NoMyBank!#

看到是Godot游戏，先按正常流程解一下包

1
PS E:\ctf\nctf2026\NoMyBank!> & C:/Users/35159/AppData/Local/Programs/Python/Python313/python.exe e:/ctf/nctf2026/NoMyBank!/extract.py
2
Possible PCK header at offset: 0x2F05D6E
3
Possible PCK header at offset: 0x2F05EC9
4
Possible PCK header at offset: 0x2F0604A
5
Possible PCK header at offset: 0x2F061B6
6
Possible PCK header at offset: 0x32B61ED
7
Possible PCK header at offset: 0x5194000
8
Possible PCK header at offset: 0x5773754

1
PS E:\ctf\nctf2026\NoMyBank!> & C:/Users/35159/AppData/Local/Programs/Python/Python313/python.exe e:/ctf/nctf2026/NoMyBank!/check.py
2
Offset 0x2F05D6E: b'GDPCu\x05\xc6D$P\x01\x0f\xb6D$P'
3
Offset 0x2F05EC9: b'GDPCu\x07\xc6D$P\x01\xeb\x18H\x8b\x84'
4
Offset 0x2F0604A: b'GDPC\x0f\x85m\x01\x00\x00H\x8dL$X\xe8'
5
Offset 0x2F061B6: b'GDPCu\x05\xc6D$P\x01\x0f\xb6D$P'
6
Offset 0x32B61ED: b'GDPCH\x8b\x8c$\x90\x00\x00\x00\xff\x94$H'
7
Offset 0x5194000: b'GDPC\x03\x00\x00\x00\x04\x00\x00\x00\x05\x00\x00\x00'
8
Offset 0x5773754: b'GDPC'

只不过这些gdc文件都加密了，整体异或0x86后就可以正常反编译拿到gd文件，这样就可以看到游戏逻辑，主要看游戏通关逻辑，发现校验逻辑在dll里面

1
extends CanvasLayer
2
@onready var button = $Panel / Button
3
@onready var note = $Panel / Label
4
var menu_scene = preload("res://Scenes/menu.tscn")
5

6
func _on_button_pressed():
7
var flag_checker = get_checker_from_loaded_dll_node()
8
if flag_checker:
9
    flag_checker.show_flag_dialog()
10
    queue_free()
11

12
func get_checker_from_loaded_dll_node():
13
var checker = get_tree().get_first_node_in_group("dllchecker")
14
return checker
15

16

17
func _input(event: InputEvent) -> void :
18
if event.is_action_pressed("ui_cancel"):
19
    var menu = menu_scene.instantiate()
20
    menu.is_pause_menu = true
21
    get_tree().current_scene.add_child(menu)
22

23

24
func _ready() -> void :
25
note.text = "Congratulations!\n\tYou are now in my treasury.\n\tGive me your key, and I will give you my gift."
26

27

28
process_mode = Node.PROCESS_MODE_ALWAYS
29
button.pressed.connect(_on_button_pressed)

但题目给我们的dll是不能直接用的，我们在程序启动时，在%LOCALAPPDATA%\Temp_libextension.dll 生成一份运行时处理后的 DLL

然后拖入IDA分析

跟进sub_180002700函数，循环把 byte_18014F000[i] ^ byte_18014F491 写入新内存

key

key是0xBA

把这些异或的数组patch出来

1
_DWORD *__fastcall sub_0(__int64 a1, __int64 a2, __int64 a3, __int64 a4, _DWORD *a5)
2
{
3
    _DWORD *result; // rax
4
    int j; // [rsp+0h] [rbp-108h]
5
    int k; // [rsp+0h] [rbp-108h]
6
    int m; // [rsp+0h] [rbp-108h]
7
    int v9; // [rsp+4h] [rbp-104h]
8
    int v10; // [rsp+4h] [rbp-104h]
9
    int v11; // [rsp+4h] [rbp-104h]
10
    int v12; // [rsp+4h] [rbp-104h]
11
    unsigned __int8 v13; // [rsp+Dh] [rbp-FBh]
12
    int i; // [rsp+10h] [rbp-F8h]
13
    unsigned int v15; // [rsp+18h] [rbp-F0h]
14
    unsigned __int8 v16; // [rsp+1Ch] [rbp-ECh]
15
    unsigned __int8 v17; // [rsp+20h] [rbp-E8h]
16
    _BYTE v18[216]; // [rsp+30h] [rbp-D8h]
17

18
    v18[0] = -91;
19
    v18[1] = -90;
20
    v18[2] = -89;
21
    v18[3] = -88;
22
    v18[4] = -87;
23
    v18[5] = -86;
24
    v18[6] = -85;
25
    v18[7] = -84;
26
    v18[8] = -83;
27
    v18[9] = -82;
28
    v18[10] = -81;
29
    v18[11] = -80;
30
    v18[12] = -79;
31
    v18[13] = -78;
32
    v18[14] = -77;
33
    v18[15] = -76;
34
    v18[16] = -75;
35
    v18[17] = -74;
36
    v18[18] = -73;
37
    v18[19] = -72;
38
    v18[20] = -71;
39
    v18[21] = -70;
40
    v18[22] = -69;
41
    v18[23] = -68;
42
    v18[24] = -67;
43
    v18[25] = -66;
44
    v18[26] = -123;
45
    v18[27] = -122;
46
    v18[28] = -121;
47
    v18[29] = -120;
48
    v18[30] = -119;
49
    v18[31] = -118;
50
    v18[32] = -117;
51
    v18[33] = -116;
52
    v18[34] = -115;
53
    v18[35] = -114;
54
    v18[36] = -113;
55
    v18[37] = -112;
56
    v18[38] = -111;
57
    v18[39] = -110;
58
    v18[40] = -109;
59
    v18[41] = -108;
60
    v18[42] = -107;
61
    v18[43] = -106;
62
    v18[44] = -105;
63
    v18[45] = -104;
64
    v18[46] = -103;
65
    v18[47] = -102;
66
    v18[48] = -101;
67
    v18[49] = -100;
68
    v18[50] = -99;
69
    v18[51] = -98;
70
    v18[52] = -58;
71
    v18[53] = -57;
72
    v18[54] = -56;
73
    v18[55] = -55;
74
    v18[56] = -54;
75
    v18[57] = -53;
76
    v18[58] = -52;
77
    v18[59] = -51;
78
    v18[60] = -50;
79
    v18[61] = -49;
80
    v18[62] = -44;
81
    v18[63] = -48;
82
    for ( i = 0; i < 64; ++i )
83
        v18[i + 128] = ~v18[i];
84
    v9 = 0;
85
    for ( j = 0; j < 40; j += 3 )
86
    {
87
        v13 = *(_BYTE *)(a4 + j);
88
        if ( j + 1 >= 40 )
89
            v16 = 0;
90
        else
91
            v16 = *(_BYTE *)(a4 + j + 1);
92
        if ( j + 2 >= 40 )
93
            v17 = 0;
94
        else
95
            v17 = *(_BYTE *)(a4 + j + 2);
96
        v18[v9 + 64] = v18[(((int)v16 >> 4) & 0xF | (unsigned __int8)(16 * (v13 & 3))) + 128];
97
        v10 = v9 + 1;
98
        v18[v10 + 64] = v18[(((int)v13 >> 2) & 0x3F) + 128];
99
        v11 = v10 + 1;
100
        if ( j + 1 >= 40 )
101
            v18[v11 + 64] = 61;
102
        else
103
            v18[v11 + 64] = v18[(v17 & 0x3F) + 128];
104
        v12 = v11 + 1;
105
        if ( j + 2 >= 40 )
106
            v18[v12 + 64] = 61;
107
        else
108
            v18[v12 + 64] = v18[(((int)v17 >> 6) & 3 | (unsigned __int8)(4 * (v16 & 0xF))) + 128];
109
        v9 = v12 + 1;
110
    }
111
    for ( k = 0; k < v9; ++k )
112
        *(_BYTE *)(a3 + k) = v18[k + 64];
113
    v15 = 1131796;
114
    for ( m = 0; m < v9; ++m )
115
    {
116
        *(_BYTE *)(a3 + m) ^= v15 >> (8 * m % 24);
117
        *(_BYTE *)(a3 + m) = (((int)*(unsigned __int8 *)(a3 + m) >> 6) | (4 * *(_BYTE *)(a3 + m))) ^ 0xBA;
118
        v15 = 16843155 * v15 + 305419896;
119
    }
120
    result = a5;
121
    *a5 = v9;
122
    return result;
123
}

有了加密逻辑，现在我们要找密文，而之前的gd文件里提到了show_flag_dialog

然后看校验层的sub_1800033A0函数的参数sub_180001760函数

比较就在sub_180002A40函数里

1
2B F7 67 5E 7C 98 ED 6D D1 8C EF 57 BB 33 22 7E B2 1F 34 5B 36 6C 2B AF BB 5B 12 D6 3C 0A 45 27 84 6C 47 AB 2F 75 78 3E 88 89 2D 7A CD 5C F6 FA 36 73 FF 6E D3 4C 1C 75

1
from pathlib import Path
2

3
# hidden compare bytes dumped from DLL (56 bytes)
4
CMP56_HEX = (
5
    "2bf7675e7c98ed6dd18cef57bb33227eb21f345b366c2baf"
6
    "bb5b12d63c0a4527846c47ab2f75783e88892d7acd5cf6fa"
7
    "3673ff6ed34c1c75"
8
)
9

10
def build_alphabet() -> list[int]:
11
    base = []
12
    base += list(range(0xA5, 0xBF))
13
    base += list(range(0x85, 0x9F))
14
    base += list(range(0xC6, 0xD0))
15
    base += [0xD4, 0xD0]
16
    return [(~b) & 0xFF for b in base]
17

18
def ror2(x: int) -> int:
19
    return ((x >> 2) | ((x << 6) & 0xFF)) & 0xFF
20

21
def undo_stream_transform(data: bytes) -> bytes:
22
    out = bytearray()
23
    v = 0x114514
24
    for m, c in enumerate(data):
25
        x = c ^ 0xBA
26
        x = ror2(x)
27
        x ^= (v >> ((8 * m) % 24)) & 0xFF
28
        out.append(x)
29
        v = (0x1010193 * v + 0x12345678) & 0xFFFFFFFF
30
    return bytes(out)
31

32
def decode_custom_b64(enc: bytes) -> bytes:
33
    inv = {c: i for i, c in enumerate(build_alphabet())}
34
    out = bytearray()
35

36
    for i in range(0, len(enc), 4):
37
        c1, c2, c3, c4 = enc[i:i + 4]
38
        if c1 == 0x3D or c2 == 0x3D:
39
            break
40

41
        i1 = inv[c1]
42
        i2 = inv[c2]
43
        b0 = ((i2 << 2) | (i1 >> 4)) & 0xFF
44

45
        if c3 == 0x3D and c4 == 0x3D:
46
            out.append(b0)
47
            break
48

49
        i3 = inv[c3]
50
        i4 = inv[c4]
51
        b1 = (((i1 & 0x0F) << 4) | (i4 >> 2)) & 0xFF
52
        b2 = (((i4 & 0x03) << 6) | i3) & 0xFF
53
        out += bytes((b0, b1, b2))
54

55
    return bytes(out)
56

57
def main() -> None:
58
    cmp56 = bytes.fromhex(CMP56_HEX)
59
    key = decode_custom_b64(undo_stream_transform(cmp56))
60
    print(key.decode("ascii"))
61

62
if __name__ == "__main__":
63
    main()

NCTF{You_deserve_this_gift_b1bd7c719cfc}

Hook My secret#

这个apk需要闯过三层关卡，函数流程就是main->pattern->stage2->stage3->success

先来看Mainactivity,不是真正的校验，只负责进入PatternActivity和状态显示

去看patternactivity定位patternLockView.setOnPatternComplete，跟进到N0.c

第一关的逻辑就是把我们连线的图案写成0,1,2…，然后SHA-256后与”4a6bc34076c8eef0f9eac59ad30d99bb4f56ecea4b0bfab92540fb655ac680f3“对比

1
import hashlib
2
import itertools
3

4
TARGET = "4a6bc34076c8eef0f9eac59ad30d99bb4f56ecea4b0bfab92540fb655ac680f3"
5
NODES = list(range(9))
6

7
def sha256_hex(s: str) -> str:
8
    return hashlib.sha256(s.encode("utf-8")).hexdigest()
9

10
for length in range(1, 10):
11
    for perm in itertools.permutations(NODES, length):
12
        s = ",".join(map(str, perm))
13
        if sha256_hex(s) == TARGET:
14
            print("FOUND:", s)
15
            raise SystemExit
16

17
print("NOT FOUND")

按照序列0,1,2,4,8连接通关，进入第二关，第二关是去解密key

去到StageSubmitClickListener类声明处，到地方发现case 0是关卡2

会调用nativecen的so库来加密输入，最后与Stage2TargetVector做对比

ida打开so看一下，读输入

先做trim，去掉首尾空白

核心加密

解出keyk7Xm2Pq9Wv4N8bRt

1
TARGET = [250, 113, 87, 185, 6, 125, 167, 156, 4, 0, 229, 239, 119, 155, 187, 95]
2

3
def rol8(x, n):
4
    x &= 0xFF
5
    return ((x << n) | (x >> (8 - n))) & 0xFF
6

7
def ror8(x, n):
8
    x &= 0xFF
9
    return ((x >> n) | (x << (8 - n))) & 0xFF
10

11
# 逆向恢复输入
12
d = 0x51
13
xs = []
14
for i, y in enumerate(TARGET):
15
    t = (y - i - 7 * d) & 0xFF
16
    x = ror8(t, 3) ^ d ^ ((13 * i + 0x42) & 0xFF)
17
    x &= 0xFF
18
    xs.append(x)
19
    d = (d + x + (y ^ i)) & 0xFF
20

21
key = bytes(xs).decode("utf-8")
22
print("Stage2 key =", key)

default是关卡三，加密模式就是AES/CBC/PKCS5Padding模式加密，key是第二关的结果

IV定义在M0.5，最后在Base64

IVbase解密后的VerifyVector1234

1
from base64 import b64decode, b64encode
2
from Crypto.Cipher import AES
3

4
STAGE2_KEY = b"k7Xm2Pq9Wv4N8bRt"  # 第二关得到
5
IV = b"VerifyVector1234"         # stage3_iv(Base64解码后)
6
TARGET_B64 = "jSaMnziall55Tdr+IZc7EKUNm/N4uwrZw1QFPw6DuirfYFJZg88j6GKLhWfNljAB"
7

8
def pkcs7_unpad(data: bytes) -> bytes:
9
    pad = data[-1]
10
    return data[:-pad]
11

12
# 1) 直接解出第三关正确输入
13
ct = b64decode(TARGET_B64)
14
pt = AES.new(STAGE2_KEY, AES.MODE_CBC, IV).decrypt(ct)
15
flag = pkcs7_unpad(pt).decode("utf-8")
16
print("Stage3 input =", flag)

当然这题主要还是想HOOK挂钩来实现

1
'use strict';
2

3
Java.perform(function () {
4
  const TARGET_B64 = "jSaMnziall55Tdr+IZc7EKUNm/N4uwrZw1QFPw6DuirfYFJZg88j6GKLhWfNljAB";
5

6
  const ActivityThread = Java.use('android.app.ActivityThread');
7
  const Base64 = Java.use('android.util.Base64');
8
  const Cipher = Java.use('javax.crypto.Cipher');
9
  const SecretKeySpec = Java.use('javax.crypto.spec.SecretKeySpec');
10
  const IvParameterSpec = Java.use('javax.crypto.spec.IvParameterSpec');
11
  const JString = Java.use('java.lang.String');
12
  const DbHelper = Java.use('M0.a');
13

14
  const ctx = ActivityThread.currentApplication().getApplicationContext();
15

16
  // 1) 取 stage2Key
17
  const sp = ctx.getSharedPreferences("challenge_state", 0);
18
  let stage2Key = sp.getString("stage2Key", "");
19
  if (stage2Key === null) stage2Key = "";
20
  stage2Key = stage2Key.toString().trim().replace(/-/g, "");
21

22
  // 没有就用已知正确 key 兜底（你也可删掉这行）
23
  if (stage2Key.length === 0) {
24
    stage2Key = "k7Xm2Pq9Wv4N8bRt";
25
    console.log("[*] stage2Key empty, fallback =", stage2Key);
26
  } else {
27
    console.log("[*] stage2Key from SP =", stage2Key);
28
  }
29

30
  // 2) 读 SQLite 的 stage3_iv
31
  const db = DbHelper.$new(ctx).getReadableDatabase();
32
  const cursor = db.rawQuery("SELECT v FROM app_cfg WHERE k = ?", Java.array('java.lang.String', ["stage3_iv"]));
33

34
  let ivB64 = null;
35
  if (cursor.moveToFirst()) {
36
    ivB64 = cursor.getString(0).toString();
37
  }
38
  cursor.close();
39
  db.close();
40

41
  if (ivB64 === null) {
42
    console.log("[-] stage3_iv not found");
43
    return;
44
  }
45

46
  console.log("[*] iv(base64) =", ivB64);
47

48
  // 3) AES/CBC/PKCS5Padding 解密 TARGET_B64
49
  const keyBytes = JString.$new(stage2Key).getBytes("UTF-8");
50
  const ivBytes = Base64.decode(ivB64, 0);
51
  const ctBytes = Base64.decode(TARGET_B64, 0);
52

53
  const cipher = Cipher.getInstance("AES/CBC/PKCS5Padding");
54
  const keySpec = SecretKeySpec.$new(keyBytes, "AES");
55
  const ivSpec = IvParameterSpec.$new(ivBytes);
56

57
  cipher.init(2, keySpec, ivSpec); // DECRYPT_MODE = 2
58
  const ptBytes = cipher.doFinal(ctBytes);
59
  const flag = JString.$new(ptBytes, "UTF-8").toString();
60

61
  console.log("[+] FLAG =", flag);
62
});

NCTF{a680107e-a49b-43e1-915b-cedd25e7835a}

pay-for-2048-attachment#

先解一下asar包

1
npx asar extract app.asar app_unpacked

这是 Electron + Rust/WASM 题，真实校验都在 resources/app_unpacked/wasm-build/wasm32-unknown-unknown/release/wasm_core.wasm 里

src文件还里的wasm-bridge.js等只是桥接

接下来就是分析wasm，这里我用的是Ghirda+wasm插件

第一个主要函数verify_license_impl

主要逻辑：

1
parse_context(json)：先从输入 JSON 取 key/score/steps/maxTile/board/sessionToken。
2
如果解析失败：返回 invalid payload（你前面看到的 1099）。
3
如果 maxTile < 0x100（256）：直接失败（“reach 256 before requesting activation”那条分支）。
4
校验 key 格式：
5
必须按 - 分成 5 段
6
第 1 段必须是 "NCTF"
7
    后 3 段各 4 字符
8
字符限制是大写字母/数字（等价 NCTF-XXXX-XXXX-XXXX）
9
normalize_key：把后 3 段拼成 12 字符，例如 ABCD-EFGH-IJKL -> ABCDEFGHIJKL。
10
对这 12 字符跑自定义 32 位混淆哈希，最终比较常量：0xFC97CA2F。
11
命中则 build_session_token(...)，返回 ok + sessionToken；否则 license verification failed。

1
void _ZN9wasm_core7license19verify_license_impl17h5b9422e6bd42d743E
2
               (undefined4 *param1,undefined4 param2,undefined4 param3)
3

4
{
5
  undefined8 uVar1;
6
  undefined4 param3_00;
7
  undefined8 uVar2;
8
  undefined8 uVar3;
9
  int iVar4;
10
  undefined *puVar5;
11
  int iVar6;
12
  uint uVar7;
13
  undefined4 uVar8;
14
  undefined8 *puVar9;
15
  int *param1_00;
16
  char *pcVar10;
17
  int iVar11;
18
  int iVar12;
19
  uint uVar13;
20
  undefined *puVar14;
21
  int local_b8;
22
  undefined4 local_b4;
23
  int local_b0;
24
  undefined4 local_ac;
25
  int local_a8;
26
  int local_a4;
27
  undefined8 local_a0;
28
  undefined8 local_98;
29
  undefined8 local_90;
30
  undefined8 local_88;
31
  undefined8 local_80;
32
  undefined8 local_78;
33
  undefined8 local_70;
34
  undefined8 local_68;
35
  undefined8 local_60;
36
  undefined8 local_58;
37
  undefined8 local_50;
38
  undefined8 local_48;
39
  undefined1 auStack_40 [12];
40
  undefined4 local_34;
41
  undefined4 local_30;
42
  undefined4 local_2c;
43
  undefined4 local_28;
44
  undefined4 local_24;
45
  undefined4 local_20;
46
  undefined4 local_1c;
47
  undefined4 local_18;
48
  undefined4 local_14;
49
  undefined2 local_10;
50
  undefined2 uStack_e;
51
  int local_c;
52
  int *local_8;
53
  int local_4;
54

55
  _ZN9wasm_core5utils13parse_context17hdd86c9e433334ca3E(&local_70,param2,param3);
56
  if ((int)local_70 == -0x80000000) {
57
    _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
58
    puVar9 = (undefined8 *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0xf,1);
59
    if (puVar9 != (undefined8 *)0x0) {
60
      *(undefined1 *)(param1 + 8) = 0;
61
      *(undefined8 *)(param1 + 6) = 0x44b0000000f;
62
      param1[5] = puVar9;
63
      param1[4] = 0xf;
64
      *param1 = 2;
65
      *(ulonglong *)((int)puVar9 + 7) =
66
           CONCAT71(s_license_format_must_match_NCTF-X_ram_001005c4._118_7_,
67
                    s_license_format_must_match_NCTF-X_ram_001005c4[0x75]);
68
      *puVar9 = CONCAT17(s_license_format_must_match_NCTF-X_ram_001005c4[0x75],
69
                         s_license_format_must_match_NCTF-X_ram_001005c4._110_7_);
70
      return;
71
    }
72
    _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0xf);
73
    do {
74
      halt_trap();
75
    } while( true );
76
  }
77
  local_78 = local_48;
78
  uVar3 = local_78;
79
  local_80 = local_50;
80
  local_88 = local_58;
81
  local_90 = local_60;
82
  local_98 = local_68;
83
  uVar2 = local_98;
84
  local_a0 = local_70;
85
  uVar1 = local_a0;
86
  local_78._4_4_ = (uint)((ulonglong)local_48 >> 0x20);
87
  local_78 = uVar3;
88
  if (local_78._4_4_ < 0x100) {
89
    _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
90
    pcVar10 = (char *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0x26,1);
91
    if (pcVar10 == (char *)0x0) {
92
      _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0x26);
93
      do {
94
        halt_trap();
95
      } while( true );
96
    }
97
    *(undefined1 *)(param1 + 8) = 0;
98
    *(undefined8 *)(param1 + 6) = 0x3ec00000026;
99
    param1[5] = pcVar10;
100
    param1[4] = 0x26;
101
    *param1 = 2;
102
    *(ulonglong *)(pcVar10 + 0x1e) =
103
         CONCAT62(s_license_format_must_match_NCTF-X_ram_001005c4._104_6_,
104
                  s_license_format_must_match_NCTF-X_ram_001005c4._102_2_);
105
    *(ulonglong *)(pcVar10 + 0x18) =
106
         CONCAT26(s_license_format_must_match_NCTF-X_ram_001005c4._102_2_,
107
                  s_license_format_must_match_NCTF-X_ram_001005c4._96_6_);
108
    *(undefined8 *)(pcVar10 + 0x10) = s_license_format_must_match_NCTF-X_ram_001005c4._88_8_;
109
    *(undefined8 *)(pcVar10 + 8) = s_license_format_must_match_NCTF-X_ram_001005c4._80_8_;
110
    *(undefined8 *)pcVar10 = s_license_format_must_match_NCTF-X_ram_001005c4._72_8_;
111
    goto code_r0x80002989;
112
  }
113
  local_a0._4_4_ = (undefined4)((ulonglong)local_70 >> 0x20);
114
  local_98._0_4_ = (undefined4)local_68;
115
  local_10 = 1;
116
  local_14 = (undefined4)local_98;
117
  local_18 = 0;
118
  local_1c = CONCAT31(local_1c._1_3_,1);
119
  local_20 = 0x2d;
120
  local_24 = (undefined4)local_98;
121
  local_28 = 0;
122
  local_2c = (undefined4)local_98;
123
  local_30 = local_a0._4_4_;
124
  local_34 = 0x2d;
125
  local_a0 = uVar1;
126
  local_98 = uVar2;
127
  _ZN90_$LT$core..str..iter..Split$LT$P$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$4ne xt17hb6cfa7a2baf19f1aE
128
            (&local_a8,&local_34);
129
  if (local_a8 != 0) {
130
    _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
131
    param1_00 = (int *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0x20,4);
132
    if (param1_00 == (int *)0x0) {
133
      _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(4,0x20);
134
      do {
135
        halt_trap();
136
      } while( true );
137
    }
138
    *param1_00 = local_a8;
139
    param1_00[1] = local_a4;
140
    local_4 = 1;
141
    local_c = 4;
142
    local_50 = CONCAT26(uStack_e,CONCAT24(local_10,local_14));
143
    local_58 = CONCAT44(local_18,local_1c);
144
    local_60 = CONCAT44(local_20,local_24);
145
    local_68 = CONCAT44(local_28,local_2c);
146
    local_70 = CONCAT44(local_30,local_34);
147
    local_8 = param1_00;
148
    _ZN90_$LT$core..str..iter..Split$LT$P$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$GT$4 next17hb6cfa7a2baf19f1aE
149
              (&local_b0,&local_70);
150
    if (local_b0 != 0) {
151
      iVar4 = 0xc;
152
      iVar6 = 2;
153
      iVar12 = local_b0;
154
      uVar8 = local_ac;
155
      do {
156
        if (iVar6 + -1 == local_c) {
157
          _ZN5alloc7raw_vec20RawVecInner$LT$A$GT$7reserve21do_reserve_and_handle17h27a7abd20686458bE
158
                    (&local_c,iVar6 + -1,1,4,8);
159
          param1_00 = local_8;
160
        }
161
        *(undefined4 *)((int)param1_00 + iVar4) = uVar8;
162
        ((undefined4 *)((int)param1_00 + iVar4))[-1] = iVar12;
163
        iVar4 = iVar4 + 8;
164
        iVar11 = iVar6 + 1;
165
        local_4 = iVar6;
166
        _ZN90_$LT$core..str..iter..Split$LT$P$GT$$u20$as$u20$core..iter..traits..iterator..Iterator$ GT$4next17hb6cfa7a2baf19f1aE
167
                  (&local_b8,&local_70);
168
        iVar6 = iVar11;
169
        iVar12 = local_b8;
170
        uVar8 = local_b4;
171
      } while (local_b8 != 0);
172
      if ((((iVar11 == 5) && (local_8[1] == 4)) && (*(int *)*local_8 == 0x4654434e)) &&
173
         (local_8[3] == 4)) {
174
        iVar12 = local_8[2];
175
        iVar6 = 0;
176
        do {
177
          if (iVar6 == 4) {
178
code_r0x800024ba:
179
            if (local_8[5] == 4) {
180
              iVar12 = local_8[4];
181
              iVar6 = 0;
182
              goto code_r0x800024d6;
183
            }
184
            break;
185
          }
186
          iVar4 = iVar6 + 1;
187
          uVar7 = (uint)(char)*(byte *)(iVar12 + iVar6);
188
          if ((int)uVar7 < 0) {
189
            uVar13 = *(byte *)(iVar12 + iVar4) & 0x3f;
190
            iVar4 = iVar6 + 2;
191
            if (uVar7 < 0xffffffe0) {
192
              uVar13 = (uVar7 & 0x1f) << 6 | uVar13;
193
            }
194
            else {
195
              uVar13 = uVar13 << 6 | *(byte *)(iVar12 + iVar4) & 0x3f;
196
              iVar4 = iVar6 + 3;
197
              if (uVar7 < 0xfffffff0) {
198
                uVar13 = uVar13 | (uVar7 & 0x1f) << 0xc;
199
              }
200
              else {
201
                uVar13 = uVar13 << 6 | *(byte *)(iVar12 + iVar4) & 0x3f | (uVar7 & 7) << 0x12;
202
                if (uVar13 == 0x110000) goto code_r0x800024ba;
203
                iVar4 = iVar6 + 4;
204
              }
205
            }
206
          }
207
          else {
208
            uVar13 = (uint)*(byte *)(iVar12 + iVar6);
209
          }
210
          iVar6 = iVar4;
211
        } while ((0xffffffe5 < uVar13 - 0x5b) || (0xfffffff5 < uVar13 - 0x3a));
212
      }
213
      goto code_r0x800028cf;
214
    }
215
    iVar6 = 4;
216
    goto code_r0x800028d5;
217
  }
218
  goto code_r0x800028e5;
219
  while( true ) {
220
    iVar4 = iVar6 + 1;
221
    uVar7 = (uint)(char)*(byte *)(iVar12 + iVar6);
222
    if ((int)uVar7 < 0) {
223
      uVar13 = *(byte *)(iVar12 + iVar4) & 0x3f;
224
      iVar4 = iVar6 + 2;
225
      if (uVar7 < 0xffffffe0) {
226
        uVar13 = (uVar7 & 0x1f) << 6 | uVar13;
227
      }
228
      else {
229
        uVar13 = uVar13 << 6 | *(byte *)(iVar12 + iVar4) & 0x3f;
230
        iVar4 = iVar6 + 3;
231
        if (uVar7 < 0xfffffff0) {
232
          uVar13 = uVar13 | (uVar7 & 0x1f) << 0xc;
233
        }
234
        else {
235
          uVar13 = uVar13 << 6 | *(byte *)(iVar12 + iVar4) & 0x3f | (uVar7 & 7) << 0x12;
236
          if (uVar13 == 0x110000) goto code_r0x800025b7;
237
          iVar4 = iVar6 + 4;
238
        }
239
      }
240
    }
241
    else {
242
      uVar13 = (uint)*(byte *)(iVar12 + iVar6);
243
    }
244
    iVar6 = iVar4;
245
    if ((uVar13 - 0x5b < 0xffffffe6) && (uVar13 - 0x3a < 0xfffffff6)) break;
246
code_r0x800024d6:
247
    if (iVar6 == 4) {
248
code_r0x800025b7:
249
      if (local_8[7] == 4) {
250
        iVar12 = local_8[6];
251
        iVar6 = 0;
252
        goto code_r0x800025d1;
253
      }
254
      break;
255
    }
256
  }
257
  goto code_r0x800028cf;
258
  while( true ) {
259
    iVar4 = iVar6 + 1;
260
    uVar7 = (uint)(char)*(byte *)(iVar12 + iVar6);
261
    if ((int)uVar7 < 0) {
262
      uVar13 = *(byte *)(iVar12 + iVar4) & 0x3f;
263
      iVar4 = iVar6 + 2;
264
      if (uVar7 < 0xffffffe0) {
265
        uVar13 = (uVar7 & 0x1f) << 6 | uVar13;
266
      }
267
      else {
268
        uVar13 = uVar13 << 6 | *(byte *)(iVar12 + iVar4) & 0x3f;
269
        iVar4 = iVar6 + 3;
270
        if (uVar7 < 0xfffffff0) {
271
          uVar13 = uVar13 | (uVar7 & 0x1f) << 0xc;
272
        }
273
        else {
274
          uVar13 = uVar13 << 6 | *(byte *)(iVar12 + iVar4) & 0x3f | (uVar7 & 7) << 0x12;
275
          if (uVar13 == 0x110000) goto code_r0x80002747;
276
          iVar4 = iVar6 + 4;
277
        }
278
      }
279
    }
280
    else {
281
      uVar13 = (uint)*(byte *)(iVar12 + iVar6);
282
    }
283
    iVar6 = iVar4;
284
    if ((uVar13 - 0x5b < 0xffffffe6) && (uVar13 - 0x3a < 0xfffffff6)) break;
285
code_r0x800025d1:
286
    if (iVar6 == 4) {
287
code_r0x80002747:
288
      if (local_c != 0) {
289
        _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_8,local_c << 3,4);
290
      }
291
      uVar8 = local_a0._4_4_;
292
      param3_00 = (undefined4)local_98;
293
      _ZN9wasm_core7license13normalize_key17h58190eb56e6def8eE
294
                (&local_70,local_a0._4_4_,(undefined4)local_98);
295
      iVar6 = local_70._4_4_;
296
      if ((uint)local_68 != 0) {
297
        uVar7 = 0;
298
        puVar5 = &DAT_ram_00001357;
299
        do {
300
          puVar14 = &DAT_ram_00009e37;
301
          if ((uVar7 & 1) == 0) {
302
            puVar14 = &DAT_ram_000045d9;
303
          }
304
          puVar5 = (undefined *)
305
                   (((int)(puVar14 + *(byte *)(local_70._4_4_ + uVar7)) * (uVar7 + 0xb) ^
306
                    ((int)puVar5 << 3 | (uint)puVar5 >> 0x1d)) +
307
                   ((uint)*(byte *)(local_70._4_4_ + uVar7) << uVar7 % 5 ^ 0xa5a55a5a));
308
          uVar7 = uVar7 + 1;
309
        } while ((uint)local_68 != uVar7);
310
        if (puVar5 == (undefined *)0xfc97ca2f) {
311
          _ZN9wasm_core5state19build_session_token17he7d62ea5adb7b396E
312
                    (auStack_40,uVar8,param3_00,&local_a0);
313
          _ZN9wasm_core5state9ApiResult16ok_session_token17ha3cf0fe766029408E(param1,auStack_40) ;
314
          if ((int)local_70 != 0) {
315
            _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(iVar6,(int)local_70,1);
316
          }
317
          if ((int)local_a0 != 0) {
318
            _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(uVar8,(int)local_a0,1);
319
          }
320
          if (local_98._4_4_ != 0) {
321
            _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc((undefined4)local_90,local_98._4_4_ << 2,4)
322
            ;
323
          }
324
          if ((int)local_88 == 0) {
325
            return;
326
          }
327
          _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_88._4_4_,(int)local_88,1);
328
          return;
329
        }
330
      }
331
      _ZN9wasm_core5state9ApiResult3err17hbdfb8c384e65ef66E
332
                (param1,0x3eb,s_license_format_must_match_NCTF-X_ram_001005c4 + 0x2d,0x1b);
333
      if ((int)local_70 != 0) {
334
        _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(iVar6,(int)local_70,1);
335
      }
336
      goto code_r0x80002989;
337
    }
338
  }
339
code_r0x800028cf:
340
  iVar6 = local_c;
341
  param1_00 = local_8;
342
  if (local_c != 0) {
343
code_r0x800028d5:
344
    _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(param1_00,iVar6 << 3,4);
345
  }
346
code_r0x800028e5:
347
  _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
348
  pcVar10 = (char *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0x2d,1);
349
  if (pcVar10 == (char *)0x0) {
350
    _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0x2d);
351
    do {
352
      halt_trap();
353
    } while( true );
354
  }
355
  *(undefined1 *)(param1 + 8) = 0;
356
  *(undefined8 *)(param1 + 6) = 0x3ea0000002d;
357
  param1[5] = pcVar10;
358
  param1[4] = 0x2d;
359
  *param1 = 2;
360
  *(ulonglong *)(pcVar10 + 0x25) =
361
       CONCAT53(s_license_format_must_match_NCTF-X_ram_001005c4._40_5_,
362
                s_license_format_must_match_NCTF-X_ram_001005c4._37_3_);
363
  *(ulonglong *)(pcVar10 + 0x20) =
364
       CONCAT35(s_license_format_must_match_NCTF-X_ram_001005c4._37_3_,
365
                s_license_format_must_match_NCTF-X_ram_001005c4._32_5_);
366
  *(undefined8 *)(pcVar10 + 0x18) = s_license_format_must_match_NCTF-X_ram_001005c4._24_8_;
367
  *(undefined8 *)(pcVar10 + 0x10) = s_license_format_must_match_NCTF-X_ram_001005c4._16_8_;
368
  *(undefined8 *)(pcVar10 + 8) = s_license_format_must_match_NCTF-X_ram_001005c4._8_8_;
369
  *(undefined8 *)pcVar10 = s_license_format_must_match_NCTF-X_ram_001005c4._0_8_;
370
code_r0x80002989:
371
  if ((int)local_a0 != 0) {
372
    _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_a0._4_4_,(int)local_a0,1);
373
  }
374
  if (local_98._4_4_ != 0) {
375
    _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc((undefined4)local_90,local_98._4_4_ << 2,4);
376
  }
377
  if ((int)local_88 != 0) {
378
    _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_88._4_4_,(int)local_88,1);
379
  }
380
  return;
381
}

下一个unlock_flag_impl

主要逻辑

1
parse_context 失败 -> invalid payload。
2
若 maxTile < 0x800（2048）-> reach 2048 before requesting the final unlock。
3
内部重新 build_session_token(...)，与你提交的 sessionToken 做 memcmp。
4
不一致 -> session token mismatch。
5
一致后执行解密：
6
先 normalize_key（12字节）
7
拼接：normalized_key + "|" + "arcade::unlock-seed"（总长 42）
8
逐字节变换：
9
out[i] = in[i] ^ (i*0x1d + 0x11) ^ DAT_ram_001006b7[i]
10
若 UTF-8 无效 -> 返回 NCTF{decrypt_failed}
11
否则返回 success + flag

1
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */
2

3
void _ZN9wasm_core6crypto16unlock_flag_impl17hcb9a3555baab6d38E
4
               (undefined4 *param1,undefined4 param2,undefined4 param3)
5

6
{
7
  byte bVar1;
8
  byte bVar2;
9
  char cVar3;
10
  undefined8 uVar4;
11
  undefined8 uVar5;
12
  void *param1_00;
13
  int iVar6;
14
  undefined4 uVar7;
15
  int iVar8;
16
  int param2_00;
17
  int iVar9;
18
  undefined8 *puVar10;
19
  undefined8 *puVar11;
20
  undefined4 *puVar12;
21
  int iVar13;
22
  int iVar14;
23
  undefined8 local_90;
24
  undefined8 local_88;
25
  undefined8 local_80;
26
  undefined8 local_78;
27
  undefined8 local_70;
28
  undefined8 local_68;
29
  int local_60;
30
  undefined4 uStack_5c;
31
  undefined8 local_58;
32
  undefined8 local_50;
33
  undefined8 local_48;
34
  undefined8 local_40;
35
  undefined8 local_38;
36
  int local_30;
37
  void *local_2c;
38
  size_t local_28;
39
  int local_24;
40
  undefined4 local_20;
41
  int local_1c;
42
  int local_18;
43
  int local_14;
44
  int local_10;
45
  int local_c;
46
  undefined8 *local_8;
47
  int local_4;
48

49
  _ZN9wasm_core5utils13parse_context17hdd86c9e433334ca3E(&local_60,param2,param3);
50
  if (local_60 == -0x80000000) {
51
    _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
52
    puVar10 = (undefined8 *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0xf,1);
53
    if (puVar10 == (undefined8 *)0x0) {
54
      _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0xf);
55
      do {
56
        halt_trap();
57
      } while( true );
58
    }
59
    *(undefined1 *)(param1 + 8) = 0;
60
    *(undefined8 *)(param1 + 6) = 0x44b0000000f;
61
    param1[5] = puVar10;
62
    param1[4] = 0xf;
63
    *param1 = 2;
64
    *(ulonglong *)((int)puVar10 + 7) = CONCAT71(uRam00100740,DAT_ram_00100738._7_1_);
65
    *puVar10 = CONCAT17(DAT_ram_00100738._7_1_,(undefined7)DAT_ram_00100738);
66
  }
67
  else {
68
    local_68 = local_38;
69
    uVar5 = local_68;
70
    local_70 = local_40;
71
    local_78 = local_48;
72
    local_80 = local_50;
73
    local_88 = local_58;
74
    uVar4 = local_88;
75
    local_90 = CONCAT44(uStack_5c,local_60);
76
    local_68._4_4_ = (uint)((ulonglong)local_38 >> 0x20);
77
    local_68 = uVar5;
78
    if (local_68._4_4_ < 0x800) {
79
      _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
80
      puVar10 = (undefined8 *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0x2d,1);
81
      if (puVar10 == (undefined8 *)0x0) {
82
        _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0x2d);
83
        do {
84
          halt_trap();
85
        } while( true );
86
      }
87
      *(undefined1 *)(param1 + 8) = 0;
88
      *(undefined8 *)(param1 + 6) = 0x3ec0000002d;
89
      param1[5] = puVar10;
90
      param1[4] = 0x2d;
91
      *param1 = 2;
92
      *(ulonglong *)((int)puVar10 + 0x25) = CONCAT53(uRam00100733,DAT_ram_0010072b._5_3_);
93
      puVar10[4] = CONCAT35(DAT_ram_0010072b._5_3_,(undefined5)DAT_ram_0010072b);
94
      puVar10[3] = DAT_ram_00100723;
95
      puVar10[2] = DAT_ram_0010071b;
96
      puVar10[1] = DAT_ram_00100713;
97
      *puVar10 = DAT_ram_0010070b;
98
    }
99
    else {
100
      local_88._0_4_ = (undefined4)local_58;
101
      uVar7 = (undefined4)local_88;
102
      local_88 = uVar4;
103
      _ZN9wasm_core5state19build_session_token17he7d62ea5adb7b396E
104
                (&local_30,uStack_5c,uVar7,&local_90);
105
      param1_00 = local_2c;
106
      if (((size_t)local_70 != 0) && ((size_t)local_70 == local_28)) {
107
        iVar9 = memcmp(local_78._4_4_,local_2c,(size_t)local_70);
108
        if (iVar9 == 0) {
109
          _ZN9wasm_core7license13normalize_key17h58190eb56e6def8eE(&local_24,uStack_5c,uVar7);
110
          uVar7 = 0;
111
          if (-1 < local_1c) {
112
            local_14 = 1;
113
            if (local_1c != 0) {
114
              _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
115
              uVar7 = 1;
116
              local_14 = _RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(local_1c,1);
117
              if (local_14 == 0) goto code_r0x80003216;
118
            }
119
            local_18 = local_1c;
120
            if (local_1c != 0) {
121
              memory_copy(0,0,local_1c,local_20,local_14);
122
            }
123
            local_10 = local_1c;
124
            _ZN5alloc7raw_vec20RawVecInner$LT$A$GT$7reserve21do_reserve_and_handle17h27a7abd20686458 bE
125
                      (&local_18,local_1c,1,1,1);
126
            *(undefined1 *)(local_14 + local_10) = 0x7c;
127
            local_10 = local_10 + 1;
128
            if ((uint)(local_18 - local_10) < 0x13) {
129
              _ZN5alloc7raw_vec20RawVecInner$LT$A$GT$7reserve21do_reserve_and_handle17h27a7abd206864 58bE
130
                        (&local_18,local_10,0x13,1,1);
131
            }
132
            iVar9 = local_14;
133
            puVar10 = (undefined8 *)(local_14 + local_10);
134
            *puVar10 = DAT_ram_001006a4;
135
            *(undefined4 *)((int)puVar10 + 0xf) = ram0x001006b3;
136
            puVar10[1] = CONCAT17(DAT_ram_001006ac._7_1_,(undefined7)DAT_ram_001006ac);
137
            iVar14 = local_10 + 0x13;
138
            local_10 = iVar14;
139
            _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
140
            local_8 = (undefined8 *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0x2a,1);
141
            if (local_8 == (undefined8 *)0x0) {
142
              _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0x2a);
143
              do {
144
                halt_trap();
145
              } while( true );
146
            }
147
            local_4 = 0;
148
            local_c = 0x2a;
149
            iVar8 = 0;
150
            do {
151
              iVar6 = local_4;
152
              iVar13 = iVar8 + 1;
153
              bVar1 = *(byte *)(iVar9 + iVar8);
154
              cVar3 = (char)local_4;
155
              bVar2 = (&DAT_ram_001006b7)[local_4];
156
              if (local_4 == local_c) {
157
                _ZN5alloc7raw_vec19RawVec$LT$T$C$A$GT$8grow_one17hc8d51d460bbc6465E(&local_c);
158
              }
159
              puVar10 = local_8;
160
              param2_00 = local_c;
161
              iVar8 = 0;
162
              if (iVar13 != iVar14) {
163
                iVar8 = iVar13;
164
              }
165
              *(byte *)((int)local_8 + iVar6) = bVar1 ^ cVar3 * '\x1d' + 0x11U ^ bVar2;
166
              local_4 = iVar6 + 1;
167
            } while (local_4 != 0x2a);
168
            uVar7 = 0x2a;
169
            _ZN4core3str8converts9from_utf817h98d2c0a7c1a2b83eE(&local_60,local_8,0x2a);
170
            if (local_60 != 0) {
171
              _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
172
              uVar7 = 0x14;
173
              puVar11 = (undefined8 *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0x14,1);
174
              if (puVar11 == (undefined8 *)0x0) {
175
                _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0x14);
176
                do {
177
                  halt_trap();
178
                } while( true );
179
              }
180
              *(undefined4 *)(puVar11 + 2) = DAT_ram_001006f1;
181
              puVar11[1] = DAT_ram_001006e9;
182
              *puVar11 = DAT_ram_001006e1;
183
              if (param2_00 != 0) {
184
                _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(puVar10,param2_00,1);
185
              }
186
              param2_00 = 0x14;
187
              puVar10 = puVar11;
188
            }
189
            if (local_18 != 0) {
190
              _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(iVar9,local_18,1);
191
            }
192
            _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
193
            puVar12 = (undefined4 *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(7,1);
194
            if (puVar12 != (undefined4 *)0x0) {
195
              *(undefined1 *)(param1 + 8) = 1;
196
              *(undefined8 *)(param1 + 6) = 7;
197
              param1[5] = puVar12;
198
              param1[4] = 7;
199
              param1[3] = uVar7;
200
              param1[2] = puVar10;
201
              param1[1] = param2_00;
202
              *param1 = 1;
203
              *(uint *)((int)puVar12 + 3) = CONCAT31(uRam00100764,DAT_ram_00100760._3_1_);
204
              *puVar12 = DAT_ram_00100760;
205
              if (local_24 != 0) {
206
                _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_20,local_24,1);
207
              }
208
              if (local_30 != 0) {
209
                _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(param1_00,local_30,1);
210
              }
211
              if ((int)local_90 != 0) {
212
                _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_90._4_4_,(int)local_90,1);
213
              }
214
              if (local_88._4_4_ != 0) {
215
                _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc
216
                          ((undefined4)local_80,local_88._4_4_ << 2,4);
217
              }
218
              if ((int)local_78 == 0) {
219
                return;
220
              }
221
              _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_78._4_4_,(int)local_78,1);
222
              return;
223
            }
224
            _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,7);
225
            do {
226
              halt_trap();
227
            } while( true );
228
          }
229
code_r0x80003216:
230
          _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(uVar7,local_1c);
231
          do {
232
            halt_trap();
233
          } while( true );
234
        }
235
      }
236
      _RNvCs1Y7DaGC1cwg_7___rustc35___rust_no_alloc_shim_is_unstable_v2();
237
      puVar10 = (undefined8 *)_RNvCs1Y7DaGC1cwg_7___rustc12___rust_alloc(0x16,1);
238
      if (puVar10 == (undefined8 *)0x0) {
239
        _ZN5alloc7raw_vec12handle_error17h9ace31a903e6893eE(1,0x16);
240
        do {
241
          halt_trap();
242
        } while( true );
243
      }
244
      *(undefined1 *)(param1 + 8) = 0;
245
      *(undefined8 *)(param1 + 6) = 0x3ed00000016;
246
      param1[5] = puVar10;
247
      param1[4] = 0x16;
248
      *param1 = 2;
249
      *(ulonglong *)((int)puVar10 + 0xe) = CONCAT62(uRam00100705,DAT_ram_001006fd._6_2_);
250
      puVar10[1] = CONCAT26(DAT_ram_001006fd._6_2_,(undefined6)DAT_ram_001006fd);
251
      *puVar10 = DAT_ram_001006f5;
252
      if (local_30 != 0) {
253
        _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_2c,local_30,1);
254
      }
255
    }
256
    if ((int)local_90 != 0) {
257
      _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_90._4_4_,(int)local_90,1);
258
    }
259
    if (local_88._4_4_ != 0) {
260
      _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc((undefined4)local_80,local_88._4_4_ << 2,4);
261
    }
262
    if ((int)local_78 != 0) {
263
      _RNvCs1Y7DaGC1cwg_7___rustc14___rust_dealloc(local_78._4_4_,(int)local_78,1);
264
    }
265
  }
266
  return;
267
}

先解密key license key = NCTF-RU57-W45M-2048

1
# pip install z3-solver
2
from z3 import *
3

4
MASK = bytes.fromhex(
5
    "0d382a19a9f4ecf7fa10355e27c6b693e6a853360b6583edc4b75f3d6359279486ffe70f42145f05c8fb"
6
)
7
SEED = b"arcade::unlock-seed"
8
TAIL = b"|" + SEED  # 20 bytes
9

10
chars = [BitVec(f"c{i}", 32) for i in range(12)]
11
s = Solver()
12

13
# key 字符集：A-Z0-9
14
for c in chars:
15
    s.add(Or(And(c >= ord("0"), c <= ord("9")), And(c >= ord("A"), c <= ord("Z"))))
16

17
# verify_license_impl 的 32-bit 校验
18
state = BitVecVal(0x1357, 32)
19
for i, c in enumerate(chars):
20
    k = BitVecVal(0x9E37 if (i & 1) else 0x45D9, 32)
21
    rot = (state << 3) | LShR(state, 29)
22
    state = (((k + c) * BitVecVal(i + 0xB, 32)) ^ rot) + ((c << (i % 5)) ^ BitVecVal(0xA5A55A5A, 32))
23
s.add(state == BitVecVal(0xFC97CA2F, 32))
24

25
# 为避免哈希碰撞，约束输出 flag 形态：NCTF{8-4-4-4-12 hex}
26
outs = []
27
for i in range(42):
28
    src = chars[i] if i < 12 else (BitVecVal(TAIL[i - 12], 32) if i < 32 else chars[i - 32])
29
    mix = ((i * 0x1D + 0x11) & 0xFF) ^ MASK[i]
30
    outs.append((src ^ BitVecVal(mix, 32)) & 0xFF)
31

32
fixed = {0: "N", 1: "C", 2: "T", 3: "F", 4: "{", 13: "-", 18: "-", 23: "-", 28: "-", 41: "}"}
33
for i, ch in fixed.items():
34
    s.add(outs[i] == ord(ch))
35

36
hex_pos = list(range(5, 13)) + list(range(14, 18)) + list(range(19, 23)) + list(range(24, 28)) + list(range(29, 41))
37
for i in hex_pos:
38
    o = outs[i]
39
    s.add(Or(And(o >= ord("0"), o <= ord("9")), And(o >= ord("a"), o <= ord("f"))))
40

41
if s.check() != sat:
42
    print("No solution")
43
    raise SystemExit(1)
44

45
m = s.model()
46
key12 = "".join(chr(m[c].as_long()) for c in chars)
47
full_key = f"NCTF-{key12[:4]}-{key12[4:8]}-{key12[8:]}"
48
print("key12 =", key12)
49
print("license key =", full_key)

在用key解密flag

1
import re
2
import sys
3

4
MASK = bytes.fromhex(
5
    "0d382a19a9f4ecf7fa10355e27c6b693e6a853360b6583edc4b75f3d6359279486ffe70f42145f05c8fb"
6
)
7
SEED = b"arcade::unlock-seed"
8

9
def normalize_key(full_key: str) -> str:
10
    m = re.fullmatch(r"NCTF-([A-Z0-9]{4})-([A-Z0-9]{4})-([A-Z0-9]{4})", full_key)
11
    if not m:
12
        raise ValueError("key format must be NCTF-XXXX-XXXX-XXXX (A-Z0-9)")
13
    return "".join(m.groups())
14

15
def decrypt_flag(full_key: str) -> str:
16
    key12 = normalize_key(full_key).encode()
17
    plain = key12 + b"|" + SEED  # 32 bytes
18
    out = bytearray(42)
19
    for i in range(42):
20
        mix = ((i * 0x1D + 0x11) & 0xFF) ^ MASK[i]
21
        out[i] = plain[i % len(plain)] ^ mix
22
    return out.decode("utf-8", errors="replace")
23

24
if __name__ == "__main__":
25
    if len(sys.argv) != 2:
26
        print("Usage: python flag.py NCTF-XXXX-XXXX-XXXX")
27
        sys.exit(1)
28
    print(decrypt_flag(sys.argv[1]))

NCTF{bff16266-c4f2-4dbb-b270-f5ded900b54c}

vm encryptor#

main函数是sub_140001000

读取code.bin到vm内存

调用vm解释起执行code.bin

vm解释器sub_140001270

VM 上下文布局（按 int *a1）

a1[0]：pc（程序计数器）

a1[1]：sp（栈深，最大 0x1000）

((uint8_t*)a1)+12：mem[0x10000]（代码+数据统一内存）

a1[16387 …]：stack[0x1000]（32-bit 栈）

a1[20483]：运行标志（非 0 继续，0 停止）

a1[20484]：错误码（0 表示无错）

1
指令集（已确认）
2

3
控制流
4
0x00 JMP imm32
5
0x01 JZ imm32（弹栈，值==0跳）
6
0x02 JNZ imm32（弹栈，值!=0跳）
7
0x1E CALL imm32（压返回地址，跳转）
8
0x1F RET（弹返回地址到 pc）
9
0xFF HALT
10

11
栈/内存
12
0x03 PUSH8 imm8
13
0x04 PUSH32 imm32
14
0x05 LDB（弹地址，读 1 字节压栈）
15
0x06 LDI（弹地址，读 4 字节压栈）
16
0x07 POP
17
0x08 STB（弹 addr,val，写 1 字节）
18
0x09 STI（弹 addr,val，写 4 字节）
19
0x1C DUP
20
0x1D SWAP
21
0x20 PUTS（弹地址，输出内存中的 \0 字符串）
22

23
算术/比较
24
0x0A ADD
25
0x0B SUB
26
0x0C MUL
27
0x0D DIV
28
0x0E MOD
29
0x18 LT
30
0x19 GT
31
0x1A LE
32
0x1B GE
33

34
位运算组（在题目里大量用于 24-bit 混淆）
35
0x0F~0x17 这组是按位与/或/异或/移位类操作（从字节码行为可确认被用于拼 24-bit、mask 0x00ffffff、常量 0x55757d 变换）。

1
#!/usr/bin/env python3
2
import base64
3
from pathlib import Path
4

5
MASK24 = (1 << 24) - 1
6
C = 0x55757D
7

8
def ror24(x: int, n: int) -> int:
9
    n %= 24
10
    return ((x >> n) | ((x << (24 - n)) & MASK24)) & MASK24
11

12
def solve(path="code.bin"):
13
    data = Path(path).read_bytes()
14

15
    # 比较常量（56字节）
16
    enc = data[0x109D:0x109D + 56]
17

18
    # 逆阶段2：xor 0x63
19
    s = bytes(b ^ 0x63 for b in enc)
20

21
    # 逆阶段1：base64 decode -> 42 bytes
22
    mid = base64.b64decode(s)
23

24
    # 逆阶段0：每3字节逆三轮 24-bit 变换
25
    out = bytearray()
26
    for i in range(0, len(mid), 3):
27
        x = (mid[i] << 16) | (mid[i + 1] << 8) | mid[i + 2]
28
        x = ror24(x ^ C, 20)
29
        x = ror24(x ^ C, 11)
30
        x = ror24(x ^ C, 5)
31
        out += bytes([(x >> 16) & 0xFF, (x >> 8) & 0xFF, x & 0xFF])
32

33
    flag = out.decode("ascii")
34
    print(flag)
35

36
if __name__ == "__main__":
37
    solve()

NCTF{1578be15-ad09-4859-9193-5d52585eb485}