring', 55 0xff : 'quit',} 56 57 i = 0 #3个byte为一条指令 58 x = 0 59 for ip in cmd: 60 if x % 3 == 0: 61 i += 1 62 print(str(i) + ': ', end='') # 打印行号 63 print(opcode[ip] + ' ', end='') 64 elif x % 3 == 1: 65 print(str(ip)+',', end='') 66 else: 67 print(str(ip)) 68 x += 1
运行结果(因为我的标注所以有点难看、将就一下)：
1: mov i(寄存器编号), j 3,3 2: print 0,0 3: input 0,0 4: mov i(寄存器编号), j 1,17 5: subcmp 0,1 6: je 10,0 7: mov i(寄存器编号), j 3,1 8: print 0,0 9: quit 0,0 10: mov i(寄存器编号), j 2,0 11: mov i(寄存器编号), j 0,17 12: subcmp 0,2 13: je 43,0 14: loadstring 0,2 15: mov i(寄存器编号), j 1,97 16: subcmp 0,1 17: jl 26,0 18: mov i(寄存器编号), j 1,122 19: subcmp 0,1 20: jg 26,0 21: mov i(寄存器编号), j 1,71 22: xor 0,1 23: mov i(寄存器编号), j 1,1 24: add i(寄存器编号),j(寄存器编号?) 0,1 25: jmp 36,0 26: mov i(寄存器编号), j 1,65 27: subcmp 0,1 28: jl 36,0 29: mov i(寄存器编号), j 1,90 30: subcmp 0,1 31: jg 36,0 32: mov i(寄存器编号), j 1,75 33: xor 0,1 34: mov i(寄存器编号), j 1,1 35: sub 0,1 36: mov i(寄存器编号), j 1,16 37: div 0,1 38: push i(寄存器编号) 1,0 39: push i(寄存器编号) 0,0 40: mov i(寄存器编号), j 1,1 41: add i(寄存器编号),j(寄存器编号?) 2,1 42: jmp 11,0 43: push x 7,0 44: push x 13,0 45: push x 0,0 46: push x 5,0 47: push x 1,0 48: push x 12,0 49: push x 1,0 50: push x 0,0 51: push x 0,0 52: push x 13,0 53: push x 5,0 54: push x 15,0 55: push x 0,0 56: push x 9,0 57: push x 5,0 58: push x 15,0 59: push x 3,0 60: push x 0,0 61: push x 2,0 62: push x 5,0 63: push x 3,0 64: push x 3,0 65: push x 1,0 66: push x 7,0 67: push x 7,0 68: push x 11,0 69: push x 2,0 70: push x 1,0 71: push x 2,0 72: push x 7,0 73: push x 2,0 74: push x 12,0 75: push x 2,0 76: push x 2,0 77: mov i(寄存器编号), j 2,1 78: loadstack 1,2 79: pop i(寄存器编号) 0,0 80: subcmp 0,1 81: jne 91,0 82: mov i(寄存器编号), j 1,34 83: subcmp 2,1 84: je 89,0 85: mov i(寄存器编号), j 1,1 86: add i(寄存器编号),j(寄存器编号?) 2,1 87: jmp 78,0 88: mov i(寄存器编号), j 3,0 89: print 0,0 90: quit 0,0 91: mov i(寄存器编号), j 3,1 92: print 0,0 93: quit 0,0 94: nop
整体逻辑如下：
1.先判断是不是17位
2.大小写字母分别进行操作并压栈
3.将结果压栈
4.将结果pop出来比较
具体的分析过程还是有参考上面的那篇文章。
然后写一个脚本来还原flag：
1 ans = [7, 2 13, 3 0, 4 5, 5 1, 6 12, 7 1, 8 0, 9 0, 10 13, 11 5, 12 15, 13 0, 14 9, 15 5, 16 15, 17 3, 18 0, 19 2, 20 5, 21 3, 22 3, 23 1, 24 7, 25 7, 26 11, 27 2, 28 1, 29 2, 30 7, 31 2, 32 12, 33 2, 34 2,] 35 ans.reverse() 36 flag = '' 37 for i in range(0, len(ans), 2): 38 x = ans[i] + ans[i+1]*16 39 tmp = (x-1) ^ 71 40 if tmp >= ord('a') and tmp <= ord('z'): 41 flag += chr(tmp) 42 continue 43 tmp = (x+1) ^ 75 44 if tmp >= ord('A') and tmp <= ord('Z'): 45 flag += chr(tmp) 46 continue 47 flag += chr(x) 48 49 print(flag)
跑一下就出来了。
总的来说感觉这种题不是很复杂，但是需要足够细致耐心。