[原创]2023腾讯游戏安全竞赛初赛题解(安卓) | 宜武汇-ag真人国际厅网站

#include

#include

 

void vmdecode(int* flag)

    for(int i = 0; i <= 3; i)

        ((char*)flag)[4 i] -= i * 8;

 

    ((char*)flag)[7] ^= 0x98;

    ((char*)flag)[6] -= 0x37;

    ((char*)flag)[5] ^= 0xb6;

    ((char*)flag)[4] = 0x2f;

 

    for(int i = 0; i <= 3; i)

        ((char*)flag)[i] ^= i * 8;

 

    ((char*)flag)[3] ^= 0x36;

    ((char*)flag)[2] -= 0xa8;

    ((char*)flag)[1] ^= 0xc2;

    ((char*)flag)[0] = 0x1b;

 

void decode2(int* flag)

    char temp[] = {50, -51, -1, -104, 25, -78, 0x7c, -102};

    for(int j = 0; j < 2; j)

    {

        unsigned int v7 = flag[j];

        for(int i = 0; i < 4; i)

        {

            ((char *)&v7)[i] -= i;

            ((char *)&v7)[i] ^= temp[i % 8];

        }

 

        char v77[4] = {};

        v77[0] = ((char *)&v7)[3];

        v77[1] = ((char *)&v7)[2];

        v77[2] = ((char *)&v7)[1];

        v77[3] = ((char *)&v7)[0];

        v7 = *(int*)v77;

        //printf("0x%x\n", v7);

 

        v7 = (unsigned int)(v7 << 7) | (v7 >> 25);

 

        v77[0] = ((char *)&v7)[3];

        v77[1] = ((char *)&v7)[2];

        v77[2] = ((char *)&v7)[1];

        v77[3] = ((char *)&v7)[0];

        v7 = *(int*)v77;

        //printf("0x%x\n", v7);

        flag[j] = v7;

    }

 

void decode1(unsigned int* flag)

    for(int j = 0; j < 2; j)

    {

        unsigned int v7 = flag[j];

        //v7 = 0x18100800;

        ((unsigned char *)&v7)[0] = 0x00;

        ((unsigned char *)&v7)[1] = 0x08;

        ((unsigned char *)&v7)[2] = 0x10;

        ((unsigned char *)&v7)[3] = 0x18;

 

        ((unsigned char *)&v7)[3] ^= 0x86;

        ((unsigned char *)&v7)[2] = 94;

        ((unsigned char *)&v7)[1] ^= 0xd3;

        ((unsigned char *)&v7)[0] = 28;

 

        for(int i = 3; i >= 0; --i)

        {

            ((unsigned char*)flag)[j * 4 i] = (unsigned char)(v7 >> (i * 8)) ^ i;

        }

    }

 

void obfudecode(unsigned int* flag)//sub_3b8cc

    vmdecode(flag);

 

    decode2(flag);//sub_3a054

 

    char v77[4] = {};

    v77[0] = ((char *)flag)[3];

    v77[1] = ((char *)flag)[2];

    v77[2] = ((char *)flag)[1];

    v77[3] = ((char *)flag)[0];

    flag[0] = *(int*)v77;

 

 

    v77[0] = ((char *)flag)[7];

    v77[1] = ((char *)flag)[6];

    v77[2] = ((char *)flag)[5];

    v77[3] = ((char *)flag)[4];

    flag[1] = *(int*)v77;

 

 

    decode1(flag);//sub_3b9d4

 

 

int* decodetea(int randnum)

    unsigned int v20 = 0xbeefbeef - 0x21524111 * 64;

    unsigned int v21 = 0x9d9d7dde - 0x21524111 * 64;

    int v22 = 64;

    char key_char[] = {0x63,0x7c,0x77,0x7b,0xf2,0x6b,0x6f,0xc5,0x30,0x01,0x67,0x2b,0xfe,0xd7,0xab,0x76};

 

    int* key = (int*)key_char;

    unsigned int v16 = randnum;

    unsigned int v17 = 0;

    do

    {

        v21 = 0x21524111;

        v17 -= (v21 key[(v21 >> 13) & 3]) ^ (((v16 << 8) ^ (v16 >> 7)) - v16);

        v20 = 0x21524111;

        v16 -= (v20 - key[v20 & 3]) ^ (((v17 << 7) ^ (v17 >> 8)) v17);

        --v22;

    }

    while ( v22 );

    unsigned int* temp = (int*)malloc(8);

    temp[0] = v16;

    temp[1] = v17;

    return temp;

 

 

int main()

    printf("pls input rand:");

    int rand;

    scanf("%d", &rand);

    int* temp = decodetea(rand);

 

    //unsigned int* temp = malloc(10);

    //temp[0] = 0x4d09f96f;

    //temp[1] = 0x2d55b70a;

 

    obfudecode(temp);

 

    printf("%llu\n", (((unsigned long long)temp[0]<<32) | (temp[1] & 0xffffffff)));

    free(temp);

原文链接:https://bbs.kanxue.com/thread-276949.htm

网络摘文,本文作者:15h,如若转载,请注明出处:https://www.15cov.cn/2023/08/27/原创2023腾讯游戏安全竞赛初赛题解安卓/

发表评论

邮箱地址不会被公开。 必填项已用*标注

网站地图