MENU

2022 腾讯游戏安全初赛 Writeup

April 30, 2022 • Read: 354 • 默认分类

解题过程

主要逻辑

程序通过 shellcode 的形式来解析 opcode,执行 vm 的相关操作,最终通过 D3D 函数来绘制方框

解析 Opcode 逻辑

通过编写以下程序来解析 opcode 基本逻辑

#include <cstdio>

int table[1596] = {
    0x00000002, 0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004,
    0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x005A8E2C, 0x00000002, 0x00000000,
    0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002, 0x00000003, 0x00000001, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008,
    0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000005,
    0x00000000, 0x00000003, 0x000001F4, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x005A8E2C,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002,
    0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004, 0x00000000,
    0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00985AD2, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002,
    0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00A9685D, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002,
    0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000004, 0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000005, 0x00000000, 0x00000003, 0x000001F4,
    0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000,
    0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00785CEF, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000012C, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x00963EA7, 0x00000002, 0x00000000, 0x00000003, 0x00000002,
    0x00000001, 0x00000000, 0x00000002, 0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004,
    0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000005, 0x00000000, 0x00000003, 0x000001F4, 0x00000001,
    0x00000001, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x00465215, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000005, 0x00000000, 0x00000003, 0x000001F4, 0x00000001, 0x00000001, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00856DCE, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002,
    0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004, 0x00000000, 0x00000003, 0x000003E8,
    0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00758C6E, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000005, 0x00000000, 0x00000003, 0x000001F4, 0x00000001,
    0x00000001, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x0098A6B4, 0x00000002, 0x00000000, 0x00000003, 0x00000002,
    0x00000001, 0x00000000, 0x00000002, 0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004,
    0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00856ECE, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000,
    0x00000002, 0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000258, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000008, 0x00000002, 0x00000008, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00ABFC52,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000001, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005,
    0x00000001, 0x00000004, 0x00856ECE, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001,
    0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x009654EA, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x000000B4, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x008523AC, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000001, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x0086EACC, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000B4,
    0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00EA3245, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00854AEC, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00963DCE, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0098EE44,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0078A213, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00526339, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000,
    0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0088574E, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009,
    0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0012445A,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005,
    0x00000001, 0x00000004, 0x00965243, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00AA23E4, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x00000168, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00AA2488, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000001A4, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x00965224, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000008, 0x00000002, 0x00000008, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00263554, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00015478,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00963524, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00AEBCDF, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x008547AE, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x009685AA, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000B4,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0096335A, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00965234, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000,
    0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x007845EE, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009,
    0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00482526,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005,
    0x00000001, 0x00000004, 0x00326212, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00747475, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x00000168, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x002314EC, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000001A4, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x009634EA, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000007
};

int main()
{
    int ip = 0;
    unsigned int data[10] = { 0 };
    data[8] = data[9] = 0x32;
    while (1)
    {
        switch (table[ip])
        {
        case 0:
            printf("data[0] += data[1] #data[0] = 0x%08X data[1] = 0x%08X\n", data[0], data[1]);
            data[0] += data[1];
            break;
        case 1:
            printf("data[0] -= data[1] #data[0] = 0x%08X data[1] = 0x%08X\n", data[0], data[1]);
            data[0] -= data[1];
            if (*(int*)&data[0] < 0)
                data[0] += data[1];
            break;
        case 2:
        {
            printf("%02X %02X %02X ", table[ip], table[ip + 1], table[ip + 2]);
            __int64 idx = table[ip + 1];
            ip += 2;

            data[table[ip]] = (__int64)data[idx];
        
            printf("data[%d] = data[%d] #data[%d] = 0x%08X\n", table[ip], idx, table[ip], data[table[ip]]);
            break;
        }
        case 3:
        {
            unsigned int val = table[ip + 1];
            ip += 2;
            data[table[ip]] = val;

            printf("data[%d] = 0x%08X\n", table[ip], val);
            break;
        }
        case 4:
        {
        
            ++ip;
            printf("Encode (data[0], data[1], table[ip]) #Encode(0x%08X, 0x%08X, 0x%08X)\n", data[0], data[1], table[ip]);
            __int32 v13 = data[0];
            __int32 v14 = data[0] * (data[1] + 1);
            data[0] = table[ip] ^ 0x414345;
            data[1] = (unsigned int)((int)(data[0] ^ (data[1] + v13)) % 256
                + (((int)(data[0] ^ (v13 * data[1])) % 256
                    + (((int)(data[0] ^ (data[1] + v14)) % 256) << 8)) << 8));
            break;
        }
        case 5:
        {
            printf("Draw(0x%08x, 0x%08x, 0x%08x, 0x%08x, 0xFFFFFF00)\n", data[4], data[5], data[6], data[7]);
            break;
        }
        case 6:
            printf("Draw(0x%08x, 0x%08x, 0x%08x, 0x%08x, 0xFF2DDBE7)\n", data[4], data[5], data[6], data[7]);
            break;
        case 7:
            printf("End\n");
            return 0;
        }
        if (++ip >= 0x1301)
            break;
    }
    return 0;

}

通过观察可以发现,在正常的情况下,所调用的 Draw 函数前两个参数分别对应着写入位置的坐标,第三个和第四个参数对应着从 case 4 中加密计算的验证值。

寻找 Flag 不能显示的原因

在输出内容中,其中 0xFFFFFF00 对应是颜色值为黄色,0xFF2DDBE7 为蓝色,结合题目说明来看,前者就是 Flag 标志的图案内容,而后者是正常输出的 ACE Logo。

在过程中,可以发现和 Flag 标志内容有关的位置信息存在错误,被减去一个值成为了负数,导致坐标偏移正常范围,我们可以在代码中对 case 1 这个 opcode handler 进行 hook,使用汇编指令 jns 来判定相减过程是否导致值变成了负数,如果这样的情况存在则把减去的值加回。

BYTE Myshellcode[] =
 "\x79\x03" // jns $+3
 "\x01\x45\xD8" // add dword ptr [rbp - 0x28], eax
 "\xE9\x00\x00\x00\x00"; // jmp xxx

在通过以上修复后,发现有几个 Flag 方框被成功显示

image-20220417192641790

但是显示内容并不完整,于是继续观察能够被成功显示的这几个方框存在的特性。

image-20220417192808570

发现,能够被正常显示的方框的参数三四没有通过交换,而没有正常显示的方框的参数三四被交换!这说明交换参数三、四这个操作是错误的,需要我们剔除。

这里因为我们之前使用了 Hook 的方法进行修改,所以这里尝试使用修复 opcode 的方式。我们打印出这个操作序列对应的 opcode,然后搜索此序列并剔除,再把修复后的 opcode 写回到程序中。

成功显示 Flag 内容

通过以上两个修复,最终成功显示了 Flag 内容

FLAG.png

解题代码

#define NAME TEXT("2022游戏安全技术竞赛初赛.exe")
#include <iostream>
#include <Windows.h>
#include <tlhelp32.h>
#include <tchar.h>

int opcode[1596] = {
    0x00000002, 0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004,
    0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x005A8E2C, 0x00000002, 0x00000000,
    0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002, 0x00000003, 0x00000001, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008,
    0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000005,
    0x00000000, 0x00000003, 0x000001F4, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x005A8E2C,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002,
    0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004, 0x00000000,
    0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00985AD2, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002,
    0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00A9685D, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002,
    0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000004, 0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000005, 0x00000000, 0x00000003, 0x000001F4,
    0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000,
    0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00785CEF, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000012C, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x00963EA7, 0x00000002, 0x00000000, 0x00000003, 0x00000002,
    0x00000001, 0x00000000, 0x00000002, 0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004,
    0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000005, 0x00000000, 0x00000003, 0x000001F4, 0x00000001,
    0x00000001, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x00465215, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000005, 0x00000000, 0x00000003, 0x000001F4, 0x00000001, 0x00000001, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00856DCE, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000, 0x00000002,
    0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004, 0x00000000, 0x00000003, 0x000003E8,
    0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00758C6E, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000005, 0x00000000, 0x00000003, 0x000001F4, 0x00000001,
    0x00000001, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x0098A6B4, 0x00000002, 0x00000000, 0x00000003, 0x00000002,
    0x00000001, 0x00000000, 0x00000002, 0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000004,
    0x00000000, 0x00000003, 0x000003E8, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00856ECE, 0x00000002, 0x00000000, 0x00000003, 0x00000002, 0x00000001, 0x00000000,
    0x00000002, 0x00000003, 0x00000001, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000005, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000258, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000008, 0x00000002, 0x00000008, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00ABFC52,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000001, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005,
    0x00000001, 0x00000004, 0x00856ECE, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001,
    0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x009654EA, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x000000B4, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x008523AC, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000001, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x0086EACC, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000B4,
    0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00EA3245, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000001, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00854AEC, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00963DCE, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0098EE44,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0078A213, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00526339, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000,
    0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0088574E, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009,
    0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0012445A,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005,
    0x00000001, 0x00000004, 0x00965243, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00AA23E4, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x00000168, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00AA2488, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000001A4, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x00965224, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000008, 0x00000002, 0x00000008, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x00263554, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00015478,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00963524, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00AEBCDF, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x0000003C, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x008547AE, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x009685AA, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000000B4,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000,
    0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002,
    0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x0096335A, 0x00000002,
    0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008,
    0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004,
    0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001,
    0x00000004, 0x00965234, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007,
    0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x00000078,
    0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000,
    0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x007845EE, 0x00000002, 0x00000000, 0x00000006,
    0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003,
    0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009,
    0x00000000, 0x00000003, 0x000000B4, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005,
    0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00482526,
    0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002,
    0x00000008, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000,
    0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005,
    0x00000001, 0x00000004, 0x00326212, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001,
    0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x0000012C, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003,
    0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004,
    0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004, 0x00747475, 0x00000002, 0x00000000,
    0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006, 0x00000002, 0x00000008, 0x00000000,
    0x00000003, 0x00000168, 0x00000001, 0x00000000, 0x00000002, 0x00000000, 0x00000004, 0x00000002,
    0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001, 0x00000000, 0x00000002, 0x00000000,
    0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002, 0x00000005, 0x00000001, 0x00000004,
    0x002314EC, 0x00000002, 0x00000000, 0x00000006, 0x00000002, 0x00000001, 0x00000007, 0x00000006,
    0x00000002, 0x00000008, 0x00000000, 0x00000003, 0x000001A4, 0x00000001, 0x00000000, 0x00000002,
    0x00000000, 0x00000004, 0x00000002, 0x00000009, 0x00000000, 0x00000003, 0x000000F0, 0x00000001,
    0x00000000, 0x00000002, 0x00000000, 0x00000005, 0x00000002, 0x00000004, 0x00000000, 0x00000002,
    0x00000005, 0x00000001, 0x00000004, 0x009634EA, 0x00000002, 0x00000000, 0x00000006, 0x00000002,
    0x00000001, 0x00000007, 0x00000006, 0x00000007
};

int fcode[1596];

void printError(const TCHAR* msg)
{
    DWORD eNum;
    TCHAR sysMsg[256];
    TCHAR* p;

    eNum = GetLastError();
    FormatMessage(FORMAT_MESSAGE_FROM_SYSTEM | FORMAT_MESSAGE_IGNORE_INSERTS,
        NULL, eNum,
        MAKELANGID(LANG_NEUTRAL, SUBLANG_DEFAULT), // Default language
        sysMsg, 256, NULL);

    // Trim the end of the line and terminate it with a null
    p = sysMsg;
    while ((*p > 31) || (*p == 9))
        ++p;
    do { *p-- = 0; } while ((p >= sysMsg) &&
        ((*p == '.') || (*p < 33)));

    // Display the message
    _tprintf(TEXT("\n  WARNING: %s failed with error %d (%s)"), msg, eNum, sysMsg);
}

BYTE* FindShellcodeAddr(DWORD dwPID)
{
    HANDLE hModuleSnap = INVALID_HANDLE_VALUE;
    MODULEENTRY32 me32;

    // Take a snapshot of all modules in the specified process.
    hModuleSnap = CreateToolhelp32Snapshot(TH32CS_SNAPMODULE, dwPID);
    if (hModuleSnap == INVALID_HANDLE_VALUE)
    {
        printError(TEXT("CreateToolhelp32Snapshot (of modules)"));
        return(FALSE);
    }

    // Set the size of the structure before using it.
    me32.dwSize = sizeof(MODULEENTRY32);

    // Retrieve information about the first module,
    // and exit if unsuccessful
    if (!Module32First(hModuleSnap, &me32))
    {
        printError(TEXT("Module32First"));  // show cause of failure
        CloseHandle(hModuleSnap);           // clean the snapshot object
        return(FALSE);
    }

    // Now walk the module list of the process,
    // and display information about each module
    BYTE* shellcode_addr = 0;
    do
    {
        if (!_tcscmp(me32.szModule, NAME))
        {
            shellcode_addr = me32.modBaseAddr + 0x8318;
            break;
        }
    } while (Module32Next(hModuleSnap, &me32));

    CloseHandle(hModuleSnap);
    return shellcode_addr;
}

BOOL CommandThread(DWORD dwOwnerPID, BOOL isSuspend)
{
    HANDLE hThreadSnap = INVALID_HANDLE_VALUE;
    THREADENTRY32 te32;

    // Take a snapshot of all running threads  
    hThreadSnap = CreateToolhelp32Snapshot(TH32CS_SNAPTHREAD, 0);
    if (hThreadSnap == INVALID_HANDLE_VALUE)
        return(FALSE);

    // Fill in the size of the structure before using it. 
    te32.dwSize = sizeof(THREADENTRY32);

    // Retrieve information about the first thread,
    // and exit if unsuccessful
    if (!Thread32First(hThreadSnap, &te32))
    {
        printError(TEXT("Thread32First")); // show cause of failure
        CloseHandle(hThreadSnap);          // clean the snapshot object
        return(FALSE);
    }

    // Now walk the thread list of the system,
    // and display information about each thread
    // associated with the specified process
    do
    {
        if (te32.th32OwnerProcessID == dwOwnerPID)
        {
            HANDLE hThread = OpenThread(THREAD_ALL_ACCESS, 0, te32.th32ThreadID);
            if (isSuspend)
                SuspendThread(hThread);
            else
                ResumeThread(hThread);
            CloseHandle(hThread);
        }
    } while (Thread32Next(hThreadSnap, &te32));

    CloseHandle(hThreadSnap);
    return(TRUE);
}


BOOL HOOK()
{
    HANDLE hProcessSnap;
    HANDLE hProcess;
    PROCESSENTRY32 pe32;
    DWORD dwPriorityClass;


    hProcessSnap = CreateToolhelp32Snapshot(TH32CS_SNAPPROCESS, 0);
    if (hProcessSnap == INVALID_HANDLE_VALUE)
    {
        printError(TEXT("CreateToolhelp32Snapshot (of processes)"));
        return(FALSE);
    }

    pe32.dwSize = sizeof(PROCESSENTRY32);

    if (!Process32First(hProcessSnap, &pe32))
    {
        printError(TEXT("Process32First"));
        CloseHandle(hProcessSnap);
        return(FALSE);
    }

    do
    {
        if (!_tcscmp(pe32.szExeFile, NAME))
        {
            hProcess = OpenProcess(PROCESS_ALL_ACCESS, FALSE, pe32.th32ProcessID);
            if (hProcess == NULL)
            {
                printError(TEXT("OpenProcess"));
                CloseHandle(hProcessSnap);
                return(FALSE);
            }
            _tprintf(TEXT("Process ID: 0x%08X\n"), pe32.th32ProcessID);
            BYTE* shellcode_ptr = FindShellcodeAddr(pe32.th32ProcessID);
    
            BYTE* shellcode;
            if (!ReadProcessMemory(hProcess, shellcode_ptr, &shellcode, 8, 0))
            {
                printError(TEXT("ReadProcessMemory"));
                CloseHandle(hProcess);
                return(FALSE);
            }
            shellcode -= 0x650;
            _tprintf(TEXT("Shellcode: 0x%p"), shellcode);
            BYTE* HookAdr = shellcode + 0x4DE;


            BYTE Myshellcode[] =
                "\x79\x03" // jns $+3
                "\x01\x45\xD8" // add dword ptr [rbp - 0x28], eax
                "\xE9\x00\x00\x00\x00"; // jmp xxx
            BYTE HookCode[] = "\xE9\x00\x00\x00\x00";
    
            
            //Alloc Shellcode, Write Shellcode
            PBYTE pMem = (PBYTE)VirtualAllocEx(hProcess, NULL, sizeof(Myshellcode), MEM_COMMIT, PAGE_EXECUTE_READWRITE);
            if (!pMem)
            {
                printError(TEXT("VirtualAllocEx"));
                return(FALSE);
            }

            ULONG ShellcodeJmp = (sizeof(Myshellcode) - 1 - 5);
            *(ULONG*)(HookCode + 1) = (ULONG)pMem - (ULONG)HookAdr - 5;
            *(ULONG*)(Myshellcode + ShellcodeJmp + 1) = (ULONG)(shellcode + 0x5FA) - (ULONG)(pMem + ShellcodeJmp) - 5;

    
            if (!WriteProcessMemory(hProcess, pMem, &Myshellcode, sizeof(Myshellcode), 0))
            {
                VirtualFreeEx(hProcess, pMem, 0, MEM_RELEASE);
                return(FALSE);
            }


            CommandThread(pe32.th32ParentProcessID, TRUE);

            // FIX OPCODE
            int i = 0, j = 0;
            while (i < 1596)
            {
                if (i + 8 < 1596 &&
                    opcode[i] == 2 && opcode[i + 1] == 0 && opcode[i + 2] == 3 &&
                    opcode[i + 3] == 2 && opcode[i + 4] == 1 && opcode[i + 5] == 0 &&
                    opcode[i + 6] == 2 && opcode[i + 7] == 3 && opcode[i + 8] == 1)
                    i += 9;
                else 
                {
                    fcode[j++] = opcode[i++];
                }
            }
    
            //Write JMP
            DWORD dwOldProt;
            VirtualProtectEx(hProcess, (LPVOID)(HookAdr), 5, PAGE_EXECUTE_READWRITE, &dwOldProt);

            if (!WriteProcessMemory(hProcess, (LPVOID)HookAdr, &HookCode, 5, 0))
            {
                return(FALSE);
            }
            VirtualProtectEx(hProcess, (LPVOID)(HookAdr), 5, dwOldProt, &dwOldProt);

            //Write Opcode
            BYTE* opcode_addr = shellcode + 0x1301;

            VirtualProtectEx(hProcess, (LPVOID)(opcode_addr), sizeof(fcode), PAGE_EXECUTE_READWRITE, &dwOldProt);

            if (!WriteProcessMemory(hProcess, (LPVOID)opcode_addr, &fcode, sizeof(fcode), 0))
            {
                return(FALSE);
            }
            VirtualProtectEx(hProcess, (LPVOID)(opcode_addr), sizeof(fcode), dwOldProt, &dwOldProt);

            CommandThread(pe32.th32ParentProcessID, FALSE);
            break;
        }
    } while (Process32Next(hProcessSnap, &pe32));

    CloseHandle(hProcessSnap);
    return(TRUE);
}

int main()
{
    HOOK();
    return 0;
}
Archives QR Code
QR Code for this page
Tipping QR Code