强网杯 tradre 复现

tradre复现

1.fork()简介

函数原型：

pid_t fork(void)；//pid_t为int类型，进行了重载
pid_t getpid();// 获取当前进程的 pid 值。
pid_t getppid(); //获取当前进程的父进程 pid 值。
用于创建一个进程，所创建的进程复制父进程的代码段/数据段/BSS段/堆/栈等所有用户空间信息；在内核中操作系统重新为其申请了一个PCB，并使用父进程的PCB进行初始化。

2.ptrace 基础介绍

​ ptrace 是 linux内核 提供的一个系统调用，并非一个标准的posix接口，ptrace 主要用于进程跟踪和调试。它运行一个用户态进程（通常称为跟踪器, Tracer）控制和监视另一个进程（称为被调试进程, Tracee）的执行。ptrace是许多调试跟踪工具（如：GDB、strace 等）的 “基座”，其函数原型如下：

参数：

​ request：用于标识一个需要执行的操作；

​ pid：标识目标线程ID

​ addr、data：一个内存地址和附加信息，其语义因选择的操作而不同；

这里详细介绍下ptrace系统调用中的参数request，通过该参数，ptrace为用户态提供了丰富的进程调试跟踪功能。

1）PTRACE_TRACEME

​ 允许当前进程被其父进程跟踪，通常用于GDB加载运行一个被调试程序；

2）PTRACE_PEEKTEXT

​ 读取目标进程的代码段内容，通常用于GDB查看目标进程的指令代码；

3）PTRACE_PEEKDATA

​ 读取目标进程的数据段内容，通常用于GDB查看目标进程的全局变量、堆栈内容等；

4）PTRACE_PEEKUSER

​ 读取目标进程的用户态寄存器和状态信息，通常用于GDB查看目标进程的PC、SP等；

5）PTRACE_POKETEXT

​ 修改目标进程的代码段内容，用于GDB修改目标进程的指令代码，例如设置软断点；

6）PTRACE_POKEDATA

​ 修改目标进程的数据段内容，用于GDB修改目标进程的全局变量、堆栈内容等数据；

7）PTRACE_POKEUSER

​ 修改目标进程的用户态寄存器和状态信息；

8）PTRACE_CONT

​ 唤醒目标进程继续执行，通常用于GDB的continue功能；

9）PTRACE_KILL

​ 终止目标进程，用于GDB杀死被调试进程；

10）PTRACE_SINGLESTEP

​ 单步执行目标进程，通常用于GDB的step单步调试目标进程的功能；

11）PTRACE_GETREGS

​ 获取目标进程的寄存器状态，如当前的程序计数器（PC）、栈指针（SP）等；

12）PTRACE_SETREGS

​ 设置目标进程的寄存器状态；

13）PTRACE_ATTACH

​ 用于attach到一个正在运行的目标进程，通常用于GDB attach调试功能；

14）PTRACE_DETACH

​ 从一个目标进程上detach，通常用于GDB解除对目标进程的调试功能；

15）PTRACE_SYSCALL

​ 在目标进程的系统调用入口处、返回处暂停，通常用于strace工具捕获目标进程的系统调用；

16）PTRACE_SETOPTIONS

​ 设置目标进程的跟踪选项，通常用于GDB设置是否对目标进程的一些操作（如：fork、pthread_create、exec、所有系统调用等）进行跟踪；

17）PTRACE_GETSIGINFO

​ 获取目标进程的信号信息，通常用于GDB获取目标进程的异常地址、exit_code、pending信号等信息；

18）PTRACE_GETEVENTMSG

​ 获取目标进程与特定 ptrace事件 相关联的消息，例如GDB获取目标进程fork创建的子进程/子线程pid信息、位于系统调用入口处/出口处 等信息；

19）PTRACE_GETREGSET

​ 获取目标进程的寄存器集合；

20）PTRACE_SETREGSET

​ 设置目标进程的寄存器集合，通常用于GDB设置目标进程的硬断点、观察点；

题目分析

先找到main函数

很明显上来就是一个fork函数

将程序分成父子进程

通过子进程的PTRACE_TRACEME可以看出，这里的子进程被父进程所调试，父进程也进行了某些操作，所以如果我们进行动态调试的话，程序走到这里会报错，其中执行的代码无法实现，直接nop掉也无法实现父进程中所进行的操作，从而实现了反调试

接着往子进程来分析

我们转到汇编层再看可以看出

汇编层有很多int 3

这在正常的程序中并不是很常见

再分析父进程的逻辑可以大概看出，

父进程一直在监听着子进程的信号

当子进程走到int 3的时候会像父进程发送这个信号

父进程收到了这个信号之后进行了一些修改从而实现了程序的正常运行，

一开始我以为父进程是对子进程的内存进行了某些修改从而实现了把int 3来替换成其它的汇编代码，

所以想通过附加父进程来获取它对内存的修改，

实际上并非如此，

下面来分析这个父进程

从整体上来看可以看出这里面的数据其实是非常抽象的

但我们结合sub_402425来分析

其实可以看出其实qword_606AA0就是代表着一个地址，这个地址可以是指向另一个地址，也可以指向某个函数，

sub_401EA5指向return 3

sub_401EB4 return 4

sub_401E96 return 2

从中可以提取出一个结构体，如下

struct Handler {  
	struct Handler* left;
    struct Handler* right;
    int (*func)(user_regs_struct *regs);
    size_t addr;
    }

还有一些其它的函数例如

这里我也不是太懂，看大佬分析说是标志位判断，估计是a1中存的值是当时所有寄存器中的值再加上标志位的值a1+144所对应的值应该就是，当时标志位的值

建立了结构体之后

将qword_606AC0设置为对应的数据

再看到set_handlers()(就是原来的sub_402425

大概就能够看出来这些代码的逻辑了

再回到父进程的代码进行分析

在 set_handlers 函数初始化 handlers 之后，父进程捕获子进程的 int3 指令，然后根据当前的 handler_ptr 进行处理，处理方式有：

0 无条件 jmp 指令（ func 为空）

1 条件跳转指令（ func 返回值为 0 或者 1）

2 ret 指令（ func 为 return2 ）

3 call 指令，目标是未被保护的函数（ func 为 return3 ，当前逆向题的调用目标都是库函数）

4 call 指令，目标是同样被保护的函数（ func 为 return4 ）

所以父进程中并没有实际的运算逻辑，而是只有跳转逻辑，反过来说就是子进程中的各个基本块被切分开，由父进程做基本块之间的逻辑分发。

所以只需要复原逻辑分发，这个翻译的代码也是按大佬的代码来写的，其中会遇到一些报错，是因为前面的set_handle函数中有一些sub函数是标志位的判断，需要根据上面的那个图分析逻辑

import re
import keystone
import capstone

lines ='''
handlers[14].left = &handlers[134];
handlers[10].addr = &loc_400BF8;
handlers[67].right = &handlers[39];
handlers[91].addr = &loc_40138B;
handlers[135].addr = &loc_4015CC;
handlers[145].addr = &loc_4016BF;
handlers[30].right = &handlers[83];
handlers[68].addr = &loc_40120C;
handlers[129].addr = &loc_401594;
handlers[82].addr = &loc_4012EF;
handlers[117].right = &handlers[34];
handlers[160].addr = &loc_401839;
handlers[57].func = return4;
handlers[28].addr = &loc_400D5B;
handlers[41].func = return2;
handlers[102].left = &handlers[116];
handlers[178].addr = sub_4019B7;
handlers[54].func = return2;
handlers[150].addr = &loc_40171B;
handlers[129].right = atoi;
handlers[38].addr = &loc_400E5D;
handlers[176].func = l;
handlers[8].right = &handlers[179];
handlers[45].left = &handlers[46];
handlers[26].left = &handlers[171];
handlers[177].addr = sub_4019AC;
handlers[126].func = return3;
handlers[170].left = 0LL;
handlers[53].left = &handlers[61];
handlers[122].right = memset;
handlers[6].left = &handlers[104];
handlers[135].right = &handlers[165];
handlers[117].left = 0LL;
handlers[101].right = &handlers[123];
handlers[64].left = 0LL;
handlers[163].left = &handlers[41];
handlers[40].left = &handlers[160];
handlers[140].addr = &loc_40163E;
handlers[42].left = 0LL;
handlers[6].addr = &loc_400B81;
handlers[153].func = return4;
handlers[11].addr = &loc_400BFE;
handlers[54].addr = &locret_401032;
handlers[53].addr = &loc_401018;
handlers[132].func = return2;
handlers[4].right = srand;
handlers[169].right = puts;
handlers[23].right = &handlers[173];
handlers[37].func = return3;
handlers[167].right = &handlers[26];
handlers[41].addr = &loc_400F7A;
handlers[70].addr = &loc_40122E;
handlers[178].func = l;
handlers[94].addr = &loc_4013CE;
handlers[163].right = &handlers[40];
handlers[125].right = &handlers[51];
handlers[156].left = &handlers[106];
handlers[161].right = &handlers[43];
handlers[85].left = &handlers[36];
handlers[62].func = return4;
handlers[75].right = puts;
handlers[127].addr = &loc_40158A;
handlers[152].right = &handlers[59];
handlers[81].right = puts;
handlers[170].right = 0LL;
handlers[111].func = return4;
handlers[125].func = return4;
handlers[42].func = 0LL;
handlers[69].func = return4;
handlers[131].right = 0LL;
handlers[3].left = &handlers[152];
handlers[23].addr = &loc_400CDF;
handlers[58].right = &handlers[178];
handlers[159].addr = &loc_401831;
handlers[147].left = 0LL;
handlers[44].addr = &loc_400FC1;
handlers[118].func = return4;
handlers[137].left = &handlers[73];
handlers[51].right = &handlers[40];
handlers[60].left = 0LL;
handlers[7].addr = &loc_400BAB;
handlers[144].right = &handlers[40];
handlers[66].left = 0LL;
handlers[67].left = 0LL;
handlers[2].addr = &loc_400B03;
handlers[128].addr = &loc_40158B;
handlers[63].left = &handlers[180];
handlers[17].left = &handlers[133];
handlers[156].right = &handlers[54];
handlers[9].func = return3;
handlers[72].addr = &loc_401254;
handlers[101].addr = &loc_401441;
handlers[53].func = return3;
handlers[1].addr = &loc_400AFD;
handlers[55].left = 0LL;
handlers[47].right = &handlers[5];
handlers[172].func = 0LL;
handlers[46].addr = &loc_400FDB;
handlers[132].right = 0LL;
handlers[97].right = &handlers[84];
handlers[115].right = &handlers[149];
handlers[102].func = return4;
handlers[156].func = e;
handlers[42].right = &handlers[117];
handlers[69].right = &handlers[173];
handlers[6].func = ne;
handlers[22].func = 0LL;
handlers[64].right = &handlers[124];
handlers[61].left = &handlers[140];
handlers[141].left = &handlers[119];
handlers[106].addr = &loc_4014A0;
handlers[17].right = &handlers[33];
handlers[112].right = &handlers[43];
handlers[97].left = &handlers[1];
handlers[117].addr = &loc_4014FA;
handlers[34].addr = &loc_400E1A;
handlers[72].left = &handlers[75];
handlers[153].addr = &loc_4017C4;
handlers[177].left = &handlers[150];
handlers[114].addr = &loc_4014DA;
handlers[159].right = &handlers[149];
handlers[158].addr = &loc_40180D;
handlers[45].right = &handlers[142];
handlers[94].left = &handlers[87];
handlers[113].right = &handlers[151];
handlers[82].right = &handlers[173];
handlers[111].addr = &loc_4014C7;
handlers[60].addr = &loc_40117F;
handlers[23].left = &handlers[120];
handlers[120].left = 0LL;
handlers[119].left = 0LL;
handlers[31].left = 0LL;
handlers[53].right = setvbuf;
handlers[111].right = &handlers[40];
handlers[137].addr = &loc_4015E3;
handlers[170].func = return2;
handlers[46].func = return4;
handlers[98].right = &handlers[24];
handlers[179].func = 0LL;
handlers[86].func = return4;
handlers[103].addr = &loc_40148B;
handlers[83].right = &handlers[30];
handlers[89].left = 0LL;
handlers[121].addr = &loc_401525;
handlers[62].right = &handlers[51];
handlers[49].addr = &locret_400FF9;
handlers[133].right = &handlers[157];
handlers[136].left = 0LL;
handlers[5].func = le;
handlers[151].right = &handlers[113];
handlers[104].addr = &loc_401490;
handlers[19].left = &handlers[143];
handlers[76].addr = &loc_4012B2;
handlers[71].func = return4;
handlers[134].left = &handlers[155];
handlers[152].func = return4;
handlers[69].left = &handlers[112];
handlers[113].addr = &loc_4014D5;
handlers[150].right = &handlers[59];
handlers[2].left = 0LL;
handlers[126].left = &handlers[55];
handlers[39].left = &handlers[50];
handlers[56].addr = &loc_40104D;
handlers[34].func = le;
handlers[43].addr = &loc_400FB1;
handlers[180].right = &handlers[102];
handlers[164].right = &handlers[19];
handlers[4].left = &handlers[115];
handlers[12].right = &handlers[165];
handlers[160].right = &handlers[114];
handlers[102].right = &handlers[165];
handlers[171].addr = &loc_4018E5;
handlers[88].addr = &loc_40133D;
handlers[36].addr = &loc_400E3A;
handlers[85].addr = &loc_401319;
handlers[29].left = &handlers[21];
handlers[124].addr = &loc_401566;
handlers[180].func = return4;
handlers[92].left = 0LL;
handlers[125].left = &handlers[11];
handlers[16].func = return3;
handlers[60].func = 0LL;
handlers[144].addr = &loc_401684;
handlers[80].func = 0LL;
handlers[141].addr = &loc_401658;
handlers[29].func = return4;
handlers[130].right = &handlers[162];
handlers[26].func = return4;
handlers[152].left = &handlers[70];
handlers[162].right = &handlers[102];
handlers[2].right = &handlers[34];
handlers[89].right = &handlers[18];
handlers[25].addr = &loc_400D45;
handlers[93].func = return3;
handlers[145].right = &handlers[130];
handlers[49].left = 0LL;
handlers[161].func = 0LL;
handlers[175].func = return4;
handlers[23].func = return4;
handlers[163].addr = &loc_40185B;
handlers[123].right = &handlers[101];
handlers[12].addr = &loc_400C10;
handlers[21].right = &handlers[40];
handlers[60].right = &handlers[5];
handlers[166].left = &handlers[13];
handlers[28].right = &handlers[91];
handlers[96].addr = &loc_4013F4;
handlers[94].right = &handlers[12];
handlers[179].addr = &loc_4019CA;
handlers[24].left = 0LL;
handlers[112].func = 0LL;
handlers[112].addr = &loc_4014CD;
handlers[176].left = &handlers[66];
handlers[163].func = return4;
handlers[64].addr = &loc_4011C4;
handlers[158].left = 0LL;
handlers[15].right = &handlers[178];
handlers[68].right = 0LL;
handlers[147].addr = &loc_401703;
handlers[93].right = puts;
handlers[31].addr = &loc_400DDB;
handlers[39].func = e;
handlers[143].right = &handlers[117];
handlers[12].left = &handlers[128];
handlers[63].addr = &loc_4011B1;
handlers[10].left = &handlers[47];
handlers[20].addr = &loc_400C8C;
handlers[129].left = &handlers[156];
handlers[168].left = 0LL;
handlers[88].right = &handlers[103];
handlers[142].addr = &loc_40165E;
handlers[1].right = exit;
handlers[169].left = &handlers[72];
handlers[123].func = le;
handlers[31].right = 0LL;
handlers[155].addr = &loc_4017E1;
handlers[139].addr = &loc_401633;
handlers[106].right = &__stack_chk_fail;
handlers[146].addr = &loc_401702;
handlers[88].func = 0LL;
handlers[148].left = &handlers[131];
handlers[145].func = 0LL;
handlers[142].func = return4;
handlers[16].left = &handlers[6];
handlers[50].left = &handlers[20];
handlers[130].func = le;
handlers[115].addr = &loc_4014DC;
handlers[73].left = 0LL;
handlers[0].func = return4;
handlers[85].func = return4;
handlers[132].addr = &loc_4015AD;
handlers[161].addr = &loc_401843;
handlers[158].func = 0LL;
handlers[162].left = &handlers[7];
handlers[48].func = return2;
handlers[54].left = 0LL;
handlers[151].addr = &loc_401726;
handlers[13].left = &handlers[90];
handlers[179].right = &handlers[17];
handlers[65].left = 0LL;
handlers[20].right = 0LL;
handlers[15].addr = &loc_400C47;
handlers[170].addr = &loc_4018E2;
handlers[167].left = &handlers[71];
handlers[171].right = &handlers[59];
handlers[165].right = &handlers[40];
handlers[66].func = 0LL;
handlers[77].addr = &loc_4012B8;
handlers[65].func = 0LL;
handlers[140].left = &handlers[9];
handlers[171].left = &handlers[85];
handlers[9].addr = &loc_400BEB;
handlers[100].left = &handlers[97];
handlers[59].left = 0LL;
handlers[30].addr = &loc_400DA3;
handlers[78].right = &__stack_chk_fail;
handlers[11].right = &handlers[51];
handlers[87].left = &handlers[118];
handlers[105].left = 0LL;
handlers[33].left = &handlers[8];
handlers[77].left = 0LL;
handlers[59].right = 0LL;
handlers[0].right = &handlers[169];
handlers[16].right = rand;
handlers[1].func = return3;
handlers[63].func = return4;
handlers[138].func = e;
handlers[99].addr = &loc_40141C;
handlers[49].func = return2;
handlers[20].left = 0LL;
handlers[90].addr = &loc_40138A;
handlers[104].left = 0LL;
handlers[81].addr = &loc_4012E7;
handlers[161].left = 0LL;
handlers[48].left = 0LL;
handlers[84].left = &handlers[35];
handlers[80].right = &handlers[130];
handlers[71].addr = &loc_401249;
handlers[47].left = 0LL;
handlers[29].addr = &loc_400D90;
handlers[110].func = return2;
handlers[154].func = 0LL;
handlers[87].addr = &loc_40132A;
handlers[62].left = &handlers[144];
handlers[76].func = return3;
handlers[73].addr = &loc_40125C;
handlers[99].right = puts;
handlers[25].func = return3;
handlers[47].addr = &loc_400FEE;
handlers[26].addr = &loc_400D4D;
handlers[137].func = return4;
handlers[136].addr = &locret_4015E1;
handlers[86].left = &handlers[141];
handlers[68].func = return2;
handlers[174].left = 0LL;
handlers[160].func = 0LL;
handlers[121].left = &handlers[96];
handlers[13].right = &handlers[147];
handlers[149].left = &handlers[65];
handlers[108].right = &handlers[24];
handlers[116].func = return4;
handlers[109].addr = &loc_4014BD;
handlers[131].addr = &loc_4015A1;
handlers[72].right = puts;
handlers[100].func = return3;
handlers[82].left = &handlers[175];
handlers[78].addr = &loc_4012C0;
handlers[30].left = 0LL;
handlers[38].left = 0LL;
handlers[127].right = &__stack_chk_fail;
handlers[90].right = &__stack_chk_fail;
handlers[83].addr = &loc_40130A;
handlers[43].left = &handlers[3];
handlers[57].left = &handlers[56];
handlers[0].left = &handlers[53];
handlers[147].right = 0LL;
handlers[18].addr = &loc_400C7C;
handlers[101].func = 0LL;
handlers[166].func = le;
handlers[155].func = return4;
handlers[47].func = 0LL;
handlers[137].right = &handlers[40];
handlers[10].right = srand;
handlers[113].left = &handlers[60];
handlers[18].left = &handlers[64];
handlers[59].func = return2;
handlers[116].right = &handlers[95];
handlers[107].func = return2;
handlers[75].left = &handlers[81];
handlers[13].addr = &loc_400C25;
handlers[122].left = &handlers[98];
handlers[159].func = 0LL;
handlers[66].right = &handlers[138];
handlers[17].addr = &loc_400C74;
handlers[164].left = 0LL;
handlers[114].func = return2;
handlers[164].addr = &loc_401864;
handlers[5].addr = &loc_400B7C;
handlers[167].func = le;
handlers[89].func = 0LL;
handlers[133].func = le;
handlers[178].left = &handlers[23];
handlers[89].addr = &loc_40137F;
handlers[22].right = &handlers[123];
handlers[102].addr = &loc_401476;
handlers[125].addr = &loc_401576;
handlers[142].left = &handlers[31];
handlers[39].addr = &loc_400F5C;
handlers[139].right = &handlers[158];
handlers[157].func = return3;
handlers[59].addr = &loc_401080;
handlers[99].func = return3;
handlers[86].addr = &loc_401324;
handlers[70].right = &handlers[173];
handlers[178].right = &handlers[174];
handlers[135].func = return4;
handlers[50].func = return3;
handlers[169].addr = &loc_4018CE;
handlers[117].func = 0LL;
handlers[108].func = return4;
handlers[44].func = return3;
handlers[138].right = &handlers[49];
handlers[176].addr = &loc_4019A2;
handlers[92].addr = &loc_401390;
handlers[16].addr = &loc_400C4F;
handlers[50].addr = &loc_400FFB;
handlers[166].addr = &loc_4018B7;
handlers[151].left = 0LL;
handlers[122].func = return3;
handlers[43].func = le;
handlers[7].left = &handlers[57];
handlers[150].left = &handlers[139];
handlers[61].right = setvbuf;
handlers[4].addr = &loc_400B79;
handlers[130].addr = &loc_40159C;
handlers[175].addr = &loc_40195E;
handlers[0].addr = sub_4009F7;
handlers[22].addr = &loc_400CCF;
handlers[130].left = &handlers[32];
handlers[51].left = &handlers[132];
handlers[103].right = &handlers[88];
handlers[35].func = 0LL;
handlers[3].func = return4;
handlers[55].func = 0LL;
handlers[22].left = 0LL;
handlers[133].left = &handlers[93];
handlers[5].left = &handlers[170];
handlers[153].right = &handlers[40];
handlers[33].func = return3;
handlers[32].func = e;
handlers[84].addr = &loc_401312;
handlers[83].left = &handlers[42];
handlers[166].right = &handlers[153];
handlers[8].left = &handlers[52];
handlers[154].left = 0LL;
handlers[177].right = &handlers[154];
handlers[128].func = return4;
handlers[44].right = puts;
handlers[58].func = 0LL;
handlers[123].addr = &loc_401561;
handlers[164].func = 0LL;
handlers[33].addr = &loc_400DEF;
handlers[143].addr = &loc_401672;
handlers[81].left = &handlers[37];
handlers[118].left = &handlers[14];
handlers[2].func = 0LL;
handlers[75].addr = &loc_4012AA;
handlers[35].addr = &loc_400E22;
handlers[99].left = &handlers[76];
handlers[127].left = &handlers[49];
handlers[57].right = &handlers[12];
handlers[37].addr = &loc_400E55;
handlers[103].func = le;
handlers[110].right = 0LL;
handlers[74].addr = &loc_40129F;
handlers[21].addr = &loc_400C96;
handlers[83].func = le;
handlers[98].addr = &loc_40140F;
handlers[103].left = &handlers[27];
handlers[24].func = 0LL;
handlers[58].addr = &loc_401073;
handlers[97].func = g;
handlers[15].left = 0LL;
handlers[10].func = return3;
handlers[148].addr = &loc_40170A;
handlers[29].right = &handlers[51];
handlers[174].addr = &loc_401953;
handlers[25].right = puts;
handlers[107].left = 0LL;
handlers[37].left = &handlers[25];
handlers[38].func = return2;
handlers[19].func = le;
handlers[7].right = &handlers[135];
handlers[136].right = 0LL;
handlers[79].addr = &loc_4012C1;
handlers[119].right = 0LL;
handlers[14].addr = &loc_400C34;
handlers[175].right = &handlers[173];
handlers[119].func = return2;
handlers[88].left = 0LL;
handlers[39].right = &handlers[20];
handlers[34].left = &handlers[15];
handlers[37].right = puts;
handlers[74].right = &handlers[59];
handlers[48].addr = &loc_400FF6;
handlers[32].right = &handlers[68];
handlers[172].right = &handlers[83];
handlers[14].right = &handlers[135];
handlers[42].addr = &loc_400F83;
handlers[94].func = return4;
handlers[165].left = &handlers[86];
handlers[109].func = 0LL;
handlers[28].func = 0LL;
handlers[52].addr = &loc_401010;
handlers[180].left = &handlers[145];
handlers[8].addr = &loc_400BBE;
handlers[90].left = &handlers[147];
handlers[84].func = e;
handlers[107].right = 0LL;
handlers[143].func = ne;
handlers[24].addr = &loc_400D1F;
handlers[96].func = return4;
handlers[36].right = &handlers[173];
handlers[9].right = printf;
handlers[49].right = 0LL;
handlers[123].left = &handlers[110];
handlers[108].addr = &loc_4014AD;
handlers[105].right = &handlers[167];
handlers[115].left = 0LL;
handlers[138].left = &handlers[127];
handlers[56].left = &handlers[45];
handlers[40].addr = &loc_400F6A;
handlers[69].addr = &loc_401213;
handlers[86].right = &handlers[40];
handlers[40].right = &handlers[109];
handlers[132].left = 0LL;
handlers[157].left = &handlers[168];
handlers[104].right = &handlers[159];
handlers[177].func = return4;
handlers[136].func = return2;
handlers[129].func = return3;
handlers[21].left = &handlers[62];
handlers[126].right = rand;
handlers[121].func = return4;
handlers[171].func = return4;
handlers[27].addr = &loc_400D58;
handlers[74].left = &handlers[82];
handlers[144].left = &handlers[125];
handlers[116].left = &handlers[163];
handlers[141].right = &handlers[40];
handlers[165].func = return4;
handlers[101].left = 0LL;
handlers[150].func = return4;
handlers[31].func = return2;
handlers[158].right = &handlers[166];
handlers[97].addr = &loc_401407;
handlers[151].func = 0LL;
handlers[70].func = return4;
handlers[82].func = return4;
handlers[32].left = &handlers[78];
handlers[24].right = &handlers[176];
handlers[162].addr = &loc_40184E;
handlers[91].left = &handlers[48];
handlers[67].func = 0LL;
handlers[141].func = return4;
handlers[118].right = &handlers[102];
handlers[19].right = &handlers[164];
handlers[146].func = return3;
handlers[70].left = &handlers[146];
handlers[149].right = &handlers[16];
handlers[153].left = &handlers[29];
handlers[1].left = &handlers[84];
handlers[95].right = &handlers[40];
handlers[4].func = return3;
handlers[173].func = 0LL;
handlers[20].func = return2;
handlers[148].func = return4;
handlers[175].left = &handlers[161];
handlers[56].right = &handlers[142];
handlers[134].func = return4;
handlers[148].right = &handlers[40];
handlers[75].func = return3;
handlers[168].addr = &loc_4018CC;
handlers[34].right = &handlers[2];
handlers[143].left = &handlers[172];
handlers[65].right = &handlers[17];
handlers[71].right = &handlers[154];
handlers[35].right = &handlers[176];
handlers[21].func = return4;
handlers[18].right = &handlers[126];
handlers[154].right = &handlers[91];
handlers[96].left = &handlers[94];
handlers[92].right = &handlers[124];
handlers[9].left = &handlers[108];
handlers[6].right = &handlers[159];
handlers[142].right = &handlers[165];
handlers[119].addr = &locret_401518;
handlers[95].addr = &loc_4013E0;
handlers[18].func = le;
handlers[71].left = &handlers[74];
handlers[173].left = 0LL;
handlers[54].right = 0LL;
handlers[3].addr = &loc_400B6E;
handlers[139].func = return4;
handlers[19].addr = &loc_400C84;
handlers[56].func = return4;
handlers[138].addr = &loc_401612;
handlers[27].left = 0LL;
handlers[167].addr = &loc_4018BC;
handlers[121].right = &handlers[135];
handlers[115].func = 0LL;
handlers[40].func = ns;
handlers[91].right = &handlers[28];
handlers[114].right = 0LL;
handlers[124].func = l;
handlers[77].func = 0LL;
handlers[36].func = return4;
handlers[145].left = 0LL;
handlers[98].func = return4;
handlers[46].left = &handlers[121];
handlers[38].right = 0LL;
handlers[149].addr = &loc_401713;
handlers[55].addr = &loc_401034;
handlers[128].left = &handlers[107];
handlers[62].addr = &loc_40119E;
handlers[100].right = read;
handlers[93].left = &handlers[67];
handlers[66].addr = &loc_40120A;
handlers[146].right = rand;
handlers[87].right = &handlers[142];
handlers[104].func = 0LL;
handlers[76].left = &handlers[24];
handlers[111].left = &handlers[136];
handlers[78].left = &handlers[68];
handlers[67].addr = &loc_40120B;
handlers[120].addr = &loc_40151A;
handlers[118].addr = &loc_401505;
handlers[81].func = return3;
handlers[52].left = 0LL;
handlers[91].func = le;
handlers[133].addr = &loc_4015B2;
handlers[100].addr = &loc_40142F;
handlers[173].right = &handlers[103];
handlers[44].left = &handlers[10];
handlers[45].addr = &loc_400FC9;
handlers[106].left = &handlers[54];
handlers[126].addr = &loc_401589;
handlers[149].func = le;
handlers[58].left = 0LL;
handlers[93].addr = &loc_4013C3;
handlers[11].left = &handlers[137];
handlers[122].addr = &loc_401538;
handlers[159].left = 0LL;
handlers[162].func = return4;
handlers[168].right = &handlers[39];
handlers[30].func = 0LL;
handlers[77].right = &handlers[113];
handlers[174].func = 0LL;
handlers[127].func = return3;
handlers[65].addr = &loc_4011FF;
handlers[169].func = return3;
handlers[11].func = return4;
handlers[113].func = le;
handlers[144].func = return4;
handlers[124].left = &handlers[58];
handlers[5].right = &handlers[77];
handlers[110].left = 0LL;
handlers[110].addr = &loc_4014C4;
handlers[64].func = 0LL;
handlers[168].func = 0LL;
handlers[8].func = ne;
handlers[92].func = 0LL;
handlers[135].left = &handlers[148];
handlers[73].func = 0LL;
handlers[120].right = &handlers[167];
handlers[33].right = rand;
handlers[73].right = &handlers[166];
handlers[147].func = return2;
handlers[79].left = 0LL;
handlers[57].addr = &loc_401060;
handlers[84].right = &handlers[79];
handlers[61].addr = &loc_401184;
handlers[25].left = &handlers[44];
handlers[3].right = &handlers[154];
handlers[120].func = 0LL;
handlers[35].left = 0LL;
handlers[114].left = 0LL;
handlers[95].left = &handlers[111];
handlers[51].addr = &loc_400FFC;
handlers[140].func = return3;
handlers[109].left = 0LL;
handlers[7].func = return4;
handlers[172].left = 0LL;
handlers[45].func = return4;
handlers[139].left = &handlers[69];
handlers[80].left = 0LL;
handlers[108].left = &handlers[89];
handlers[12].func = return4;
handlers[72].func = return3;
handlers[165].addr = &loc_4018A3;
handlers[78].func = return3;
handlers[134].addr = &loc_4015BA;
handlers[106].func = return3;
handlers[173].addr = &loc_40193C;
handlers[95].func = return4;
handlers[112].left = 0LL;
handlers[61].func = return3;
handlers[28].left = 0LL;
handlers[85].right = &handlers[158];
handlers[51].func = return4;
handlers[68].left = 0LL;
handlers[128].right = &handlers[95];
handlers[17].func = le;
handlers[176].right = &handlers[100];
handlers[156].addr = &loc_4017F4;
handlers[74].func = return4;
handlers[46].right = &handlers[102];
handlers[116].addr = &loc_4014F1;
handlers[52].right = &handlers[179];
handlers[13].func = e;
handlers[131].func = return2;
handlers[48].right = 0LL;
handlers[15].func = 0LL;
handlers[41].right = 0LL;
handlers[98].left = &handlers[129];
handlers[52].func = 0LL;
handlers[179].left = 0LL;
handlers[157].right = puts;
handlers[76].right = exit;
handlers[27].right = 0LL;
handlers[131].left = 0LL;
handlers[43].right = &handlers[177];
handlers[36].left = &handlers[105];
handlers[172].addr = &loc_4018F0;
handlers[134].right = &handlers[135];
handlers[80].addr = &loc_4012C3;
handlers[50].right = &__stack_chk_fail;
handlers[96].right = &handlers[12];
handlers[79].right = &handlers[138];
handlers[124].right = &handlers[92];
handlers[174].right = &handlers[19];
handlers[32].addr = &loc_400DE0;
handlers[105].addr = &loc_401498;
handlers[41].left = 0LL;
handlers[154].addr = &loc_4017D1;
handlers[14].func = return4;
handlers[55].right = &handlers[18];
handlers[155].right = &handlers[12];
handlers[63].right = &handlers[142];
handlers[152].addr = &loc_4017B9;
handlers[27].func = return2;
handlers[160].left = 0LL;
handlers[87].func = return4;
handlers[90].func = return3;
handlers[105].func = 0LL;
handlers[157].addr = &loc_401802;
handlers[140].right = setvbuf;
handlers[26].right = &handlers[154];
handlers[109].right = &handlers[114];
handlers[107].addr = &loc_4014A1;
handlers[155].left = &handlers[63];
handlers[146].left = &handlers[4];
handlers[79].func = 0LL;
handlers[180].addr = &loc_4019D2;
'''
handlers = []
for i in range(181):
    handlers.append([None] * 4)

for line in lines.strip().splitlines():
    r = re.match(r'handlers\[([0-9]+)\]\.([^ ]+) = ([^;]+);', line)
    assert r, line

    index = int(r.group(1))
    field = r.group(2)
    val = r.group(3)

    if field == 'left':
        if val == '0LL':
            handlers[index][0] = None
        else:
            assert val.startswith('&handlers[') and val[-1] == ']', line
            handlers[index][0] = int(val[10:-1])

    elif field == 'right':
        if val == '0LL':
            handlers[index][1] = None
        elif val.startswith('&handlers[') and val[-1] == ']':
            handlers[index][1] = int(val[10:-1])
        else:
            if val[0] == '&':
                val = val[1:]
            assert val in [
                'atoi', 'memset', 'srand', 'puts',
                'setvbuf', 'exit', '__stack_chk_fail',
                'rand', 'printf', 'read'
            ], line
            handlers[index][1] = val

    elif field == 'func':
        if val == '0LL':
            handlers[index][2] = None
        else:
            assert val in [
                'return2', 'return3', 'return4',
                'l', 'le', 'g',
                'e', 'ne', 'ns'
            ], line
            handlers[index][2] = val

    elif field == 'addr':
        if val[0] == '&':
            val = val[1:]
        if val.startswith('sub_') or val.startswith('loc_') or val.startswith('locret_'):
            handlers[index][3] = int(val[val.index('_') + 1:], 16)
        else:
            assert False, line


ks = keystone.Ks(keystone.KS_ARCH_X86, keystone.KS_MODE_64)
cs = capstone.Cs(capstone.CS_ARCH_X86, capstone.CS_MODE_64)

_binary = open('./tradre', 'rb').read()[:0x48CC]
_binary_base = 0x400000


def get_byte(addr):
    global _binary, _binary_base
    offset = addr - _binary_base
    return _binary[offset]


def get_bytes(addr, size=0x20):
    global _binary, _binary_base
    offset = addr - _binary_base
    assert offset >= 0 and offset + size <= len(_binary)
    return _binary[offset: offset + size]


def asm(code, addr=0):
    return bytes(ks.asm(code, addr)[0])


def disasm(code, addr=0):
    for i in cs.disasm(code, addr):
        return ('%s %s' % (i.mnemonic, i.op_str)), i.size
    else:
        assert False, hex(addr)
        # return '', 0


def disasm_at(addr):
    code = get_bytes(addr)
    code, size = disasm(code, addr)
    return code, addr + size


funcs_to_process = {(0x4009F7, 0)}
funcs_processed = dict()

while funcs_to_process:
    addr, handler_index = funcs_to_process.pop()
    if addr in funcs_processed:
        assert funcs_processed[addr] == handler_index
        continue

    funcs_processed[addr] = handler_index

    addr_to_process = {(addr, handler_index)}
    addr_processed = dict()

    while addr_to_process:
        addr, handler_index = addr_to_process.pop()
        if addr in addr_processed:
            assert addr_processed[addr] == handler_index
            continue

        while True:
            if addr in addr_processed:
                assert addr_processed[addr] == handler_index
                print('jmp _0x%x' % addr)
                break

            addr_processed[addr] = handler_index
            print('_0x%x: ' % addr, end='')

            if get_byte(addr) == 0xCC:  # handler
                addr += 1
                func = handlers[handler_index][2]  # func

                if func is None:
                    # follow right
                    handler_index = handlers[handler_index][1]  # right
                    assert isinstance(handler_index, int)
                    addr = handlers[handler_index][3]  # addr

                elif func.startswith('return'):
                    val = int(func[6:])

                    if val == 2:
                        # handler_ptr = saved_handlers.pop();
                        print('ret')
                        break  # break while True

                    elif val == 3:
                        # native call
                        target = handlers[handler_index][1]  # right
                        assert isinstance(target, str)
                        native_call_map = {
                            'puts': 0x400810,
                            '__stack_chk_fail': 0x400820,
                            'printf': 0x400830,
                            'memset': 0x400840,
                            'read': 0x400860,
                            'srand': 0x400870,
                            'setvbuf': 0x4008A0,
                            'atoi': 0x4008C0,
                            'exit': 0x4008D0,
                            'rand': 0x400900,
                        }
                        print('call 0x%x' % native_call_map[target])
                        handler_index = handlers[handler_index][0]  # left
                        addr = handlers[handler_index][3]  # addr

                    elif val == 4:
                        # vm call
                        call_handler_index = handlers[handler_index][1]  # right
                        ret_handler_index = handlers[handler_index][0]   # left
                        assert isinstance(call_handler_index, int)
                        assert isinstance(ret_handler_index, int)

                        call_addr = handlers[call_handler_index][3]  # addr
                        ret_addr = handlers[ret_handler_index][3]    # addr

                        print('call _0x%x' % call_addr)
                        funcs_to_process.add((call_addr, call_handler_index))
                        addr, handler_index = ret_addr, ret_handler_index

                    else:
                        assert False, val

                elif func in ['l', 'le', 'g', 'e', 'ne', 'ns']:
                    taken_handler_index = handlers[handler_index][1]   # right
                    not_taken_handler_index = handlers[handler_index][0]  # left
                    assert isinstance(taken_handler_index, int)
                    assert isinstance(not_taken_handler_index, int)

                    taken_addr = handlers[taken_handler_index][3]
                    not_taken_addr = handlers[not_taken_handler_index][3]

                    print('j%s _0x%x' % (func, taken_addr))
                    # print('jmp _0x%x' % not_taken_addr)  # not_taken is next instruction

                    addr_to_process.add((taken_addr, taken_handler_index))
                    addr, handler_index = not_taken_addr, not_taken_handler_index

                else:
                    assert False, func

            else:
                code, addr = disasm_at(addr)
                assert code[0] != 'j', code
                assert code[:4] != 'call'

                if code[:4] == 'lea ' and '[rip' in code:
                    reg, value = code.split(' ', 1)[1].split(', ')
                    assert value.startswith('[rip + ') and value[-1] == ']'
                    value = addr + int(value[7:-1], 16) & 0xFFFFFFFF
                    code = 'mov %s, 0x%x' % (reg, value)

                elif code[:4] == 'mov ' and 'ptr [rip' in code:
                    reg, value = code.split(' ', 1)[1].split(', ')
                    prefix, value = value.split(' [')
                    assert value.startswith('rip + ') and value[-1] == ']'
                    value = addr + int(value[6:-1], 16) & 0xFFFFFFFF
                    code = 'mov %s, 0x%x\nmov %s, %s [%s]' % (
                        reg, value, reg, prefix, reg
                    )

                assert 'rip' not in code, code
                print(code)

将输出的结果在ida中新建一个段导入进去

import keystone
import ida_bytes


ks = keystone.Ks(keystone.KS_ARCH_X86, keystone.KS_MODE_64)


def asm(code, addr=0):
    encoding, _ = ks.asm(code, addr)
    return bytes(encoding)


patch_addr = 0x406000

with open(
    r"D:\学习\题目\re\qwb\tradre_b9fee4eb2a0a9d36c3732c971e0b56e1\1.txt",
    "r",
    encoding="utf-8"
) as f:
    patch_code = f.read()

patch_bin = asm(patch_code, patch_addr)
ida_bytes.patch_bytes(patch_addr, patch_bin)

将最终的数据编成代码

unsigned __int64 sub_406000()
{
  int v0; // eax
  char v2; // bl
  char v3; // bl
  char v4; // [rsp+Fh] [rbp-1E1h]
  int i; // [rsp+10h] [rbp-1E0h]
  int mm; // [rsp+10h] [rbp-1E0h]
  int nn; // [rsp+10h] [rbp-1E0h]
  int v8; // [rsp+14h] [rbp-1DCh]
  int kk; // [rsp+1Ch] [rbp-1D4h]
  int jj; // [rsp+24h] [rbp-1CCh]
  int j; // [rsp+30h] [rbp-1C0h]
  int k; // [rsp+30h] [rbp-1C0h]
  int m; // [rsp+34h] [rbp-1BCh]
  int n; // [rsp+34h] [rbp-1BCh]
  int ii; // [rsp+34h] [rbp-1BCh]
  char v16; // [rsp+6Ch] [rbp-184h]
  char v17; // [rsp+6Dh] [rbp-183h]
  char v18; // [rsp+6Eh] [rbp-182h]
  char v19; // [rsp+6Fh] [rbp-181h]
  char v20[32]; // [rsp+70h] [rbp-180h] BYREF
  char v21[8]; // [rsp+90h] [rbp-160h] BYREF
  char v22[24]; // [rsp+98h] [rbp-158h] BYREF
  unsigned __int8 v23[16]; // [rsp+B0h] [rbp-140h] BYREF
  unsigned __int8 v24[32]; // [rsp+C0h] [rbp-130h] BYREF
  char v25[248]; // [rsp+E0h] [rbp-110h] BYREF
  unsigned __int64 v26; // [rsp+1D8h] [rbp-18h]

  v26 = __readfsqword(0x28u);
  v21[0] = 226;
  v21[1] = 139;
  v21[2] = 85;
  v21[3] = 56;
  v21[4] = 105;
  v21[5] = 250;
  v21[6] = 128;
  v21[7] = 194;
  qmemcpy(v22, "dN", 2);
  v22[2] = 127;
  v22[3] = -25;
  v22[4] = 19;
  v22[5] = 6;
  v22[6] = 20;
  v22[7] = -59;
  v22[8] = -64;
  v22[9] = 19;
  v22[10] = -45;
  v22[11] = 18;
  v22[12] = 107;
  v22[13] = -67;
  v22[14] = -14;
  v22[15] = -57;
  v22[16] = -120;
  v22[17] = 68;
  v22[18] = 62;
  v22[19] = 9;
  v22[20] = -24;
  v22[21] = -93;
  v22[22] = -125;
  v22[23] = 48;
  sub_406B50(v21);
  setvbuf(stdin, 0LL, 2, 0LL);
  setvbuf(stdout, 0LL, 2, 0LL);
  setvbuf(stderr, 0LL, 2, 0LL);
  printf("Input your flag: ");
  sub_406AA9(v23, 33);
  for ( i = 0; i <= 15; ++i )
    v20[i] = rand();
  for ( j = 0; j < 16; ++j )
    v25[j] = v20[j];
  for ( k = 4; k < 44; ++k )
  {
    for ( m = 0; m <= 3; ++m )
      *(&v16 + m) = v25[4 * k - 4 + m];
    if ( !(k % 4) )
    {
      v4 = v16;
      v16 = v17;
      v17 = v18;
      v18 = v19;
      v19 = v4;
      for ( n = 0; n <= 3; ++n )
        *(&v16 + n) = byte_606020[*(&v16 + n)];
      v16 ^= byte_404B30[k / 4 - 1];
    }
    for ( ii = 0; ii <= 3; ++ii )
      v25[4 * k + ii] = *(&v16 + ii) ^ v25[4 * k - 16 + ii];
  }
  sub_4067A0(v23, v25, 0);
  for ( jj = 1; jj <= 9; ++jj )
  {
    sub_406C74(v23);
    sub_4069AA(v23);
    sub_406802(v23);
    sub_4067A0(v23, v25, jj);
  }
  sub_406C74(v23);
  sub_4069AA(v23);
  sub_4067A0(v23, v25, 10);
  sub_4067A0(v24, v25, 0);
  for ( kk = 1; kk <= 9; ++kk )
  {
    sub_406C74(v24);
    sub_4069AA(v24);
    sub_406802(v24);
    sub_4067A0(v24, v25, kk);
  }
  sub_406C74(v24);
  sub_4069AA(v24);
  sub_4067A0(v24, v25, 10);
  v0 = rand();
  srand(v0);
  v8 = 0;
  for ( mm = 0; mm <= 15; ++mm )
  {
    v2 = v23[mm] ^ v21[mm];
    if ( (v2 ^ rand()) == off_606A48[mm] )
      ++v8;
  }
  for ( nn = 0; nn <= 15; ++nn )
  {
    v3 = v23[nn + 16] ^ v21[nn + 16];
    if ( (v3 ^ rand()) == off_606A48[nn + 17] )
      ++v8;
  }
  if ( v8 <= 31 )
    puts(off_606A40);
  else
    puts(off_606A48);
  return __readfsqword(0x28u) ^ v26;
}

剩下的就是进行解密了，这题难点主要还是在分析这个函数父子函数之间是如何相互作用的，让后将整个代码逻辑还原