其他
祥云杯2021 Windows R0题 Rev_APC
看雪论坛作者ID：cslime
附件已上传对应的i64文件，把驱动拖入IDA分析,发现创建了通信设备。
构建调试环境条件
分析InjectDLL.dll
#include <iostream>#include "windows.h"#include "intrin.h" void re_dec1(PCHAR b1, PCHAR b2) { char v9; char v8; for (int i = 0x1F; i >= 0; i--) { v9 = i; v8 = b1[i]; b2[i] ^= v8; b1[i] -= 0x10; } }void re_dec2(PCHAR b1, PCHAR b2) { char v8 = 0; for (int i = 0x1F; i >= 0; i--) { char b1v = b1[i]; _asm mov al, b1v; _asm ror al, 4; _asm mov v8, al; b2[i] ^= v8; } for (int i = 0x1F; i >= 0; i--) { b1[i] += 80; } }void re_dec3(PCHAR b1, PCHAR b2) { for (int i = 0x1F; i >= 0; i--) { b2[i] ^= b1[i]; }}void re_dec4(PCHAR b1, PCHAR b2) { /*for (int i = 0xF; i >= 0; i--) { char v = b1[i * 2]; b2[i * 2 + 1] ^= v >> 4; b2[i * 2] ^= v * 16; }*/ BYTE* v8; // r8 BYTE* fu_sz; // r10 unsigned __int64 v10; // r9 unsigned __int8 v_pbuf1; // cl v8 = (BYTE*)(b2 + 1); fu_sz = (BYTE*)-0x20; v10 = 0x10;// 0x10 do { v_pbuf1 = v8[(DWORD64)fu_sz - 1]; *v8 ^= v_pbuf1 >> 4; v8 += 2; *(v8 - 3) ^= 16 * v_pbuf1; --v10; } while (v10); for (int i = 0x1F; i >= 0; i--) { b1[i] += 80; }}void re_dec5(PCHAR b1, PCHAR b2) { for (int i = 0x1F; i >= 0; i--) { b2[i] ^= b1[i]; } char* buf1_right = &b1[0x10]; char* buf1_left = &b1[0x10 - 1]; for (int i = 0xF; i >= 0; i--) { char temp = 0; temp = *buf1_right; *buf1_right = *buf1_left; *buf1_left = temp; buf1_left--; buf1_right++; } char* buf1_start = b1; char* buf1_end = &b1[0x20 - 1]; for (int i = 0xF; i >= 0; i--) { char temp = 0; temp = *buf1_start; *buf1_start = *buf1_end; *buf1_end = temp; buf1_start++; buf1_end--; } }void re_dec6(PUCHAR b1, PUCHAR b2) { unsigned char v8 = 0; unsigned char v7 = 0; unsigned char v6 = 0; for (int i = 0x1F; i >= 0; i--) { if (b1[i] == 0x50) continue; if (b1[i] == 0x80) __debugbreak(); if (b1[i] > 0x50 && b1[i] <= 0xCF) { v8 = b1[i]; b1[i] += 0x30; b2[i] += v8; } else if (b1[i] > 0x20 && b1[i] <= 0x4F) { v7 = b1[i]; b1[i] += 0x30; b2[i] ^= v7 >> 4; } else if (b1[i] > 0xD0 && b1[i] <= 0xFF) { v6 = b1[i]; b1[i] += 0x50; b2[i] -= v6; } }} int main(){ unsigned char pstatic[] = { 0xF5, 0x9A, 0xF7, 0xA1, 0xC4, 0xA7, 0xD6, 0x23, 0xE1, 0x28, 0xEF, 0xB8, 0xDE, 0x23, 0xE7, 0x2F }; unsigned char pebuf[] = { 0xDC, 0xA7, 0xCA, 0x92, 0xFE, 0x9D, 0xED, 0xB8, 0x70, 0x29, 0xE5, 0xE5, 0xE5, 0xE5, 0xE5, 0xE5 }; unsigned char use_buf1[0x20] = { 0 }; memcpy(use_buf1, pstatic, 0x10); memcpy(use_buf1 + 0x10, pebuf, 0x10); unsigned char use_buf2[0x20] = { 0 }; *(ULONG64*)use_buf2 = 0x2F34A83A1B38C557; *(ULONG64*)(use_buf2 + 0x8) = 0xEE8F2F04E4C69739; *(ULONG*)(use_buf2 + 0x10) = 0x6780515E; *(ULONG*)(use_buf2 + 0x14) = 0x486FC924; *(ULONG*)(use_buf2 + 0x18) = 0xC7BD7F5B; *(ULONG*)(use_buf2 + 0x1C) = 0xEBC2C2B0; unsigned char all_buf[0x40] = { 0 }; memcpy(all_buf, use_buf1, 0x20); memcpy(all_buf + 0x20, use_buf2, 0x20); char* pbuf1 = (char*)all_buf; char* pbuf2 = (char*)(all_buf + 0x20); int reverseidx[32] = { 0 }; HMODULE hmod = LoadLibraryA("ucrtbase.dll"); typedef int (*fnrand)(); fnrand prand = (fnrand)GetProcAddress(hmod, "rand"); for (int i = 0; i < 32; i++) { int v = prand() % 6; reverseidx[i] = v; printf("%d\n", v); } for (int j = 31; j >= 0; j--) { int i = reverseidx[j]; switch (i) { case 0: re_dec1(pbuf1, pbuf2); break; case 1: re_dec2(pbuf1, pbuf2); break; case 2: re_dec3(pbuf1, pbuf2); break; case 3: re_dec4(pbuf1, pbuf2); break; case 4: re_dec5(pbuf1, pbuf2); break; case 5: re_dec6((PUCHAR)pbuf1, (PUCHAR)pbuf2); break; default: break; } } }看雪ID：cslime
https://bbs.pediy.com/user-home-844784.htm
# 往期推荐
球分享
球点赞
球在看
点击“阅读原文”，了解更多！