PicoCTF - Some Assembly Required 3

Posted on 2024-01-31 | Post modified | In Security Practice｜PicoCTF｜Web |

PicoCTF - Some Assembly Required 3

Background

1	`$ ./build/wasm2c qCCYI0ajpD.wasm -o dump.c`

Source code

rTEuOmSfG3.js

'use strict';
const str_list = ["exports", "270328ewawLo", "instantiate", "1OsuamQ", "Incorrect!", "length", "copy_char", "value", "1512517ESezaM", "innerHTML", "check_flag", "result", "1383842SQRPPf", "924408cukzgO", "getElementById", "418508cLDohp", "input", "Correct!", "573XsMMHp", "arrayBuffer", "183RUQBDE", "38934oMACea"];
const tranfer_fn = function(url, whensCollection) {
  /** @type {number} */
  url = url - 285;
  let _0x143f7d = str_list[url];
  return _0x143f7d;
};
(function(data, oldPassword) {
  const tranfer_fn = tranfer_fn;
  for (; !![];) {
    try {
      const userPsd = -parseInt("length") + -parseInt("573XsMMHp") + -parseInt("innerHTML") * -parseInt("getElementById") + -parseInt("38934oMACea") + parseInt("value") + -parseInt("Incorrect!") * -parseInt("instantiate") + parseInt("arrayBuffer");
      if (userPsd === oldPassword) {
        break;
      } else {
        data["push"](data["shift"]());
      }
    } catch (_0x289152) {
      data["push"](data["shift"]());
    }
  }
})(str_list, 970828);
let exports;
(async() => {
  const tranfer_fn = tranfer_fn;
  let rpm_traffic = await fetch("./qCCYI0ajpD");
  let m = await WebAssembly["1512517ESezaM"](await rpm_traffic["1OsuamQ"]());
  let updatedEdgesById = m["instance"];
  exports = updatedEdgesById["copy_char"];
})();
/**
 * @return {undefined}
 */
function onButtonPress() {
  const tranfer_fn = tranfer_fn;
  let data = document["183RUQBDE"]("exports")["924408cukzgO"];
  for (let i = 0; i < data["result"]; i++) {
    exports["1383842SQRPPf"](data["charCodeAt"](i), i);
  }
  exports["1383842SQRPPf"](0, data["result"]);
  if (exports["input"]() == 1) {
    document["183RUQBDE"]("Correct!")["418508cLDohp"] = "270328ewawLo";
  } else {
    document["183RUQBDE"]("Correct!")["innerHTML"] = "check_flag";
  }
}
;

dump.c

/* Automatically generated by wasm2c */
#include <assert.h>
#include <math.h>
#include <stdarg.h>
#include <stddef.h>
#include <string.h>
#if defined(__MINGW32__)
#include <malloc.h>
#elif defined(_MSC_VER)
#include <intrin.h>
#include <malloc.h>
#define alloca _alloca
#elif defined(__FreeBSD__) || defined(__OpenBSD__)
#include <stdlib.h>
#else
#include <alloca.h>
#endif

#include "dump.h"

#define TRAP(x) (wasm_rt_trap(WASM_RT_TRAP_##x), 0)

#if WASM_RT_USE_STACK_DEPTH_COUNT
#define FUNC_PROLOGUE                                            \
  if (++wasm_rt_call_stack_depth > WASM_RT_MAX_CALL_STACK_DEPTH) \
    TRAP(EXHAUSTION);

#define FUNC_EPILOGUE --wasm_rt_call_stack_depth
#else
#define FUNC_PROLOGUE

#define FUNC_EPILOGUE
#endif

#define UNREACHABLE TRAP(UNREACHABLE)

static inline bool func_types_eq(const wasm_rt_func_type_t a,
                                 const wasm_rt_func_type_t b) {
  return (a == b) || LIKELY(a && b && !memcmp(a, b, 32));
}

#define CALL_INDIRECT(table, t, ft, x, ...)              \
  (LIKELY((x) < table.size && table.data[x].func &&      \
          func_types_eq(ft, table.data[x].func_type)) || \
       TRAP(CALL_INDIRECT),                              \
   ((t)table.data[x].func)(__VA_ARGS__))

#ifdef SUPPORT_MEMORY64
#define RANGE_CHECK(mem, offset, len)              \
  do {                                             \
    uint64_t res;                                  \
    if (__builtin_add_overflow(offset, len, &res)) \
      TRAP(OOB);                                   \
    if (UNLIKELY(res > mem->size))                 \
      TRAP(OOB);                                   \
  } while (0);
#else
#define RANGE_CHECK(mem, offset, len)               \
  if (UNLIKELY(offset + (uint64_t)len > mem->size)) \
    TRAP(OOB);
#endif

#if WASM_RT_MEMCHECK_GUARD_PAGES
#define MEMCHECK(mem, a, t)
#else
#define MEMCHECK(mem, a, t) RANGE_CHECK(mem, a, sizeof(t))
#endif

#ifdef __GNUC__
#define wasm_asm __asm__
#else
#define wasm_asm(X)
#endif

#if WABT_BIG_ENDIAN
static inline void load_data(void* dest, const void* src, size_t n) {
  if (!n) {
    return;
  }
  size_t i = 0;
  u8* dest_chars = dest;
  memcpy(dest, src, n);
  for (i = 0; i < (n >> 1); i++) {
    u8 cursor = dest_chars[i];
    dest_chars[i] = dest_chars[n - i - 1];
    dest_chars[n - i - 1] = cursor;
  }
}
#define LOAD_DATA(m, o, i, s)                   \
  do {                                          \
    RANGE_CHECK((&m), m.size - o - s, s);       \
    load_data(&(m.data[m.size - o - s]), i, s); \
  } while (0)
#define DEFINE_LOAD(name, t1, t2, t3)                                  \
  static inline t3 name(wasm_rt_memory_t* mem, u64 addr) {             \
    MEMCHECK(mem, addr, t1);                                           \
    t1 result;                                                         \
    wasm_rt_memcpy(&result, &mem->data[mem->size - addr - sizeof(t1)], \
                   sizeof(t1));                                        \
    wasm_asm("" ::"r"(result));                                        \
    return (t3)(t2)result;                                             \
  }

#define DEFINE_STORE(name, t1, t2)                                      \
  static inline void name(wasm_rt_memory_t* mem, u64 addr, t2 value) {  \
    MEMCHECK(mem, addr, t1);                                            \
    t1 wrapped = (t1)value;                                             \
    wasm_rt_memcpy(&mem->data[mem->size - addr - sizeof(t1)], &wrapped, \
                   sizeof(t1));                                         \
  }
#else
static inline void load_data(void* dest, const void* src, size_t n) {
  if (!n) {
    return;
  }
  memcpy(dest, src, n);
}
#define LOAD_DATA(m, o, i, s)      \
  do {                             \
    RANGE_CHECK((&m), o, s);       \
    load_data(&(m.data[o]), i, s); \
  } while (0)
#define DEFINE_LOAD(name, t1, t2, t3)                      \
  static inline t3 name(wasm_rt_memory_t* mem, u64 addr) { \
    MEMCHECK(mem, addr, t1);                               \
    t1 result;                                             \
    wasm_rt_memcpy(&result, &mem->data[addr], sizeof(t1)); \
    wasm_asm("" ::"r"(result));                            \
    return (t3)(t2)result;                                 \
  }

#define DEFINE_STORE(name, t1, t2)                                     \
  static inline void name(wasm_rt_memory_t* mem, u64 addr, t2 value) { \
    MEMCHECK(mem, addr, t1);                                           \
    t1 wrapped = (t1)value;                                            \
    wasm_rt_memcpy(&mem->data[addr], &wrapped, sizeof(t1));            \
  }
#endif

DEFINE_LOAD(i32_load, u32, u32, u32)
DEFINE_LOAD(i64_load, u64, u64, u64)
DEFINE_LOAD(f32_load, f32, f32, f32)
DEFINE_LOAD(f64_load, f64, f64, f64)
DEFINE_LOAD(i32_load8_s, s8, s32, u32)
DEFINE_LOAD(i64_load8_s, s8, s64, u64)
DEFINE_LOAD(i32_load8_u, u8, u32, u32)
DEFINE_LOAD(i64_load8_u, u8, u64, u64)
DEFINE_LOAD(i32_load16_s, s16, s32, u32)
DEFINE_LOAD(i64_load16_s, s16, s64, u64)
DEFINE_LOAD(i32_load16_u, u16, u32, u32)
DEFINE_LOAD(i64_load16_u, u16, u64, u64)
DEFINE_LOAD(i64_load32_s, s32, s64, u64)
DEFINE_LOAD(i64_load32_u, u32, u64, u64)
DEFINE_STORE(i32_store, u32, u32)
DEFINE_STORE(i64_store, u64, u64)
DEFINE_STORE(f32_store, f32, f32)
DEFINE_STORE(f64_store, f64, f64)
DEFINE_STORE(i32_store8, u8, u32)
DEFINE_STORE(i32_store16, u16, u32)
DEFINE_STORE(i64_store8, u8, u64)
DEFINE_STORE(i64_store16, u16, u64)
DEFINE_STORE(i64_store32, u32, u64)

#if defined(_MSC_VER)

// Adapted from
// https://github.com/nemequ/portable-snippets/blob/master/builtin/builtin.h

static inline int I64_CLZ(unsigned long long v) {
  unsigned long r = 0;
#if defined(_M_AMD64) || defined(_M_ARM)
  if (_BitScanReverse64(&r, v)) {
    return 63 - r;
  }
#else
  if (_BitScanReverse(&r, (unsigned long)(v >> 32))) {
    return 31 - r;
  } else if (_BitScanReverse(&r, (unsigned long)v)) {
    return 63 - r;
  }
#endif
  return 64;
}

static inline int I32_CLZ(unsigned long v) {
  unsigned long r = 0;
  if (_BitScanReverse(&r, v)) {
    return 31 - r;
  }
  return 32;
}

static inline int I64_CTZ(unsigned long long v) {
  if (!v) {
    return 64;
  }
  unsigned long r = 0;
#if defined(_M_AMD64) || defined(_M_ARM)
  _BitScanForward64(&r, v);
  return (int)r;
#else
  if (_BitScanForward(&r, (unsigned int)(v))) {
    return (int)(r);
  }

  _BitScanForward(&r, (unsigned int)(v >> 32));
  return (int)(r + 32);
#endif
}

static inline int I32_CTZ(unsigned long v) {
  if (!v) {
    return 32;
  }
  unsigned long r = 0;
  _BitScanForward(&r, v);
  return (int)r;
}

#define POPCOUNT_DEFINE_PORTABLE(f_n, T)                            \
  static inline u32 f_n(T x) {                                      \
    x = x - ((x >> 1) & (T) ~(T)0 / 3);                             \
    x = (x & (T) ~(T)0 / 15 * 3) + ((x >> 2) & (T) ~(T)0 / 15 * 3); \
    x = (x + (x >> 4)) & (T) ~(T)0 / 255 * 15;                      \
    return (T)(x * ((T) ~(T)0 / 255)) >> (sizeof(T) - 1) * 8;       \
  }

POPCOUNT_DEFINE_PORTABLE(I32_POPCNT, u32)
POPCOUNT_DEFINE_PORTABLE(I64_POPCNT, u64)

#undef POPCOUNT_DEFINE_PORTABLE

#else

#define I32_CLZ(x) ((x) ? __builtin_clz(x) : 32)
#define I64_CLZ(x) ((x) ? __builtin_clzll(x) : 64)
#define I32_CTZ(x) ((x) ? __builtin_ctz(x) : 32)
#define I64_CTZ(x) ((x) ? __builtin_ctzll(x) : 64)
#define I32_POPCNT(x) (__builtin_popcount(x))
#define I64_POPCNT(x) (__builtin_popcountll(x))

#endif

#define DIV_S(ut, min, x, y)                                      \
  ((UNLIKELY((y) == 0))                                           \
       ? TRAP(DIV_BY_ZERO)                                        \
       : (UNLIKELY((x) == min && (y) == -1)) ? TRAP(INT_OVERFLOW) \
                                             : (ut)((x) / (y)))

#define REM_S(ut, min, x, y) \
  ((UNLIKELY((y) == 0))      \
       ? TRAP(DIV_BY_ZERO)   \
       : (UNLIKELY((x) == min && (y) == -1)) ? 0 : (ut)((x) % (y)))

#define I32_DIV_S(x, y) DIV_S(u32, INT32_MIN, (s32)x, (s32)y)
#define I64_DIV_S(x, y) DIV_S(u64, INT64_MIN, (s64)x, (s64)y)
#define I32_REM_S(x, y) REM_S(u32, INT32_MIN, (s32)x, (s32)y)
#define I64_REM_S(x, y) REM_S(u64, INT64_MIN, (s64)x, (s64)y)

#define DIVREM_U(op, x, y) \
  ((UNLIKELY((y) == 0)) ? TRAP(DIV_BY_ZERO) : ((x)op(y)))

#define DIV_U(x, y) DIVREM_U(/, x, y)
#define REM_U(x, y) DIVREM_U(%, x, y)

#define ROTL(x, y, mask) \
  (((x) << ((y) & (mask))) | ((x) >> (((mask) - (y) + 1) & (mask))))
#define ROTR(x, y, mask) \
  (((x) >> ((y) & (mask))) | ((x) << (((mask) - (y) + 1) & (mask))))

#define I32_ROTL(x, y) ROTL(x, y, 31)
#define I64_ROTL(x, y) ROTL(x, y, 63)
#define I32_ROTR(x, y) ROTR(x, y, 31)
#define I64_ROTR(x, y) ROTR(x, y, 63)

#define FMIN(x, y)                                                     \
  ((UNLIKELY((x) != (x)))                                              \
       ? NAN                                                           \
       : (UNLIKELY((y) != (y)))                                        \
             ? NAN                                                     \
             : (UNLIKELY((x) == 0 && (y) == 0)) ? (signbit(x) ? x : y) \
                                                : (x < y) ? x : y)

#define FMAX(x, y)                                                     \
  ((UNLIKELY((x) != (x)))                                              \
       ? NAN                                                           \
       : (UNLIKELY((y) != (y)))                                        \
             ? NAN                                                     \
             : (UNLIKELY((x) == 0 && (y) == 0)) ? (signbit(x) ? y : x) \
                                                : (x > y) ? x : y)

#define TRUNC_S(ut, st, ft, min, minop, max, x)                           \
  ((UNLIKELY((x) != (x)))                                                 \
       ? TRAP(INVALID_CONVERSION)                                         \
       : (UNLIKELY(!((x)minop(min) && (x) < (max)))) ? TRAP(INT_OVERFLOW) \
                                                     : (ut)(st)(x))

#define I32_TRUNC_S_F32(x) \
  TRUNC_S(u32, s32, f32, (f32)INT32_MIN, >=, 2147483648.f, x)
#define I64_TRUNC_S_F32(x) \
  TRUNC_S(u64, s64, f32, (f32)INT64_MIN, >=, (f32)INT64_MAX, x)
#define I32_TRUNC_S_F64(x) \
  TRUNC_S(u32, s32, f64, -2147483649., >, 2147483648., x)
#define I64_TRUNC_S_F64(x) \
  TRUNC_S(u64, s64, f64, (f64)INT64_MIN, >=, (f64)INT64_MAX, x)

#define TRUNC_U(ut, ft, max, x)                                          \
  ((UNLIKELY((x) != (x)))                                                \
       ? TRAP(INVALID_CONVERSION)                                        \
       : (UNLIKELY(!((x) > (ft)-1 && (x) < (max)))) ? TRAP(INT_OVERFLOW) \
                                                    : (ut)(x))

#define I32_TRUNC_U_F32(x) TRUNC_U(u32, f32, 4294967296.f, x)
#define I64_TRUNC_U_F32(x) TRUNC_U(u64, f32, (f32)UINT64_MAX, x)
#define I32_TRUNC_U_F64(x) TRUNC_U(u32, f64, 4294967296., x)
#define I64_TRUNC_U_F64(x) TRUNC_U(u64, f64, (f64)UINT64_MAX, x)

#define TRUNC_SAT_S(ut, st, ft, min, smin, minop, max, smax, x) \
  ((UNLIKELY((x) != (x)))                                       \
       ? 0                                                      \
       : (UNLIKELY(!((x)minop(min))))                           \
             ? smin                                             \
             : (UNLIKELY(!((x) < (max)))) ? smax : (ut)(st)(x))

#define I32_TRUNC_SAT_S_F32(x)                                            \
  TRUNC_SAT_S(u32, s32, f32, (f32)INT32_MIN, INT32_MIN, >=, 2147483648.f, \
              INT32_MAX, x)
#define I64_TRUNC_SAT_S_F32(x)                                              \
  TRUNC_SAT_S(u64, s64, f32, (f32)INT64_MIN, INT64_MIN, >=, (f32)INT64_MAX, \
              INT64_MAX, x)
#define I32_TRUNC_SAT_S_F64(x)                                        \
  TRUNC_SAT_S(u32, s32, f64, -2147483649., INT32_MIN, >, 2147483648., \
              INT32_MAX, x)
#define I64_TRUNC_SAT_S_F64(x)                                              \
  TRUNC_SAT_S(u64, s64, f64, (f64)INT64_MIN, INT64_MIN, >=, (f64)INT64_MAX, \
              INT64_MAX, x)

#define TRUNC_SAT_U(ut, ft, max, smax, x)               \
  ((UNLIKELY((x) != (x))) ? 0                           \
                          : (UNLIKELY(!((x) > (ft)-1))) \
                                ? 0                     \
                                : (UNLIKELY(!((x) < (max)))) ? smax : (ut)(x))

#define I32_TRUNC_SAT_U_F32(x) \
  TRUNC_SAT_U(u32, f32, 4294967296.f, UINT32_MAX, x)
#define I64_TRUNC_SAT_U_F32(x) \
  TRUNC_SAT_U(u64, f32, (f32)UINT64_MAX, UINT64_MAX, x)
#define I32_TRUNC_SAT_U_F64(x) TRUNC_SAT_U(u32, f64, 4294967296., UINT32_MAX, x)
#define I64_TRUNC_SAT_U_F64(x) \
  TRUNC_SAT_U(u64, f64, (f64)UINT64_MAX, UINT64_MAX, x)

#define DEFINE_REINTERPRET(name, t1, t2) \
  static inline t2 name(t1 x) {          \
    t2 result;                           \
    memcpy(&result, &x, sizeof(result)); \
    return result;                       \
  }

DEFINE_REINTERPRET(f32_reinterpret_i32, u32, f32)
DEFINE_REINTERPRET(i32_reinterpret_f32, f32, u32)
DEFINE_REINTERPRET(f64_reinterpret_i64, u64, f64)
DEFINE_REINTERPRET(i64_reinterpret_f64, f64, u64)

static float quiet_nanf(float x) {
  uint32_t tmp;
  memcpy(&tmp, &x, 4);
  tmp |= 0x7fc00000lu;
  memcpy(&x, &tmp, 4);
  return x;
}

static double quiet_nan(double x) {
  uint64_t tmp;
  memcpy(&tmp, &x, 8);
  tmp |= 0x7ff8000000000000llu;
  memcpy(&x, &tmp, 8);
  return x;
}

static double wasm_quiet(double x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nan(x);
  }
  return x;
}

static float wasm_quietf(float x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nanf(x);
  }
  return x;
}

static double wasm_floor(double x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nan(x);
  }
  return floor(x);
}

static float wasm_floorf(float x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nanf(x);
  }
  return floorf(x);
}

static double wasm_ceil(double x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nan(x);
  }
  return ceil(x);
}

static float wasm_ceilf(float x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nanf(x);
  }
  return ceilf(x);
}

static double wasm_trunc(double x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nan(x);
  }
  return trunc(x);
}

static float wasm_truncf(float x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nanf(x);
  }
  return truncf(x);
}

static float wasm_nearbyintf(float x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nanf(x);
  }
  return nearbyintf(x);
}

static double wasm_nearbyint(double x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nan(x);
  }
  return nearbyint(x);
}

static float wasm_fabsf(float x) {
  if (UNLIKELY(isnan(x))) {
    uint32_t tmp;
    memcpy(&tmp, &x, 4);
    tmp = tmp & ~(1UL << 31);
    memcpy(&x, &tmp, 4);
    return x;
  }
  return fabsf(x);
}

static double wasm_fabs(double x) {
  if (UNLIKELY(isnan(x))) {
    uint64_t tmp;
    memcpy(&tmp, &x, 8);
    tmp = tmp & ~(1ULL << 63);
    memcpy(&x, &tmp, 8);
    return x;
  }
  return fabs(x);
}

static double wasm_sqrt(double x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nan(x);
  }
  return sqrt(x);
}

static float wasm_sqrtf(float x) {
  if (UNLIKELY(isnan(x))) {
    return quiet_nanf(x);
  }
  return sqrtf(x);
}

static inline void memory_fill(wasm_rt_memory_t* mem, u32 d, u32 val, u32 n) {
  RANGE_CHECK(mem, d, n);
  memset(mem->data + d, val, n);
}

static inline void memory_copy(wasm_rt_memory_t* dest,
                               const wasm_rt_memory_t* src,
                               u32 dest_addr,
                               u32 src_addr,
                               u32 n) {
  RANGE_CHECK(dest, dest_addr, n);
  RANGE_CHECK(src, src_addr, n);
  memmove(dest->data + dest_addr, src->data + src_addr, n);
}

static inline void memory_init(wasm_rt_memory_t* dest,
                               const u8* src,
                               u32 src_size,
                               u32 dest_addr,
                               u32 src_addr,
                               u32 n) {
  if (UNLIKELY(src_addr + (uint64_t)n > src_size))
    TRAP(OOB);
  LOAD_DATA((*dest), dest_addr, src + src_addr, n);
}

typedef struct {
  wasm_rt_func_type_t type;
  wasm_rt_function_ptr_t func;
  size_t module_offset;
} wasm_elem_segment_expr_t;

static inline void funcref_table_init(wasm_rt_funcref_table_t* dest,
                                      const wasm_elem_segment_expr_t* src,
                                      u32 src_size,
                                      u32 dest_addr,
                                      u32 src_addr,
                                      u32 n,
                                      void* module_instance) {
  if (UNLIKELY(src_addr + (uint64_t)n > src_size))
    TRAP(OOB);
  if (UNLIKELY(dest_addr + (uint64_t)n > dest->size))
    TRAP(OOB);
  for (u32 i = 0; i < n; i++) {
    const wasm_elem_segment_expr_t* src_expr = &src[src_addr + i];
    dest->data[dest_addr + i] =
        (wasm_rt_funcref_t){src_expr->type, src_expr->func,
                            (char*)module_instance + src_expr->module_offset};
  }
}

// Currently Wasm only supports initializing externref tables with ref.null.
static inline void externref_table_init(wasm_rt_externref_table_t* dest,
                                        u32 src_size,
                                        u32 dest_addr,
                                        u32 src_addr,
                                        u32 n) {
  if (UNLIKELY(src_addr + (uint64_t)n > src_size))
    TRAP(OOB);
  if (UNLIKELY(dest_addr + (uint64_t)n > dest->size))
    TRAP(OOB);
  for (u32 i = 0; i < n; i++) {
    dest->data[dest_addr + i] = wasm_rt_externref_null_value;
  }
}

#define DEFINE_TABLE_COPY(type)                                              \
  static inline void type##_table_copy(wasm_rt_##type##_table_t* dest,       \
                                       const wasm_rt_##type##_table_t* src,  \
                                       u32 dest_addr, u32 src_addr, u32 n) { \
    if (UNLIKELY(dest_addr + (uint64_t)n > dest->size))                      \
      TRAP(OOB);                                                             \
    if (UNLIKELY(src_addr + (uint64_t)n > src->size))                        \
      TRAP(OOB);                                                             \
                                                                             \
    memmove(dest->data + dest_addr, src->data + src_addr,                    \
            n * sizeof(wasm_rt_##type##_t));                                 \
  }

DEFINE_TABLE_COPY(funcref)
DEFINE_TABLE_COPY(externref)

#define DEFINE_TABLE_GET(type)                        \
  static inline wasm_rt_##type##_t type##_table_get(  \
      const wasm_rt_##type##_table_t* table, u32 i) { \
    if (UNLIKELY(i >= table->size))                   \
      TRAP(OOB);                                      \
    return table->data[i];                            \
  }

DEFINE_TABLE_GET(funcref)
DEFINE_TABLE_GET(externref)

#define DEFINE_TABLE_SET(type)                                               \
  static inline void type##_table_set(const wasm_rt_##type##_table_t* table, \
                                      u32 i, const wasm_rt_##type##_t val) { \
    if (UNLIKELY(i >= table->size))                                          \
      TRAP(OOB);                                                             \
    table->data[i] = val;                                                    \
  }

DEFINE_TABLE_SET(funcref)
DEFINE_TABLE_SET(externref)

#define DEFINE_TABLE_FILL(type)                                               \
  static inline void type##_table_fill(const wasm_rt_##type##_table_t* table, \
                                       u32 d, const wasm_rt_##type##_t val,   \
                                       u32 n) {                               \
    if (UNLIKELY((uint64_t)d + n > table->size))                              \
      TRAP(OOB);                                                              \
    for (uint32_t i = d; i < d + n; i++) {                                    \
      table->data[i] = val;                                                   \
    }                                                                         \
  }

DEFINE_TABLE_FILL(funcref)
DEFINE_TABLE_FILL(externref)

#if defined(__GNUC__) || defined(__clang__)
#define FUNC_TYPE_DECL_EXTERN_T(x) extern const char* const x
#define FUNC_TYPE_EXTERN_T(x) const char* const x
#define FUNC_TYPE_T(x) static const char* const x
#else
#define FUNC_TYPE_DECL_EXTERN_T(x) extern const char x[]
#define FUNC_TYPE_EXTERN_T(x) const char x[]
#define FUNC_TYPE_T(x) static const char x[]
#endif

static void w2c_qCCYI0ajpD_0x5F_wasm_call_ctors_0(w2c_qCCYI0ajpD*);
static u32 w2c_qCCYI0ajpD_strcmp_0(w2c_qCCYI0ajpD*, u32, u32);
static u32 w2c_qCCYI0ajpD_check_flag_0(w2c_qCCYI0ajpD*);
static void w2c_qCCYI0ajpD_copy_char_0(w2c_qCCYI0ajpD*, u32, u32);

FUNC_TYPE_T(w2c_qCCYI0ajpD_t0) = "\x36\xa9\xe7\xf1\xc9\x5b\x82\xff\xb9\x97\x43\xe0\xc5\xc4\xce\x95\xd8\x3c\x9a\x43\x0a\xac\x59\xf8\x4e\xf3\xcb\xfa\xb6\x14\x50\x68";
FUNC_TYPE_T(w2c_qCCYI0ajpD_t1) = "\x92\xfb\x6a\xdf\x49\x07\x0a\x83\xbe\x08\x02\x68\xcd\xf6\x95\x27\x4a\xc2\xf3\xe5\xe4\x7d\x29\x49\xe8\xed\x42\x92\x6a\x9d\xda\xf0";
FUNC_TYPE_T(w2c_qCCYI0ajpD_t2) = "\x72\xab\x00\xdf\x20\x3d\xce\xa1\xf2\x29\xc7\x9d\x13\x40\x7e\x98\xac\x7d\x41\x4a\x53\x2e\x42\x42\x61\x55\x2e\xaa\xeb\xbe\xc6\x35";
FUNC_TYPE_T(w2c_qCCYI0ajpD_t3) = "\x26\x10\x81\xe2\x21\x43\xd6\x01\x3e\x2d\x2f\x16\x17\x78\x6f\xba\xb3\x2f\x4d\x54\x9b\x8a\xa9\xdd\xbf\x53\x92\x3c\xd3\x71\xc6\xb2";

static void init_globals(w2c_qCCYI0ajpD* instance) {
  instance->w2c_g0 = 66864u;
  instance->w2c_input = 1072u;
  instance->w2c_key = 1067u;
  instance->w2c_0x5F_dso_handle = 1024u;
  instance->w2c_0x5F_data_end = 1328u;
  instance->w2c_0x5F_global_base = 1024u;
  instance->w2c_0x5F_heap_base = 66864u;
  instance->w2c_0x5F_memory_base = 0u;
  instance->w2c_0x5F_table_base = 1u;
}

static const u8 data_segment_data_w2c_qCCYI0ajpD_d0[] = {
  0x9d, 0x6e, 0x93, 0xc8, 0xb2, 0xb9, 0x41, 0x8b, 0xc2, 0x97, 0xd4, 0x66, 
  0xc7, 0x93, 0xc4, 0xd4, 0x61, 0xc2, 0xc6, 0xc9, 0xdd, 0x62, 0x94, 0x9e, 
  0xc2, 0x89, 0x32, 0x91, 0x90, 0xc1, 0xdd, 0x33, 0x91, 0x91, 0x97, 0x8b, 
  0x64, 0xc1, 0x92, 0xc4, 0x90, 0x00, 0x00, 
};

static const u8 data_segment_data_w2c_qCCYI0ajpD_d1[] = {
  0xf1, 0xa7, 0xf0, 0x07, 0xed, 
};

static void init_memories(w2c_qCCYI0ajpD* instance) {
  wasm_rt_allocate_memory(&instance->w2c_memory, 2, 65536, 0);
  LOAD_DATA(instance->w2c_memory, 1024u, data_segment_data_w2c_qCCYI0ajpD_d0, 43);
  LOAD_DATA(instance->w2c_memory, 1067u, data_segment_data_w2c_qCCYI0ajpD_d1, 5);
}

static void init_data_instances(w2c_qCCYI0ajpD *instance) {
}

static void init_tables(w2c_qCCYI0ajpD* instance) {
  wasm_rt_allocate_funcref_table(&instance->w2c_T0, 1, 1);
}

/* export: 'memory' */
wasm_rt_memory_t* w2c_qCCYI0ajpD_memory(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_memory;
}

/* export: '__wasm_call_ctors' */
void w2c_qCCYI0ajpD_0x5F_wasm_call_ctors(w2c_qCCYI0ajpD* instance) {
  return w2c_qCCYI0ajpD_0x5F_wasm_call_ctors_0(instance);
}

/* export: 'strcmp' */
u32 w2c_qCCYI0ajpD_strcmp(w2c_qCCYI0ajpD* instance, u32 var_p0, u32 var_p1) {
  return w2c_qCCYI0ajpD_strcmp_0(instance, var_p0, var_p1);
}

/* export: 'check_flag' */
u32 w2c_qCCYI0ajpD_check_flag(w2c_qCCYI0ajpD* instance) {
  return w2c_qCCYI0ajpD_check_flag_0(instance);
}

/* export: 'input' */
u32* w2c_qCCYI0ajpD_input(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_input;
}

/* export: 'copy_char' */
void w2c_qCCYI0ajpD_copy_char(w2c_qCCYI0ajpD* instance, u32 var_p0, u32 var_p1) {
  return w2c_qCCYI0ajpD_copy_char_0(instance, var_p0, var_p1);
}

/* export: 'key' */
u32* w2c_qCCYI0ajpD_key(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_key;
}

/* export: '__dso_handle' */
u32* w2c_qCCYI0ajpD_0x5F_dso_handle(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_0x5F_dso_handle;
}

/* export: '__data_end' */
u32* w2c_qCCYI0ajpD_0x5F_data_end(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_0x5F_data_end;
}

/* export: '__global_base' */
u32* w2c_qCCYI0ajpD_0x5F_global_base(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_0x5F_global_base;
}

/* export: '__heap_base' */
u32* w2c_qCCYI0ajpD_0x5F_heap_base(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_0x5F_heap_base;
}

/* export: '__memory_base' */
u32* w2c_qCCYI0ajpD_0x5F_memory_base(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_0x5F_memory_base;
}

/* export: '__table_base' */
u32* w2c_qCCYI0ajpD_0x5F_table_base(w2c_qCCYI0ajpD* instance) {
  return &instance->w2c_0x5F_table_base;
}

void wasm2c_qCCYI0ajpD_instantiate(w2c_qCCYI0ajpD* instance) {
  assert(wasm_rt_is_initialized());
  init_globals(instance);
  init_tables(instance);
  init_memories(instance);
  init_data_instances(instance);
}

void wasm2c_qCCYI0ajpD_free(w2c_qCCYI0ajpD* instance) {
  wasm_rt_free_funcref_table(&instance->w2c_T0);
  wasm_rt_free_memory(&instance->w2c_memory);
}

wasm_rt_func_type_t wasm2c_qCCYI0ajpD_get_func_type(uint32_t param_count, uint32_t result_count, ...) {
  va_list args;
  
  if (param_count == 0 && result_count == 0) {
    va_start(args, result_count);
    if (true) {
      va_end(args);
      return w2c_qCCYI0ajpD_t0;
    }
    va_end(args);
  }
  
  if (param_count == 2 && result_count == 1) {
    va_start(args, result_count);
    if (true && va_arg(args, wasm_rt_type_t) == WASM_RT_I32 && va_arg(args, wasm_rt_type_t) == WASM_RT_I32 && va_arg(args, wasm_rt_type_t) == WASM_RT_I32) {
      va_end(args);
      return w2c_qCCYI0ajpD_t1;
    }
    va_end(args);
  }
  
  if (param_count == 0 && result_count == 1) {
    va_start(args, result_count);
    if (true && va_arg(args, wasm_rt_type_t) == WASM_RT_I32) {
      va_end(args);
      return w2c_qCCYI0ajpD_t2;
    }
    va_end(args);
  }
  
  if (param_count == 2 && result_count == 0) {
    va_start(args, result_count);
    if (true && va_arg(args, wasm_rt_type_t) == WASM_RT_I32 && va_arg(args, wasm_rt_type_t) == WASM_RT_I32) {
      va_end(args);
      return w2c_qCCYI0ajpD_t3;
    }
    va_end(args);
  }
  
  return NULL;
}

void w2c_qCCYI0ajpD_0x5F_wasm_call_ctors_0(w2c_qCCYI0ajpD* instance) {
  FUNC_PROLOGUE;
  FUNC_EPILOGUE;
}

u32 w2c_qCCYI0ajpD_strcmp_0(w2c_qCCYI0ajpD* instance, u32 var_p0, u32 var_p1) {
  u32 var_l2 = 0, var_l3 = 0, var_l4 = 0, var_l5 = 0, var_l6 = 0, var_l7 = 0, var_l8 = 0, var_l9 = 0, 
      var_l10 = 0, var_l11 = 0, var_l12 = 0, var_l13 = 0, var_l14 = 0, var_l15 = 0, var_l16 = 0, var_l17 = 0, 
      var_l18 = 0, var_l19 = 0, var_l20 = 0, var_l21 = 0, var_l22 = 0, var_l23 = 0, var_l24 = 0, var_l25 = 0, 
      var_l26 = 0, var_l27 = 0, var_l28 = 0, var_l29 = 0, var_l30 = 0, var_l31 = 0, var_l32 = 0, var_l33 = 0, 
      var_l34 = 0, var_l35 = 0, var_l36 = 0, var_l37 = 0, var_l38 = 0, var_l39 = 0, var_l40 = 0, var_l41 = 0, 
      var_l42 = 0, var_l43 = 0;
  FUNC_PROLOGUE;
  u32 var_i0, var_i1;
  var_i0 = instance->w2c_g0;
  var_l2 = var_i0;
  var_i0 = 32u;
  var_l3 = var_i0;
  var_i0 = var_l2;
  var_i1 = var_l3;
  var_i0 -= var_i1;
  var_l4 = var_i0;
  var_i0 = var_l4;
  var_i1 = var_p0;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 24, var_i1);
  var_i0 = var_l4;
  var_i1 = var_p1;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 20, var_i1);
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 24u);
  var_l5 = var_i0;
  var_i0 = var_l4;
  var_i1 = var_l5;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 16, var_i1);
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 20u);
  var_l6 = var_i0;
  var_i0 = var_l4;
  var_i1 = var_l6;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 12, var_i1);
  var_L1: 
    var_i0 = var_l4;
    var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 16u);
    var_l7 = var_i0;
    var_i0 = 1u;
    var_l8 = var_i0;
    var_i0 = var_l7;
    var_i1 = var_l8;
    var_i0 += var_i1;
    var_l9 = var_i0;
    var_i0 = var_l4;
    var_i1 = var_l9;
    i32_store(&instance->w2c_memory, (u64)(var_i0) + 16, var_i1);
    var_i0 = var_l7;
    var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0));
    var_l10 = var_i0;
    var_i0 = var_l4;
    var_i1 = var_l10;
    i32_store8(&instance->w2c_memory, (u64)(var_i0) + 11, var_i1);
    var_i0 = var_l4;
    var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 12u);
    var_l11 = var_i0;
    var_i0 = 1u;
    var_l12 = var_i0;
    var_i0 = var_l11;
    var_i1 = var_l12;
    var_i0 += var_i1;
    var_l13 = var_i0;
    var_i0 = var_l4;
    var_i1 = var_l13;
    i32_store(&instance->w2c_memory, (u64)(var_i0) + 12, var_i1);
    var_i0 = var_l11;
    var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0));
    var_l14 = var_i0;
    var_i0 = var_l4;
    var_i1 = var_l14;
    i32_store8(&instance->w2c_memory, (u64)(var_i0) + 10, var_i1);
    var_i0 = var_l4;
    var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 11u);
    var_l15 = var_i0;
    var_i0 = 255u;
    var_l16 = var_i0;
    var_i0 = var_l15;
    var_i1 = var_l16;
    var_i0 &= var_i1;
    var_l17 = var_i0;
    var_i0 = var_l17;
    if (var_i0) {goto var_B2;}
    var_i0 = var_l4;
    var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 11u);
    var_l18 = var_i0;
    var_i0 = 255u;
    var_l19 = var_i0;
    var_i0 = var_l18;
    var_i1 = var_l19;
    var_i0 &= var_i1;
    var_l20 = var_i0;
    var_i0 = var_l4;
    var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 10u);
    var_l21 = var_i0;
    var_i0 = 255u;
    var_l22 = var_i0;
    var_i0 = var_l21;
    var_i1 = var_l22;
    var_i0 &= var_i1;
    var_l23 = var_i0;
    var_i0 = var_l20;
    var_i1 = var_l23;
    var_i0 -= var_i1;
    var_l24 = var_i0;
    var_i0 = var_l4;
    var_i1 = var_l24;
    i32_store(&instance->w2c_memory, (u64)(var_i0) + 28, var_i1);
    goto var_B0;
    var_B2:;
    var_i0 = var_l4;
    var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 11u);
    var_l25 = var_i0;
    var_i0 = 255u;
    var_l26 = var_i0;
    var_i0 = var_l25;
    var_i1 = var_l26;
    var_i0 &= var_i1;
    var_l27 = var_i0;
    var_i0 = var_l4;
    var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 10u);
    var_l28 = var_i0;
    var_i0 = 255u;
    var_l29 = var_i0;
    var_i0 = var_l28;
    var_i1 = var_l29;
    var_i0 &= var_i1;
    var_l30 = var_i0;
    var_i0 = var_l27;
    var_l31 = var_i0;
    var_i0 = var_l30;
    var_l32 = var_i0;
    var_i0 = var_l31;
    var_i1 = var_l32;
    var_i0 = var_i0 == var_i1;
    var_l33 = var_i0;
    var_i0 = 1u;
    var_l34 = var_i0;
    var_i0 = var_l33;
    var_i1 = var_l34;
    var_i0 &= var_i1;
    var_l35 = var_i0;
    var_i0 = var_l35;
    if (var_i0) {goto var_L1;}
  var_i0 = var_l4;
  var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 11u);
  var_l36 = var_i0;
  var_i0 = 255u;
  var_l37 = var_i0;
  var_i0 = var_l36;
  var_i1 = var_l37;
  var_i0 &= var_i1;
  var_l38 = var_i0;
  var_i0 = var_l4;
  var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 10u);
  var_l39 = var_i0;
  var_i0 = 255u;
  var_l40 = var_i0;
  var_i0 = var_l39;
  var_i1 = var_l40;
  var_i0 &= var_i1;
  var_l41 = var_i0;
  var_i0 = var_l38;
  var_i1 = var_l41;
  var_i0 -= var_i1;
  var_l42 = var_i0;
  var_i0 = var_l4;
  var_i1 = var_l42;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 28, var_i1);
  var_B0:;
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 28u);
  var_l43 = var_i0;
  var_i0 = var_l43;
  goto var_Bfunc;
  var_Bfunc:;
  FUNC_EPILOGUE;
  return var_i0;
}

u32 w2c_qCCYI0ajpD_check_flag_0(w2c_qCCYI0ajpD* instance) {
  u32 var_l0 = 0, var_l1 = 0, var_l2 = 0, var_l3 = 0, var_l4 = 0, var_l5 = 0, var_l6 = 0, var_l7 = 0, 
      var_l8 = 0, var_l9 = 0, var_l10 = 0;
  FUNC_PROLOGUE;
  u32 var_i0, var_i1;
  var_i0 = 0u;
  var_l0 = var_i0;
  var_i0 = 1072u;
  var_l1 = var_i0;
  var_i0 = 1024u;
  var_l2 = var_i0;
  var_i0 = var_l2;
  var_i1 = var_l1;
  var_i0 = w2c_qCCYI0ajpD_strcmp_0(instance, var_i0, var_i1); // var_i0 == 1024 / var_i1 == 1072
  var_l3 = var_i0;
  var_i0 = var_l3;
  var_l4 = var_i0;
  var_i0 = var_l0;
  var_l5 = var_i0;
  var_i0 = var_l4;
  var_i1 = var_l5;
  var_i0 = var_i0 != var_i1;
  var_l6 = var_i0;
  var_i0 = 4294967295u;
  var_l7 = var_i0;
  var_i0 = var_l6;
  var_i1 = var_l7;
  var_i0 ^= var_i1;
  var_l8 = var_i0;
  var_i0 = 1u;
  var_l9 = var_i0;
  var_i0 = var_l8;
  var_i1 = var_l9;
  var_i0 &= var_i1;
  var_l10 = var_i0;
  var_i0 = var_l10;
  goto var_Bfunc;
  var_Bfunc:;
  FUNC_EPILOGUE;
  return var_i0;
}

void w2c_qCCYI0ajpD_copy_char_0(w2c_qCCYI0ajpD* instance, u32 var_p0, u32 var_p1) {
  u32 var_l2 = 0, var_l3 = 0, var_l4 = 0, var_l5 = 0, var_l6 = 0, var_l7 = 0, var_l8 = 0, var_l9 = 0, 
      var_l10 = 0, var_l11 = 0, var_l12 = 0, var_l13 = 0, var_l14 = 0, var_l15 = 0, var_l16 = 0, var_l17 = 0, 
      var_l18 = 0;
  FUNC_PROLOGUE;
  u32 var_i0, var_i1;
  var_i0 = instance->w2c_g0;
  var_l2 = var_i0;
  var_i0 = 16u;
  var_l3 = var_i0;
  var_i0 = var_l2;
  var_i1 = var_l3;
  var_i0 -= var_i1;
  var_l4 = var_i0;
  var_i0 = var_l4;
  var_i1 = var_p0;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 12, var_i1);
  var_i0 = var_l4;
  var_i1 = var_p1;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 8, var_i1);
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 12u);
  var_l5 = var_i0;
  var_i0 = var_l5;
  var_i0 = !(var_i0);
  if (var_i0) {goto var_B0;}
  var_i0 = 4u;
  var_l6 = var_i0;
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 8u);
  var_l7 = var_i0;
  var_i0 = 5u;
  var_l8 = var_i0;
  var_i0 = var_l7;
  var_i1 = var_l8;
  var_i0 = I32_REM_S(var_i0, var_i1);
  var_l9 = var_i0;
  var_i0 = var_l6;
  var_i1 = var_l9;
  var_i0 -= var_i1;
  var_l10 = var_i0;
  var_i0 = var_l10;
  var_i0 = i32_load8_u(&instance->w2c_memory, (u64)(var_i0) + 1067u);
  var_l11 = var_i0;
  var_i0 = 24u;
  var_l12 = var_i0;
  var_i0 = var_l11;
  var_i1 = var_l12;
  var_i0 <<= (var_i1 & 31);
  var_l13 = var_i0;
  var_i0 = var_l13;
  var_i1 = var_l12;
  var_i0 = (u32)((s32)var_i0 >> (var_i1 & 31));
  var_l14 = var_i0;
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 12u);
  var_l15 = var_i0;
  var_i0 = var_l15;
  var_i1 = var_l14;
  var_i0 ^= var_i1;
  var_l16 = var_i0;
  var_i0 = var_l4;
  var_i1 = var_l16;
  i32_store(&instance->w2c_memory, (u64)(var_i0) + 12, var_i1);
  var_B0:;
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 12u);
  var_l17 = var_i0;
  var_i0 = var_l4;
  var_i0 = i32_load(&instance->w2c_memory, (u64)(var_i0) + 8u);
  var_l18 = var_i0;
  var_i0 = var_l18;
  var_i1 = var_l17;
  i32_store8(&instance->w2c_memory, (u64)(var_i0) + 1072, var_i1);
  goto var_Bfunc;
  var_Bfunc:;
  FUNC_EPILOGUE;
}

Recon

這一題沒有寫出來，太難了，應該說複雜很多，即使看了maple和martin的WP還是做不出來，大概知道就是兩個list之間的XOR，不過具體的流程和解題思路是比較模糊的，沒有通透的感覺QQ

Reference

Post author: SBK6401
Post link: https://bernie6401.github.io/PicoCTF-Some-Assembly-Required-3/
Copyright Notice: All articles in this blog are licensed under CC BY-NC-SA 4.0 unless stating additionally.