使用intel pin求解一部分CTF chanllenges

examples/AlexCTF-2017-move-350/solve.py

@@ -0,0 +1,30 @@
+#!/usr/bin/env python
+# -*- coding: utf-8 -*-
+
+from string import ascii_lowercase, digits
+import os
+
+allChars = digits + '_}' + ascii_lowercase
+
+flag = 'ALEXCTF{'
+wrong = '\x01\x01\x00\x00'
+right = '\x00\x00\x01\x00'
+case = '\x00\x00\x00\x00'
+
+def tryFlag(f):
+    os.system('(echo "{}" | ~/pin-3.6-gcc-linux/pin -t ./tracer.so -- ./move.unpacked) > /dev/null'.format(f))
+    data = open('trace-1byte-writes.bin', 'rb').read()
+    offset = len(f) * 4
+    return data[offset - 4:offset]
+
+while flag[:-1] != '}':
+    for c in allChars:
+        result = tryFlag(flag + c)
+        if result == case:
+            c = c.upper()
+            result = tryFlag(flag + c)
+
+        if result == right:
+            flag += c
+            print flag
+            break

examples/AlexCTF-2017-move-350/tracer.cpp

@@ -0,0 +1,79 @@
+#include "pin.H"
+#include <fstream>
+
+std::ofstream TraceFile;
+PIN_LOCK lock;
+ADDRINT main_begin;
+ADDRINT main_end;
+
+static ADDRINT WriteAddr;
+static INT32 WriteSize;
+
+static VOID RecordWriteAddrSize(ADDRINT addr, INT32 size)
+{
+    WriteAddr = addr;
+    WriteSize = size;
+}
+
+static VOID RecordMemWrite(ADDRINT ip)
+{
+    UINT8 memdump[256];
+    PIN_GetLock(&lock, ip);
+    PIN_SafeCopy(memdump, (void *)WriteAddr, WriteSize);
+    if (WriteSize==1)
+        TraceFile << static_cast<CHAR>(*memdump);
+    PIN_ReleaseLock(&lock);
+}
+
+VOID Instruction_cb(INS ins, VOID *v)
+{
+    ADDRINT ip = INS_Address(ins);
+    if ((ip < main_begin) || (ip > main_end))
+        return;
+
+    if (INS_IsMemoryWrite(ins))
+    {
+        INS_InsertPredicatedCall(
+            ins, IPOINT_BEFORE, (AFUNPTR)RecordWriteAddrSize,
+            IARG_MEMORYWRITE_EA,
+            IARG_MEMORYWRITE_SIZE,
+            IARG_END);
+        if (INS_HasFallThrough(ins))
+        {
+            INS_InsertCall(
+                ins, IPOINT_AFTER, (AFUNPTR)RecordMemWrite,
+                IARG_INST_PTR,
+                IARG_END);
+        }
+    }
+}
+
+void ImageLoad_cb(IMG Img, void *v)
+{
+    PIN_GetLock(&lock, 0);
+    if(IMG_IsMainExecutable(Img))
+    {
+        main_begin = IMG_LowAddress(Img);
+        main_end = IMG_HighAddress(Img);
+    }
+    PIN_ReleaseLock(&lock);
+}
+
+VOID Fini(INT32 code, VOID *v)
+{
+    TraceFile.close();
+}
+
+int  main(int argc, char *argv[])
+{
+    PIN_InitSymbols();
+    PIN_Init(argc,argv);
+    TraceFile.open("trace-1byte-writes.bin");
+    if(TraceFile == NULL)
+        return -1;
+    IMG_AddInstrumentFunction(ImageLoad_cb, 0);
+    INS_AddInstrumentFunction(Instruction_cb, 0);
+    PIN_AddFiniFunction(Fini, 0);
+    PIN_StartProgram();
+    return 0;
+}

examples/ISCC-2018-re250/pin.py

@@ -14,7 +14,7 @@ def getLen():
         pin = Popen([pinPath, '-t', './myInscount1.so', '--', './re'], stdin = PIPE, stdout = PIPE)
         pin.stdin.write('_' * i + '\n')
         out, err = pin.communicate()
-        now = int(out.split('Count')[1])
+        now = int(out.split('Count: ')[1])
         delta = now - last
         print "inputLen({}) -> int({}) -> delta({})".format(i, now, delta)
         if delta > 10000 and i:

examples/NDH2k13-crackme-500/guessLen.py

@@ -1,6 +1,5 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
-__Auther__ = 'M4x'
 
 from subprocess import Popen, PIPE
 from sys import argv

examples/NDH2k13-crackme-500/guessPWD.py

@@ -1,6 +1,5 @@
 #!/usr/bin/env python
 # -*- coding: utf-8 -*-
-__Auther__ = 'M4x'
 
 from subprocess import Popen, PIPE
 from sys import argv

examples/NDH2k13-crackme-500/inscount.out

@@ -1 +1 @@
-Count 182841
+Count 165937

examples/NDH2k13-crackme-500/nohup.out

@@ -0,0 +1,23 @@
+002c:fixme:vcruntime:__telemetry_main_invoke_trigger (0x67000000)
+002c:fixme:vcruntime:__telemetry_main_invoke_trigger (0x530000)
+002c:fixme:vcruntime:__telemetry_main_invoke_trigger (0x65000000)
+002c:fixme:vcruntime:__telemetry_main_invoke_trigger (0x180000000)
+002c:fixme:file:FindFirstFileExW flags not implemented 0x00000002
+002c:fixme:vcruntime:__telemetry_main_invoke_trigger (0xe10000)
+002c:fixme:process:SetProcessDEPPolicy (3): stub
+002c:fixme:vcruntime:__telemetry_main_invoke_trigger (0x61a0000)
+002c:fixme:vcruntime:__telemetry_main_return_trigger (0x61a0000)
+002c:fixme:process:GetSystemDEPPolicy stub
+002c:fixme:process:GetSystemDEPPolicy stub
+002c:fixme:process:GetSystemDEPPolicy stub
+002c:fixme:process:GetSystemDEPPolicy stub
+002c:fixme:process:GetSystemDEPPolicy stub
+002c:fixme:process:GetSystemDEPPolicy stub
+002c:fixme:msvcrt:__clean_type_info_names_internal (0xa179aa8) stub
+002c:fixme:msvcrt:__clean_type_info_names_internal (0x1d1bdd68) stub
+002c:fixme:msvcrt:__clean_type_info_names_internal (0x1e31e2e8) stub
+002c:fixme:vcruntime:__telemetry_main_return_trigger (0xe10000)
+002c:fixme:vcruntime:__telemetry_main_return_trigger (0x180000000)
+002c:fixme:vcruntime:__telemetry_main_return_trigger (0x65000000)
+002c:fixme:vcruntime:__telemetry_main_return_trigger (0x530000)
+002c:fixme:vcruntime:__telemetry_main_return_trigger (0x67000000)

examples/hxpCTF-2017-main_strip/cmp.c

@@ -0,0 +1,9 @@
+for (int i=0; i<length(provided_flag); i++)
+{
+	if (main_mapanic(provided_flag[i]) != constant_binary_blob[i])
+	{
+		bad_boy();
+		exit();
+	}
+	goodboy();
+}

examples/hxpCTF-2017-main_strip/nohup.out

@@ -0,0 +1,64 @@
+002a:fixme:vcruntime:__telemetry_main_invoke_trigger (0x67000000)
+002a:fixme:vcruntime:__telemetry_main_invoke_trigger (0x530000)
+002a:fixme:vcruntime:__telemetry_main_invoke_trigger (0x65000000)
+002a:fixme:vcruntime:__telemetry_main_invoke_trigger (0x180000000)
+002a:fixme:file:FindFirstFileExW flags not implemented 0x00000002
+002a:fixme:vcruntime:__telemetry_main_invoke_trigger (0xe10000)
+002a:fixme:process:SetProcessDEPPolicy (3): stub
+002a:fixme:vcruntime:__telemetry_main_invoke_trigger (0xaaf0000)
+002a:fixme:vcruntime:__telemetry_main_return_trigger (0xaaf0000)
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:commdlg:IServiceProvider_fnQueryService Interface {e07010ec-bc17-44c0-97b0-46c7c95b9edc} requested from unknown service {e07010ec-bc17-44c0-97b0-46c7c95b9edc}
+002a:fixme:shell:ViewModeToListStyle ViewMode 0 not implemented
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a003, 0, 0x528178)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a004, 0, 0x528178)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a003, 1, 0x528178)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a004, 1, 0x528178)
+002a:fixme:nstc:NSTC2_fnSetControlStyle2 mask & style (0x00000004) contains unsupported style(s): 0x00000004
+002a:fixme:shell:IShellBrowser_fnOnViewWindowActive stub, 0x99aa140 (0x99acda0)
+002a:fixme:commdlg:IServiceProvider_fnQueryService Interface {e07010ec-bc17-44c0-97b0-46c7c95b9edc} requested from unknown service {e07010ec-bc17-44c0-97b0-46c7c95b9edc}
+002a:fixme:shell:ViewModeToListStyle ViewMode 0 not implemented
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a003, 0, 0x527ba8)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a004, 0, 0x527ba8)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a003, 1, 0x527ba8)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a004, 1, 0x527ba8)
+002a:fixme:commdlg:IServiceProvider_fnQueryService Interface {e07010ec-bc17-44c0-97b0-46c7c95b9edc} requested from unknown service {e07010ec-bc17-44c0-97b0-46c7c95b9edc}
+002a:fixme:shell:ViewModeToListStyle ViewMode 0 not implemented
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a003, 0, 0x527e58)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a004, 0, 0x527e58)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a003, 1, 0x527e58)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a004, 1, 0x527e58)
+002a:fixme:shell:IShellBrowser_fnOnViewWindowActive stub, 0x99aa140 (0x99acc60)
+002a:fixme:commdlg:IServiceProvider_fnQueryService Interface {e07010ec-bc17-44c0-97b0-46c7c95b9edc} requested from unknown service {e07010ec-bc17-44c0-97b0-46c7c95b9edc}
+002a:fixme:shell:ViewModeToListStyle ViewMode 0 not implemented
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a003, 0, 0x527ba8)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1026, a004, 0, 0x527ba8)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a003, 1, 0x527ba8)
+002a:fixme:shell:IShellBrowser_fnSendControlMsg stub, 0x99aa140 (2, 1025, a004, 1, 0x527ba8)
+002a:fixme:shell:IShellBrowser_fnOnViewWindowActive stub, 0x99aa140 (0x9a1b160)
+002a:fixme:win:FlashWindowEx 0x527680 - semi-stub
+002a:fixme:win:FlashWindowEx 0x5284d0 - semi-stub
+002a:fixme:vcruntime:__telemetry_main_invoke_trigger (0x114c0000)
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:process:GetSystemDEPPolicy stub
+002a:fixme:vcruntime:__telemetry_main_return_trigger (0x114c0000)
+002a:fixme:msvcrt:__clean_type_info_names_internal (0xfae6268) stub
+002a:fixme:msvcrt:__clean_type_info_names_internal (0xeac9aa8) stub
+002a:fixme:msvcrt:__clean_type_info_names_internal (0x1d1bdd68) stub
+002a:fixme:msvcrt:__clean_type_info_names_internal (0x1e31e2e8) stub
+002a:fixme:vcruntime:__telemetry_main_return_trigger (0xe10000)
+002a:fixme:vcruntime:__telemetry_main_return_trigger (0x180000000)
+002a:fixme:vcruntime:__telemetry_main_return_trigger (0x65000000)
+002a:fixme:vcruntime:__telemetry_main_return_trigger (0x530000)
+002a:fixme:vcruntime:__telemetry_main_return_trigger (0x67000000)