selph
selph
Published on 2022-11-28 / 326 Visits
0
0

HITCON CTF 2022 Writeup Re-checker

挺有意思的一道题,这里的关键函数是使用的动态生成执行操作,按照特定参数序列进行解密才能正常执行,否则一定会报错异常

checker

一共给了两个文件:checker.exe和checker_drv.sys

是一道驱动逆向的题,查壳,无壳,有签名的Windows 10 x64驱动

先看用户程序checker.exe:

image

逻辑很简单,就是打开符号链接发送IRP请求,控制码是0x222080,没有输入参数,接收1个字节的输出

接下来看驱动程序checker_drv.sys:

image

DriverEntry里面就这么一个函数,进来后,可以看到,先是创建驱动对象和符号链接,然后填充IRP处理函数

接下来往全局变量里填充了映射的内存地址,

  • qword_140013170:里的是dword_140003000函数地址
  • addr_140003030_qword:里的是dword_140003000+48数组地址
  • qword_140013188:里的是sub_140001430函数地址
  • qword_140013180:里的是sub_140001B30函数地址

最后就是一系列异或操作:

image

对qword_140013180里头的前16字节异或了两轮,使用的是qword_140013188里的前32字节的内容

qword_140013180地址的内容:

image

qword_140013188地址的内容:

image

可以看到这两个地址都是函数,这里用一个函数去异或另一个函数emmm

这大概是某种保护手段,阻碍静态分析,真正的函数是运行中动态生成的(实测,异或这两轮的结果并不是可执行的代码)

之前用户程序里看到,传入给驱动了一个控制码,这里到驱动里去看看这个控制码的作用:

image

除了这个控制码,上面还有8个控制码,等会再看

当用户传入0x222080的时候,驱动进入这个分支,如果数组byte_140013190里的8个值均为1,则会跳转到LABEL_21,很显然,这里验证的内容是dword_140003000的开头是否是hitcon,这说明这里会出现flag

byte_140013190的值是在哪里改变的呢?往上看:

image

上面的其他8个控制码分支,分别修改该数组的每一位为1,同时也会执行一个相同的处理函数(参数不同)

随便点进去一个看看:

image

首先是进行了对刚刚那个函数的又一轮异或操作,异或的值取决于函数的参数

然后对qword_140013170地址,也就是dword_140003000数组里的值进行修改,一共修改48个字节,修改方式是调用sub_140001B30函数(被异或了好几轮的那个)

image

最后再次异或一轮

整理一下思路:

  • flag的生成,是在函数中通过调用一个奇怪的东西sub_140001B30生成出来的
  • flag是否完成生产的判定是,是否走完了其他8个控制码的处理分支

那么是不是只需要依次把这8个函数都调用一遍,生成出来的内容就是flag了呢?经测试,根本执行不了,直接报错地址异常,应该是函数异或出来的东西就不是可执行的内容,在Windows 10 x64虚拟机上安装驱动实测则会蓝屏崩溃

这里我卡住了,感觉很接近了,但就是总差一点

休息了一下突然意识到,有没有可能是这8次函数调用的顺序问题?如果程序一定能执行成功的话,就一定能一个一个把8个函数执行出结果

于是经过一番倒腾测试,发现执行一个函数,只有最后一个函数能执行下去,能行,一定是顺序问题,经过又一番测试,得到最终测试顺序,

flag生成:

#include <iostream>
#include <Windows.h>

#define _BYTE BYTE

// qword_140013180 = sub_140001B30
unsigned char* pFunc;
DWORD oldprotect;
typedef BYTE(_cdecl* g_pFunc)(BYTE a);
g_pFunc sub_140001B30;

unsigned char* qword_140013180;



// qword_140013170 = dword_140003000
unsigned char qword_140013170[304] = {
    0x63, 0x60, 0xA5, 0xB9, 0xFF, 0xFC, 0x30, 0x0A, 0x48, 0xBB, 0xFE, 0xFE, 0x32, 0x2C, 0x0A, 0xD6,
    0xE6, 0xFE, 0xFE, 0x32, 0x2C, 0x0A, 0xD6, 0xBB, 0x4A, 0x4A, 0x32, 0x2C, 0xFC, 0xFF, 0x0A, 0xFD,
    0xBB, 0xFE, 0x2C, 0xB9, 0x63, 0xD6, 0xB9, 0x62, 0xD6, 0x0A, 0x4F, 0x00, 0x00, 0x00, 0x00, 0x00,
    0x19, 0xBC, 0x8F, 0x82, 0xD0, 0x2C, 0x61, 0x34, 0xC0, 0x9F, 0xF6, 0x50, 0xD5, 0xFB, 0x0C, 0x6E,
    0xD0, 0xEB, 0xE5, 0xE3, 0xCE, 0xB5, 0x4C, 0xCA, 0x45, 0xAA, 0x11, 0xB2, 0x3E, 0x62, 0x6F, 0x7D,
    0xD0, 0xEB, 0xA9, 0xE3, 0xB2, 0x2F, 0x06, 0x47, 0x7C, 0x28, 0xC5, 0xDE, 0xDE, 0x1A, 0x4E, 0xD6,
    0xD8, 0x2D, 0x93, 0x4F, 0x82, 0x65, 0x64, 0xFD, 0x08, 0x62, 0x4B, 0x87, 0x7E, 0x52, 0x47, 0x30,
    0xB7, 0xBA, 0xD0, 0x39, 0x68, 0x53, 0x50, 0xAB, 0x20, 0xD5, 0xCA, 0x84, 0x26, 0x71, 0x6F, 0x91,
    0x1B, 0x36, 0x46, 0x11, 0xA5, 0xF1, 0x4E, 0x58, 0x6C, 0x74, 0xD4, 0x9C, 0x15, 0xE2, 0x28, 0xD5,
    0xD9, 0x0F, 0x3D, 0x83, 0xF3, 0xFC, 0xD1, 0x13, 0x1A, 0x62, 0x12, 0x40, 0xAA, 0xEA, 0xCD, 0xCB,
    0xE1, 0xC6, 0x08, 0x81, 0x98, 0xF6, 0x68, 0x88, 0xBE, 0x23, 0xB5, 0x9E, 0x55, 0xB9, 0xE2, 0x7D,
    0x5A, 0xDA, 0x39, 0x07, 0xF0, 0x2E, 0x32, 0x20, 0x59, 0x56, 0x4C, 0xB4, 0x8F, 0x3E, 0x07, 0x61,
    0xD9, 0x0F, 0x2D, 0x61, 0xF1, 0x91, 0x33, 0x14, 0xCB, 0x49, 0x68, 0xFE, 0x1F, 0xD4, 0x8A, 0xFE,
    0xE1, 0xC6, 0x18, 0x63, 0x9A, 0x9B, 0x8A, 0x8A, 0x7F, 0x08, 0xC3, 0xE8, 0xE1, 0xEC, 0x0B, 0x8F,
    0x3B, 0x00, 0x94, 0xA5, 0x11, 0xE7, 0x47, 0x66, 0xC4, 0x9F, 0x98, 0x18, 0x70, 0xF0, 0x30, 0xF6,
    0x94, 0x71, 0xB1, 0x95, 0xD1, 0xF0, 0x6F, 0xB7, 0xD9, 0x3D, 0x05, 0x9E, 0xC1, 0x53, 0x33, 0x76,
    0x9B, 0x4B, 0x69, 0xCA, 0xDE, 0xFD, 0x7D, 0x67, 0xB8, 0x29, 0x2B, 0xC7, 0xC5, 0x84, 0x2C, 0xD1,
    0x87, 0x87, 0xF1, 0x98, 0x97, 0x74, 0xAD, 0x4B, 0x32, 0xF0, 0x4A, 0x51, 0x72, 0xEA, 0x09, 0xF7,
    0x38, 0xFD, 0x27, 0xBD, 0x1C, 0x52, 0x71, 0x43, 0x95, 0x9C, 0x1A, 0x86, 0xF2, 0xC0, 0xF9, 0xF8
};

// addr_140003030_qword = dword_140003030
unsigned char* qword_140003030 = qword_140013170 + 48;

// qword_140013188 = sub_140001430
void init() {
    unsigned char sub_140001B30_init[20] = {
     0x80, 0xE9, 0x22, 0x80, 0xF1, 0xAD, 0x0F, 0xB6, 0xC1, 0x6B, 0xC8, 0x11, 0xB8, 0x9E, 0x00, 0x00,
     0x00, 0x2A, 0xC1, 0xC3
    };
    unsigned char sub_140001430[88] = {
    0x40, 0x53, 0x48, 0x83, 0xEC, 0x20, 0x48, 0x8B, 0x05, 0x3B, 0x0C, 0x00, 0x00, 0x48, 0x8B, 0xDA,
    0x48, 0x8B, 0x4A, 0x10, 0x48, 0x39, 0x08, 0x75, 0x37, 0x48, 0x8B, 0x4A, 0x08, 0xFF, 0x15, 0x1D,
    0x0C, 0x00, 0x00, 0x48, 0x8D, 0x0D, 0x16, 0x1D, 0x00, 0x00, 0x80, 0x3C, 0x08, 0x00, 0x74, 0x20,
    0x8B, 0x03, 0x83, 0xF8, 0x01, 0x74, 0x05, 0x83, 0xF8, 0x02, 0x75, 0x14, 0x48, 0x8B, 0x4B, 0x20,
    0x8B, 0x41, 0x04, 0x83, 0xE0, 0x01, 0x84, 0xC0, 0x74, 0x06, 0xC7, 0x01, 0x00, 0x00, 0x00, 0x00,
    0x33, 0xC0, 0x48, 0x83, 0xC4, 0x20, 0x5B, 0xC3
    };
  
    pFunc = (unsigned char*)malloc(20);
    VirtualProtect((LPVOID)pFunc, 20, PAGE_EXECUTE_READWRITE, &oldprotect);
    memcpy(pFunc, sub_140001B30_init, 20);
    sub_140001B30 = (g_pFunc)pFunc;
    qword_140013180 = pFunc;
    for (int i = 0, j = 0; i < 32; i++,j++)
    {
        if (j == 16)j = 0;
        pFunc[j] ^= sub_140001430[i];
    }
}


void __fastcall sub_1400014D0(unsigned int a1)
{
    __int64 v1; // rdi
    char* v3; // rbx
    unsigned char * v4; // rbx
    unsigned char * v5; // rbx
    unsigned char * v6; // rbx
    unsigned char * v7; // rbx
    unsigned char * v8; // rbx
    unsigned char * v9; // rbx
    unsigned char * v10; // rbx
    unsigned char * v11; // rbx
    unsigned char * v12; // rbx
    unsigned char * v13; // rbx
    unsigned char * v14; // rbx
    unsigned char * v15; // rbx
    unsigned char * v16; // rbx
    unsigned char * v17; // rbx
    unsigned char * v18; // rbx
    unsigned char * v19; // rbx
    unsigned char * v20; // rbx
    unsigned char * v21; // rbx
    unsigned char * v22; // rbx
    unsigned char * v23; // rbx
    unsigned char * v24; // rbx
    unsigned char * v25; // rbx
    unsigned char * v26; // rbx
    unsigned char * v27; // rbx
    unsigned char * v28; // rbx
    unsigned char * v29; // rbx
    unsigned char * v30; // rbx
    unsigned char * v31; // rbx
    unsigned char * v32; // rbx
    unsigned char * v33; // rbx
    unsigned char * v34; // rbx
    unsigned char * v35; // rbx
    unsigned char * v36; // rbx
    unsigned char * v37; // rbx
    unsigned char * v38; // rbx
    unsigned char * v39; // rbx
    unsigned char * v40; // rbx
    unsigned char * v41; // rbx
    unsigned char * v42; // rbx
    unsigned char * v43; // rbx
    unsigned char * v44; // rbx
    unsigned char * v45; // rbx

    v1 = a1;
    *(_BYTE*)qword_140013180 ^= *(_BYTE*)(v1 + qword_140003030);// 修改这16个值,dword_140003000+48
    *(_BYTE*)(qword_140013180 + 1) ^= *(_BYTE*)((unsigned int)(v1 + 1) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 2) ^= *(_BYTE*)((unsigned int)(v1 + 2) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 3) ^= *(_BYTE*)((unsigned int)(v1 + 3) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 4) ^= *(_BYTE*)((unsigned int)(v1 + 4) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 5) ^= *(_BYTE*)((unsigned int)(v1 + 5) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 6) ^= *(_BYTE*)((unsigned int)(v1 + 6) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 7) ^= *(_BYTE*)((unsigned int)(v1 + 7) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 8) ^= *(_BYTE*)((unsigned int)(v1 + 8) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 9) ^= *(_BYTE*)((unsigned int)(v1 + 9) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 10) ^= *(_BYTE*)((unsigned int)(v1 + 10) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 11) ^= *(_BYTE*)((unsigned int)(v1 + 11) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 12) ^= *(_BYTE*)((unsigned int)(v1 + 12) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 13) ^= *(_BYTE*)((unsigned int)(v1 + 13) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 14) ^= *(_BYTE*)((unsigned int)(v1 + 14) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 15) ^= *(_BYTE*)((unsigned int)(v1 + 15) + qword_140003030);
    v3 = (char*)qword_140013170;                 // 修改这43字节,通过函数1B30(1B30是被篡改过的函数)
    *v3 = sub_140001B30(*(_BYTE*)qword_140013170);
    v4 = qword_140013170;
    *(_BYTE*)(v4 + 1) = sub_140001B30(*(_BYTE*)(qword_140013170 + 1));
    v5 = qword_140013170;
    *(_BYTE*)(v5 + 2) = sub_140001B30(*(_BYTE*)(qword_140013170 + 2));
    v6 = qword_140013170;
    *(_BYTE*)(v6 + 3) = sub_140001B30(*(_BYTE*)(qword_140013170 + 3));
    v7 = qword_140013170;
    *(_BYTE*)(v7 + 4) = sub_140001B30(*(_BYTE*)(qword_140013170 + 4));
    v8 = qword_140013170;
    *(_BYTE*)(v8 + 5) = sub_140001B30(*(_BYTE*)(qword_140013170 + 5));
    v9 = qword_140013170;
    *(_BYTE*)(v9 + 6) = sub_140001B30(*(_BYTE*)(qword_140013170 + 6));
    v10 = qword_140013170;
    *(_BYTE*)(v10 + 7) = sub_140001B30(*(_BYTE*)(qword_140013170 + 7));
    v11 = qword_140013170;
    *(_BYTE*)(v11 + 8) = sub_140001B30(*(_BYTE*)(qword_140013170 + 8));
    v12 = qword_140013170;
    *(_BYTE*)(v12 + 9) = sub_140001B30(*(_BYTE*)(qword_140013170 + 9));
    v13 = qword_140013170;
    *(_BYTE*)(v13 + 10) = sub_140001B30(*(_BYTE*)(qword_140013170 + 10));
    v14 = qword_140013170;
    *(_BYTE*)(v14 + 11) = sub_140001B30(*(_BYTE*)(qword_140013170 + 11));
    v15 = qword_140013170;
    *(_BYTE*)(v15 + 12) = sub_140001B30(*(_BYTE*)(qword_140013170 + 12));
    v16 = qword_140013170;
    *(_BYTE*)(v16 + 13) = sub_140001B30(*(_BYTE*)(qword_140013170 + 13));
    v17 = qword_140013170;
    *(_BYTE*)(v17 + 14) = sub_140001B30(*(_BYTE*)(qword_140013170 + 14));
    v18 = qword_140013170;
    *(_BYTE*)(v18 + 15) = sub_140001B30(*(_BYTE*)(qword_140013170 + 15));
    v19 = qword_140013170;
    *(_BYTE*)(v19 + 16) = sub_140001B30(*(_BYTE*)(qword_140013170 + 16));
    v20 = qword_140013170;
    *(_BYTE*)(v20 + 17) = sub_140001B30(*(_BYTE*)(qword_140013170 + 17));
    v21 = qword_140013170;
    *(_BYTE*)(v21 + 18) = sub_140001B30(*(_BYTE*)(qword_140013170 + 18));
    v22 = qword_140013170;
    *(_BYTE*)(v22 + 19) = sub_140001B30(*(_BYTE*)(qword_140013170 + 19));
    v23 = qword_140013170;
    *(_BYTE*)(v23 + 20) = sub_140001B30(*(_BYTE*)(qword_140013170 + 20));
    v24 = qword_140013170;
    *(_BYTE*)(v24 + 21) = sub_140001B30(*(_BYTE*)(qword_140013170 + 21));
    v25 = qword_140013170;
    *(_BYTE*)(v25 + 22) = sub_140001B30(*(_BYTE*)(qword_140013170 + 22));
    v26 = qword_140013170;
    *(_BYTE*)(v26 + 23) = sub_140001B30(*(_BYTE*)(qword_140013170 + 23));
    v27 = qword_140013170;
    *(_BYTE*)(v27 + 24) = sub_140001B30(*(_BYTE*)(qword_140013170 + 24));
    v28 = qword_140013170;
    *(_BYTE*)(v28 + 25) = sub_140001B30(*(_BYTE*)(qword_140013170 + 25));
    v29 = qword_140013170;
    *(_BYTE*)(v29 + 26) = sub_140001B30(*(_BYTE*)(qword_140013170 + 26));
    v30 = qword_140013170;
    *(_BYTE*)(v30 + 27) = sub_140001B30(*(_BYTE*)(qword_140013170 + 27));
    v31 = qword_140013170;
    *(_BYTE*)(v31 + 28) = sub_140001B30(*(_BYTE*)(qword_140013170 + 28));
    v32 = qword_140013170;
    *(_BYTE*)(v32 + 29) = sub_140001B30(*(_BYTE*)(qword_140013170 + 29));
    v33 = qword_140013170;
    *(_BYTE*)(v33 + 30) = sub_140001B30(*(_BYTE*)(qword_140013170 + 30));
    v34 = qword_140013170;
    *(_BYTE*)(v34 + 31) = sub_140001B30(*(_BYTE*)(qword_140013170 + 31));
    v35 = qword_140013170;
    *(_BYTE*)(v35 + 32) = sub_140001B30(*(_BYTE*)(qword_140013170 + 32));
    v36 = qword_140013170;
    *(_BYTE*)(v36 + 33) = sub_140001B30(*(_BYTE*)(qword_140013170 + 33));
    v37 = qword_140013170;
    *(_BYTE*)(v37 + 34) = sub_140001B30(*(_BYTE*)(qword_140013170 + 34));
    v38 = qword_140013170;
    *(_BYTE*)(v38 + 35) = sub_140001B30(*(_BYTE*)(qword_140013170 + 35));
    v39 = qword_140013170;
    *(_BYTE*)(v39 + 36) = sub_140001B30(*(_BYTE*)(qword_140013170 + 36));
    v40 = qword_140013170;
    *(_BYTE*)(v40 + 37) = sub_140001B30(*(_BYTE*)(qword_140013170 + 37));
    v41 = qword_140013170;
    *(_BYTE*)(v41 + 38) = sub_140001B30(*(_BYTE*)(qword_140013170 + 38));
    v42 = qword_140013170;
    *(_BYTE*)(v42 + 39) = sub_140001B30(*(_BYTE*)(qword_140013170 + 39));
    v43 = qword_140013170;
    *(_BYTE*)(v43 + 40) = sub_140001B30(*(_BYTE*)(qword_140013170 + 40));
    v44 = qword_140013170;
    *(_BYTE*)(v44 + 41) = sub_140001B30(*(_BYTE*)(qword_140013170 + 41));
    v45 = qword_140013170;
    *(_BYTE*)(v45 + 42) = sub_140001B30(*(_BYTE*)(qword_140013170 + 42));
    *(_BYTE*)qword_140013180 ^= *(_BYTE*)((unsigned int)(v1 + 16) + qword_140003030);// 然后再次修改这16个值
    *(_BYTE*)(qword_140013180 + 1) ^= *(_BYTE*)((unsigned int)(v1 + 17) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 2) ^= *(_BYTE*)((unsigned int)(v1 + 18) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 3) ^= *(_BYTE*)((unsigned int)(v1 + 19) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 4) ^= *(_BYTE*)((unsigned int)(v1 + 20) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 5) ^= *(_BYTE*)((unsigned int)(v1 + 21) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 6) ^= *(_BYTE*)((unsigned int)(v1 + 22) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 7) ^= *(_BYTE*)((unsigned int)(v1 + 23) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 8) ^= *(_BYTE*)((unsigned int)(v1 + 24) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 9) ^= *(_BYTE*)((unsigned int)(v1 + 25) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 10) ^= *(_BYTE*)((unsigned int)(v1 + 26) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 11) ^= *(_BYTE*)((unsigned int)(v1 + 27) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 12) ^= *(_BYTE*)((unsigned int)(v1 + 28) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 13) ^= *(_BYTE*)((unsigned int)(v1 + 29) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 14) ^= *(_BYTE*)((unsigned int)(v1 + 30) + qword_140003030);
    *(_BYTE*)(qword_140013180 + 15) ^= *(_BYTE*)((unsigned int)(v1 + 31) + qword_140003030);
}
int main()
{
    // 得到修改后的函数,可能是干扰动态调试的
    init();
    // 顺序问题!!按照特定顺序执行才能运行成功
    sub_1400014D0(0xE0);    // 1
    sub_1400014D0(0x40);    // 2
    sub_1400014D0(0xC0);    // 3
    sub_1400014D0(0x00);    // 4
    sub_1400014D0(0x20);    // 5

    sub_1400014D0(0x80);    // 6
    sub_1400014D0(0x60);    // 

    sub_1400014D0(0xA0);    // 

    printf("%s", qword_140013170);
}

运行结果:hitcon


Comment