[Python知识库]2021巅峰极客ichunqiu_baby-maze

2021巅峰极客ichunqiu_baby-maze

题目来源和附件

Written by Poilzero（blog：poilzero.sipc115.club）

• 同步转发到简书和CSDN

题目来源：

• 2021巅峰极客网络安全技能挑战赛
• reverse方向
• baby_maze

个人解题目录和部分所需程序（含题目附件）：

https://poil.lanzoui.com/iOpu1s329mj

思路

程序逻辑

• 迷宫，输入WASD进行方向移动，Q是退出。
• 答案就是flag{md(输入的WASD组合)}

摸索尝试

因为找不到地图数据，也想换一个思路做题，于是一开始尝试从sub_54DD7E开始逆推，存在多分枝，放弃。

然后尝试爆破但是遇到subprocess不能实时IO的问题，如果按照我之前的写法进程执行完读取全部缓冲区处理感觉速度爆炸，后发觉逆推回去可控，而且可以用ida python正好练练手。

先试了试手推了28位，后放弃 SDD SSA ASS SSS SDD SSA ASS SSS SSS D 原因是地图太大，无法手动逆推，地图规模预计100x100。

正确思路

后来想到一种方法，觉得可行性比较大就是使用ida python编写脚本代替手推

伪代码如下，因为api还不是很熟可能写了很久，边学边写的，当然也可以写一起，我不太熟所以分开写了

marked_block = []
def find_path(now_block):
    if now_block == start_block:
        return
    for x in now_block.xref_block():
        if not(x in marked_block):
            marked_block.append(x) 
            find_path(x)
            
if __name__ == '__main__': 
     res_block = FuncBlock(addr=0x054DE35)
     find_path(res_block)
     print(marked_block)

EXP

requirement

• IDA Pro 7.0
• IDA Python

得到正确路径

# coding:utf-8

def fm(s):
    return hex(s)

# after input 13 S
# sub_42360E()
start_block     = 0x40187C
queue_call_refs = []
def find_path(callee_addr, queue_call):
    # print(hex(callee_addr))
    '''
        0x53cdaeL
        0x53ce65L
        bad circle
    '''
    if callee_addr == start_block:
        print '[+] ' + str(len(queue_call))
        print '[+] Path found:\n' + '-'.join(queue_call)
        print '[+] Path refs:\n' + '-'.join(queue_call_refs)
        return

    # for x in now_block.xref_block():
    for refs_addr in idautils.CodeRefsTo(callee_addr, 0):
        caller_name = GetFunctionName(refs_addr)
        caller_addr = LocByName(caller_name)

        if fm(caller_addr) in queue_call:
            continue

        queue_call.append(fm(caller_addr))
        queue_call_refs.append(fm(refs_addr))
        try:
            find_path(caller_addr, queue_call)
        except BaseException,e:
            print e
        queue_call.remove(fm(caller_addr))
        queue_call_refs.remove(fm(refs_addr))

print '\n'*0x10000
print '[+] start to search'
res_block = 0x054DE35
ls = []
find_path(res_block, ls)
print '[+] end for search'

路径转换为WASD

s, s1为上一个脚本输出的结果

# coding:utf-8

s = '0x54dd7eL-0x54dcc7L-0x54dc10L-0x5490e9L-0x547f0eL-0x547fc1L-0x548078L-0x543df5L-0x54265eL-0x53e76eL-0x53cfd7L-0x538e0fL-0x537b79L-0x537ac2L-0x537a0bL-0x5339a9L-0x532212L-0x5322c9L-0x532380L-0x52e287L-0x52c8cbL-0x5289e3L-0x527303L-0x52340bL-0x521d2bL-0x51de3bL-0x51c5edL-0x51c536L-0x51c47fL-0x51c3c8L-0x51c311L-0x51c25aL-0x51c1a3L-0x51dd84L-0x521a4bL-0x521994L-0x5218ddL-0x51dccdL-0x51c0ecL-0x518656L-0x5169baL-0x512cfbL-0x51128cL-0x5111d5L-0x51111eL-0x511067L-0x510fb4L-0x50d5c5L-0x50b9dcL-0x50b925L-0x50b86eL-0x50b7b7L-0x50b700L-0x50b649L-0x50b592L-0x50b4dbL-0x50b424L-0x507c6eL-0x505e68L-0x502759L-0x50050dL-0x4fcf5cL-0x4fb209L-0x4fb2c0L-0x4fb377L-0x4f7826L-0x4f5c45L-0x4f5b8eL-0x4f5ad7L-0x4f5a20L-0x4f5969L-0x4f58b2L-0x4f57fbL-0x4f1e1cL-0x4f0188L-0x4ec854L-0x4ea772L-0x4ea6bbL-0x4ea608L-0x4ea551L-0x4ea49aL-0x4ec6e6L-0x4f0016L-0x4f1d65L-0x4f55d6L-0x4f568dL-0x4f5744L-0x4f776fL-0x4faf2dL-0x4fae76L-0x4fadbfL-0x4fad08L-0x4fac51L-0x4f76b8L-0x4f551fL-0x4f1caeL-0x4eff5fL-0x4ec62fL-0x4ea3e3L-0x4ea32cL-0x4ea275L-0x4ec578L-0x4efea8L-0x4efdf1L-0x4efd3aL-0x4efc83L-0x4efbccL-0x4ec4c1L-0x4ea103L-0x4ea04cL-0x4e9f99L-0x4e9ee2L-0x4e9e2bL-0x4e9d74L-0x4e9cc1L-0x4e6cd4L-0x4e4c99L-0x4e4d50L-0x4e4e07L-0x4e19d0L-0x4df119L-0x4df062L-0x4defabL-0x4dc2aaL-0x4d97d2L-0x4d9885L-0x4d993cL-0x4d6a0eL-0x4d4370L-0x4d1010L-0x4ceadcL-0x4ceb93L-0x4cbaebL-0x4c972dL-0x4c9676L-0x4c651bL-0x4c40a6L-0x4c3fefL-0x4c3f3cL-0x4c0e98L-0x4be8b5L-0x4bb3cfL-0x4b917fL-0x4b90c8L-0x4b9015L-0x4b8f5eL-0x4b8ea7L-0x4b8df0L-0x4b8d39L-0x4b5d60L-0x4b355cL-0x4b0411L-0x4ade2aL-0x4add73L-0x4adcc0L-0x4adc09L-0x4adb52L-0x4aad8aL-0x4a8410L-0x4a56ffL-0x4a305dL-0x4a2fa6L-0x4a2eefL-0x49ffbdL-0x49d59cL-0x49a88fL-0x497e62L-0x495214L-0x4927e3L-0x49272cL-0x492675L-0x48f802L-0x48d0b1L-0x48cffaL-0x48cf43L-0x48ce8cL-0x48cdd5L-0x48a45bL-0x487255L-0x484b10L-0x481dfbL-0x481d44L-0x481c91L-0x47f264L-0x47c6c5L-0x47c60eL-0x47c557L-0x47c4a0L-0x47c3e9L-0x47c332L-0x47c27bL-0x47c1c4L-0x47c111L-0x4799c0L-0x476a96L-0x4769dfL-0x476928L-0x474345L-0x471088L-0x470fd1L-0x470f1aL-0x47428eL-0x476871L-0x4767baL-0x476703L-0x47664cL-0x476599L-0x4741d7L-0x470da8L-0x470cf1L-0x470c3aL-0x470b83L-0x470accL-0x46ea99L-0x46b4f4L-0x469363L-0x465f34L-0x465febL-0x4660a2L-0x4638a6L-0x460980L-0x45e22bL-0x45b0d4L-0x458c57L-0x45599eL-0x453255L-0x4505ebL-0x450534L-0x45047dL-0x45319eL-0x4558e7L-0x458ba0L-0x45b021L-0x45af6aL-0x45aeb3L-0x45e0bdL-0x46080eL-0x4637efL-0x465e81L-0x465dcaL-0x465d13L-0x4691f5L-0x46b386L-0x46e92bL-0x47095eL-0x474069L-0x476206L-0x47614fL-0x476098L-0x473fb2L-0x4708a7L-0x46e874L-0x46b2cfL-0x46913eL-0x465c5cL-0x463738L-0x4605e9L-0x4606a0L-0x460757L-0x45e006L-0x45adfcL-0x458ae9L-0x4556c2L-0x455779L-0x455830L-0x4530e7L-0x4503c6L-0x45030fL-0x450258L-0x44de8aL-0x44a9acL-0x44a8f5L-0x44a83eL-0x44a787L-0x44a6d4L-0x44a61dL-0x44a566L-0x44a4afL-0x44a3f8L-0x44a341L-0x44a28aL-0x448490L-0x444d89L-0x442a86L-0x43f4e1L-0x43f598L-0x43f64fL-0x442b3dL-0x444e40L-0x444ef7L-0x444faeL-0x442bf4L-0x43f706L-0x43d575L-0x439d08L-0x439dbfL-0x439e76L-0x437d90L-0x43496dL-0x432441L-0x42f00aL-0x42d08eL-0x429db9L-0x429e70L-0x429f27L-0x429fdeL-0x42a095L-0x4279f3L-0x4247e5L-0x42472eL-0x424677L-0x4245c0L-0x424509L-0x42242fL-0x41ed2cL-0x41c8bfL-0x419547L-0x417520L-0x413e15L-0x411d2bL-0x40e565L-0x40c812L-0x408ef6L-0x408e3fL-0x408d88L-0x406bf3L-0x402b06L-0x402a4fL-0x40299cL-0x406b3cL-0x408cd1L-0x40c75bL-0x40e340L-0x40e3f7L-0x40e4aeL-0x411c74L-0x413d5eL-0x413ca7L-0x413bf0L-0x413b39L-0x413a82L-0x417469L-0x4191b4L-0x41926bL-0x419322L-0x4193d9L-0x419490L-0x41c808L-0x41ec75L-0x41ebbeL-0x41eb07L-0x41ea50L-0x41e99dL-0x41e8e6L-0x41e82fL-0x4222c1L-0x4240c3L-0x42400cL-0x423f55L-0x423e9eL-0x423debL-0x42220aL-0x41e6bdL-0x41e606L-0x41e54fL-0x422153L-0x423d34L-0x427717L-0x429693L-0x4295dcL-0x429525L-0x427660L-0x423c7dL-0x42209cL-0x41e498L-0x41e3e1L-0x41e32eL-0x41c69aL-0x418b45L-0x418bfcL-0x418cb3L-0x41718dL-0x413638L-0x411998L-0x40de3bL-0x40c3c8L-0x408666L-0x40871dL-0x4087d4L-0x40c47fL-0x40def2L-0x411a4fL-0x4136efL-0x4137a2L-0x413859L-0x4172fbL-0x418e25L-0x418edcL-0x418f93L-0x419046L-0x4190fdL-0x4173b2L-0x4139cbL-0x411bbdL-0x40e11bL-0x40e1d2L-0x40e289L-0x40c6a4L-0x408c1aL-0x408b63L-0x408aacL-0x406a85L-0x402773L-0x4026bcL-0x402605L-0x40254eL-0x40249bL-0x4023e4L-0x40232dL-0x402276L-0x4021bfL-0x402108L-0x402051L-0x401f9aL-0x401ee3L-0x401e2cL-0x401d79L-0x401cc2L-0x401c0fL-0x401b58L-0x401aa1L-0x4019eaL-0x401933L-0x4067a9L-0x407ff7L-0x4080aaL-0x408161L-0x40c25aL-0x40d93aL-0x40d9f1L-0x40daa8L-0x4116bcL-0x413358L-0x416f68L-0x418869L-0x4187b2L-0x4186fbL-0x418644L-0x41858dL-0x4184d6L-0x418423L-0x416eb1L-0x413078L-0x41154eL-0x40d7ccL-0x40c0ecL-0x407f40L-0x4066f2L-0x40187cL'

s2 = '0x54de16L-0x54dd51L-0x54dc96L-0x54917dL-0x547f9eL-0x548063L-0x54811aL-0x543e89L-0x5426f2L-0x53e802L-0x53d06bL-0x538ea3L-0x537c11L-0x537b4cL-0x537a91L-0x533a3dL-0x5322a6L-0x53236bL-0x532422L-0x52e31bL-0x52c95fL-0x528a77L-0x527397L-0x52349fL-0x521dbfL-0x51decfL-0x51c685L-0x51c5c0L-0x51c509L-0x51c452L-0x51c39bL-0x51c2e4L-0x51c22dL-0x51de00L-0x521ac7L-0x521a1eL-0x521963L-0x51dd61L-0x51c180L-0x5186eaL-0x516a4eL-0x512d8fL-0x511324L-0x51125fL-0x5111a8L-0x5110f1L-0x51103aL-0x50d659L-0x50ba74L-0x50b9afL-0x50b8f8L-0x50b841L-0x50b78aL-0x50b6d3L-0x50b61cL-0x50b565L-0x50b4aaL-0x507d02L-0x505efcL-0x5027edL-0x50059dL-0x4fcff0L-0x4fb29dL-0x4fb362L-0x4fb419L-0x4f78baL-0x4f5cddL-0x4f5c18L-0x4f5b61L-0x4f5aaaL-0x4f59f3L-0x4f593cL-0x4f5881L-0x4f1eb0L-0x4f0218L-0x4ec8e8L-0x4ea80aL-0x4ea745L-0x4ea692L-0x4ea5dbL-0x4ea524L-0x4ec762L-0x4f0092L-0x4f1de1L-0x4f5652L-0x4f572fL-0x4f57e6L-0x4f77ebL-0x4fafa9L-0x4faf00L-0x4fae49L-0x4fad92L-0x4facd7L-0x4f774cL-0x4f55b3L-0x4f1d42L-0x4efff3L-0x4ec6c3L-0x4ea47bL-0x4ea3b6L-0x4ea2ffL-0x4ec5f4L-0x4eff24L-0x4efe7bL-0x4efdc4L-0x4efd0dL-0x4efc52L-0x4ec555L-0x4ea19bL-0x4ea0d6L-0x4ea023L-0x4e9f6cL-0x4e9eb5L-0x4e9dfeL-0x4e9d47L-0x4e6d68L-0x4e4d2dL-0x4e4df2L-0x4e4ea9L-0x4e1a64L-0x4df1b1L-0x4df0ecL-0x4df031L-0x4dc33eL-0x4d9862L-0x4d9927L-0x4d99deL-0x4d6aa2L-0x4d4404L-0x4d10a4L-0x4ceb70L-0x4cec35L-0x4cbb7fL-0x4c97c5L-0x4c96fcL-0x4c65afL-0x4c413eL-0x4c4079L-0x4c3fc2L-0x4c0f2cL-0x4be949L-0x4bb463L-0x4b9217L-0x4b9152L-0x4b909fL-0x4b8fe8L-0x4b8f31L-0x4b8e7aL-0x4b8dbfL-0x4b5df4L-0x4b35f0L-0x4b04a5L-0x4adec2L-0x4addfdL-0x4add4aL-0x4adc93L-0x4adbd8L-0x4aae1eL-0x4a84a0L-0x4a5793L-0x4a30f5L-0x4a3030L-0x4a2f75L-0x4a0051L-0x49d630L-0x49a923L-0x497ef6L-0x4952a8L-0x49287bL-0x4927b6L-0x4926fbL-0x48f896L-0x48d149L-0x48d084L-0x48cfcdL-0x48cf16L-0x48ce5bL-0x48a4efL-0x4872e9L-0x484ba4L-0x481e93L-0x481dceL-0x481d17L-0x47f2f8L-0x47c75dL-0x47c698L-0x47c5e1L-0x47c52aL-0x47c473L-0x47c3bcL-0x47c305L-0x47c24eL-0x47c197L-0x479a54L-0x476b2aL-0x476a69L-0x4769aeL-0x4743d9L-0x471120L-0x47105bL-0x470fa4L-0x47430aL-0x4768edL-0x476844L-0x47678dL-0x4766d6L-0x47661fL-0x47426bL-0x470e40L-0x470d7bL-0x470cc4L-0x470c0dL-0x470b52L-0x46eb2dL-0x46b588L-0x4693f7L-0x465fc8L-0x46608dL-0x466140L-0x46393aL-0x460a14L-0x45e2bfL-0x45b168L-0x458cebL-0x455a2eL-0x4532e9L-0x45067fL-0x4505beL-0x450507L-0x45321aL-0x455963L-0x458c1cL-0x45b09dL-0x45aff4L-0x45af3dL-0x45e139L-0x46088aL-0x46386bL-0x465efdL-0x465e54L-0x465d9dL-0x469271L-0x46b402L-0x46e9a7L-0x4709daL-0x4740e5L-0x476282L-0x4761d9L-0x47611eL-0x474046L-0x47093bL-0x46e908L-0x46b363L-0x4691d2L-0x465cf0L-0x4637ccL-0x46067dL-0x460742L-0x4607f9L-0x45e09aL-0x45ae90L-0x458b7dL-0x455756L-0x45581bL-0x4558d2L-0x45317bL-0x45045eL-0x450399L-0x4502deL-0x44df1eL-0x44aa44L-0x44a97fL-0x44a8c8L-0x44a811L-0x44a75eL-0x44a6a7L-0x44a5f0L-0x44a539L-0x44a482L-0x44a3cbL-0x44a310L-0x448524L-0x444e1dL-0x442b1aL-0x43f575L-0x43f63aL-0x43f6f1L-0x442bb9L-0x444ebcL-0x444f99L-0x445050L-0x442c88L-0x43f79aL-0x43d609L-0x439d9cL-0x439e61L-0x439f18L-0x437e24L-0x434a01L-0x4324d5L-0x42f09eL-0x42d122L-0x429e4dL-0x429f12L-0x429fc9L-0x42a080L-0x42a137L-0x427a87L-0x42487dL-0x4247b8L-0x424701L-0x42464aL-0x42458fL-0x4224c3L-0x41edc0L-0x41c953L-0x4195dbL-0x4175b4L-0x413ea5L-0x411dbfL-0x40e5f9L-0x40c8a6L-0x408f8eL-0x408ec9L-0x408e0eL-0x406c87L-0x402b9aL-0x402ad9L-0x402a26L-0x406bb8L-0x408d4dL-0x40c7d7L-0x40e3bcL-0x40e499L-0x40e550L-0x411cf0L-0x413ddaL-0x413d31L-0x413c7aL-0x413bc3L-0x413b0cL-0x4174e5L-0x419230L-0x41930dL-0x4193c4L-0x41947bL-0x419532L-0x41c884L-0x41ecf1L-0x41ec48L-0x41eb91L-0x41eadaL-0x41ea27L-0x41e970L-0x41e8b9L-0x42233dL-0x42413fL-0x424096L-0x423fdfL-0x423f28L-0x423e71L-0x42229eL-0x41e755L-0x41e690L-0x41e5d9L-0x4221cfL-0x423db0L-0x427793L-0x42970fL-0x429666L-0x4295abL-0x4276f4L-0x423d11L-0x422130L-0x41e530L-0x41e46bL-0x41e3b4L-0x41c72eL-0x418bd9L-0x418c9eL-0x418d55L-0x417221L-0x4136ccL-0x411a2cL-0x40decfL-0x40c45cL-0x4086faL-0x4087bfL-0x408876L-0x40c4fbL-0x40df6eL-0x411acbL-0x41376bL-0x413844L-0x4138fbL-0x417377L-0x418ea1L-0x418f7eL-0x419031L-0x4190e8L-0x41919fL-0x417446L-0x413a5fL-0x411c51L-0x40e1afL-0x40e274L-0x40e32bL-0x40c738L-0x408cb2L-0x408bedL-0x408b32L-0x406b19L-0x40280bL-0x402746L-0x40268fL-0x4025d8L-0x402525L-0x40246eL-0x4023b7L-0x402300L-0x402249L-0x402192L-0x4020dbL-0x402024L-0x401f6dL-0x401eb6L-0x401e03L-0x401d4cL-0x401c99L-0x401be2L-0x401b2bL-0x401a74L-0x4019bdL-0x406825L-0x408073L-0x40814cL-0x408203L-0x40c2d6L-0x40d9b6L-0x40da93L-0x40db4aL-0x411738L-0x4133d4L-0x416fe4L-0x4188e5L-0x41883cL-0x418785L-0x4186ceL-0x418617L-0x418560L-0x4184a9L-0x416f45L-0x41310cL-0x4115e2L-0x40d860L-0x40c180L-0x407fd4L-0x406786L-0x401910L'

'''
    @:param must be the switch jump address
    :return wasd's goto address by dic
'''
def get_switch_table(jump_ea):
    res = {}

    si = idaapi.get_switch_info_ex(jump_ea)
    assert si!=None
    results = idaapi.calc_switch_cases(jump_ea, si)
    wasd = [87,65,83,68]
    for idx in xrange(len(results.cases)):
        # muti case constrain will cause one case process
        cur_case = results.cases[idx]
        constrain = False
        for cidx in xrange(len(cur_case)):
            if cur_case[cidx] in wasd:
                # print "case: %d" % cur_case[cidx]
                res[results.targets[idx]] = cur_case[cidx]
                constrain = True
        if constrain==True:
            # print "  goto 0x%x" % results.targets[idx]
            pass
    return res

'''
    @:param must be the function address
    :return switch jump address
'''
def get_sjump_addr(caller_ea):
    func = idaapi.get_func(caller_ea)
    start_ea = func.startEA
    end_ea   = func.endEA

    pattern = 'FF E0' # push eax
    addr = start_ea
    addr = idc.FindBinary(addr, SEARCH_DOWN | SEARCH_NEXT, pattern)
    assert addr != idc.BADADDR and addr<=end_ea
    # print hex(addr),idc.GetDisasm(addr)
    return addr

'''
    by call locate_sjump_addr && get_switch_table
    to get the value of case belong
    
    @:param must be the refs address
    :return value
'''
def get_case_value(caller_ea=0x048D0B1, refs_ea=0x048D12F):
    jump_addr  = get_sjump_addr(caller_ea)
    wasd_table = get_switch_table(jump_addr)

    # from refs_ea to up untill first match wasd_table_re
    min_addr   = 0x1000
    target_addr= 0
    for addr in wasd_table:
        if refs_ea >= addr and (refs_ea-addr) < min_addr:
            min_addr = refs_ea-addr
            target_addr = addr
        # if caller_ea == 0x4184d6:
        #     print(hex(addr), wasd_table[addr])
        #     print('target_addr:', hex(target_addr), 'refs_ea', hex(refs_ea))

    return chr(wasd_table[target_addr])

'''
    format the addr from str to int
'''
def fm(addr_in_str):
    res = addr_in_str[2:]
    if res[-1]=='L':
        res = res[:-1]
    return int(res, 16)

get_case_value()

print '\n'*0x10000
print '[+] transvering datas'
caller_ls      =  s.split('-')
caller_refs_ls = s2.split('-')
res = ''
for i in range(len(caller_ls)):
    per = get_case_value(fm(caller_ls[i]), fm(caller_refs_ls[i]))
    res+=per
    print '[+] get %c from'%per, caller_ls[i], caller_refs_ls[i], len(caller_ls)-i-1+1
res = 'S'+res[::-1]
print '[+] path: '+res

import hashlib
print '[+] flag{'+hashlib.md5(res).hexdigest()+'}'

'''
print:
........
[+] path: SSSSSSSSSDDDDDDWWWWAAWWAAWWDDDDDDDDDDDDDDDDDDDDSSDDSSAASSSSAAAAWWAAWWWWAASSSSSSAASSDDSSSSDDWWWWDDSSDDDDWWDDDDDDWWAAAAWWDDDDWWAAWWWWDDSSDDSSSSSSSSSSDDDDSSAAAASSSSSSAASSSSAAWWAASSSSDDDDDDDDDDSSDDSSAASSSSAASSSSSSSSDDWWWWWWDDWWWWDDWWWWDDSSSSSSSSAASSSSDDDDSSDDDDWWDDSSDDSSDDDDDDDDSSDDSSSSDDDDSSDDSSSSSSDDSSSSDDDDSSSSDDDDDDSSSSDDSSDSSASSSSAASSDDSSAASSDDDDDDSSDDDDWWDDSSSSSSDDDDWWAAWWWWDDDDSSSSDDDDDDSSAASSSSSSDDDDDDDDSSDDDDSSSSSSDDWWDDDDDDSSSSSSSSAASSDDSSSSSSAASSDDS
[+] flag{078c8fbc1d0d033f663dcc58e899c101}
'''