[🥉 Bronze 1] 64바이트를 6개 함수가 나눠 검증하는 crackme — DreamHack mix-compare 풀이

lea    0x9(%rax),%edx        <-- input[0]+9
mov    0x2e54(%rip),%eax     # 4020 <result>
cmp    %eax,%edx
jne    13ad <check+0x204>
...
not    %eax                  <-- NOT(input[1])
mov    0x2e38(%rip),%eax     # 4024 <result+0x4>
cmp    %eax,%edx

loc:
    movzbl (%rax),%eax
    movsbl %al,%edx
    lea    (%rdx,%rax,1),%ecx    ; input[i] + i
    ...
    cmp    %eax,%ecx
    jne    <fail>
    addl   $0x1,-0x4(%rbp)       ; i++
    cmpl   $0x23,-0x4(%rbp)      ; i <= 0x23(35) 까지
    jle    <loop>
    call   <check_dec>            ; 다음 구간으로 체인

4020 39000000 9bffffff 2c000000 c6000000
4030 59000000 58000000 39000000 ab000000
...
4120 24000000

# check()/check_not()/check_add()/check_dec()/check_mul()/check_la() 가 64바이트 입력을
# 8바이트씩(정확히는 16+10+10+10+10+8) 서로 다른 산술 변환으로 result[i]와 비교한다.
#   i= 0..15 (check 자체, 각기 다른 상수 변환)
#   i=16..25 (check_not): NOT(c) + i        == result[i]
#   i=26..35 (check_add): c + i             == result[i]
#   i=36..45 (check_dec): c - i             == result[i]
#   i=46..55 (check_mul): c * i             == result[i]
#   i=56..63 (check_la) : c + 100 - i       == result[i]
# result[] 는 .data 섹션(0x4020부터 64개 int32)에 초기값으로 그대로 박혀 있다.
import re
import struct
import subprocess
 
raw = subprocess.run(["objdump", "-s", "-j", ".data", "chall"],
                      capture_output=True, text=True, check=True).stdout
 
mem = {}
for line in raw.splitlines():
    m = re.match(r"^\s*([0-9a-f]{4,8})\s+((?:[0-9a-f]{2,8}\s*){1,4})", line)
    if not m:
        continue
    addr = int(m.group(1), 16)
    words = m.group(2).split()
    off = 0
    for w in words:
        b = bytes.fromhex(w)
        for i, byte in enumerate(b):
            mem[addr + off + i] = byte
        off += len(b)
 
base = 0x4020
data = bytes(mem[base + i] for i in range(64 * 4))
result = struct.unpack("<64i", data)
 
flag_chars = [0] * 64
const_ops = {
    0: lambda r: r - 9,       1: lambda r: -r - 1,      2: lambda r: r + 4,
    3: lambda r: r // 2,      4: lambda r: r - 0x22,    5: lambda r: r - 0x28,
    6: lambda r: r + 0x28,    7: lambda r: r // 3,      8: lambda r: -r - 1,
    9: lambda r: r // 2,      10: lambda r: r // 4,     11: lambda r: r // 4,
    12: lambda r: 0x13 - r,   13: lambda r: r - 0x11,   14: lambda r: r - 0x1e,
    15: lambda r: r,
}
for i in range(16):
    flag_chars[i] = const_ops[i](result[i])
for i in range(16, 26):
    flag_chars[i] = i - result[i] - 1
for i in range(26, 36):
    flag_chars[i] = result[i] - i
for i in range(36, 46):
    flag_chars[i] = result[i] + i
for i in range(46, 56):
    flag_chars[i] = result[i] // i
for i in range(56, 64):
    flag_chars[i] = result[i] - 100 + i
 
recovered = bytes(flag_chars)
print("recovered input:", recovered.decode())
print(f"FLAG: DH{{{recovered.decode()}}}")

./chall < input.txt   # input.txt = 복원된 64바이트

python3 dreamhack.py wg 961 --flag 'DH{0d0c70a91ccd9b4fda8eedc657580618c37d08dbfbdc9a426c8f9d1674e0dbf0}'