2026长城杯决赛题目复现

解压附件打开发现Unity引擎,GameAssembly.dll和global-metadata.dat

可以确定这题是il2cpp_data

尝试用Il2CppDumper来dump

发现dump失败，查壳发现GameAssembly.dll加了壳

当时线下赛，之前都没见过这个壳，一下子就卡住了，之前在52pj里面下了一个re工具包，里面有themida的脱壳工具，但是没一个能脱壳成功的，根据之前的经验，通过CE中的mono插件能够进行一些分析，所以我就尝试了一下用CE来看这个exe程序

在Assembly-Csharp.dll中找到了一些可疑函数，

这里经过确认，发现程序的主要逻辑还是在check_input这个函数中

check_input

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
xYz987.check_input - 48 89 5C 24 10        - mov [rsp+10],rbx
GameAssembly.dll+28C115- 48 89 74 24 18        - mov [rsp+18],rsi
GameAssembly.dll+28C11A- 48 89 7C 24 20        - mov [rsp+20],rdi
GameAssembly.dll+28C11F- 48 89 4C 24 08        - mov [rsp+08],rcx
GameAssembly.dll+28C124- 41 56                 - push r14
GameAssembly.dll+28C126- 48 83 EC 30           - sub rsp,30 { 48 }
GameAssembly.dll+28C12A- 48 8B F9              - mov rdi,rcx
GameAssembly.dll+28C12D- 80 3D AE001201 00     - cmp byte ptr [GameAssembly.dll+13AC1E2],00 { (1),0 }
GameAssembly.dll+28C134- 75 37                 - jne GameAssembly.dll+28C16D
GameAssembly.dll+28C136- 48 8D 0D 2BF60401     - lea rcx,[GameAssembly.dll+12DB768] { (164619AC530) }
GameAssembly.dll+28C13D- E8 2E7DF1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28C142- 48 8D 0D 3F620501     - lea rcx,[GameAssembly.dll+12E2388] { (164605ACA60) }
GameAssembly.dll+28C149- E8 227DF1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28C14E- 48 8D 0D 8B770501     - lea rcx,[GameAssembly.dll+12E38E0] { ("@QZ`d") }
GameAssembly.dll+28C155- E8 167DF1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28C15A- 48 8D 0D 7FB90301     - lea rcx,[GameAssembly.dll+12C7AE0] { (165C4B25660) }
GameAssembly.dll+28C161- E8 0A7DF1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28C166- C6 05 75001201 01     - mov byte ptr [GameAssembly.dll+13AC1E2],01 { (1),1 }
GameAssembly.dll+28C16D- 48 8B 5F 20           - mov rbx,[rdi+20]
GameAssembly.dll+28C171- 48 8B 0D 68770501     - mov rcx,[GameAssembly.dll+12E38E0] { ("@QZ`d") }
GameAssembly.dll+28C178- 83 B9 E0000000 00     - cmp dword ptr [rcx+000000E0],00 { 0 }
GameAssembly.dll+28C17F- 75 05                 - jne GameAssembly.dll+28C186
GameAssembly.dll+28C181- E8 DA7FF1FF           - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+28C186- 45 33 C0              - xor r8d,r8d
GameAssembly.dll+28C189- 33 D2                 - xor edx,edx
GameAssembly.dll+28C18B- 48 8B CB              - mov rcx,rbx
GameAssembly.dll+28C18E- E8 9D379B00           - call UnityEngine.Object.op_Equality
GameAssembly.dll+28C193- 84 C0                 - test al,al
GameAssembly.dll+28C195- 0F85 3C010000         - jne GameAssembly.dll+28C2D7
GameAssembly.dll+28C19B- 48 8B 5F 28           - mov rbx,[rdi+28]
GameAssembly.dll+28C19F- 48 8B 0D 3A770501     - mov rcx,[GameAssembly.dll+12E38E0] { ("@QZ`d") }
GameAssembly.dll+28C1A6- 83 B9 E0000000 00     - cmp dword ptr [rcx+000000E0],00 { 0 }
GameAssembly.dll+28C1AD- 75 05                 - jne GameAssembly.dll+28C1B4
GameAssembly.dll+28C1AF- E8 AC7FF1FF           - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+28C1B4- 45 33 C0              - xor r8d,r8d
GameAssembly.dll+28C1B7- 33 D2                 - xor edx,edx
GameAssembly.dll+28C1B9- 48 8B CB              - mov rcx,rbx
GameAssembly.dll+28C1BC- E8 6F379B00           - call UnityEngine.Object.op_Equality
GameAssembly.dll+28C1C1- 84 C0                 - test al,al
GameAssembly.dll+28C1C3- 0F85 0E010000         - jne GameAssembly.dll+28C2D7
GameAssembly.dll+28C1C9- 48 8B 47 20           - mov rax,[rdi+20]
GameAssembly.dll+28C1CD- 48 85 C0              - test rax,rax
GameAssembly.dll+28C1D0- 0F84 50010000         - je GameAssembly.dll+28C326
GameAssembly.dll+28C1D6- 48 8B 88 20020000     - mov rcx,[rax+00000220]
GameAssembly.dll+28C1DD- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28C1E0- 0F84 40010000         - je GameAssembly.dll+28C326
GameAssembly.dll+28C1E6- 33 D2                 - xor edx,edx
GameAssembly.dll+28C1E8- E8 23825200           - call System.String.Trim
GameAssembly.dll+28C1ED- 4C 8B F0              - mov r14,rax
GameAssembly.dll+28C1F0- 48 85 C0              - test rax,rax
GameAssembly.dll+28C1F3- 0F84 2D010000         - je GameAssembly.dll+28C326
GameAssembly.dll+28C1F9- 83 78 10 2A           - cmp dword ptr [rax+10],2A { 42 }
GameAssembly.dll+28C1FD- 0F85 C8000000         - jne GameAssembly.dll+28C2CB
GameAssembly.dll+28C203- 33 DB                 - xor ebx,ebx
GameAssembly.dll+28C205- 8B F3                 - mov esi,ebx
GameAssembly.dll+28C207- 66 0F1F 84 00 00000000  - nop word ptr [rax+rax+00000000]
GameAssembly.dll+28C210- 48 8B 0D 71610501     - mov rcx,[GameAssembly.dll+12E2388] { (164605ACA60) }
GameAssembly.dll+28C217- 39 99 E0000000        - cmp [rcx+000000E0],ebx
GameAssembly.dll+28C21D- 75 05                 - jne GameAssembly.dll+28C224
GameAssembly.dll+28C21F- E8 3C7FF1FF           - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+28C224- 48 8B 4F 58           - mov rcx,[rdi+58]
GameAssembly.dll+28C228- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28C22B- 0F84 F5000000         - je GameAssembly.dll+28C326
GameAssembly.dll+28C231- 48 8B 11              - mov rdx,[rcx]
GameAssembly.dll+28C234- 48 8B 82 B8010000     - mov rax,[rdx+000001B8]
GameAssembly.dll+28C23B- 48 8B 92 C0010000     - mov rdx,[rdx+000001C0]
GameAssembly.dll+28C242- FF D0                 - call rax
GameAssembly.dll+28C244- FF C6                 - inc esi
GameAssembly.dll+28C246- 81 FE A0860100        - cmp esi,000186A0 { 100000 }
GameAssembly.dll+28C24C- 7C C2                 - jl GameAssembly.dll+28C210
GameAssembly.dll+28C24E- 33 D2                 - xor edx,edx
GameAssembly.dll+28C250- 48 8B CF              - mov rcx,rdi
GameAssembly.dll+28C253- E8 68F9FFFF           - call xYz987.GetRealKey
GameAssembly.dll+28C258- 45 33 C9              - xor r9d,r9d
GameAssembly.dll+28C25B- 4C 8B C0              - mov r8,rax
GameAssembly.dll+28C25E- 49 8B D6              - mov rdx,r14
GameAssembly.dll+28C261- 48 8B CF              - mov rcx,rdi
GameAssembly.dll+28C264- E8 B7F1FFFF           - call xYz987.AESEncrypt
GameAssembly.dll+28C269- 48 8B 57 30           - mov rdx,[rdi+30]
GameAssembly.dll+28C26D- 48 85 C0              - test rax,rax
GameAssembly.dll+28C270- 0F84 AA000000         - je GameAssembly.dll+28C320
GameAssembly.dll+28C276- 48 85 D2              - test rdx,rdx
GameAssembly.dll+28C279- 0F84 9C000000         - je GameAssembly.dll+28C31B
GameAssembly.dll+28C27F- 8B 4A 18              - mov ecx,[rdx+18]
GameAssembly.dll+28C282- 39 48 18              - cmp [rax+18],ecx
GameAssembly.dll+28C285- 75 27                 - jne GameAssembly.dll+28C2AE
GameAssembly.dll+28C287- 3B 58 18              - cmp ebx,[rax+18]
GameAssembly.dll+28C28A- 7D 1E                 - jnl GameAssembly.dll+28C2AA
GameAssembly.dll+28C28C- 48 63 CB              - movsxd  rcx,ebx
GameAssembly.dll+28C28F- 73 7F                 - jae GameAssembly.dll+28C310
GameAssembly.dll+28C291- 44 0FB6 44 01 20      - movzx r8d,byte ptr [rcx+rax+20]
GameAssembly.dll+28C297- 48 63 CB              - movsxd  rcx,ebx
GameAssembly.dll+28C29A- 3B 5A 18              - cmp ebx,[rdx+18]
GameAssembly.dll+28C29D- 73 77                 - jae GameAssembly.dll+28C316
GameAssembly.dll+28C29F- 44 3A 44 11 20        - cmp r8b,[rcx+rdx+20]
GameAssembly.dll+28C2A4- 75 08                 - jne GameAssembly.dll+28C2AE
GameAssembly.dll+28C2A6- FF C3                 - inc ebx
GameAssembly.dll+28C2A8- EB DD                 - jmp GameAssembly.dll+28C287
GameAssembly.dll+28C2AA- B0 01                 - mov al,01 { 1 }
GameAssembly.dll+28C2AC- EB 02                 - jmp GameAssembly.dll+28C2B0
GameAssembly.dll+28C2AE- 32 C0                 - xor al,al
GameAssembly.dll+28C2B0- 84 C0                 - test al,al
GameAssembly.dll+28C2B2- 74 17                 - je GameAssembly.dll+28C2CB
GameAssembly.dll+28C2B4- 80 7F 50 00           - cmp byte ptr [rdi+50],00 { 0 }
GameAssembly.dll+28C2B8- 75 11                 - jne GameAssembly.dll+28C2CB
GameAssembly.dll+28C2BA- 33 D2                 - xor edx,edx
GameAssembly.dll+28C2BC- 48 8B CF              - mov rcx,rdi
GameAssembly.dll+28C2BF- E8 5CFAFFFF           - call xYz987.ShowRight
GameAssembly.dll+28C2C4- EB 34                 - jmp GameAssembly.dll+28C2FA
GameAssembly.dll+28C2C6- 48 8B 7C 24 40        - mov rdi,[rsp+40]
GameAssembly.dll+28C2CB- 33 D2                 - xor edx,edx
GameAssembly.dll+28C2CD- 48 8B CF              - mov rcx,rdi
GameAssembly.dll+28C2D0- E8 CBFAFFFF           - call xYz987.ShowWrong
GameAssembly.dll+28C2D5- EB 23                 - jmp GameAssembly.dll+28C2FA
GameAssembly.dll+28C2D7- 48 8B 0D 8AF40401     - mov rcx,[GameAssembly.dll+12DB768] { (164619AC530) }
GameAssembly.dll+28C2DE- 83 B9 E0000000 00     - cmp dword ptr [rcx+000000E0],00 { 0 }
GameAssembly.dll+28C2E5- 75 05                 - jne GameAssembly.dll+28C2EC
GameAssembly.dll+28C2E7- E8 747EF1FF           - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+28C2EC- 33 D2                 - xor edx,edx
GameAssembly.dll+28C2EE- 48 8B 0D EBB70301     - mov rcx,[GameAssembly.dll+12C7AE0] { (165C4B25660) }
GameAssembly.dll+28C2F5- E8 864D9900           - call UnityEngine.Debug.LogError
GameAssembly.dll+28C2FA- 48 8B 5C 24 48        - mov rbx,[rsp+48]
GameAssembly.dll+28C2FF- 48 8B 74 24 50        - mov rsi,[rsp+50]
GameAssembly.dll+28C304- 48 8B 7C 24 58        - mov rdi,[rsp+58]
GameAssembly.dll+28C309- 48 83 C4 30           - add rsp,30 { 48 }
GameAssembly.dll+28C30D- 41 5E                 - pop r14
GameAssembly.dll+28C30F- C3                    - ret 
GameAssembly.dll+28C310- E8 9B7DF1FF           - call GameAssembly.mono_method_get_class+90

ce只能从汇编入手，所以只能硬着头皮看汇编，但是通过大致的函数名字也能猜出来程序在做什么操作

确定输入长度为42

1
GameAssembly.dll+28C1F9- 83 78 10 2A           - cmp dword ptr [rax+10],2A { 42 }

获得一个key

1
GameAssembly.dll+28C253- E8 68F9FFFF           - call xYz987.GetRealKey

用这个key进行aes加密

1
GameAssembly.dll+28C264- E8 B7F1FFFF           - call xYz987.AESEncrypt

进行结果的比对

1
GameAssembly.dll+28C29F- 44 3A 44 11 20        - cmp r8b,[rcx+rdx+20]

接着分析GetRealKey和AESEncrypt函数

GetRealKey

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
xYz987.GetRealKey - 48 89 5C 24 08        - mov [rsp+08],rbx
GameAssembly.dll+28BBC5- 48 89 6C 24 10        - mov [rsp+10],rbp
GameAssembly.dll+28BBCA- 48 89 74 24 18        - mov [rsp+18],rsi
GameAssembly.dll+28BBCF- 57                    - push rdi
GameAssembly.dll+28BBD0- 48 83 EC 20           - sub rsp,20 { 32 }
GameAssembly.dll+28BBD4- 80 3D 09061201 00     - cmp byte ptr [GameAssembly.dll+13AC1E4],00 { (0),0 }
GameAssembly.dll+28BBDB- 48 8B E9              - mov rbp,rcx
GameAssembly.dll+28BBDE- 75 2B                 - jne GameAssembly.dll+28BC0B
GameAssembly.dll+28BBE0- 48 8D 0D 81FB0401     - lea rcx,[GameAssembly.dll+12DB768] { (203A19AC530) }
GameAssembly.dll+28BBE7- E8 8482F1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28BBEC- 48 8D 0D D5680301     - lea rcx,[GameAssembly.dll+12C24C8] { (536894845) }
GameAssembly.dll+28BBF3- E8 7882F1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28BBF8- 48 8D 0D C90D0501     - lea rcx,[GameAssembly.dll+12DC9C8] { (-1610603207) }
GameAssembly.dll+28BBFF- E8 6C82F1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28BC04- C6 05 D9051201 01     - mov byte ptr [GameAssembly.dll+13AC1E4],01 { (0),1 }
GameAssembly.dll+28BC0B- 48 8B 0D B6680301     - mov rcx,[GameAssembly.dll+12C24C8] { (536894845) }
GameAssembly.dll+28BC12- E8 5984F1FF           - call GameAssembly.mono_method_get_class+50
GameAssembly.dll+28BC17- 33 D2                 - xor edx,edx
GameAssembly.dll+28BC19- 48 8B C8              - mov rcx,rax
GameAssembly.dll+28BC1C- 48 8B F0              - mov rsi,rax
GameAssembly.dll+28BC1F- E8 9C3D6F00           - call System.Text.StringBuilder..ctor
GameAssembly.dll+28BC24- 48 8B 7D 38           - mov rdi,[rbp+38]
GameAssembly.dll+28BC28- 33 DB                 - xor ebx,ebx
GameAssembly.dll+28BC2A- 8B C3                 - mov eax,ebx
GameAssembly.dll+28BC2C- 48 85 FF              - test rdi,rdi
GameAssembly.dll+28BC2F- 0F84 D9000000         - je GameAssembly.dll+28BD0E
GameAssembly.dll+28BC35- 3B 47 18              - cmp eax,[rdi+18]
GameAssembly.dll+28BC38- 7D 2B                 - jnl GameAssembly.dll+28BC65
GameAssembly.dll+28BC3A- 3B 5F 18              - cmp ebx,[rdi+18]
GameAssembly.dll+28BC3D- 0F83 D1000000         - jae GameAssembly.dll+28BD14
GameAssembly.dll+28BC43- 48 85 F6              - test rsi,rsi
GameAssembly.dll+28BC46- 0F84 C2000000         - je GameAssembly.dll+28BD0E
GameAssembly.dll+28BC4C- 48 63 D3              - movsxd  rdx,ebx
GameAssembly.dll+28BC4F- 45 33 C0              - xor r8d,r8d
GameAssembly.dll+28BC52- 48 8B CE              - mov rcx,rsi
GameAssembly.dll+28BC55- 0FB7 54 97 20         - movzx edx,word ptr [rdi+rdx*4+20]
GameAssembly.dll+28BC5A- E8 A1186F00           - call System.Text.StringBuilder.Append
GameAssembly.dll+28BC5F- FF C3                 - inc ebx
GameAssembly.dll+28BC61- 8B C3                 - mov eax,ebx
GameAssembly.dll+28BC63- EB D0                 - jmp GameAssembly.dll+28BC35
GameAssembly.dll+28BC65- 48 8B 4D 40           - mov rcx,[rbp+40]
GameAssembly.dll+28BC69- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28BC6C- 0F84 9C000000         - je GameAssembly.dll+28BD0E
GameAssembly.dll+28BC72- 45 33 C9              - xor r9d,r9d
GameAssembly.dll+28BC75- 41 8D 51 03           - lea edx,[r9+03]
GameAssembly.dll+28BC79- 45 8D 41 05           - lea r8d,[r9+05]
GameAssembly.dll+28BC7D- E8 5E775200           - call System.String.Substring
GameAssembly.dll+28BC82- 48 85 F6              - test rsi,rsi
GameAssembly.dll+28BC85- 0F84 83000000         - je GameAssembly.dll+28BD0E
GameAssembly.dll+28BC8B- 45 33 C0              - xor r8d,r8d
GameAssembly.dll+28BC8E- 48 8B D0              - mov rdx,rax
GameAssembly.dll+28BC91- 48 8B CE              - mov rcx,rsi
GameAssembly.dll+28BC94- E8 C7146F00           - call System.Text.StringBuilder.Append
GameAssembly.dll+28BC99- 48 8B 16              - mov rdx,[rsi]
GameAssembly.dll+28BC9C- 48 8B CE              - mov rcx,rsi
GameAssembly.dll+28BC9F- 48 8B 82 68010000     - mov rax,[rdx+00000168]
GameAssembly.dll+28BCA6- 48 8B 92 70010000     - mov rdx,[rdx+00000170]
GameAssembly.dll+28BCAD- FF D0                 - call rax
GameAssembly.dll+28BCAF- 48 8B 0D 120D0501     - mov rcx,[GameAssembly.dll+12DC9C8] { (-1610603207) }
GameAssembly.dll+28BCB6- 45 33 C0              - xor r8d,r8d
GameAssembly.dll+28BCB9- 48 8B D0              - mov rdx,rax
GameAssembly.dll+28BCBC- E8 BF005200           - call System.String.Concat
GameAssembly.dll+28BCC1- 48 8B 0D A0FA0401     - mov rcx,[GameAssembly.dll+12DB768] { (203A19AC530) }
GameAssembly.dll+28BCC8- 48 8B D8              - mov rbx,rax
GameAssembly.dll+28BCCB- 83 B9 E0000000 00     - cmp dword ptr [rcx+000000E0],00 { 0 }
GameAssembly.dll+28BCD2- 75 05                 - jne GameAssembly.dll+28BCD9
GameAssembly.dll+28BCD4- E8 8784F1FF           - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+28BCD9- 33 D2                 - xor edx,edx
GameAssembly.dll+28BCDB- 48 8B CB              - mov rcx,rbx
GameAssembly.dll+28BCDE- E8 BD5C9900           - call UnityEngine.Debug.Log
GameAssembly.dll+28BCE3- 48 8B 16              - mov rdx,[rsi]
GameAssembly.dll+28BCE6- 48 8B CE              - mov rcx,rsi
GameAssembly.dll+28BCE9- 48 8B 82 68010000     - mov rax,[rdx+00000168]
GameAssembly.dll+28BCF0- 48 8B 92 70010000     - mov rdx,[rdx+00000170]
GameAssembly.dll+28BCF7- 48 8B 5C 24 30        - mov rbx,[rsp+30]
GameAssembly.dll+28BCFC- 48 8B 6C 24 38        - mov rbp,[rsp+38]
GameAssembly.dll+28BD01- 48 8B 74 24 40        - mov rsi,[rsp+40]
GameAssembly.dll+28BD06- 48 83 C4 20           - add rsp,20 { 32 }
GameAssembly.dll+28BD0A- 5F                    - pop rdi
GameAssembly.dll+28BD0B- 48 FF E0              - jmp rax
GameAssembly.dll+28BD0E- E8 AD83F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28BD13- CC                    - int 3 
GameAssembly.dll+28BD14- E8 9783F1FF           - call GameAssembly.mono_method_get_class+90
GameAssembly.dll+28BD19- CC                    - int 3 
GameAssembly.dll+28BD1A- CC                    - int 3 
GameAssembly.dll+28BD1B- CC                    - int 3 
GameAssembly.dll+28BD1C- CC                    - int 3 
GameAssembly.dll+28BD1D- CC                    - int 3 
GameAssembly.dll+28BD1E- CC                    - int 3 
GameAssembly.dll+28BD1F- CC                    - int 3

GetRealKey函数的操作其实就是读取程序中的两部分数据，然后进行拼接，而且我们可以看见其中有一段汇编

1
GameAssembly.dll+28BCDE- E8 BD5C9900           - call UnityEngine.Debug.Log

程序会打印日志，所以我们只需要让程序正常运行到这里，然后查看程序的日志就能得到它的key，当然也可以通过动态调试的方式来进行获取

unity程序的默认日志打印路径如下，找到对应的日志

1
C:\Users\用户\AppData\LocalLow\DefaultCompany

AESEncrypt

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
xYz987.AESEncrypt - 48 89 5C 24 08        - mov [rsp+08],rbx
GameAssembly.dll+28B425- 48 89 74 24 10        - mov [rsp+10],rsi
GameAssembly.dll+28B42A- 48 89 7C 24 18        - mov [rsp+18],rdi
GameAssembly.dll+28B42F- 41 54                 - push r12
GameAssembly.dll+28B431- 41 56                 - push r14
GameAssembly.dll+28B433- 41 57                 - push r15
GameAssembly.dll+28B435- 48 81 EC C0000000     - sub rsp,000000C0 { 192 }
GameAssembly.dll+28B43C- 49 8B F0              - mov rsi,r8
GameAssembly.dll+28B43F- 4C 8B FA              - mov r15,rdx
GameAssembly.dll+28B442- 4C 8B F1              - mov r14,rcx
GameAssembly.dll+28B445- 80 3D 970D1201 00     - cmp byte ptr [GameAssembly.dll+13AC1E3],00 { (0),0 }
GameAssembly.dll+28B44C- 75 37                 - jne GameAssembly.dll+28B485
GameAssembly.dll+28B44E- 48 8D 0D 5BC70401     - lea rcx,[GameAssembly.dll+12D7BB0] { (536886253) }
GameAssembly.dll+28B455- E8 168AF1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28B45A- 48 8D 0D 97FB0401     - lea rcx,[GameAssembly.dll+12DAFF8] { (536888225) }
GameAssembly.dll+28B461- E8 0A8AF1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28B466- 48 8D 0D 033F0501     - lea rcx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B46D- E8 FE89F1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28B472- 48 8D 0D E7710501     - lea rcx,[GameAssembly.dll+12E2660] { (536891961) }
GameAssembly.dll+28B479- E8 F289F1FF           - call GameAssembly.il2cpp_get_exception_argument_null+3B0
GameAssembly.dll+28B47E- C6 05 5E0D1201 01     - mov byte ptr [GameAssembly.dll+13AC1E3],01 { (0),1 }
GameAssembly.dll+28B485- 45 33 E4              - xor r12d,r12d
GameAssembly.dll+28B488- 4C 89 64 24 48        - mov [rsp+48],r12
GameAssembly.dll+28B48D- 4C 89 64 24 40        - mov [rsp+40],r12
GameAssembly.dll+28B492- 4C 89 64 24 38        - mov [rsp+38],r12
GameAssembly.dll+28B497- 4C 89 64 24 50        - mov [rsp+50],r12
GameAssembly.dll+28B49C- 48 8B 0D 0DC70401     - mov rcx,[GameAssembly.dll+12D7BB0] { (536886253) }
GameAssembly.dll+28B4A3- 44 39 A1 E0000000     - cmp [rcx+000000E0],r12d
GameAssembly.dll+28B4AA- 75 05                 - jne GameAssembly.dll+28B4B1
GameAssembly.dll+28B4AC- E8 AF8CF1FF           - call GameAssembly.il2cpp_runtime_class_init
GameAssembly.dll+28B4B1- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B4B3- E8 48615300           - call System.Security.Cryptography.Aes.Create
GameAssembly.dll+28B4B8- 48 89 44 24 30        - mov [rsp+30],rax
GameAssembly.dll+28B4BD- 4C 89 A4 24 88000000  - mov [rsp+00000088],r12
GameAssembly.dll+28B4C5- 48 8D 44 24 30        - lea rax,[rsp+30]
GameAssembly.dll+28B4CA- 48 89 84 24 90000000  - mov [rsp+00000090],rax
GameAssembly.dll+28B4D2- 48 8B 5C 24 30        - mov rbx,[rsp+30]
GameAssembly.dll+28B4D7- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B4D9- E8 32477000           - call System.Text.Encoding.get_UTF8
GameAssembly.dll+28B4DE- 48 8B F8              - mov rdi,rax
GameAssembly.dll+28B4E1- 48 85 F6              - test rsi,rsi
GameAssembly.dll+28B4E4- 0F84 33040000         - je GameAssembly.dll+28B91D
GameAssembly.dll+28B4EA- 41 B8 30000000        - mov r8d,00000030 { 48 }
GameAssembly.dll+28B4F0- 45 33 C9              - xor r9d,r9d
GameAssembly.dll+28B4F3- 41 8D 50 F0           - lea edx,[r8-10]
GameAssembly.dll+28B4F7- 48 8B CE              - mov rcx,rsi
GameAssembly.dll+28B4FA- E8 21655200           - call System.String.PadRight
GameAssembly.dll+28B4FF- 48 85 C0              - test rax,rax
GameAssembly.dll+28B502- 0F84 10040000         - je GameAssembly.dll+28B918
GameAssembly.dll+28B508- 45 33 C9              - xor r9d,r9d
GameAssembly.dll+28B50B- 33 D2                 - xor edx,edx
GameAssembly.dll+28B50D- 45 8D 41 20           - lea r8d,[r9+20]
GameAssembly.dll+28B511- 48 8B C8              - mov rcx,rax
GameAssembly.dll+28B514- E8 C77E5200           - call System.String.Substring
GameAssembly.dll+28B519- 48 85 FF              - test rdi,rdi
GameAssembly.dll+28B51C- 0F84 F1030000         - je GameAssembly.dll+28B913
GameAssembly.dll+28B522- 4C 8B 07              - mov r8,[rdi]
GameAssembly.dll+28B525- 4D 8B 88 38020000     - mov r9,[r8+00000238]
GameAssembly.dll+28B52C- 4D 8B 80 40020000     - mov r8,[r8+00000240]
GameAssembly.dll+28B533- 48 8B D0              - mov rdx,rax
GameAssembly.dll+28B536- 48 8B CF              - mov rcx,rdi
GameAssembly.dll+28B539- 41 FF D1              - call r9
GameAssembly.dll+28B53C- 48 85 DB              - test rbx,rbx
GameAssembly.dll+28B53F- 0F84 C9030000         - je GameAssembly.dll+28B90E
GameAssembly.dll+28B545- 4C 8B 03              - mov r8,[rbx]
GameAssembly.dll+28B548- 4D 8B 88 F8010000     - mov r9,[r8+000001F8]
GameAssembly.dll+28B54F- 4D 8B 80 00020000     - mov r8,[r8+00000200]
GameAssembly.dll+28B556- 48 8B D0              - mov rdx,rax
GameAssembly.dll+28B559- 48 8B CB              - mov rcx,rbx
GameAssembly.dll+28B55C- 41 FF D1              - call r9
GameAssembly.dll+28B55F- 48 8B 5C 24 30        - mov rbx,[rsp+30]
GameAssembly.dll+28B564- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B566- E8 A5467000           - call System.Text.Encoding.get_UTF8
GameAssembly.dll+28B56B- 48 8B C8              - mov rcx,rax
GameAssembly.dll+28B56E- 48 85 C0              - test rax,rax
GameAssembly.dll+28B571- 0F84 92030000         - je GameAssembly.dll+28B909
GameAssembly.dll+28B577- 4C 8B 00              - mov r8,[rax]
GameAssembly.dll+28B57A- 49 8B 80 38020000     - mov rax,[r8+00000238]
GameAssembly.dll+28B581- 4D 8B 80 40020000     - mov r8,[r8+00000240]
GameAssembly.dll+28B588- 49 8B 56 48           - mov rdx,[r14+48]
GameAssembly.dll+28B58C- FF D0                 - call rax
GameAssembly.dll+28B58E- 48 85 DB              - test rbx,rbx
GameAssembly.dll+28B591- 0F84 6D030000         - je GameAssembly.dll+28B904
GameAssembly.dll+28B597- 4C 8B 03              - mov r8,[rbx]
GameAssembly.dll+28B59A- 4D 8B 88 D8010000     - mov r9,[r8+000001D8]
GameAssembly.dll+28B5A1- 4D 8B 80 E0010000     - mov r8,[r8+000001E0]
GameAssembly.dll+28B5A8- 48 8B D0              - mov rdx,rax
GameAssembly.dll+28B5AB- 48 8B CB              - mov rcx,rbx
GameAssembly.dll+28B5AE- 41 FF D1              - call r9
GameAssembly.dll+28B5B1- 48 8B 4C 24 30        - mov rcx,[rsp+30]
GameAssembly.dll+28B5B6- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B5B9- 0F84 40030000         - je GameAssembly.dll+28B8FF
GameAssembly.dll+28B5BF- 4C 8B 01              - mov r8,[rcx]
GameAssembly.dll+28B5C2- 49 8B 80 48020000     - mov rax,[r8+00000248]
GameAssembly.dll+28B5C9- 4D 8B 80 50020000     - mov r8,[r8+00000250]
GameAssembly.dll+28B5D0- BA 01000000           - mov edx,00000001 { 1 }
GameAssembly.dll+28B5D5- FF D0                 - call rax
GameAssembly.dll+28B5D7- 48 8B 4C 24 30        - mov rcx,[rsp+30]
GameAssembly.dll+28B5DC- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B5DF- 0F84 15030000         - je GameAssembly.dll+28B8FA
GameAssembly.dll+28B5E5- 4C 8B 01              - mov r8,[rcx]
GameAssembly.dll+28B5E8- 49 8B 80 68020000     - mov rax,[r8+00000268]
GameAssembly.dll+28B5EF- 4D 8B 80 70020000     - mov r8,[r8+00000270]
GameAssembly.dll+28B5F6- BA 02000000           - mov edx,00000002 { 2 }
GameAssembly.dll+28B5FB- FF D0                 - call rax
GameAssembly.dll+28B5FD- 48 8B 5C 24 30        - mov rbx,[rsp+30]
GameAssembly.dll+28B602- 48 85 DB              - test rbx,rbx
GameAssembly.dll+28B605- 0F84 EA020000         - je GameAssembly.dll+28B8F5
GameAssembly.dll+28B60B- 48 8B 13              - mov rdx,[rbx]
GameAssembly.dll+28B60E- 48 8B 82 E8010000     - mov rax,[rdx+000001E8]
GameAssembly.dll+28B615- 48 8B 92 F0010000     - mov rdx,[rdx+000001F0]
GameAssembly.dll+28B61C- 48 8B CB              - mov rcx,rbx
GameAssembly.dll+28B61F- FF D0                 - call rax
GameAssembly.dll+28B621- 48 8B F8              - mov rdi,rax
GameAssembly.dll+28B624- 48 8B 4C 24 30        - mov rcx,[rsp+30]
GameAssembly.dll+28B629- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B62C- 0F84 BE020000         - je GameAssembly.dll+28B8F0
GameAssembly.dll+28B632- 48 8B 11              - mov rdx,[rcx]
GameAssembly.dll+28B635- 4C 8B 82 C8010000     - mov r8,[rdx+000001C8]
GameAssembly.dll+28B63C- 48 8B 92 D0010000     - mov rdx,[rdx+000001D0]
GameAssembly.dll+28B643- 41 FF D0              - call r8
GameAssembly.dll+28B646- 48 85 DB              - test rbx,rbx
GameAssembly.dll+28B649- 0F84 9C020000         - je GameAssembly.dll+28B8EB
GameAssembly.dll+28B64F- 4C 8B 0B              - mov r9,[rbx]
GameAssembly.dll+28B652- 4D 8B 91 88020000     - mov r10,[r9+00000288]
GameAssembly.dll+28B659- 4D 8B 89 90020000     - mov r9,[r9+00000290]
GameAssembly.dll+28B660- 4C 8B C0              - mov r8,rax
GameAssembly.dll+28B663- 48 8B D7              - mov rdx,rdi
GameAssembly.dll+28B666- 48 8B CB              - mov rcx,rbx
GameAssembly.dll+28B669- 41 FF D2              - call r10
GameAssembly.dll+28B66C- 48 89 44 24 48        - mov [rsp+48],rax
GameAssembly.dll+28B671- 4C 89 64 24 78        - mov [rsp+78],r12
GameAssembly.dll+28B676- 48 8D 44 24 48        - lea rax,[rsp+48]
GameAssembly.dll+28B67B- 48 89 84 24 80000000  - mov [rsp+00000080],rax
GameAssembly.dll+28B683- 48 8B 0D D66F0501     - mov rcx,[GameAssembly.dll+12E2660] { (536891961) }
GameAssembly.dll+28B68A- E8 E189F1FF           - call GameAssembly.mono_method_get_class+50
GameAssembly.dll+28B68F- 48 8B D8              - mov rbx,rax
GameAssembly.dll+28B692- 33 D2                 - xor edx,edx
GameAssembly.dll+28B694- 48 8B C8              - mov rcx,rax
GameAssembly.dll+28B697- E8 14A16200           - call System.IO.MemoryStream..ctor
GameAssembly.dll+28B69C- 48 89 5C 24 40        - mov [rsp+40],rbx
GameAssembly.dll+28B6A1- 4C 89 64 24 68        - mov [rsp+68],r12
GameAssembly.dll+28B6A6- 48 8D 44 24 40        - lea rax,[rsp+40]
GameAssembly.dll+28B6AB- 48 89 44 24 70        - mov [rsp+70],rax
GameAssembly.dll+28B6B0- 48 8B 7C 24 40        - mov rdi,[rsp+40]
GameAssembly.dll+28B6B5- 48 8B 74 24 48        - mov rsi,[rsp+48]
GameAssembly.dll+28B6BA- 48 8B 0D 37F90401     - mov rcx,[GameAssembly.dll+12DAFF8] { (536888225) }
GameAssembly.dll+28B6C1- E8 AA89F1FF           - call GameAssembly.mono_method_get_class+50
GameAssembly.dll+28B6C6- 48 8B D8              - mov rbx,rax
GameAssembly.dll+28B6C9- 4C 89 64 24 20        - mov [rsp+20],r12
GameAssembly.dll+28B6CE- 41 B9 01000000        - mov r9d,00000001 { 1 }
GameAssembly.dll+28B6D4- 4C 8B C6              - mov r8,rsi
GameAssembly.dll+28B6D7- 48 8B D7              - mov rdx,rdi
GameAssembly.dll+28B6DA- 48 8B C8              - mov rcx,rax
GameAssembly.dll+28B6DD- E8 6E7A5300           - call System.Security.Cryptography.CryptoStream..ctor
GameAssembly.dll+28B6E2- 48 89 5C 24 38        - mov [rsp+38],rbx
GameAssembly.dll+28B6E7- 4C 89 64 24 58        - mov [rsp+58],r12
GameAssembly.dll+28B6EC- 48 8D 44 24 38        - lea rax,[rsp+38]
GameAssembly.dll+28B6F1- 48 89 44 24 60        - mov [rsp+60],rax
GameAssembly.dll+28B6F6- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B6F8- E8 13457000           - call System.Text.Encoding.get_UTF8
GameAssembly.dll+28B6FD- 48 8B C8              - mov rcx,rax
GameAssembly.dll+28B700- 48 85 C0              - test rax,rax
GameAssembly.dll+28B703- 0F84 C4010000         - je GameAssembly.dll+28B8CD
GameAssembly.dll+28B709- 4C 8B 00              - mov r8,[rax]
GameAssembly.dll+28B70C- 49 8B 80 38020000     - mov rax,[r8+00000238]
GameAssembly.dll+28B713- 4D 8B 80 40020000     - mov r8,[r8+00000240]
GameAssembly.dll+28B71A- 49 8B D7              - mov rdx,r15
GameAssembly.dll+28B71D- FF D0                 - call rax
GameAssembly.dll+28B71F- 48 8B D0              - mov rdx,rax
GameAssembly.dll+28B722- 48 85 C0              - test rax,rax
GameAssembly.dll+28B725- 0F84 9D010000         - je GameAssembly.dll+28B8C8
GameAssembly.dll+28B72B- 48 8B 4C 24 38        - mov rcx,[rsp+38]
GameAssembly.dll+28B730- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B733- 0F84 8A010000         - je GameAssembly.dll+28B8C3
GameAssembly.dll+28B739- 48 8B 01              - mov rax,[rcx]
GameAssembly.dll+28B73C- 4C 8B 90 F8020000     - mov r10,[rax+000002F8]
GameAssembly.dll+28B743- 48 8B 80 00030000     - mov rax,[rax+00000300]
GameAssembly.dll+28B74A- 48 89 44 24 20        - mov [rsp+20],rax
GameAssembly.dll+28B74F- 44 8B 4A 18           - mov r9d,[rdx+18]
GameAssembly.dll+28B753- 45 33 C0              - xor r8d,r8d
GameAssembly.dll+28B756- 41 FF D2              - call r10
GameAssembly.dll+28B759- 48 8B 4C 24 38        - mov rcx,[rsp+38]
GameAssembly.dll+28B75E- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B761- 0F84 57010000         - je GameAssembly.dll+28B8BE
GameAssembly.dll+28B767- 33 D2                 - xor edx,edx
GameAssembly.dll+28B769- E8 B2695300           - call System.Security.Cryptography.CryptoStream.FlushFinalBlock
GameAssembly.dll+28B76E- 48 8B 4C 24 40        - mov rcx,[rsp+40]
GameAssembly.dll+28B773- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B776- 0F84 3C010000         - je GameAssembly.dll+28B8B8
GameAssembly.dll+28B77C- 48 8B 11              - mov rdx,[rcx]
GameAssembly.dll+28B77F- 48 8B 82 58030000     - mov rax,[rdx+00000358]
GameAssembly.dll+28B786- 48 8B 92 60030000     - mov rdx,[rdx+00000360]
GameAssembly.dll+28B78D- FF D0                 - call rax
GameAssembly.dll+28B78F- 48 8B D8              - mov rbx,rax
GameAssembly.dll+28B792- 48 89 44 24 50        - mov [rsp+50],rax
GameAssembly.dll+28B797- 4C 8B 44 24 38        - mov r8,[rsp+38]
GameAssembly.dll+28B79C- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B79F- 74 0F                 - je GameAssembly.dll+28B7B0
GameAssembly.dll+28B7A1- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B7A3- 48 8B 15 C63B0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B7AA- E8 1173D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B7AF- 90                    - nop 
GameAssembly.dll+28B7B0- 4C 8B 44 24 40        - mov r8,[rsp+40]
GameAssembly.dll+28B7B5- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B7B8- 74 0F                 - je GameAssembly.dll+28B7C9
GameAssembly.dll+28B7BA- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B7BC- 48 8B 15 AD3B0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B7C3- E8 F872D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B7C8- 90                    - nop 
GameAssembly.dll+28B7C9- 4C 8B 44 24 48        - mov r8,[rsp+48]
GameAssembly.dll+28B7CE- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B7D1- 74 0F                 - je GameAssembly.dll+28B7E2
GameAssembly.dll+28B7D3- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B7D5- 48 8B 15 943B0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B7DC- E8 DF72D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B7E1- 90                    - nop 
GameAssembly.dll+28B7E2- 4C 8B 44 24 30        - mov r8,[rsp+30]
GameAssembly.dll+28B7E7- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B7EA- 74 0E                 - je GameAssembly.dll+28B7FA
GameAssembly.dll+28B7EC- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B7EE- 48 8B 15 7B3B0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B7F5- E8 C672D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B7FA- E9 98000000           - jmp GameAssembly.dll+28B897
GameAssembly.dll+28B7FF- 4C 8B 44 24 38        - mov r8,[rsp+38]
GameAssembly.dll+28B804- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B807- 74 0E                 - je GameAssembly.dll+28B817
GameAssembly.dll+28B809- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B80B- 48 8B 15 5E3B0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B812- E8 A972D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B817- 48 8B 4C 24 58        - mov rcx,[rsp+58]
GameAssembly.dll+28B81C- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B81F- 0F85 AE000000         - jne GameAssembly.dll+28B8D3
GameAssembly.dll+28B825- 4C 8B 44 24 40        - mov r8,[rsp+40]
GameAssembly.dll+28B82A- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B82D- 74 0E                 - je GameAssembly.dll+28B83D
GameAssembly.dll+28B82F- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B831- 48 8B 15 383B0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B838- E8 8372D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B83D- 48 8B 4C 24 68        - mov rcx,[rsp+68]
GameAssembly.dll+28B842- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B845- 0F85 8E000000         - jne GameAssembly.dll+28B8D9
GameAssembly.dll+28B84B- 4C 8B 44 24 48        - mov r8,[rsp+48]
GameAssembly.dll+28B850- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B853- 74 0E                 - je GameAssembly.dll+28B863
GameAssembly.dll+28B855- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B857- 48 8B 15 123B0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B85E- E8 5D72D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B863- 48 8B 4C 24 78        - mov rcx,[rsp+78]
GameAssembly.dll+28B868- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B86B- 75 72                 - jne GameAssembly.dll+28B8DF
GameAssembly.dll+28B86D- 4C 8B 44 24 30        - mov r8,[rsp+30]
GameAssembly.dll+28B872- 4D 85 C0              - test r8,r8
GameAssembly.dll+28B875- 74 0E                 - je GameAssembly.dll+28B885
GameAssembly.dll+28B877- 33 C9                 - xor ecx,ecx
GameAssembly.dll+28B879- 48 8B 15 F03A0501     - mov rdx,[GameAssembly.dll+12DF370] { (164606393D0) }
GameAssembly.dll+28B880- E8 3B72D7FF           - call GameAssembly.dll+2AC0
GameAssembly.dll+28B885- 48 8B 8C 24 88000000  - mov rcx,[rsp+00000088]
GameAssembly.dll+28B88D- 48 85 C9              - test rcx,rcx
GameAssembly.dll+28B890- 75 53                 - jne GameAssembly.dll+28B8E5
GameAssembly.dll+28B892- 48 8B 5C 24 50        - mov rbx,[rsp+50]
GameAssembly.dll+28B897- 48 8B C3              - mov rax,rbx
GameAssembly.dll+28B89A- 4C 8D 9C 24 C0000000  - lea r11,[rsp+000000C0]
GameAssembly.dll+28B8A2- 49 8B 5B 20           - mov rbx,[r11+20]
GameAssembly.dll+28B8A6- 49 8B 73 28           - mov rsi,[r11+28]
GameAssembly.dll+28B8AA- 49 8B 7B 30           - mov rdi,[r11+30]
GameAssembly.dll+28B8AE- 49 8B E3              - mov rsp,r11
GameAssembly.dll+28B8B1- 41 5F                 - pop r15
GameAssembly.dll+28B8B3- 41 5E                 - pop r14
GameAssembly.dll+28B8B5- 41 5C                 - pop r12
GameAssembly.dll+28B8B7- C3                    - ret 
GameAssembly.dll+28B8B8- E8 0388F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8BD- 90                    - nop 
GameAssembly.dll+28B8BE- E8 FD87F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8C3- E8 F887F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8C8- E8 F387F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8CD- E8 EE87F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8D2- 90                    - nop 
GameAssembly.dll+28B8D3- E8 7888F1FF           - call GameAssembly.mono_method_get_class+130
GameAssembly.dll+28B8D8- 90                    - nop 
GameAssembly.dll+28B8D9- E8 7288F1FF           - call GameAssembly.mono_method_get_class+130
GameAssembly.dll+28B8DE- 90                    - nop 
GameAssembly.dll+28B8DF- E8 6C88F1FF           - call GameAssembly.mono_method_get_class+130
GameAssembly.dll+28B8E4- 90                    - nop 
GameAssembly.dll+28B8E5- E8 6688F1FF           - call GameAssembly.mono_method_get_class+130
GameAssembly.dll+28B8EA- 90                    - nop 
GameAssembly.dll+28B8EB- E8 D087F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8F0- E8 CB87F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8F5- E8 C687F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8FA- E8 C187F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B8FF- E8 BC87F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B904- E8 B787F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B909- E8 B287F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B90E- E8 AD87F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B913- E8 A887F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B918- E8 A387F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B91D- E8 9E87F1FF           - call GameAssembly.mono_method_get_class+A0
GameAssembly.dll+28B922- CC                    - int 3 
GameAssembly.dll+28B923- CC                    - int 3 
GameAssembly.dll+28B924- CC                    - int 3 
GameAssembly.dll+28B925- CC                    - int 3 
GameAssembly.dll+28B926- CC                    - int 3 
GameAssembly.dll+28B927- CC                    - int 3 
GameAssembly.dll+28B928- CC                    - int 3 
GameAssembly.dll+28B929- CC                    - int 3 
GameAssembly.dll+28B92A- CC                    - int 3 
GameAssembly.dll+28B92B- CC                    - int 3 
GameAssembly.dll+28B92C- CC                    - int 3 
GameAssembly.dll+28B92D- CC                    - int 3 
GameAssembly.dll+28B92E- CC                    - int 3 
GameAssembly.dll+28B92F- CC                    - int 3

这个aes是标准的aes，从汇编中导入的crypto初始化就可以看出来，但是有一个难点，就是这里需要用到key和iv，

key我们可以获得，

iv需要我们分析汇编代码来获得，明文不会显示出来，而且这个题目里面添加了一些反调试，直接用ce来附加无法附加成功，并且程序会直接关闭，后面发现用x64的ScyllaHide插件能过掉反调试让程序正常运行，并且找到一个脱壳工具能够把这个GameAssembly.dll中的themida壳脱掉，叫Magicmida64，

用il2cppdumper进行dump，

dump成功后将文件导入ida中

能找到我们在ce中看到的程序

所以这里通过ida中的伪代码和汇编代码相结合进行分析

这里可以看到很多IV的操作，但跟踪不到IV值是从哪里写入的，在这里通过ida的可以看到这个iv是写在了这个结构体中，但是这个结构体有点无从下手

所以这里还是用x64来进行动调来获取更方便

这里的v20可以分析出来存的应该是IV的数据，

所以到汇编层来看是哪一个寄存器来存了这个变量的值

这里需要补充一个小知识点

在 Windows 64 位程序里，前 4 个参数一般这样传：

1
2
3
4
5
第 1 个参数 -> RCX
第 2 个参数 -> RDX
第 3 个参数 -> R8
第 4 个参数 -> R9
返回值     -> RAX

例如 C 代码：

1
func(a, b, c, d);

汇编里通常是：

1
2
3
4
5
mov rcx, a
mov rdx, b
mov r8,  c
mov r9,  d
call func

调用完之后：

1
RAX = func 的返回值

如果参数超过 4 个，多出来的参数会放到栈上，比如：

1
2
3
4
5
6
mov [rsp+20], 第5个参数
mov r9, 第4个参数
mov r8, 第3个参数
mov rdx, 第2个参数
mov rcx, 第1个参数
call func

直接选中这个v20变量tab直接跳转到对应的汇编代码

看到这里的r8应该就是

1
v31->klass->vtable._9_get_IV.methodPtr

那么运行完这一段函数之后的返回值对应的就是v20的值，windows 64位程序一般会把返回值存在RAX中

所以这时候的RAX的值对应的就是v20的值

这里直接用x64启动这个cpp，在18028B643这个地址下个断点

这里在程序中直接输入长度为42的数据

让程序走到这里

可以看到，这时候RAX的值为0000017840126700

直接跳转到对应的地址去看

这里补充一个知识点

1
2
3
string 内容地址 - 0x14 = string 对象
数组 + 0x18 = 长度
数组 + 0x20 = 数据

所以这里我们需要找这个地址+0x20的数据作为IV的值

就是

1
31323334353637383930414243444546

转成字符串就是

1
1234567890ABCDEF

找完IV之后就是找密文了

ida对check_input这个函数的反编译有点问题

还是得回到汇编代码中来看，

找到最终密文比对这一块

这时候rcx+rdx+0x20所对应的地址的值就是密文的值

最终可以解出flag