{"id":13840315,"url":"https://github.com/lcatro/SISE_Traning_CTF_RE","last_synced_at":"2025-07-11T07:33:23.312Z","repository":{"id":94690711,"uuid":"43805514","full_name":"lcatro/SISE_Traning_CTF_RE","owner":"lcatro","description":"SNST Traning RE Project .华软网络安全小组逆向工程训练营,尝试以CTF 的形式来使大家可以动手训练快速提升自己的逆向工程水平.CTF 的训练程序又浅到深,没有使用太复杂的算法,在逆向的过程中遇到的难关都是在分析病毒和破解中遇到的实际情况,注重于实用.训练营还包含有源代码文件,训练程序和思路.希望可以帮助小伙伴们入门逆向工程这个神奇的世界..","archived":false,"fork":false,"pushed_at":"2016-01-22T10:37:18.000Z","size":5103,"stargazers_count":112,"open_issues_count":1,"forks_count":34,"subscribers_count":7,"default_branch":"master","last_synced_at":"2024-08-05T17:24:58.079Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C++","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/lcatro.png","metadata":{"files":{"readme":"readme.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2015-10-07T09:12:58.000Z","updated_at":"2024-07-02T16:47:12.000Z","dependencies_parsed_at":"2023-03-11T18:31:26.437Z","dependency_job_id":null,"html_url":"https://github.com/lcatro/SISE_Traning_CTF_RE","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lcatro%2FSISE_Traning_CTF_RE","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lcatro%2FSISE_Traning_CTF_RE/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lcatro%2FSISE_Traning_CTF_RE/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/lcatro%2FSISE_Traning_CTF_RE/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/lcatro","download_url":"https://codeload.github.com/lcatro/SISE_Traning_CTF_RE/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":225705368,"owners_count":17511277,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-08-04T17:00:45.644Z","updated_at":"2024-11-21T09:31:20.632Z","avatar_url":"https://github.com/lcatro.png","language":"C++","funding_links":[],"categories":["C++","C++ (225)"],"sub_categories":[],"readme":"\n#华软网络安全小组逆向工程训练营\n\n\n###SNST Reverse Engineering Traning\n\n\n各个训练程序解析\n\n\n-----\n\n###1.RE-50 Writeup\n\n  把代码导入到IDA ,用Hex-ray 把Main 函数汇编转到伪C 代码,结果如下\n\n ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180046.png)\n\n  程序代码意思是:先给本地的数组的每个位置赋值,然后接收我们输入的字符串,再通过字符串对比函数来对比输入的字符串是否和本地校验的字符串一样,于是在strcmp 处下断点,位置如下\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180056.png)\n\n  启动Ollydbg ,随意输入字符串\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180101.png)\n\n\n  Ollydbg 会卡在0x40109D 这个地方(下断点的快捷键是F2 )\n \n ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180107.png)\n\n  查看寄存器窗口,可以看到flag\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180111.png)\n \n---\n\n###2.RE-100 Writeup\n\n\n  同样是转换到伪C 代码分析\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180116.png)\n\n  程序原理:判断输入的字符串长度是否为19 ,符合的话把输入的字符串里面的每个字符的值加50 和byte_408030 里面的数据进行对比,于是我们把进去byte_408030 ,设置它的Array (数组)长度\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180120.png)\n\n  然后按几下d 键把这个串转换成char \n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180125.png)\n\n  提取这些数据出来,拿到python 里面做逆运算(因为程序是把我们输入的数据加上50 再和这些数据做比较的,所以我们把这些数据减50 就可以获取到原来的字符串了)\n\n    code=[0x9A,0xA4,0x95,0xA4,0x98,0xAD,0x84,0x77,0x63,0x62,0x62,0x91,0x75,0x93,0x9E,0x95,0xA7,0xAF]\n\n    for index in code :\n        print chr(index-50),\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180130.png)\n \n---\n\n###3.RE-250 Writeup\n\n\n  在main 函数的入口处和之前所见的有点不同,我们直接关注jmp loc_401113 \n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180137.png)\n\n  跳到jmp loc_401113 中分析代码,可以看到这里有SEH 异常处理,异常回调的地址是0x401053\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180141.png)\n\n  往下分析,程序会执行到0x40115A ,这是一个无效的指令,于是会印发SEH 异常处理,程序跳转到0x401053\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180146.png)\n\n  于是找到0x401053 ,分析\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180151.png)\n\n  可以看到这里的对比运算:输入的字符串和byte_40B938 里面的数据做异或运算之后再对比两个字符是否相同,异或运算的key 是80 加上当前对比的偏移位置,于是可以写出解密python\n\n\n    code=[0x38,0x23,0x31,0x27,0x32,0x2E,0x4,0x32,0x7,0x6B,0x6F,0x6B,0x3,0x25,0x31,0x2D,0x1D]\n    xor_number=80\n\n    for index in code :\n        print chr(index^xor_number),\n        xor_number+=1\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180156.png)\n\n---\n\n###4.RE-500 Writeup\n\n  第一步首先要绕过IDA 本身的bug ,因为IDA 默认是从第一区块开始解析数据的,但是在入口点中的跳转却是在第一区块之前的,所以IDA 无法从这个位置中获取数据,于是使用OllyDbg 跟踪\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180201.png)\n\n  跟踪到0x401041 处,继续往下单步\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180208.png)\n\n  可以看到这又是SEH 异常处理,直接跳到0x404100\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180213.png)\n\n  来到0x404100 ,先给它创建函数\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180217.png)\n\n  创建函数之后的变化\n  \n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180221.png)\n\n  然后用Hex-ray转换\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180225.png)\n\n  进去到0x401014 \n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180229.png)\n\n  切换回汇编窗口查看代码\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180233.png)\n\n  继续跳到0x40199E 去分析,这里创建一个线程,线程入口地址是0x401023 ,于是我们过去分析这个函数的功能\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180238.png)\n\n  发现这里一直死循环调用两个函数\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180242.png)\n\n  sub_40102D 的代码如下(为什么会显示sub_401400 呢?因为代码是从sub_40102D 直接jmp 到sub_401400 的):从PEB 中获取程序是否被调试\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180248.png)\n\n  Sub_401028 的功能是直接调用IsDebuggerPresent() 获取是否被调试\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180252.png)\n\n  转换到汇编,可以发现,每次检测到程序被调试的话就会除0 ,产生异常退出程序,于是这个线程是用来反调试的\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180259.png)\n\n  回去主线代码继续分析,遇到代码混淆\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180304.png)\n\n  先到0x4019C8 中用c 键把代码转换成二进制数据\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180309.png)\n\n  再到0x4019C9 中用d 键把二进指数据转换成代码,转换之后的代码如下:\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180313.png)\n\n  继续往下分析,这里计算函数的真实地址,具体作用还不知道\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180318.png)\n\n  继续往下,发现程序又创建新线程\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180323.png)\n\n  于是我们查看线程里面的代码,这里是要让我们输入flag\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180327.png)\n\n  再往下,线程自己就关闭了\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180331.png)\n\n  主线代码里面在创建线程成功之后就阻塞等待它关闭,如果创建失败的话就关闭程序\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180336.png)\n\n  继续往下,发现又有新线程…\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180340.png)\n\n  在线程执行的代码最后有一处混淆\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180344.png)\n\n  因为Push EAX + Retn 等价于Jmp Eax ,eax 的值是ecx+40 (sub -40 等于add 40),ecx 的值是这个函数的入口地址,于是可以计算出接下来程序运行到这里的将会跳转到下面这个地址\n\n0x401610+0x40=0x401650\n\n  跳转到此\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180349.png)\n\n  C 键转换代码\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180353.png)\n\n  然后又是过混淆,相信大家已经明白啦\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180359.png)\n\n  下面遇到switch 语句,先来分析下每个cases 的意义\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180403.png)\n\n  Case 0 是检测程序是否被调试\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180407.png)\n\n  Case 1 往缓冲区中写ERROR\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180411.png)\n\n  Case 2 输出刚才的缓冲区\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180416.png)\n\n  Case 3 把OK 写入缓冲区\n  \n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180423.png)\n\n  Case 4 是flag 对比,然后我们把精力主要集中在此\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180427.png)\n\n  这里调用了两个未知的函数,先忽略他们,继续往下分析\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180433.png)\n\n  发现下面有一段数据\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180438.png)\n\n  然后把这段数据和另一个缓冲区做对比\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180442.png)\n\n  往上寻找EBP-0x28 ,发现刚才忽略的函数有利用到这两个缓冲区\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180446.png)\n\n  在分析sub_401019 中发现,这个应该是加密函数\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180450.png)\n\n  函数的参数有两个,于是回去看看到底程序传哪两个参数进去\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180454.png)\n\n  可以看到,一个是0x10 ,一个是缓冲区地址,所以我们可以大胆的确定,a1 是要加密的数据地址,a2 是数据长度\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180500.png)\n\n  给加密函数中的变量写好命名,整体的加密流程也就一看明了\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180504.png)\n\n  于是获取到这段加密过后的字符串\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ图片20160122180511.png)\n\n  放到python 里面解码\n\n    def decode(string) :\n        for index in range(0,16,2) :\n            string[index]=string[index]^16\n            string[index+1]=string[index+1]^16\n            bit_1_high=string[index]\u00260xF\n            bit_2_low=(string[index]\u00260xF0)\u003e\u003e4\n            bit_2_high=string[index+1]\u00260xF\n            bit_1_low=(string[index+1]\u00260xF0)\u003e\u003e4\n            source_bit_1=bit_1_high*16+bit_1_low\n            source_bit_2=bit_2_high*16+bit_2_low\n            print chr(source_bit_1),chr(source_bit_2),\n        \n    code=[0xE7,0x86,0xE7,0x45,0x06,0x26,0xE6,0xF5,0x06,0xC6,0x46,0xA6,0x05,0xE6,0xD6,0xD6]\n    decode(code)\n\n  ![](https://raw.githubusercontent.com/lcatro/SISE_Traning_CTF_RE/master/Writeup_Picture/QQ截图20160122183538.png)\n\n  合起来就是hrctf:{you_can_make_all}\n\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flcatro%2FSISE_Traning_CTF_RE","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Flcatro%2FSISE_Traning_CTF_RE","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Flcatro%2FSISE_Traning_CTF_RE/lists"}