[SWPU2019]EasiestRe

双进程保护

父进程

用于调试运行子进程，遇到int3指令进行处理

int __usercall sub_978BC0@<eax>(int a1@<xmm0>)
{

  ProcessInformation.hProcess = 0;
  ProcessInformation.hThread = 0;
  ProcessInformation.dwProcessId = 0;
  ProcessInformation.dwThreadId = 0;
  sub_971EFB((int)&StartupInfo, 0, 68);
  v94 = -112;
  v95 = -125;
  v96 = 125;
  v97 = -8;
  v98 = 24;
  v99 = 125;
  v100 = 17;
  v64 = -112;
  v65 = 15;
  v66 = -74;
  v67 = 85;
  v68 = -9;
  v69 = -117;
  v70 = 69;
  v71 = 8;
  v72 = -117;
  v73 = 4;
  v74 = -112;
  v75 = 15;
  v76 = -81;
  v77 = 69;
  v78 = -4;
  v79 = 51;
  v80 = -46;
  v81 = -9;
  v82 = 117;
  v83 = -8;
  v84 = 15;
  v85 = -74;
  v86 = 77;
  v87 = -9;
  v88 = -117;
  v89 = 69;
  v90 = 12;
  v91 = -119;
  v92 = 20;
  v93 = -120;
  sub_971EFB((int)Buffer, 0, 50);
  NumberOfBytesWritten = 0;
  i = 0;
  v57 = 1;
  v1 = IsDebuggerPresent();
  if ( sub_973481(v3, v2, &v47 == &v47, v1, a1) )
  {
    j_main(v47, v48, v49);　　//调试情况下
  }
  else
  {
    GetStartupInfoA(&StartupInfo);
    sub_973481(v7, v6, &v47 == &v47, v5, a1);
    v8 = GetModuleFileNameA(0, &Filename, 0x104u);
    sub_973481(v10, v9, &v47 == &v47, v8, a1);
    v11 = CreateProcessA(&Filename, 0, 0, 0, 0, 3u, 0, 0, &StartupInfo, &ProcessInformation);
    v52 = sub_973481(v13, v12, &v47 == &v47, v11, a1) != 0;
    LOBYTE(v4) = v52;
    v104 = v52;
    if ( v52 )
    {
      v54 = 1;
      lpBaseAddress = 0;
      while ( v54 )
      {
        dwContinueStatus = 65538;
        v14 = WaitForDebugEvent(&DebugEvent, 0xFFFFFFFF);
        sub_973481(v16, v15, &v47 == &v47, v14, a1);
        v51 = DebugEvent.dwDebugEventCode - 1;
        switch ( DebugEvent.dwDebugEventCode )
        {
          case 1u:
            v50 = DebugEvent.u.Exception.ExceptionRecord.ExceptionCode;
            if ( DebugEvent.u.Exception.ExceptionRecord.ExceptionCode == -2147483645 )//异常0x80000003
            {
              v57 = 1;
              dwContinueStatus = 65538;
              lpBaseAddress = DebugEvent.u.Exception.ExceptionRecord.ExceptionAddress;
              v17 = ReadProcessMemory(
                      ProcessInformation.hProcess,
                      DebugEvent.u.Exception.ExceptionRecord.ExceptionAddress,
                      Buffer,
                      0x23u,
                      &NumberOfBytesRead);
              sub_973481(v19, v18, &v47 == &v47, v17, a1);
              if ( NumberOfBytesRead )
              {
                for ( i = 1; i < 35 && (unsigned __int8)Buffer[i] == 144; ++i )　　//计算int3与nop的长度
                  ;
              }
              if ( i == 1 )
                v57 = 0;
              if ( v57 )
              {
                v49 = (const char **)(i - 4);
                switch ( i )　　//根据长度处理
                {
                  case 4:
                    Context.ContextFlags = 65543;
                    v29 = OpenThread(0x1FFFFFu, 0, DebugEvent.dwThreadId);
                    v32 = (void *)sub_973481(v31, v30, &v47 == &v47, (int)v29, a1);
                    hThread = v32;
                    v33 = GetThreadContext(v32, &Context);
                    if ( !sub_973481(v35, v34, &v47 == &v47, v33, a1) )
                      goto LABEL_32;
                    ++Context.Eip;
                    v36 = SetThreadContext(hThread, &Context);
                    if ( sub_973481(v38, v37, &v47 == &v47, v36, a1) )
                    {
                      dwContinueStatus = 65538;
                      v39 = CloseHandle(hThread);
                      sub_973481(v41, v40, &v47 == &v47, v39, a1);
                    }
                    break;
                  case 5:
LABEL_32:
                    dwContinueStatus = 0x80010001;
                    break;
                  case 7:　　//和下面30都是补缺的机器码
                    v20 = WriteProcessMemory(
                            ProcessInformation.hProcess,
                            (LPVOID)lpBaseAddress,
                            &v94,
                            7u,
                            &NumberOfBytesWritten);
                    sub_973481(v22, v21, &v47 == &v47, v20, a1);
                    if ( NumberOfBytesWritten == 7 )
                    {
                      v23 = ReadProcessMemory(
                              ProcessInformation.hProcess,
                              lpBaseAddress,
                              Buffer,
                              7u,
                              &NumberOfBytesRead);
                      sub_973481(v25, v24, &v47 == &v47, v23, a1);
                      dwContinueStatus = 65538;
                    }
                    break;
                  case 30:
                    v26 = WriteProcessMemory(
                            ProcessInformation.hProcess,
                            (LPVOID)lpBaseAddress,
                            &v64,
                            0x1Eu,
                            &NumberOfBytesWritten);
                    sub_973481(v28, v27, &v47 == &v47, v26, a1);
                    if ( NumberOfBytesWritten == 30 )
                      dwContinueStatus = 65538;
                    break;
                  default:
                    goto LABEL_35;
                }
              }
              else
              {
                dwContinueStatus = 0x80010001;
              }
            }
            break;
          case 2u:
            dwContinueStatus = 65538;
            break;
          case 3u:
            dwContinueStatus = 65538;
            break;
          case 4u:
            dwContinueStatus = 65538;
            v54 = 0;
            break;
          case 5u:
            dwContinueStatus = 65538;
            v54 = 0;
            break;
          case 6u:
            dwContinueStatus = 65538;
            break;
          default:
            break;
        }
LABEL_35:
        v42 = ContinueDebugEvent(DebugEvent.dwProcessId, DebugEvent.dwThreadId, dwContinueStatus);
        sub_973481(v44, v43, &v47 == &v47, v42, a1);
      }
    }
  }
  v45 = v4;
  sub_973616((int)&savedregs, (int)&dword_9791A0);
  return sub_973481((unsigned int)&savedregs ^ v105, v45, 1, 0, a1);
}

子进程

根据父进程的代码对缺失的机器码进行修改后

看加密部分

v28 = 0x1234;
  v20 = 0;
  v21 = 0;
  v22 = 0;
  v23 = 0;
  v24 = 0;
  v25 = 0;
  v26 = 0;
  v27 = 0;
  v18 = 0;
  v19 = 0;
  v17 = len(a1);
  sub_97460B(v7, xmm0_4_0, a2, (int)&v20);
  for ( i = 0; ; ++i )
  {
    v9 = v17;
    if ( i >= v17 )
      break;
    if ( i )
      a1[i] ^= *(_BYTE *)(a3 + 4 * i - 4);
    else
      *a1 ^= v28;
    v13 = 1;
    sub_971EFB((int)&v18, 0, 8);
    __debugbreak();
    for ( j = 0; j < 8; ++j )
    {
      if ( v13 & (char)a1[i] )
      {
        *((_BYTE *)&v18 + j) = 1;
      }
      else
      {
        if ( (unsigned int)j >= 8 )
          sub_9726CB(ebx0, edi0, a4);
        *((_BYTE *)&v18 + j) = 0;
      }
      v13 *= 2;
    }
    for ( k = 0; k < 8; ++k )
      *(_DWORD *)(a3 + 4 * i) += *(&v20 + 7 - k) * *((unsigned __int8 *)&v18 + k);
    v8 = i + 1;
  }

其中sub_97460B经过填充后

背包加密，sub_97460B是公钥的生成函数，给了私钥，iv

看check部分

可找到密文

#for i in range(1,10000):　　#这里计算的是inv
　　#if 41*i%491==1:
        #print(i)
  #      break
iv=0x1234
inv=12
c=[0x3d1,0x2f0,0x52,0x475,0x1d2,0x2f0,0x224,0x51c,0x4e6,0x29f,0x2ee,0x39b,0x3f9,0x32b,0x2f2,0x5b5,0x24c,0x45a,0x34c,0x56d,0xa,0x4e6,0x476,0x2d9]
key=[2,3,7,14,30,57,120,251]
flag=[]
for i in range(24):
    t=c[i]*inv%491
    p=""
    for i in range(8):
        if key[7-i]>t:
            p+="0"
        else:
            p+="1"
            t-=key[7-i]
    flag.append(int(p[::-1],2))
print(chr((flag[0]^0x1234)&0xff),end="")
for i in range(1,len(flag)):
    print(chr((flag[i]^c[i-1])&0xff),end="")