0x01 程序逻辑

``````00000000 stack_mem       struc ; (sizeof=0x140)  ; XREF: check/r
00000000 u               fst ?                   ; XREF: check+216/w
00000000                                         ; check+21C/w ...
00000010 input_idxes     db 304 dup(?)           ; XREF: check:loc_40123A/w
00000010                                         ; check+206/o ...
00000140 stack_mem       ends
00000140
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 fst             union ; (sizeof=0x10)   ; XREF: check+216/w
00000000                                         ; check+21C/w ...
00000000 arr             db 16 dup(?)
00000000 i               info ?
00000000 fst             ends
00000000
00000000 ; ---------------------------------------------------------------------------
00000000
00000000 info            struc ; (sizeof=0x10)   ; XREF: fst/r
00000000 four            dd ?
00000004 field_4         dd ?
00000008 key_idx         db 4 dup(?)
0000000C idx             dd ?
00000010 info            ends
``````

1. 整理内存结构能大大加快分析效率
2. 有时候静态看不出来尝试动态理解

``````         3rd 2nd 1st
0 key_idx = 020100 -> [0x00][0x01][0x02]
1 key_idx = 000403
2 key_idx = 000605
3 key_idx = 010705
4 key_idx = 010604
5 key_idx = 030208
6 key_idx = 040209
7 key_idx = 030A07
8 key_idx = 050C08
9 key_idx = 060D0B
10 key_idx = 070D0C
11 key_idx = 090E0B
12 key_idx = 0A080E
13 key_idx = 0A090F
14 key_idx = 0C0B0F
15 key_idx = 0E0D0F
``````

0x02 暴力破解

``````pow(64, m-n)
``````

``````vector<uint32_t> find_idxes(uint8_t c)
{
vector<uint32_t> ret;
for (uint32_t i = 0; i < KEYS_LEN; i++)
{
if (keys[i] == c)
{
ret.push_back(i);
}
}
return ret;
}
``````

``````inline uint8_t keys_access(uint8_t fst, uint8_t snd, uint8_t trd)
{
return keys[(fst << 12) + (snd << 6) + trd];
}
inline uint8_t fst(uint32_t idx)
{
return idx >> 12;
}
inline uint8_t snd(uint32_t idx)
{
return (idx >> 6) & 0x3f ;
}
inline uint8_t trd(uint32_t idx)
{
return idx & 0x3f;
}
vector<vector<uint8_t>> crack_01234(vector<uint8_t>& res)
{
vector<uint32_t> poss_012 = find_idxes(res[0]),
poss_340 = find_idxes(res[1]);
vector<vector<uint8_t>> ret;
for (uint32_t y : poss_012)
{
for (uint32_t x : poss_340)
{
if (fst(y) == trd(x))
{
vector<uint8_t> tmp;
tmp.push_back(fst(y));
tmp.push_back(snd(y));
tmp.push_back(trd(y));
tmp.push_back(fst(x));
tmp.push_back(snd(x));
ret.push_back(tmp);
}
}
}
return ret;
}
``````

``````vector<vector<uint8_t>> crack_012346(vector<uint8_t>& res)
{
vector<vector<uint8_t>> poss_01234 = crack_01234(res);
vector<uint32_t> poss_461 = find_idxes(res[4]);
vector<vector<uint8_t>> ret;
for (vector<uint8_t> y : poss_01234)
{
for (uint32_t x : poss_461)
{
if (fst(x) == y[4] && trd(x) == y[1])
{
vector<uint8_t> tmp = {y[0], y[1], y[2], y[3], y[4], snd(x)};
ret.push_back(tmp);
}
}
}
return ret;
}
``````

``````vector<vector<uint8_t>> shrink_0123456789abcde(vector<uint8_t>& res)
{
vector<vector<uint8_t>> poss_0123456789abcde = crack_0123456789abcde(res);
vector<uint32_t> poss_e8a = find_idxes(res[12]);
vector<vector<uint8_t>> ret;
for (vector<uint8_t> y : poss_0123456789abcde)
{
for (uint32_t x : poss_e8a)
{
if (fst(x) == y[0xe] && snd(x) == y[0x8] && trd(x) == y[0xa])
{
ret.push_back(y);
}
}
}
return ret;
}
``````