前言

不得不说，本科组真是太卷了，，，，哇哇哇哇哇哇

最近打的比赛这下真成取证手了，hhhh

前蓝帽，陇剑负责取证，这块misc也是做出来了取证，哈哈哈哈

比赛总共输出2道逆向，2道杂项，题目做着很有手感，(

但是嘞，das的题目不想多说了

看题都能看出来是谁出的 (虽然也做不出来

CSGO - GO/base64/反调试

base64,动调出来table表即可得解

有个反调试，过掉即可

提取密文

动调

table: LMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/ABCDEFGHIJK

cipher: cPQebAcRp+n+ZeP+YePEWfP7bej4YefCYd/7cuP7WfcPb/URYeMRbesObi/=

flag：DASCTF{73913519-A0A6-5575-0F10-DDCBF50FA8CA}

vm_wo - mac/vm

拿到附件发现是macos系统文件

拖入ida64 函数很好看

main函数，很明了

int __cdecl main(int argc, const char **argv, const char **envp)

{

 __int64 i; // x8

 char __s[16]; // [xsp+10h] [xbp-E0h] BYREF

 __int128 v6; // [xsp+20h] [xbp-D0h]

 __int128 v7; // [xsp+30h] [xbp-C0h]

 __int128 v8; // [xsp+40h] [xbp-B0h]

 __int128 v9; // [xsp+50h] [xbp-A0h]

 __int128 v10; // [xsp+60h] [xbp-90h]

 __int128 v11; // [xsp+70h] [xbp-80h]

 __int128 v12; // [xsp+80h] [xbp-70h]

 __int128 v13; // [xsp+90h] [xbp-60h]

 __int128 v14; // [xsp+A0h] [xbp-50h]

 __int128 v15; // [xsp+B0h] [xbp-40h]

 __int128 v16; // [xsp+C0h] [xbp-30h]

 __int64 v17; // [xsp+D0h] [xbp-20h]

 

 if ( ptrace(0, 0, (caddr_t)1, 0) == -1 )

  goto LABEL_8;

 v17 = 0LL;

 v15 = 0u;

 v16 = 0u;

 v13 = 0u;

 v14 = 0u;

 v11 = 0u;

 v12 = 0u;

 v9 = 0u;

 v10 = 0u;

 v7 = 0u;

 v8 = 0u;

 *(_OWORD *)__s = 0u;

 v6 = 0u;

 printf("please input your flag:");

 scanf("%s", __s);

 if ( strlen(__s) != 29 )

LABEL_8:

  exit(0);

 myoperate(__s, 29);

 for ( i = 0LL; i != 29; ++i )

 {

  if ( __s[i] != byte_100003F47[i] )

  {

   printf("error!");

   goto LABEL_8;

  }

 }

 printf("ok you get the flag");

 return 0;

}

1	encData= [0xDF, 0xD5, 0xF1, 0xD1, 0xFF, 0xDB, 0xA1, 0xA5, 0x89, 0xBD, 0xE9, 0x95, 0xB3, 0x9D, 0xE9, 0xB3, 0x85, 0x99, 0x87, 0xBF, 0xE9, 0xB1, 0x89, 0xE9, 0x91, 0x89, 0x89, 0x8F, 0xAD]

主要的指令

__int64 __fastcall myoperate(char *a1, int a2)

{

 __int64 v2; // x20

 _QWORD v5[2]; // [xsp+8h] [xbp-98h] BYREF

 _QWORD v6[2]; // [xsp+18h] [xbp-88h] BYREF

 _QWORD v7[2]; // [xsp+28h] [xbp-78h] BYREF

 _QWORD v8[2]; // [xsp+38h] [xbp-68h] BYREF

 

 LODWORD(v2) = a2;

 dword_100008003 = -1091715345;

 if ( ptrace(0, 0, (caddr_t)1, 0) == -1 )

  exit(0);

 if ( (int)v2 >= 1 )

 {

  v2 = (unsigned int)v2;

  do

  {

   v8[0] = 0x20D01011903001ALL;

   *(_QWORD *)((char *)v8 + 7) = 0x300010201180702LL;

   BYTE2(v8[0]) = *a1;

   interpretBytecode((char *)v8, 15);

   v7[0] = 0x20D02011903001ALL;

   *(_QWORD *)((char *)v7 + 7) = 0x400010201180602LL;

   BYTE2(v7[0]) = vm_body;

   interpretBytecode((char *)v7, 15);

   v6[0] = 0x20D03011903001ALL;

   *(_QWORD *)((char *)v6 + 7) = 0x500010201180502LL;

   BYTE2(v6[0]) = vm_body;

   interpretBytecode((char *)v6, 15);

   v5[0] = 0x20D04011903001ALL;

   *(_QWORD *)((char *)v5 + 7) = 0x600010201180402LL;

   BYTE2(v5[0]) = vm_body;

   interpretBytecode((char *)v5, 15);

   *a1++ = ((unsigned __int8)vm_body >> 5) | (8 * vm_body);

   --v2;

  }

  while ( v2 );

 }

 return 0LL;

}

发现指令是写死的，解密即可

exp

if __name__ == '__main__':

    encData = [0xDF, 0xD5, 0xF1, 0xD1, 0xFF, 0xDB, 0xA1, 0xA5, 0x89, 0xBD, 0xE9, 0x95, 0xB3, 0x9D, 0xE9, 0xB3, 0x85,
               0x99,
               0x87, 0xBF, 0xE9, 0xB1, 0x89, 0xE9, 0x91, 0x89, 0x89, 0x8F, 0xAD, 0x57]
    length = len(encData)
    for i in range(length):
        temp = encData[i]
        temp = ((temp >> 3) | (temp << 5)) & 0xff
        temp ^= 0xBE
        temp = ((temp >> 4) | (temp << 4)) & 0xff
        temp ^= 0xED
        temp = ((temp >> 5) | (temp << 3)) & 0xff
        temp ^= 0xBE
        temp = ((temp >> 6) | (temp << 2)) & 0xff
        temp ^= 0xEF
        temp = ((temp >> 7) | (temp << 1)) & 0xff
        print(chr(temp), end='')