這題是個逆向
要輸入正確的 FLAG
.text:0000000000005666 call objects_init
.text:000000000000566B lea rsi, input
.text:0000000000005672 lea rdi, format ; "%49s"
.text:0000000000005679 mov eax, 0
.text:000000000000567E call _scanf
.text:0000000000005683 lea rdi, input ; s
.text:000000000000568A call _strlen
.text:000000000000568F cmp rax, 48
.text:0000000000005693 jz short loc_569A
.text:0000000000005695 call putNo
.text:000000000000570B label_break_loop: ; CODE XREF: main+48↑j
.text:000000000000570B mov edx, 48 ; n
.text:0000000000005710 lea rsi, flag_encrypted ; s2
.text:0000000000005717 lea rdi, input_encrypted ; s1
.text:000000000000571E call _memcmp
.text:0000000000005723 test eax, eax
.text:0000000000005725 jnz short label_fail
.text:0000000000005727 lea rsi, input
.text:000000000000572E lea rdi, aGreatHereSTheF ; "Great! Here's the flag: hitcon{%s}\n"
.text:0000000000005735 mov eax, 0
.text:000000000000573A call _printf
.text:000000000000573F jmp short label_reutrn_0
.text:0000000000005741 ; ---------------------------------------------------------------------------
.text:0000000000005741
.text:0000000000005741 label_fail: ; CODE XREF: main+C8↑j
.text:0000000000005741 call putNo
題目要輸入正確的 Flag，Flag 長度為 48，輸入的東西會經過加密後，透過 memcpy 判斷是不是跟加密的 Flag 一樣
這類型題目通常不是暴力碰撞，就是用了可逆的加密
所以先來找如何處理 input
char qword_2131A0[16];
char qword_2131B0[16];
int main() {
char input[49];
char input_encrypted[49];
scanf("%49s", &input);
if (strlen(input) != 48) {
puts("No");
} else {
int i = 0;
for (i = 0 ; i < 48; i++) { try { *(uin64_t*)qword_2131A0 = *(uin64_t*)(input + 16 * i); *(uin64_t*)(qword_2131A0 + 8) = *(uin64_t*)(input + 16 * i + 8); execute_object(0x1C); } catche(exception& ex) { if (ex->object_index != 65) {
execute_object(ex->object_index);
} else {
*(uin64_t*)(input_encrypted + 16 * i) = *(uin64_t*)(qword_2131B0);
*(uin64_t*)(input_encrypted + 16 * i + 8) = *(uin64_t*)(qword_2131B0 + 8);
}
}
}
}
}
從 main 可以看到程式用了 try-catch 以及 throw exception 來控制流程
main 流程大概是長上面那樣，有一個 for-loop 處理 input，每次複製16個bytes到 0x0000002131A0
最後呼叫 execute_object ，如果有 exception 會看他存的一個內容是不是 65，非 65 的話繼續用這個 index 找物件的函數執行，是 65 的話把 qword_2131B0 的內容複製到 input_encrypted 中，繼續下一次的 Loop， 總共執行三次後離開
@func main
.text:00000000000056A1 cmp [rbp+i], 47
.text:00000000000056A5 jg short label_break_loop
.text:00000000000056A7 mov [rbp+function_index], 1Ch
.text:00000000000056AE mov eax, [rbp-28]
.text:00000000000056B1 movsxd rdx, eax
.text:00000000000056B4 lea rax, input
.text:00000000000056BB add rax, rdx
.text:00000000000056BE mov rdx, [rax+8]
.text:00000000000056C2 mov rax, [rax]
.text:00000000000056C5 mov cs:ptr_0, rax
.text:00000000000056CC mov cs:ptr_8, rdx
.text:00000000000056D3 mov eax, [rbp+function_index]
.text:00000000000056D6 mov edi, eax
.text:00000000000056D8 call execute_object
@func execute_object
.text:00000000000055C5 mov edx, [rbp+function_index]
.text:00000000000055C8 movsxd rdx, edx
.text:00000000000055CB lea rcx, ds:0[rdx*8]
.text:00000000000055D3 lea rdx, objects ; objects pointers
.text:00000000000055DA mov rdx, [rcx+rdx]
.text:00000000000055DE mov [rax], rdx
.text:00000000000055E1 mov edx, 0
.text:00000000000055E6 lea rsi, _ZTIP4Base ; `typeinfo for'Base *
.text:00000000000055ED mov rdi, rax
.text:00000000000055F0 call ___cxa_throw
.text:00000000000055F5 ; ---------------------------------------------------------------------------
.text:00000000000055F5 cmp rdx, 1
.text:00000000000055F9 jz short loc_5603
.text:00000000000055FB mov rdi, rax ; struct _Unwind_Exception *
.text:00000000000055FE call __Unwind_Resume
.text:0000000000005603 ; ---------------------------------------------------------------------------
.text:0000000000005603 mov rdi, rax
.text:0000000000005606 call ___cxa_begin_catch
.text:000000000000560B mov [rbp+except], rax
.text:000000000000560F mov rax, [rbp+except]
.text:0000000000005613 mov rax, [rax]
.text:0000000000005616 mov rax, [rax]
.text:0000000000005619 mov rdx, [rbp+except]
.text:000000000000561D mov rdi, rdx
.text:0000000000005620 ; try {
.text:0000000000005620 call rax ; call function
在 main 中可以找到圖中 execute_object 這個 call
這邊一樣可以發現又是 try-catch throw new exception 的噁心流程
這個 calll 有一個參數 (rdi) 是第幾個物件， .text:00000000000055D3 這行會取得物件實體的位置，然後在 .text:0000000000005620 呼叫成員函數
所以從 main 開始看 .text:00000000000056A7 第一次會 execute_object(0x1c); 呼叫開始執行加密的
.bss:00000000002131E0 ; __int64 objects[]
.bss:00000000002131E0 objects dq ? ; DATA XREF: objects_init+312↑w
.bss:00000000002131E0 ; execute_object+24↑o
.bss:00000000002131E8 qword_2131E8 dq ? ; DATA XREF: objects_init+702↑w
.bss:00000000002131F0 qword_2131F0 dq ? ; DATA XREF: objects_init+B7E↑w
.bss:00000000002131F8 qword_2131F8 dq ? ; DATA XREF: objects_init+32E↑w
.bss:0000000000213200 qword_213200 dq ? ; DATA XREF: objects_init+55E↑w
.bss:0000000000213208 qword_213208 dq ? ; DATA XREF: objects_init+A2E↑w
.bss:0000000000213210 qword_213210 dq ? ; DATA XREF: objects_init+2A2↑w
.bss:0000000000213218 qword_213218 dq ? ; DATA XREF: objects_init+73A↑w
.bss:0000000000213220 qword_213220 dq ? ; DATA XREF: objects_init+2F6↑w
.bss:0000000000213228 qword_213228 dq ? ; DATA XREF: objects_init+462↑w
.bss:0000000000213230 qword_213230 dq ? ; DATA XREF: objects_init+34A↑w
.bss:0000000000213238 qword_213238 dq ? ; DATA XREF: objects_init+A4A↑w
.bss:0000000000213240 qword_213240 dq ? ; DATA XREF: objects_init+9DA↑w
.bss:0000000000213248 qword_213248 dq ? ; DATA XREF: objects_init+7C6↑w
.bss:0000000000213250 qword_213250 dq ? ; DATA XREF: objects_init+3A↑w
.bss:0000000000213258 qword_213258 dq ? ; DATA XREF: objects_init+C0A↑w
.bss:0000000000213260 qword_213260 dq ? ; DATA XREF: objects_init+152↑w
.bss:0000000000213268 qword_213268 dq ? ; DATA XREF: objects_init+D22↑w
.bss:0000000000213270 qword_213270 dq ? ; DATA XREF: objects_init+AA↑w
.bss:0000000000213278 qword_213278 dq ? ; DATA XREF: objects_init+5CE↑w
.bss:0000000000213280 qword_213280 dq ? ; DATA XREF: objects_init+C42↑w
.bss:0000000000213288 qword_213288 dq ? ; DATA XREF: objects_init+836↑w
.bss:0000000000213290 qword_213290 dq ? ; DATA XREF: objects_init+2DA↑w
.bss:0000000000213298 qword_213298 dq ? ; DATA XREF: objects_init+216↑w
.bss:00000000002132A0 qword_2132A0 dq ? ; DATA XREF: objects_init+3F2↑w
.bss:00000000002132A8 qword_2132A8 dq ? ; DATA XREF: objects_init+57A↑w
.bss:00000000002132B0 qword_2132B0 dq ? ; DATA XREF: objects_init+72↑w
.bss:00000000002132B8 qword_2132B8 dq ? ; DATA XREF: objects_init+40E↑w
.bss:00000000002132C0 qword_2132C0 dq ? ;第一次取得的物件位置 DATA XREF: objects_init+7FE↑w
接著我們繼續看， execute_object 會從物件地址的陣列中取出
第一次執行時是使用第 0x1c 個物件
00000000002131E0 + 0x1C * 8 = 0x00000000002132C0
.text:0000000000005018 call __Znwm ; operator new(ulong)
.text:000000000000501D mov rbx, rax
.text:0000000000005020 mov rdi, rbx
.text:0000000000005023 call sub_B8BC <------------------------
.text:0000000000005028 mov cs:qword_2132C0, rbx <-----------------------
.text:000000000000B8BC push rbp
.text:000000000000B8BD mov rbp, rsp
.text:000000000000B8C0 sub rsp, 10h
.text:000000000000B8C4 mov [rbp+var_8], rdi
.text:000000000000B8C8 mov rax, [rbp+var_8]
.text:000000000000B8CC mov rdi, rax
.text:000000000000B8CF call sub_ACD2
.text:000000000000B8D4 lea rdx, off_210EA0 <-------------------- asign vtable
.text:000000000000B8DB mov rax, [rbp+var_8]
.text:000000000000B8DF mov [rax], rdx
.text:000000000000B8E2 nop
.text:000000000000B8E3 leave
.text:000000000000B8E4 retn
.data.rel.ro:0000000000210EA0 off_210EA0 dq offset sub_68C0 ; DATA XREF: sub_B8BC+18↑o
用 IDA 來看誰用到了這個位置，可以找到 0000000000005028
在這裡可以看到物件被new 出來後把位置塞進去了， syb_B8BC 想必就是他的建構子
從建構子就能找到 vtable 為 off_210EA0
最後找到成員函數 sub_68C0
.text:00000000000068C0 push rbp
.text:00000000000068C1 mov rbp, rsp
.text:00000000000068C4 push rbx
.text:00000000000068C5 sub rsp, 28h
.text:00000000000068C9 mov [rbp+var_28], rdi
.text:00000000000068CD mov edi, 8
.text:00000000000068D2 call ___cxa_allocate_exception
.text:00000000000068D7 mov rbx, rax
.text:00000000000068DA mov rdi, rbx
.text:00000000000068DD call sub_57F8
.text:00000000000068E2 mov rax, cs:_ZNSt9exceptionD1Ev_ptr
.text:00000000000068E9 mov rdx, rax
.text:00000000000068EC lea rsi, _ZTISt9exception ; `typeinfo for'std::exception
.text:00000000000068F3 mov rdi, rbx
.text:00000000000068F6 ; try {
.text:00000000000068F6 call ___cxa_throw
.text:00000000000068F6 ; } // starts at 68F6
.text:00000000000068FB ; ---------------------------------------------------------------------------
.text:00000000000068FB ; catch(...) // owned by 68F6
.text:00000000000068FB mov rdi, rax
.text:00000000000068FE call ___cxa_begin_catch
.text:0000000000006903 mov [rbp+var_14], 0
.text:000000000000690A
.text:000000000000690A loc_690A: ; CODE XREF: sub_68C0+88↓j
.text:000000000000690A cmp [rbp+var_14], 0Fh
.text:000000000000690E jg short loc_694A
.text:0000000000006910 mov eax, [rbp+var_14]
.text:0000000000006913 movsxd rdx, eax
.text:0000000000006916 lea rax, ptr_0
.text:000000000000691D movzx ecx, byte ptr [rdx+rax]
.text:0000000000006921 mov eax, [rbp+var_14]
.text:0000000000006924 movsxd rdx, eax
.text:0000000000006927 lea rax, ptr_out_0
.text:000000000000692E movzx eax, byte ptr [rdx+rax]
.text:0000000000006932 xor ecx, eax
.text:0000000000006934 mov eax, [rbp+var_14]
.text:0000000000006937 movsxd rdx, eax
.text:000000000000693A lea rax, ptr_0
.text:0000000000006941 mov [rdx+rax], cl
.text:0000000000006944 add [rbp+var_14], 1
.text:0000000000006948 jmp short loc_690A
.text:000000000000694A ; ---------------------------------------------------------------------------
.text:000000000000694A
.text:000000000000694A loc_694A: ; CODE XREF: sub_68C0+4E↑j
.text:000000000000694A mov edi, 4
.text:000000000000694F call ___cxa_allocate_exception
.text:0000000000006954 mov dword ptr [rax], 51
.text:000000000000695A mov edx, 0
.text:000000000000695F lea rsi, _ZTIi ; `typeinfo for'int
.text:0000000000006966 mov rdi, rax
.text:0000000000006969 ; try {
.text:0000000000006969 call ___cxa_throw
.text:0000000000006969 ; } // starts at 6969
.text:000000000000696E ; ---------------------------------------------------------------------------
.text:000000000000696E ; cleanup() // owned by 6969
.text:000000000000696E mov rbx, rax
.text:0000000000006971 call ___cxa_end_catch
.text:0000000000006976 mov rax, rbx
.text:0000000000006979 mov rdi, rax ; struct _Unwind_Exception *
.text:000000000000697C call __Unwind_Resume
.text:000000000000697C ; } // starts at 68C0
.text:000000000000697C sub_68C0 endp
在這邊又是 try-catch 惡夢
真正的程式碼在 .text:0000000000006903 ~ .text:0000000000006948
也就是 call ___cxa_begin_catch 的下一行到 mov edi, 4 前一行結束
裡面放的是加密的程式
接著new 出一個物件把下一個用到的物件編號 51 放入 (.text:0000000000006954) ，最後 throw exception 出去
然後剛剛 new 物件的地方有一百多個物件
每一個物件都是同樣的結構
所以可能有非常多的函數在處理，手動追的話非常累
所以開始想有沒有可以取出程式碼的方法
稍微看了一下
函數的頭 .text:00000000000068C0 到 .text:00000000000068FE 的 offset 是 0x43
最後發現每一個用到的函數頭到需要的程式碼的偏移都是 0x43
所以就用 idapython 寫了一個工具來追蹤加密流程
import idautils
from ida_hexrays import init_hexrays_plugin, decompile
from ida_funcs import get_func
from ida_lines import tag_remove
out = open('eop.asm', 'w')
out2 = open('eop.c', 'w')
def decompile_func(ea):
if not init_hexrays_plugin():
return False
f = get_func(ea)
if f is None:
return False
cfunc = decompile(f);
if cfunc is None:
return False
lines = []
sv = cfunc.get_pseudocode();
for sline in sv:
line = tag_remove(sline.line);
lines.append(line)
return "\n".join(lines)
all = ''
i = 0x1C
while i != 65:
object_pointer = 0x2131E0 + i * 8
xrefs = idautils.XrefsTo(object_pointer, 0)
for xx in xrefs:
prev_call = PrevHead(xx.frm)
prev_call_addr = idc.GetOperandValue(prev_call, 0)
lea_edx = prev_call_addr + 0x18
vtable = idc.GetOperandValue(lea_edx, 1)
call_addr = Qword(vtable)
print 'Begin function addr ('+hex(i)+')'+ hex(call_addr)
real_code_addr = call_addr + 0x43
j = real_code_addr
while True:
asm = idc.GetDisasm(j)
next_asm = idc.GetDisasm(NextHead(j))
if '___cxa_allocate_exception' in next_asm:
break
print asm
out.write(asm + "\n")
j = NextHead(j)
k = j
j = NextHead(j)
l = NextHead(j)
i = idc.GetOperandValue(l, 1)
MakeUnkn(call_addr, 0)
idc.PatchByte(k, 0xC3)
MakeFunction(real_code_addr)
SetType(real_code_addr, "void x()")
code = decompile_func(real_code_addr)
print code
code = code[code.find("{") + 2 + 1:code.find("}") - 1] + "\n"
all += code
break
out2.write(all)
out.close()
out2.close()
這個腳本主要做了幾個事情
從 0x1C 開始抓函數，然後從函數頭 + 0x43 的位置一路抓到 ___cxa_allocate_exception 前二行結束
最後為了方便 IDA Pro 做反編譯，我 patch 了 mov edi, 4 成 ret ，然後函數開始改成 +0x43 的地方
在取出程式碼最後輸出
mov dword ptr [rbp-14h], 0
cmp dword ptr [rbp-14h], 0Fh
jg short locret_694A
mov eax, [rbp-14h]
movsxd rdx, eax
lea rax, ptr_0
movzx ecx, byte ptr [rdx+rax]
mov eax, [rbp-14h]
movsxd rdx, eax
lea rax, out_0
movzx eax, byte ptr [rdx+rax]
xor ecx, eax
mov eax, [rbp-14h]
movsxd rdx, eax
lea rax, ptr_0
mov [rdx+rax], cl
add dword ptr [rbp-14h], 1
jmp short loc_690A
retn
movzx eax, byte ptr cs:ptr_0
movzx eax, al
movzx edx, byte ptr cs:ptr_0+1
movzx edx, dl
shl edx, 8
or edx, eax
movzx eax, byte ptr cs:ptr_0+2
movzx eax, al
shl eax, 10h
or edx, eax
movzx eax, byte ptr cs:ptr_0+3
movzx eax, al
...
大概長這樣，不過 ASM 有 1000 行還是很累，所以看反編譯的虛擬C扣
__int64 v0; // rbp
for ( *(_DWORD *)(v0 - 20) = 0; *(_DWORD *)(v0 - 20) <= 15; ++*(_DWORD *)(v0 - 20) )
ptr_0[*(signed int *)(v0 - 20)] ^= *((_BYTE *)&out_0 + *(signed int *)(v0 - 20));
h1 = ((ptr_0[3] << 24) | (ptr_0[2] << 16) | *(unsigned __int16 *)ptr_0) ^ *(_DWORD *)pKey;
h2 = ((ptr_0[7] << 24) | (ptr_0[6] << 16) | *(unsigned __int16 *)&ptr_0[4]) ^ *((_DWORD *)pKey + 1);
h3 = ((ptr_8[3] << 24) | (ptr_8[2] << 16) | *(unsigned __int16 *)ptr_8) ^ *((_DWORD *)pKey + 2);
h4 = ((ptr_8[7] << 24) | (ptr_8[6] << 16) | *(unsigned __int16 *)&ptr_8[4]) ^ *((_DWORD *)pKey + 3); ; h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey + (unsigned __int8)h1 + 64LL) ^ *((_DWORD *)pKey + ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h2 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 832LL);
h3 ^= *((_DWORD *)pKey + 8) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 9) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h3 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 10) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 11) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h1
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 0x240LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 0x140LL) ^ *((_DWORD *)pKey + ((unsigned int)h2 >> 24) + 0x40LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 0x340LL);
h3 ^= *((_DWORD *)pKey + 12) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 13) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h3 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 14) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 15) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h1
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h2 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 832LL);
h3 ^= *((_DWORD *)pKey + 16) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 17) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h3 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 18) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 19) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h1
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h2 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 832LL);
h3 ^= *((_DWORD *)pKey + 20) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 21) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h3 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 22) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 23) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h1
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h2 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 832LL);
h3 ^= *((_DWORD *)pKey + 24) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 25) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h3 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 26) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 27) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h1
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h2 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 832LL);
h3 ^= *((_DWORD *)pKey + 28) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 29) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h3 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 30) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 31) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h1
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h2 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 832LL);
h3 ^= *((_DWORD *)pKey + 32) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 33) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h3 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 34) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 35) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h1) + 576LL) ^ *((_DWORD *)pKey + BYTE1(h1) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h1
+ 64LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h1 >> 24)
+ 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h2) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h2 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h2 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h2) + 832LL);
h3 ^= *((_DWORD *)pKey + 36) + h6 + h5;
h3 = __ROR4__(h3, 1);
h4 = __ROL4__(h4, 1);
h4 ^= *((_DWORD *)pKey + 37) + h5 + 2 * h6;
h5 = *((_DWORD *)pKey + BYTE2(h3) + 0x240LL) ^ *((_DWORD *)pKey + BYTE1(h3) + 320LL) ^ *((_DWORD *)pKey
+ (unsigned __int8)h3
+ 64LL) ^ *((_DWORD *)pKey + ((unsigned int)h3 >> 24) + 832LL);
h6 = *((_DWORD *)pKey + BYTE1(h4) + 576LL) ^ *((_DWORD *)pKey + (unsigned __int8)h4 + 320LL) ^ *((_DWORD *)pKey
+ ((unsigned int)h4 >> 24)
+ 64LL) ^ *((_DWORD *)pKey + BYTE2(h4) + 832LL);
h1 ^= *((_DWORD *)pKey + 38) + h6 + h5;
h1 = __ROR4__(h1, 1);
h2 = __ROL4__(h2, 1);
h2 ^= *((_DWORD *)pKey + 39) + h5 + 2 * h6;
;
h3 ^= *((_DWORD *)pKey + 4);
h4 ^= *((_DWORD *)pKey + 5);
h1 ^= *((_DWORD *)pKey + 6);
h2 ^= *((_DWORD *)pKey + 7);
LOBYTE(out_0) = h3;
BYTE1(out_0) = BYTE1(h3);
BYTE2(out_0) = BYTE2(h3);
BYTE3(out_0) = HIBYTE(h3);
BYTE4(out_0) = h4;
BYTE5(out_0) = BYTE1(h4);
BYTE6(out_0) = BYTE2(h4);
HIBYTE(out_0) = HIBYTE(h4);
LOBYTE(out_8) = h1;
BYTE1(out_8) = BYTE1(h1);
BYTE2(out_8) = BYTE2(h1);
BYTE3(out_8) = HIBYTE(h1);
BYTE4(out_8) = h2;
BYTE5(out_8) = BYTE1(h2);
BYTE6(out_8) = BYTE2(h2);
HIBYTE(out_8) = HIBYTE(h2);
最後就可以解出 FLAG 了
(2018/11/01 Update )
我腦弱忘了 Check後面 QQ ，最後的 XOR 那邊要給從下次加密後要 ^ hash[ i – 16]
整理後的程式碼以及解密的程式碼我放在 gist
有興趣的可以去看看 ouo
EOP 整理後 : https://gist.github.com/taida957789/f5b606fd1286e47eb18d3b9416f21094
EOP 解密：https://gist.github.com/taida957789/57b69940f3765e9eef0cade34eacab97