das202310

# PREFACE：yysy 没咋认真在做，同时的 n1ctf 有点难了，加上早上起来心态有点差

# auuuu3

autoit3 编译的，需要专门反编译出来会比较好

这里用的 AutoEye，效果挺好的，找到核心逻辑

Func enc($data, $key)
$data = Binary($data)
Local $datalen = BinaryLen($data)
If $datalen = 0 Then
Return ''
ElseIf $datalen < 8 Then
$datalen = 8
EndIf
Local $opcode = "0x83EC14B83400000099538B5C2420558B6C242056578B7C9DFCF7FB89C683C606C74424180000000085F68D76FF0F8EEA000000896C24288D4BFF8D549D00894C2410895424148974242081442418B979379E8B4C2418C1E90281E103000000894C241C31F6397424107E568B5424288BCF8B6CB204C1E9058D14AD0000000033CA8BD58BC7C1EA03C1E00433D003CA8B5424188BDE81E303000000335C241C8B4424308B1C9833D533DF03D333CA8B542428010CB28B0CB2463974241089CF7FAA8B5424288BCF8B2AC1E9058D14AD0000000033CA8BD58BC7C1EA03C1E00433D003CA8B5424188BDE81E303000000335C241C8B4424308B1C9833D533DF03D3FF4C242033CA8B542414014AFC8B4AFC8B54242089CF420F8F2DFFFFFF5F31C05E5D5B83C414C21000"
Local $codebuffer = DllStructCreate("byte[" & BinaryLen($opcode) & "]")
DllStructSetData($codebuffer, 1, $opcode)
Local $v = DllStructCreate("byte[" & Ceiling($datalen / 4) * 4 & "]")
DllStructSetData($v, 1, $data)
Local $k = DllStructCreate("byte[16]")
DllStructSetData($k, 1, $key)
DllCall("user32.dll", "none", "CallWindowProc", "ptr", DllStructGetPtr($codebuffer), "ptr", DllStructGetPtr($v), "int", Ceiling($datalen / 4), "ptr", DllStructGetPtr($k), "int", 0)
Local $ret = DllStructGetData($v, 1)
$codebuffer = 0
$v = 0
$k = 0
Return $ret
EndFunc

$form1 = GUICreate("auuuu3", 378, 185, 254, 182)
GUICtrlSetFont(-1, 14, 400, 0, "MS Sans Serif")
$serial = GUICtrlCreateInput('', 56, 48, 257, 21)
$check = GUICtrlCreateButton("Check", 56, 80, 257, 33)
GUISetState(@SW_SHOW)
While 1
$nmsg = GUIGetMsg()
Switch $nmsg
Case $GUI_EVENT_CLOSE
Exit
Case $check
Dim $ciphertext = "0x7218181A02F79F4B5773E8FFE83FE732DF96259FF2B86AAB945468A132A83D83CF9D750E316C8675"
$key = "Wowww111auUu3"
$str = GUICtrlRead($serial)
If StringLen($str) <> 38 Then
MsgBox('', '', "wrong")
ContinueCase
EndIf
$encrypt = enc($str, $key)
If $encrypt == $ciphertext Then
MsgBox('', '', "correct")
ContinueCase
EndIf
MsgBox('', '', "wrong")
EndSwitch
WEnd

这里 key 和 enc 都有了，opcode 一眼看上去就是 shellcode（对齐的 0 太多了）

提取，发现是 xxtea

from ctypes import *

# marshal

一开始以为和上次 Seccon 2023 的 Sickle 一样需要自己改源码 print

结果只是一个 marshal 套娃…

这下不仅想多，还坑了队友…

提取字节码：

import marshal

还原流程：

Sbox = [12, 5, 6, 11, 9, 0, 10, 13, 3, 14, 15, 8, 4, 7, 1, 2]

是个 PRESENT 加密

解密 exp：

Sbox = [12, 5, 6, 11, 9, 0, 10, 13, 3, 14, 15, 8, 4, 7, 1, 2]