Simple Reverse - 0x15(2023 HW - crackme_vectorization)

Posted on | Post modified | In |

Simple Reverse - 0x15(2023 HW - crackme_vectorization)

Source Code

:::spoiler IDA Main Function

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
 
__int64 __fastcall main(int a1, char **a2, char **a3)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  __isoc99_scanf("%d", &user_input_len);        // 長度為49
  user_input_len_cp = user_input_len;
  sqrt_length = sqrt((double)user_input_len);   // 開根號後是7
  sqrt_length_cp = (int)sqrt_length;
  if ( sqrt_length > (double)(int)sqrt_length )
    ++sqrt_length_cp;
  sqrt_len = _mm_shuffle_epi32(_mm_cvtsi32_si128(sqrt_length_cp), 224).m128i_u64[0];// 原本的shuffle num就是user input length的開根號結果
  space = (struc_1 *)malloc(0x10uLL);
  space->sqrt_len = sqrt_len;
  size = 4 * sqrt_length_cp * (__int64)sqrt_length_cp;// size是196
  shuffle_space = malloc(size);
  space->content_space = (__int64)shuffle_space;
  if ( user_input_len_cp > 0 )
  {
    shuffle_space_cp = shuffle_space;
    len = 0LL;
    do
    {
      __isoc99_scanf("%d", content);
      shuffle_space_cp[len++] = content[0];
    }
    while ( user_input_len > (int)len );        // 要輸入東西49次
  }
  if ( length == sqrt_length_cp
    && (space_1 = (struc_1 *)malloc(0x10uLL),
        space_1->sqrt_len = sqrt_len,
        shuffle_space_1 = malloc(size),
        src = cipher_flag,
        space_1->content_space = (__int64)shuffle_space_1,
        memcpy(shuffle_space_1, src, size),
        result = ugly_matrix_multiplication(
                   (int *)space_1,
                   (__int64)space),             // guess_cipher的大小是196
                                                // 他會把我們輸入的東西和他原本的東西一起送到guess_encrypt的這個function中
        !memcmp((const void *)result[1], verify_key, size)) )
  {
    puts("Correct!");
  }
  else
  {
    puts(":(");
  }
  return 0LL;
}

::: :::spoiler IDA Ugly Function

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
 
_QWORD *__fastcall guess_encrypt(int *space_1, __int64 space)
{
  // [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]

  _RAX = malloc(0x10uLL);
  _RDI = *space_1;
  guess_cipher = _RAX;
  length_0x4 = *(int *)(space + 4);
  __asm { vmovd   xmm5, edi }
  length_0x0 = *space_1;
  _RBX = 4 * length_0x4;
  __asm { vpinsrd xmm0, xmm5, r13d, 1 }
  length_0x4_cp = length_0x4;
  __asm { vmovq   qword ptr [rax], xmm0 }
  space_2 = malloc(4 * length_0x4 * _RDI);
  guess_cipher[1] = space_2;
  if ( length_0x0 > 0 )
  {
    length_0x4_cp2 = length_0x4;
    if ( (int)length_0x4 > 0 )
    {
      length_0x0_2 = space_1[1];
      length_0x0_cp = length_0x0;
      guess_cipher_1 = guess_cipher;
      length_16_0x4 = 16 * length_0x4;
      space_2_cp = space_2;
      length_0x0_2_minus_1 = length_0x0_2 - 1;
      space_1_cp = space_1;
      length_0x0_2_x_4 = 16LL * ((unsigned int)length_0x0_2 >> 2);
      v14 = 0;
      while ( 1 )
      {
        v15 = 0LL;
        v16 = length_0x0_2 * v14;
        v87 = 4LL * length_0x0_2 * v14;
        cmd = length_0x4_cp & 7;
        if ( (length_0x4_cp & 7) == 0 )
          goto LABEL_44;
        switch ( cmd )
        {
          case 1LL:
            goto LABEL_42;
          case 2LL:
            goto LABEL_40;
          case 3LL:
            goto LABEL_38;
          case 4LL:
            goto LABEL_36;
          case 5LL:
            goto LABEL_34;
        }
        if ( cmd != 6 )
        {
          if ( length_0x0_2 > 0 )
            goto LABEL_12;
          v15 = 1LL;
          *space_2_cp = 0;
        }
        if ( length_0x0_2 <= 0 )
          break;
LABEL_12:
        v92 = v14;
        v18 = v15;
        v19 = *((_QWORD *)space_1_cp + 1);
        v20 = *(_QWORD *)(space + 8);
        if ( length_0x0_2_minus_1 <= 2 )
          goto LABEL_26;
        while ( 1 )
        {
          _R15 = v20 + 4 * v15;
          __asm { vpxor   xmm0, xmm0, xmm0 }
          v23 = v19 + v87;
          v24 = length_0x0_2_x_4 + v19 + v87;
          v25 = ((unsigned __int8)((unsigned __int64)(length_0x0_2_x_4 - 16) >> 4) + 1) & 3;
          if ( (((unsigned __int8)((unsigned __int64)(length_0x0_2_x_4 - 16) >> 4) + 1) & 3) == 0 )
            goto LABEL_51;
          if ( v25 != 1 )
          {
            if ( v25 != 2 )
            {
              __asm
              {
                vmovd   xmm3, dword ptr [r15+rbx*2]
                vmovd   xmm4, dword ptr [r15]
              }
              v23 += 16LL;
              __asm
              {
                vpinsrd xmm2, xmm3, dword ptr [r15+r8], 1
                vpinsrd xmm1, xmm4, dword ptr [r15+rbx], 1
              }
              _R15 += length_16_0x4;
              __asm
              {
                vpunpcklqdq xmm6, xmm1, xmm2
                vpmulld xmm0, xmm6, xmmword ptr [rdx-10h]
              }
            }
            __asm
            {
              vmovd   xmm7, dword ptr [r15+rbx*2]
              vmovd   xmm9, dword ptr [r15]
            }
            v23 += 16LL;
            __asm
            {
              vpinsrd xmm8, xmm7, dword ptr [r15+r8], 1
              vpinsrd xmm10, xmm9, dword ptr [r15+rbx], 1
            }
            _R15 += length_16_0x4;
            __asm
            {
              vpunpcklqdq xmm11, xmm10, xmm8
              vpmulld xmm12, xmm11, xmmword ptr [rdx-10h]
              vpaddd  xmm0, xmm0, xmm12
            }
          }
          __asm
          {
            vmovd   xmm13, dword ptr [r15+rbx*2]
            vmovd   xmm15, dword ptr [r15]
          }
          v23 += 16LL;
          __asm
          {
            vpinsrd xmm14, xmm13, dword ptr [r15+r8], 1
            vpinsrd xmm5, xmm15, dword ptr [r15+rbx], 1
          }
          _R15 += length_16_0x4;
          __asm
          {
            vpunpcklqdq xmm3, xmm5, xmm14
            vpmulld xmm2, xmm3, xmmword ptr [rdx-10h]
            vpaddd  xmm0, xmm0, xmm2
          }
          if ( v24 != v23 )
          {
LABEL_51:
            do
            {
              __asm
              {
                vmovd   xmm4, dword ptr [r15+rbx*2]
                vmovd   xmm6, dword ptr [r15]
              }
              v23 += 64LL;
              __asm
              {
                vpinsrd xmm1, xmm4, dword ptr [r15+r8], 1
                vpinsrd xmm7, xmm6, dword ptr [r15+rbx], 1
              }
              _R15 = length_16_0x4 + _R15;
              __asm
              {
                vmovd   xmm11, dword ptr [r15+rbx*2]
                vmovd   xmm13, dword ptr [r15]
                vpinsrd xmm12, xmm11, dword ptr [r15+r8], 1
                vpinsrd xmm14, xmm13, dword ptr [r15+rbx], 1
              }
              _R15 = length_16_0x4 + _R15;
              __asm
              {
                vpunpcklqdq xmm8, xmm7, xmm1
                vmovd   xmm3, dword ptr [r15+rbx*2]
                vpmulld xmm9, xmm8, xmmword ptr [rdx-40h]
                vpinsrd xmm4, xmm3, dword ptr [r15+r8], 1
                vpaddd  xmm10, xmm0, xmm9
                vmovd   xmm2, dword ptr [r15]
                vpinsrd xmm1, xmm2, dword ptr [r15+rbx], 1
              }
              _R15 = length_16_0x4 + _R15;
              __asm
              {
                vpunpcklqdq xmm15, xmm14, xmm12
                vmovd   xmm9, dword ptr [r15+rbx*2]
                vmovd   xmm11, dword ptr [r15]
                vpmulld xmm5, xmm15, xmmword ptr [rdx-30h]
                vpinsrd xmm12, xmm11, dword ptr [r15+rbx], 1
                vpaddd  xmm0, xmm10, xmm5
                vpunpcklqdq xmm6, xmm1, xmm4
                vpmulld xmm7, xmm6, xmmword ptr [rdx-20h]
                vpinsrd xmm10, xmm9, dword ptr [r15+r8], 1
                vpaddd  xmm8, xmm0, xmm7
              }
              _R15 = length_16_0x4 + _R15;
              __asm
              {
                vpunpcklqdq xmm13, xmm12, xmm10
                vpmulld xmm14, xmm13, xmmword ptr [rdx-10h]
                vpaddd  xmm0, xmm8, xmm14
              }
            }
            while ( v24 != v23 );
          }
          __asm
          {
            vpsrldq xmm15, xmm0, 8
            vpaddd  xmm5, xmm0, xmm15
            vpsrldq xmm0, xmm5, 4
          }
          v75 = length_0x0_2 & 0xFFFFFFFC;
          __asm
          {
            vpaddd  xmm3, xmm5, xmm0
            vmovd   ecx, xmm3
          }
          if ( length_0x0_2 != (length_0x0_2 & 0xFFFFFFFC) )
            goto LABEL_21;
LABEL_24:
          space_2_cp[v15++] = _ECX;
          if ( length_0x4_cp == v15 )
            break;
          v18 = v15;
          if ( length_0x0_2_minus_1 <= 2 )
          {
LABEL_26:
            v75 = 0;
            _ECX = 0;
LABEL_21:
            v78 = v75 + 1;
            _ECX += *(_DWORD *)(v20 + 4LL * (int)(v75 * length_0x4_cp2 + v18))
                  * *(_DWORD *)(v19 + 4LL * (int)(v16 + v75));
            if ( (int)(v75 + 1) < length_0x0_2 )
            {
              v79 = length_0x4_cp2 + v75 * length_0x4_cp2;
              v80 = v75 + 2;
              _ECX += *(_DWORD *)(v20 + 4LL * (v79 + v18)) * *(_DWORD *)(v19 + 4LL * (int)(v16 + v78));
              if ( length_0x0_2 > v80 )
                _ECX += *(_DWORD *)(v19 + 4LL * (v16 + v80)) * *(_DWORD *)(v20 + 4LL * (v18 + length_0x4_cp2 + v79));
            }
            goto LABEL_24;
          }
        }
        v14 = v92;
LABEL_28:
        space_2_cp = (_DWORD *)((char *)space_2_cp + _RBX);
        if ( length_0x0_cp == ++v14 )
          return guess_cipher_1;
      }
      space_2_cp[v15++] = 0;
LABEL_34:
      if ( length_0x0_2 > 0 )
        goto LABEL_12;
      space_2_cp[v15++] = 0;
LABEL_36:
      if ( length_0x0_2 > 0 )
        goto LABEL_12;
      space_2_cp[v15++] = 0;
LABEL_38:
      if ( length_0x0_2 > 0 )
        goto LABEL_12;
      space_2_cp[v15++] = 0;
LABEL_40:
      if ( length_0x0_2 > 0 )
        goto LABEL_12;
      space_2_cp[v15++] = 0;
LABEL_42:
      if ( length_0x0_2 > 0 )
        goto LABEL_12;
      space_2_cp[v15++] = 0;
      if ( length_0x4_cp == v15 )
        goto LABEL_28;
LABEL_44:
      v82 = v15;
      while ( length_0x0_2 <= 0 )
      {
        space_2_cp[v82] = 0;
        v83 = v82 + 1;
        space_2_cp[v83] = 0;
        space_2_cp[v83 + 1] = 0;
        space_2_cp[v83 + 2] = 0;
        space_2_cp[v83 + 3] = 0;
        space_2_cp[v83 + 4] = 0;
        space_2_cp[v83 + 5] = 0;
        space_2_cp[v83 + 6] = 0;
        v82 = v83 + 7;
        if ( length_0x4_cp == v82 )
          goto LABEL_28;
      }
      v15 = v82;
      goto LABEL_12;
    }
  }
  return guess_cipher;
}

:::

Recon

一陣基本操作處理完比較好看的狀態後，首先發現一開始先輸入字串的長度(應該是49)，然後我們要輸入一些東西(就是按照前面輸入，總共也是49次)，接著就會進到很醜沒辦法解析的function(我暫時不理他)，一開始我在猜應該是做encryption之類的事情，接著就比對mem，一樣就噴correct這樣，我認為超級醜的function應該不是這次出題的重點，因為要全部逆完真的很有難度，對於學習也沒必要，此時我開始用動態+通靈的方式猜他在幹嘛，依照題目的標題和後面對比字串長度必須要等於7這兩個東西判斷，他應該是在做矩陣之類的操作，而那個醜不拉基的function應該是類似乘法或是加法之類的功能，有了想法就可以實驗他的操作 如果輸入長度49

  1. 內容都是零，毫不意外經過醜不拉基function後都會是零 :::spoiler Result 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    		 
     0x000055aa2b46b4b0│+0x0000: 0x0000000000000000   ← $rdi
 0x000055aa2b46b4b8│+0x0008: 0x0000000000000000
 0x000055aa2b46b4c0│+0x0010: 0x0000000000000000
 0x000055aa2b46b4c8│+0x0018: 0x0000000000000000
 0x000055aa2b46b4d0│+0x0020: 0x0000000000000000
 0x000055aa2b46b4d8│+0x0028: 0x0000000000000000
 0x000055aa2b46b4e0│+0x0030: 0x0000000000000000
 0x000055aa2b46b4e8│+0x0038: 0x0000000000000000
 0x000055aa2b46b4f0│+0x0040: 0x0000000000000000
 0x000055aa2b46b4f8│+0x0048: 0x0000000000000000
 0x000055aa2b46b500│+0x0050: 0x0000000000000000
 0x000055aa2b46b508│+0x0058: 0x0000000000000000
 0x000055aa2b46b510│+0x0060: 0x0000000000000000
 0x000055aa2b46b518│+0x0068: 0x0000000000000000
 0x000055aa2b46b520│+0x0070: 0x0000000000000000
 0x000055aa2b46b528│+0x0078: 0x0000000000000000
 0x000055aa2b46b530│+0x0080: 0x0000000000000000
 0x000055aa2b46b538│+0x0088: 0x0000000000000000
 0x000055aa2b46b540│+0x0090: 0x0000000000000000
 0x000055aa2b46b548│+0x0098: 0x0000000000000000
 0x000055aa2b46b550│+0x00a0: 0x0000000000000000
 0x000055aa2b46b558│+0x00a8: 0x0000000000000000
 0x000055aa2b46b560│+0x00b0: 0x0000000000000000
 0x000055aa2b46b568│+0x00b8: 0x0000000000000000
 0x000055aa2b46b570│+0x00c0: 0x0000000000000000

    :::

  2. 內容都是一，經過醜不拉基function後都會每七個都是同一個數字 :::spoiler Result 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    		 
     0x000055d2f80754b0│+0x0000: 0x000003d4000003d4   ← $rdi
 0x000055d2f80754b8│+0x0008: 0x000003d4000003d4
 0x000055d2f80754c0│+0x0010: 0x000003d4000003d4
 0x000055d2f80754c8│+0x0018: 0x000002d8000003d4
 0x000055d2f80754d0│+0x0020: 0x000002d8000002d8
 0x000055d2f80754d8│+0x0028: 0x000002d8000002d8
 0x000055d2f80754e0│+0x0030: 0x000002d8000002d8
 0x000055d2f80754e8│+0x0038: 0x0000030f0000030f
 0x000055d2f80754f0│+0x0040: 0x0000030f0000030f
 0x000055d2f80754f8│+0x0048: 0x0000030f0000030f
 0x000055d2f8075500│+0x0050: 0x000003000000030f
 0x000055d2f8075508│+0x0058: 0x0000030000000300
 0x000055d2f8075510│+0x0060: 0x0000030000000300
 0x000055d2f8075518│+0x0068: 0x0000030000000300
 0x000055d2f8075520│+0x0070: 0x000003b0000003b0
 0x000055d2f8075528│+0x0078: 0x000003b0000003b0
 0x000055d2f8075530│+0x0080: 0x000003b0000003b0
 0x000055d2f8075538│+0x0088: 0x000003c6000003b0
 0x000055d2f8075540│+0x0090: 0x000003c6000003c6
 0x000055d2f8075548│+0x0098: 0x000003c6000003c6
 0x000055d2f8075550│+0x00a0: 0x000003c6000003c6
 0x000055d2f8075558│+0x00a8: 0x0000031e0000031e
 0x000055d2f8075560│+0x00b0: 0x0000031e0000031e
 0x000055d2f8075568│+0x00b8: 0x0000031e0000031e
 0x000055d2f8075570│+0x00c0: 0x000000000000031e

    :::

  3. 內容都是二，和上面對比全部都會是兩倍 :::spoiler Result 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    		 
     0x0000563c09e664b0│+0x0000: 0x000007a8000007a8   ← $rdi
 0x0000563c09e664b8│+0x0008: 0x000007a8000007a8
 0x0000563c09e664c0│+0x0010: 0x000007a8000007a8
 0x0000563c09e664c8│+0x0018: 0x000005b0000007a8
 0x0000563c09e664d0│+0x0020: 0x000005b0000005b0
 0x0000563c09e664d8│+0x0028: 0x000005b0000005b0
 0x0000563c09e664e0│+0x0030: 0x000005b0000005b0
 0x0000563c09e664e8│+0x0038: 0x0000061e0000061e
 0x0000563c09e664f0│+0x0040: 0x0000061e0000061e
 0x0000563c09e664f8│+0x0048: 0x0000061e0000061e
 0x0000563c09e66500│+0x0050: 0x000006000000061e
 0x0000563c09e66508│+0x0058: 0x0000060000000600
 0x0000563c09e66510│+0x0060: 0x0000060000000600
 0x0000563c09e66518│+0x0068: 0x0000060000000600
 0x0000563c09e66520│+0x0070: 0x0000076000000760
 0x0000563c09e66528│+0x0078: 0x0000076000000760
 0x0000563c09e66530│+0x0080: 0x0000076000000760
 0x0000563c09e66538│+0x0088: 0x0000078c00000760
 0x0000563c09e66540│+0x0090: 0x0000078c0000078c
 0x0000563c09e66548│+0x0098: 0x0000078c0000078c
 0x0000563c09e66550│+0x00a0: 0x0000078c0000078c
 0x0000563c09e66558│+0x00a8: 0x0000063c0000063c
 0x0000563c09e66560│+0x00b0: 0x0000063c0000063c
 0x0000563c09e66568│+0x00b8: 0x0000063c0000063c
 0x0000563c09e66570│+0x00c0: 0x000000000000063c

    :::

  4. 只有第一個element是1，其他都是零，由結果可知只有七個一數的第一個element會有值，且該值是已經從儲存在原本的執行檔中，比對之後發現一模一樣 :::spoiler Result 
    1
    2
    3
    4
    5
    6
    7
    8
    9
    10
    11
    12
    13
    14
    15
    16
    17
    18
    19
    20
    21
    22
    23
    24
    25
    		 
     0x0000563dd53444b0│+0x0000: 0x000000000000003c ("<"?)    ← $rdi
 0x0000563dd53444b8│+0x0008: 0x0000000000000000
 0x0000563dd53444c0│+0x0010: 0x0000000000000000
 0x0000563dd53444c8│+0x0018: 0x0000007300000000
 0x0000563dd53444d0│+0x0020: 0x0000000000000000
 0x0000563dd53444d8│+0x0028: 0x0000000000000000
 0x0000563dd53444e0│+0x0030: 0x0000000000000000
 0x0000563dd53444e8│+0x0038: 0x000000000000007a ("z"?)
 0x0000563dd53444f0│+0x0040: 0x0000000000000000
 0x0000563dd53444f8│+0x0048: 0x0000000000000000
 0x0000563dd5344500│+0x0050: 0x0000004100000000
 0x0000563dd5344508│+0x0058: 0x0000000000000000
 0x0000563dd5344510│+0x0060: 0x0000000000000000
 0x0000563dd5344518│+0x0068: 0x0000000000000000
 0x0000563dd5344520│+0x0070: 0x0000000000000067 ("g"?)
 0x0000563dd5344528│+0x0078: 0x0000000000000000
 0x0000563dd5344530│+0x0080: 0x0000000000000000
 0x0000563dd5344538│+0x0088: 0x0000007900000000
 0x0000563dd5344540│+0x0090: 0x0000000000000000
 0x0000563dd5344548│+0x0098: 0x0000000000000000
 0x0000563dd5344550│+0x00a0: 0x0000000000000000
 0x0000563dd5344558│+0x00a8: 0x00000000000000fa
 0x0000563dd5344560│+0x00b0: 0x0000000000000000
 0x0000563dd5344568│+0x00b8: 0x0000000000000000
 0x0000563dd5344570│+0x00c0: 0x0000000000000000

    :::

由以上實驗可以大致確認醜不拉基function做的事情就是矩陣乘法，而我們知道他比較的乘法結果，也知道和我們輸入的矩陣相乘的乘數，換言之可以反推回我們應該輸入的東西為何

Exploit

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
 
from pwn import *
from sage.all import *

r = process('./simple-crackme_f5e33c76600e')

flag_len = 49
verify_matrix = Matrix([[0x00010ee0, 0x00010814, 0x00014d06, 0x00015a7c, 0x00012de1, 0x00014a5a, 0x0000f883], 
                       [0x0000df33, 0x0000a7a5, 0x0000e66b, 0x0000e0c8, 0x0000b727, 0x0000eb70, 0x00008d9e], 
                       [0x0000fe08, 0x0000d725, 0x00010163, 0x000101a0, 0x0000c427, 0x00010365, 0x0000afca], 
                       [0x0000db6f, 0x0000dbdf, 0x00010dc3, 0x0000fb36, 0x0000d5c3, 0x00011ae8, 0x0000ddc2], 
                       [0x00011589, 0x0000fbc8, 0x00014000, 0x00011f7f, 0x0001019d, 0x0001567c, 0x0000f435], 
                       [0x00012c8d, 0x0000ff0b, 0x00012caf, 0x00014592, 0x000112ff, 0x00015e64, 0x00010322], 
                       [0x000109f9, 0x0000f002, 0x000115ee, 0x0000fe74, 0x0000d58e, 0x00011306, 0x0000c506]])

ct = Matrix([[0x3C, 0xAD, 0xB9, 0xF5, 0x84, 0x25, 0x94], 
            [0x73, 0xC8, 0x4E, 0x01, 0xAF, 0x04, 0x9B], 
            [0x7A, 0xC8, 0x33, 0x6D, 0x0A, 0x7F, 0xA4], 
            [0x41, 0x8E, 0x12, 0xE1, 0x94, 0x73, 0x37], 
            [0x67, 0x82, 0x60, 0x7F, 0xE9, 0x91, 0x6E], 
            [0x79, 0xBA, 0xEE, 0x09, 0xC1, 0xD0, 0x0B], 
            [0xFA, 0xAD, 0x46, 0x64, 0x10, 0x59, 0x64]])

# flag = [102, 103, 112, 53, 70, 100, 72, 88, 47, 55, 122, 50, 69, 49, 66, 67, 74, 120, 118, 80, 68, 53, 99, 114, 102, 101, 100, 105, 57, 49, 89, 52, 68, 107, 71, 97, 83, 79, 68, 48, 113, 85, 79, 48, 86, 53, 48, 61, 0]

flag = (verify_matrix.transpose() / ct.transpose()).transpose().coefficients()
print(flag)
r.sendline(str(flag_len).encode())
for i in range(len(flag)):
    r.sendline(str(flag[i]).encode())
r.sendline(b'0')
assert r.recvline().strip().decode() == "Correct!"
r.close()

print("Password = " + "".join([chr(i) for i in flag]))

1
2
3
4
5
 
$ python exp.py
[+] Starting local process './simple-crackme_f5e33c76600e': pid 12091
[102, 103, 112, 53, 70, 100, 72, 88, 47, 55, 122, 50, 69, 49, 66, 67, 74, 120, 118, 80, 68, 53, 99, 114, 102, 101, 100, 105, 57, 49, 89, 52, 68, 107, 71, 97, 83, 79, 68, 48, 113, 85, 79, 48, 86, 53, 48, 61]
[*] Stopped process './simple-crackme_f5e33c76600e' (pid 12091)
Password = fgp5FdHX/7z2E1BCJxvPD5crfedi91Y4DkGaSOD0qUO0V50=

最後只要把解出來的東西丟回去revguard就可以拿到真正的flag了 圖片.png

Flag: FLAG{yOu_kn0w_hOw_to_r3v3r53_4_m47riX!}