[REV][Dreamhack] rev-basic-4

리버싱 문제이다.

Ghidra로 분석하자.

 

search > For strings > correct 검색

correct를 사용하는  함수를 찾아가자

ds > show reference to address

 

void FUN_140001130(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
   undefined8 uVar1;
   longlong lVar2;
   undefined *puVar3;
   undefined auStack312 [32];
   undefined local_118 [256];
   ulonglong local_18;
   
   local_18 = DAT_140003028 ^ (ulonglong)auStack312;
   puVar3 = local_118;
   for (lVar2 = 0x100; lVar2 != 0; lVar2 = lVar2 + -1) {
      *puVar3 = 0;
      puVar3 = puVar3 + 1;
   }
   FUN_1400011c0("Input : ",param_2,param_3,param_4);
   FUN_140001220("%256s",local_118,param_3,param_4);
   uVar1 = FUN_140001000((longlong)local_118);
   if ((int)uVar1 == 0) {
      puts("Wrong");
   }
   else {
      puts("Correct");
   }
   FUN_140001310(local_18 ^ (ulonglong)auStack312);
   return;
}

실질적인 분기점인 FUN_140001000를 분석하자.

 

undefined8 FUN_140001000(longlong param_1)

{
   uint local_18;
   
   local_18 = 0;
   while( true ) {
      if (0x1b < local_18) {
          return 1;
      }
      if (((int)(uint)*(byte *)(param_1 + (int)local_18) >> 4 |
             (*(byte *)(param_1 + (int)local_18) & 0xf) << 4) !=
             (uint)(byte)(&DAT_140003000)[(int)local_18]) break;
      local_18 = local_18 + 1;
   }
   return 0;
}

 

입력한 문자열[local_18]>>4 | (입력한 문자열[local_18] & 0xf)<<4 == DAT_140003000[local_18]

예시, 입력한 값이 0x78 = 0111 1000 이면,

입력한 문자열[local_18]>>4 | (입력한 문자열[local_18] & 0xf)<<4

처리를 거치면, 1000 0111이 된다.

 

DAT_140003000 배열 값을 얻은 뒤

correct가 나오도록 하는 값을 찾는 코드를 작성하겠다.

 

#chal4.exe

DAT_140003000 = b'\x24\x27\x13\xc6\xc6\x13\x16\xe6\x47\xf5\x26\x96\x47\xf5\x46\x27\x13\x26\x26\xc6\x56\xf5\xc3\xc3\xf5\xe3\xe3\x00\x00\x00\x00\x00'

input = ""

for local_18 in range(len(DAT_140003000)):
	input += chr((DAT_140003000[local_18] >> 4) | (DAT_140003000[local_18]& 0xf) << 4)

print(input)

 

flag 획득!

 

.  끝.