def _rc4_crypt(key, data, dataLen): out = [] s_box = list(range(256)) j = 0 for i in range(256): j = (j + s_box[i] + ord(key[i % len(key)])) % 256 s_box[i], s_box[j] = s_box[j], s_box[i]
for x in range(dataLen): i = (i + 1) % 256 j = (j + s_box[i]) % 256 t = s_box[i] s_box[i] = s_box[j] s_box[j] = t ti = (s_box[i] + (s_box[j] % 256)) % 256 t = s_box[ti] while (len(out) < x + 1): out.append(0) out[x] = data[x] ^ t return out
def linux_srand(seed): if seed == 0: seed = 1 word = seed seed = seed & 0xffffffff global linux_status global linux_r linux_status = 0 linux_r = [0] * (344 + linux_status) linux_r[0] = seed for i in range(1, 31): if (word < 0): hi = (-word) // 127773 hi = -hi lo = (-word) % 127773 lo = -lo else: hi = word // 127773 lo = word % 127773 word = ((16807 * lo)) - ((2836 * hi)) if word < 0: word = (2147483647 + word) & 0xffffffff linux_r[i] = word for i in range(31, 34): linux_r[i] = linux_r[i - 31] for i in range(34, 344): linux_r[i] = (((linux_r[i - 31] + linux_r[i - 3]) & 0xffffffff) % (1 << 32)) & 0xffffffff
def linux_rand(): global linux_status global linux_r linux_r.append(0) linux_r[344 + linux_status] = (((linux_r[344 + linux_status - 31] + linux_r[344 + linux_status - 3]) & 0xffffffff) % (1 << 32)) & 0xffffffff linux_status += 1 return linux_r[344 + linux_status - 1] >> 1 print("hello challanger") flag = input("please input your flag:\n") if (type(flag) != str): print("error") sys.exit() if (len(flag) != 17): sys.exit() flag = list(bytes(flag, encoding='utf-8')) flag = _rc4_crypt('Sycl0ver', flag, len(flag)) for i in range(len(flag)): linux_srand(flag[i]) flag[i] = str(linux_rand()) ciphertext=['ee197bbac1b0e09c425e1dfd30cea2506bd493a674c4de90d9afbe5abc700b06', '1a6aafb16a23ffde40c426d5c87f5afcc77fffc96cf041dc8dd2c47e706a7ecb', '62c62ce7768a4836b10495317a32da6e3943d522bc3b9797ff0a44931e966a31', 'e6222354b50e4d33d73314b515b325633e57a105758e20aca23eb2dadd625f3f', '78f92a6ad9ffcec47f30e3ca3d18065bdba9c020ff5f477b801d11efdfaa9cd0', '127291de1f4cbbb35c41556a3c6d5a64f08661bc7ed394ea6210354e6218ad93', '62c62ce7768a4836b10495317a32da6e3943d522bc3b9797ff0a44931e966a31', '52080868c07a9ef5646b5f0b198f04f013cf23cfbfb06123d8f2fdd63d359123', 'f69b52599973fc5915ad1d435236863252dc3fd460989bd9f56ffc199ef8ff36', 'e9552f8c3e518306524fa9c9728ad6dee88fa611aa3068c169217f173964f9b4', '54cb43f463ea082699131b71d45fb0384f8c2f598e8f0072b960b4add731e048', '97e45e15c74f71ea59ffffb40298f2e5dec119c2205e434e3a0d2510c331037f', '51b7d78cfe25ede262fd85a65b24721f076ab9dd6562403878ca5cde1ebf3219', 'a1cd6c7990abb6b271695381d78898ec5c4880fbc0f6a0c9fda064422f21361e', '85ddd3721d173367465373f75e190bd937a8dc3588d5d82ebff8104dec88ac3e', 'd6eeac4ea40f9513391ef0bf72aa2fd2588889cb9d5f4cc638ce4d2c5509527b', '5023939dca9273fd767d5e4ea329846f9816af461e170b6db8d20b6e5ff3de8c'] for i in range(len(flag)): for j in range(2560): s = hashlib.sha256() s.update(bytes(flag[i], encoding='utf-8')) flag[i] = s.hexdigest() #print("'" + flag[i]+ "',") if (flag[i] != ciphertext[i]): sys.exit() print("you are right") sys.exit()
/* * Copyright 2002-2020 Intel Corporation. * * This software is provided to you as Sample Source Code as defined in the accompanying * End User License Agreement for the Intel(R) Software Development Products ("Agreement") * section 1.L. * * This software and the related documents are provided as is, with no express or implied * warranties, other than those that are expressly stated in the License. */
/*! @file * This file contains an ISA-portable PIN tool for counting dynamic instructions */
#include"pin.H" #include <iostream> using std::cerr; using std::endl;
/* ===================================================================== */ /* Global Variables */ /* ===================================================================== */
/* ****************************************************************************** * Copyright (c) 2014-2018 Google, Inc. All rights reserved. * Copyright (c) 2011 Massachusetts Institute of Technology All rights reserved. * Copyright (c) 2008 VMware, Inc. All rights reserved. * ******************************************************************************/
/* * Redistribution and use in source and binary forms, with or without * modification, are permitted provided that the following conditions are met: * * * Redistributions of source code must retain the above copyright notice, * this list of conditions and the following disclaimer. * * * Redistributions in binary form must reproduce the above copyright notice, * this list of conditions and the following disclaimer in the documentation * and/or other materials provided with the distribution. * * * Neither the name of VMware, Inc. nor the names of its contributors may be * used to endorse or promote products derived from this software without * specific prior written permission. * * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" * AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE * ARE DISCLAIMED. IN NO EVENT SHALL VMWARE, INC. OR CONTRIBUTORS BE LIABLE * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER * CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH * DAMAGE. */
/* Code Manipulation API Sample: * inscount.cpp * * Reports the dynamic count of the total number of instructions executed. * Illustrates how to perform performant clean calls. * Demonstrates effect of clean call optimization and auto-inlining with * different -opt_cleancall values. * * The runtime options for this client include: * -only_from_app Do not count instructions in shared libraries. * The options are handled using the droption extension. */
staticdroption_t<bool> only_from_app( DROPTION_SCOPE_CLIENT, "only_from_app", false, "Only count app, not lib, instructions", "Count only instructions in the application itself, ignoring instructions in " "shared libraries."); //把选项加上only_from_app就可以不进行库的计数
/* Application module */ static app_pc exe_start; /* we only have a global count */ static uint64 global_count; /* A simple clean call that will be automatically inlined because it has only * one argument and contains no calls to other functions. */ staticvoid inscount(uint num_instrs) { global_count += num_instrs; } staticvoid event_exit(void); staticdr_emit_flags_t event_bb_analysis(void *drcontext, void *tag, instrlist_t *bb, bool for_trace, bool translating, void **user_data); staticdr_emit_flags_t event_app_instruction(void *drcontext, void *tag, instrlist_t *bb, instr_t *inst, bool for_trace, bool translating, void *user_data);
/* make it easy to tell, by looking at log file, which client executed */ dr_log(NULL, DR_LOG_ALL, 1, "Client 'inscount' initializing\n"); #ifdef SHOW_RESULTS /* also give notification to stderr */ if (dr_is_notify_on()) { # ifdef WINDOWS /* ask for best-effort printing to cmd window. must be called at init. */ dr_enable_console_printing(); # endif dr_fprintf(STDERR, "Client inscount is running\n"); } #endif }
/* Count instructions. If an emulation client is running with this client, * we want to count all the original native instructions and the emulated * instruction but NOT the introduced native instructions used for emulation. */ bool is_emulation = false; for (instr = instrlist_first(bb), num_instrs = 0; instr != NULL; instr = instr_get_next(instr)) { if (drmgr_is_emulation_start(instr)) { /* Each emulated instruction is replaced by a series of native * instructions delimited by labels indicating when the emulation * sequence begins and ends. It is the responsibility of the * emulation client to place the start/stop labels correctly. */ num_instrs++; is_emulation = true; /* Data about the emulated instruction can be extracted from the * start label using the accessor function: * drmgr_get_emulated_instr_data() */ continue; } if (drmgr_is_emulation_end(instr)) { is_emulation = false; continue; } if (is_emulation) continue; if (!instr_is_app(instr)) continue; num_instrs++; } *user_data = (void *)(ptr_uint_t)num_instrs;
staticdr_emit_flags_t event_app_instruction(void *drcontext, void *tag, instrlist_t *bb, instr_t *instr, bool for_trace, bool translating, void *user_data) { uint num_instrs; /* By default drmgr enables auto-predication, which predicates all instructions with * the predicate of the current instruction on ARM. * We disable it here because we want to unconditionally execute the following * instrumentation. */ drmgr_disable_auto_predication(drcontext, bb); if (!drmgr_is_first_instr(drcontext, instr)) return DR_EMIT_DEFAULT; /* Only insert calls for in-app BBs */ if (user_data == NULL) return DR_EMIT_DEFAULT; /* Insert clean call */ num_instrs = (uint)(ptr_uint_t)user_data; dr_insert_clean_call(drcontext, bb, instrlist_first_app(bb), (void *)inscount, false/* save fpstate */, 1, OPND_CREATE_INT32(num_instrs)); return DR_EMIT_DEFAULT; }
from winpwn import * import threading from concurrent.futures import ThreadPoolExecutor, Future
def test(data): tmp = data cmd = '' #your pin.exe path module = '' #your pintool.dll path p = process([cmd, '-t', module, '--', '.\\low_re.exe']) #p = process([cmd, '-c', module, '-only_from_app', '--', '.\\low_re.exe']) //dynamorio的命令行 p.recvline() p.recvline() p.sendline(data) data = p.recvuntil("\n") if (data[0:5] != "Count"): data = p.recvuntil("\n") data = int(data.split("Count ")[1].split(" ")[0]) #if (data[0:5] != "Instr"): //dynamorio的输出 #data = p.recvuntil("\n") #data = int(re.findall('\d+', data)[0]) p.close() return data
pool = ThreadPoolExecutor(8)
testlen = 17
if (testlen): flag = "" while len(flag) != testlen: tasks = [] results = [] for i in range(32, 0x7f): data = flag + chr(i) + 'i' * (testlen - 1 - len(flag)) tasks.append(pool.submit(test, data)) for t in tasks: results.append(t.result()) #print(chr(a.index(max(a)) + 32)) flag += chr(results.index(max(results)) + 32) print(flag) else: i = 1 a = [] while i < 64: a.append(test(i * '1')) i += 1 print(a.index(max(a)) + 1)