--- //此为静态联编,当 *p 定为 A 类型时,默认A -> HaHa() 调用 A 类里的函数;则两个都输出 233 ; //当父类A里函数用 virtual 修饰时为动态联编,两个分别输出 233 和 lol; A a; B b; A *p = NULL; A = &a; A -> HaHa(); A = &b; A -> HaHa();
My plaintext has been encrypted by an innocent friend of mine while playing around cryptographic libraries, can you help me to recover the plaintext , remembers it’s just numbers and there’s a space between some numbers which you need to remove the space and submit the recovered plain text as a flag.
开始一个upx直接脱掉;
搜索运行时的字符串得到flag:flag{32117406899806798980909}
WrongDownload
My key has been missing inside these two binaries can you help me to find it out ,as per my friend the key is divided in two parts between the two binaries so, remember you need to join them up before submitting as a flag.
make mdriver mdriver.o mm.o memlib.o fsecs.o fcyc.o clock.o ftimer.o
以上两个出错请用下面指令解决;
1
sudo apt-get install gcc-multilib
下载出错请更新镜像,或者添加清华园下载路径:
1 2
deb http://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free deb-src https://mirrors.tuna.tsinghua.edu.cn/kali kali-rolling main contrib non-free
ans = 'this is answer''''比较数据''' hexs = '0123456789abcdef-''''约束范围,输入其他的程序会提前退出''' hexs = list(hexs) for i inrange(17): hexs[i] = ord(hexs[i])
real_flag="flag{" cur_index = 5'''当前位置''' k = 0
while cur_index < 42: for i in hexs: real_flag_arr = [0] * 42
for j inrange(len(real_flag)): '''爆破储存位置''' real_flag_arr[j] = ord(real_flag[j]) real_flag_arr[len(real_flag_arr)-1] = ord("}")
for j inrange(len(real_flag_arr)-2,cur_index,-1): real_flag_arr[j] = 48'''未知位填充0''' real_flag_arr[cur_index] = i real_flag_arr_s = ''.join(chr(k) for k in real_flag_arr) p = subprocess.Popen(["C:\\Users\\Second_BC\\Desktop\\analgo.exe"], stdin=subprocess.PIPE, stdout=subprocess.PIPE, stderr=subprocess.PIPE) p.stdin.write(real_flag_arr_s.encode()) '''输入程序''' p.stdin.close() out = p.stdout.read() '''读取输出''' out = list(out)
if (out[k] == ans[k] ): real_flag += chr(i) k += 1 cur_index += 1 print(real_flag) break
/* Redirect stderr to stdout (so that driver will get all output * on the pipe connected to stdout) */ dup2(1, 2);
/* Parse the command line */ while ((c = getopt(argc, argv, "hvp")) != EOF) { switch (c) { case'h': /* print help message */ usage(); break; case'v': /* emit additional diagnostic info */ verbose = 1; break; case'p': /* don't print a prompt */ emit_prompt = 0; /* handy for automatic testing */ break; default: usage(); } }
/* Install the signal handlers */
/* These are the ones you will need to implement */ Signal(SIGINT, sigint_handler); /* ctrl-c */ Signal(SIGTSTP, sigtstp_handler); /* ctrl-z */ Signal(SIGCHLD, sigchld_handler); /* Terminated or stopped child */
/* This one provides a clean way to kill the shell */ Signal(SIGQUIT, sigquit_handler);
/* Initialize the job list */ initjobs(jobs);
/* Execute the shell's read/eval loop */ while (1) {
/* Read command line */ if (emit_prompt) { printf("%s", prompt); fflush(stdout); } if ((fgets(cmdline, MAXLINE, stdin) == NULL) && ferror(stdin)) app_error("fgets error"); if (feof(stdin)) { /* End of file (ctrl-d) */ fflush(stdout); exit(0); }
/* Evaluate the command line */ eval(cmdline); fflush(stdout); fflush(stdout); }
while (simulation.active or simulation.unconstrained) and (not simulation.found): # for unconstrained_state in simulation.unconstrained: defshould_move(s): return s is unconstrained_state simulation.move('unconstrained', 'found', filter_func=should_move) # 保存
simulation.step() # 步进执行
if simulation.found: solution_state = simulation.found[0]
voidread_image_file(FILE* file) { /* the origin tells us where in memory to place the image */ uint16_t origin; fread(&origin, sizeof(origin), 1, file); origin = swap16(origin);
/* we know the maximum file size so we only need one fread */ uint16_t max_read = UINT16_MAX - origin; uint16_t* p = memory + origin; size_t read = fread(p, sizeof(uint16_t), max_read, file);
/* swap to little endian */ while (read-- > 0) { *p = swap16(*p); ++p; } }
/* since exactly one condition flag should be set at any given time, set the Z flag */ reg[R_COND] = FL_ZRO;
/* set the PC to starting position */ /* 0x3000 is the default */ enum { PC_START = 0x3000 }; reg[R_PC] = PC_START;
int running = 1; while (running) { /* FETCH */ uint16_t instr = mem_read(reg[R_PC]++); uint16_t op = instr >> 12;
switch (op) { case OP_ADD: {代码6-1} break; case OP_AND: {代码6-2} break; case OP_NOT: {代码6-3} break; case OP_BR: {代码6-4} break; case OP_JMP: {代码6-5} break; case OP_JSR: {代码6-6} break; case OP_LD: {代码6-7} break; case OP_LDI: {代码6-8} break; case OP_LDR: {代码6-9} break; case OP_LEA: {代码6-10} break; case OP_ST: {代码6-11} break; case OP_STI: {代码6-12} break; case OP_STR: {代码6-13} break; case OP_TRAP: {代码6-15} break; case OP_RES: case OP_RTI: default: abort(); break; } } {代码7-4} }
enum { TRAP_GETC = 0x20, /* get character from keyboard, not echoed onto the terminal */ TRAP_OUT = 0x21, /* output a character */ TRAP_PUTS = 0x22, /* output a word string */ TRAP_IN = 0x23, /* get character from keyboard, echoed onto the terminal */ TRAP_PUTSP = 0x24, /* output a byte string */ TRAP_HALT = 0x25/* halt the program */ };
switch (instr & 0xFF) { case TRAP_GETC: {代码6-16} break; case TRAP_OUT: {代码6-17} break; case TRAP_PUTS: {代码6-18} break; case TRAP_IN: {代码6-19} break; case TRAP_PUTSP: {代码6-20} break; case TRAP_HALT: {代码6-21} break; }
trap指令清单:
代码6-16:输入字符
1 2 3 4 5
{ /* read a single ASCII char */ reg[R_R0] = (uint16_t)getchar(); update_flags(R_R0); }
{ /* one char per word */ uint16_t* c = memory + reg[R_R0]; while (*c) { putc((char)*c, stdout); ++c; } fflush(stdout); }
代码6-19:准备输入字符
1 2 3 4 5 6 7 8
{ printf("Enter a character: "); char c = getchar(); putc(c, stdout); fflush(stdout); reg[R_R0] = (uint16_t)c; update_flags(R_R0); }
代码6-20:输出字符串
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15
{ /* one char per byte (two bytes per word) here we need to swap back to big endian format */ uint16_t* c = memory + reg[R_R0]; while (*c) { char char1 = (*c) & 0xFF; putc(char1, stdout); char char2 = (*c) >> 8; if (char2) putc(char2, stdout); ++c; } fflush(stdout); }
代码6-21:终止程序
1 2 3 4 5
{ puts("HALT"); fflush(stdout); running = 0; }
7. 头部添加以及windows加入API
加入的头部:
代码7-1:
1 2 3 4 5 6 7 8 9 10 11 12 13
#include<stdio.h> #include<stdlib.h> #include<stdint.h> #include<stdint.h>// uint16_t #include<stdio.h>// FILE #include<signal.h>// SIGINT /* windows only */ #include<Windows.h> #include<conio.h>// _kbhit
voiddisable_input_buffering() { hStdin = GetStdHandle(STD_INPUT_HANDLE); GetConsoleMode(hStdin, &fdwOldMode); /* save old mode */ fdwMode = fdwOldMode ^ ENABLE_ECHO_INPUT /* no input echo */ ^ ENABLE_LINE_INPUT; /* return when one or more characters are available */ SetConsoleMode(hStdin, fdwMode); /* set new mode */ FlushConsoleInputBuffer(hStdin); /* clear buffer */ }