1
小Q是一位热衷于PC客户端安全的技术爱好者，为了不断提升自己的技能，他经常参与各类CTF竞赛。某天，他收到了一封来自神秘人的邮件，内容如下：
2

3
“我可以引领你进入游戏安全的殿堂，但在此之前，你需要通过我的考验。打开这扇大门的钥匙就隐藏在附件中，你有能力找到它吗？”
4

5
### 评分标准：满分5分
6

7
（1）**在64位Windows10+系统**上运行exe, 找到正确的flag，作为答案提交（2分）。
8

9
（2）文档编写，详细描述解题过程，详述提供的解题程序的演示方法。（满1分）
10

11
（3）提供解题演示所用的源代码。编码工整风格优雅（1分）、注释详尽（1分）。
12

13
### 解题要求：
14

15
（1）**关闭Windows Defender等杀软、VBS、hyper-v后**，管理员运行exe（驱动需要自己解决签名问题）。
16

17
（2）解题得到正确的flag，以“flag{xxxxxxxxxxxxxxxxxxxxxx}”的形式提交。
18

19
（3）不得以任何方式暴力破解得到flag，解题注重分析过程。
20

21
（4）不得删改exe/sys的文件本身；不得使用任何文件和磁盘相关手段（比如同名文件占坑等方式）影响程序运行。
22

23
（5）必须使用64位Win10-Win11 22H2系统解题。
24

25
### 提交内容：
26

27
（1）flag（txt格式），可执行文件和运行说明（exe/dll/sys），文档（pdf或docx格式），代码（不限语言）打包压缩到一个zip文件中。
28

29
（2）zip文件命名格式：初赛-PC客户端+姓名+学校+手机号.zip。

1
rules:
2
  - name: advanced_lea_math_junk
3
    pattern:
4
      - "push $reg1"
5
      - "lea $reg1, [$mem1]"
6
      - "{lea $reg1, [$reg1 $op1 $mem2] | lea $reg1, [$reg1]}"
7
      - "jmp_inst: jmp $reg1"
8
      - "{E9|E8}"
9
      - "target: pop $reg1"
10
    condition:
11
      - "$op1 is None or $op1 in ['+', '-']"
12
      - "($target == $mem1 $op1 $mem2) if $mem2 is not None else ($target == $mem1)"
13
    replace:
14
      - "nop"
15

16
  - name: advanced_lea_math_junk_2
17
    pattern:
18
      - "push $reg1"
19
      - "lea $reg1, [$mem1]"
20
      - "lea $reg1, [$reg1 $op1 $imm2]"
21
      - "jmp_inst: jmp $reg1"
22
      - "{E9|E8}"
23
      - "target: pop $reg1"
24
    condition:
25
      - "$op1 in ['+', '-']"
26
      - "$target == $mem1 $op1 $imm2"
27
    replace:
28
      - "nop"
29

30
  - name: jmp_junk_target
31
    pattern:
32
      - "jmp_inst: jmp $target"
33
      - "{E9|E8}"
34
      - "target_loc: $any_inst"
35
    condition:
36
      - "$target == $target_loc"
37
    replace:
38
      - "nop"
39

40
  - name: pushfq_add_popfq_jmp_e8_pop
41
    pattern:
42
      - "push $reg1"
43
      - "mov $reg1, $imm1"
44
      - "pushfq"
45
      - "add $reg1, $imm2"
46
      - "popfq"
47
      - "jmp_inst: jmp $reg1"
48
      - "{E9|E8}"
49
      - "target: pop $reg1"
50
    condition:
51
      - "$target == ($imm1 + $imm2)&0xFFFFFFFFFFFFFFFF"
52
    replace:
53
      - "nop"
54

55
  - name: not_xchg_not
56
    pattern:
57
      - "not $reg1"
58
      - "{xchg $reg1, $reg2 | xchg $reg2, $reg1}"
59
      - "not $reg2"
60
    replace:
61
      - "xchg $reg1, $reg2"
62

63
  - name: mov_add_jmp
64
    pattern:
65
      - "push $reg1"
66
      - "mov $reg1, $imm1"
67
      - "pushfq"
68
      - "add $reg1, $imm2"
69
      - "popfq"
70
      - "jmp_inst: jmp $reg1"
71
      - "{E9|E8}"
72
    replace:
73
      - "push $reg1"
74
      - "mov $reg1, imm(($imm1 + $imm2)&0xFFFFFFFFFFFFFFFF)"
75
      - "jmp imm(($imm1 + $imm2)&0xFFFFFFFFFFFFFFFF)"

1
__int64 __fastcall sub_140009F83(__int64 a1, volatile void *a2, unsigned int a3, __int64 a4)
2
{
3
  __int64 result; // rax
4
  __int64 v5; // rsi
5
  __int64 v8; // rdx
6
  __int64 v10; // rt1
7
  unsigned __int64 v11; // rcx
8
  int v12; // r8d
9
  void *v13; // rbx
10
  int v14; // edx
11

12
  v10 = v5;
13
  v8 = v10;
14
  *(_QWORD *)(result - 1869574000) = v10;
15
  if ( v10 )
16
  {
17
    v11 = *(_QWORD *)result;
18
    result = a3 + v8;
19
    if ( result < v11 )
20
    {
21
      result += a4;
22
      if ( result < v11 )
23
      {
24
        result = (__int64)ExAllocatePoolWithTag(NonPagedPool, a3, ~a3);
25
        v13 = (void *)result;
26
        if ( result )
27
        {
28
          ProbeForRead(a2, a3, ~v12);
29
          memmove(v13, (const void *)a2, a3);
30
          doSomething((__int64)v13, a3, a4);
31
          ExFreePoolWithTag(v13, ~v14);
32
        }
33
      }
34
    }
35
  }
36
  return result;
37
}

1
mov  rax, rsp
2
mov  [rax+8], rbx
3
mov  [rax+10h], rbp
4
mov  [rax+18h], rsi
5
mov  [rax+20h], rdi
6
push r13
7
mov  r13, rdx
8
mov  ebx, [rdx]
9
xor  r11d, r11d
10
mov  edi, [rdx+4]
11
mov  r8, rcx
12
mov  esi, [rdx+8]
13
mov  ebp, [rdx+0Ch]
14
mov  r9d, [rcx]
15
lea  edx, [r11+20h]
16
mov  r10d, [rcx+4]
17

18
BACK:
19
mov ecx, r10d
20
lea r11d, [r11-61C88647h]
21
shr ecx, 5
22
mov eax, r10d
23
add ecx, edi
24
shl eax, 4
25
add eax, ebx
26
xor ecx, eax
27
lea eax, [r11+r10]
28
xor ecx, eax
29
add r9d, ecx
30
mov ecx,r9d
31
mov eax,r9d
32
shl eax,4
33
shr ecx,5
34
xor ecx,eax
35
mov rax,r11d
36
shr rax,0bh
37
add ecx,r9d
38
and eax,3
39
mov eax,dword ptr [r13+rax*4]
40
add eax,r11d
41
xor ecx,eax
42
add r10d,ecx
43
sub rdx,1
44
jne Back
45

46
pop r13
47
mov rbx,[rsp+8]
48
mov rbp, [rsp+10h]
49
mov rsi, [rsp+18h]
50
mov rdi, [rsp+20h]
51
mov [r8], r9d
52
mov [r8+4], r10d
53
retn

1
import struct
2

3
def solve(cipher):
4

5
    key = b"sxx"
6

7
    xor_result = ""
8
    for i in range(len(cipher)):
9
        xor_result += chr(cipher[i] ^ key[i % len(key)])
10
    reversed_str = xor_result[::-1]
11

12
    if reversed_str.startswith('@'):
13
        base58_str = reversed_str[1:]
14
    else:
15
        base58_str = reversed_str[:-1]
16

17
    ALPHABET = "abcdefghijkmnopqrstuvwxyzABCDEFGHJKLMNPQRSTUVWXYZ123456789"
18

19
    n = 0
20
    for char in base58_str:
21
        if char not in ALPHABET:
22
            print(f"[!] 警告：字符 '{char}' 不在 Base58 表中，请检查表顺序或密文！")
23
            return
24
        n = n * 58 + ALPHABET.index(char)
25

26
    res = []
27
    while n > 0:
28
        res.append(n % 256)
29
        n //= 256
30

31
    flag_body = bytes(res[::-1]).decode('ascii', errors='ignore')
32
    print(f"\n[+] 最终 Flag: ACE_{flag_body}")
33

34
def encrypt_hybrid(pt, key):
35
    delta = 0x9E3779B9
36
    m = 0xFFFFFFFF
37
    v0, v1 = pt[0] & m, pt[1] & m
38
    s = 0
39
    for _ in range(32):
40
        s = (s + delta) & m
41
        v0 = (v0 + ((s + v1) ^ (key[0] + (v1 << 4)) ^ (key[1] + (v1 >> 5)))) & m
42
        v1 = (v1 + ((s + key[(s >> 11) & 3]) ^ (v0 + ((v0 << 4) ^ (v0 >> 5))))) & m
43
    return (v0, v1)
44

45
def decrypt_hybrid(ct, key):
46
    delta = 0x9E3779B9
47
    m = 0xFFFFFFFF
48
    v0, v1 = ct[0] & m, ct[1] & m
49
    s = (delta * 32) & m
50
    for _ in range(32):
51
        v1 = (v1 - ((s + key[(s >> 11) & 3]) ^ (v0 + ((v0 << 4) ^ (v0 >> 5))))) & m
52
        v0 = (v0 - ((s + v1) ^ (key[0] + (v1 << 4)) ^ (key[1] + (v1 >> 5)))) & m
53
        s = (s - delta) & m
54
    return (v0, v1)
55

56
if __name__ == "__main__":
57
    key = [0x41, 0x43, 0x45, 0x36]
58
    ct = (0x0EC367B8, 0xC9DA9044, 0xDA6C2DEB, 0x88DDC9C3, 0x32A01575, 0x231DD0B4, 0x4B9E8A74, 0xD75D3E74, 0xEAAB8712, 0xE704E888, 0xE01A31AC, 0xECAE205C, 0xA7BE7467, 0x0C6252A3, 0x1AEFEC4E, 0xC40DED44, 0xC3C842CC, 0xDE4A0C0E, 0x7C24F3FC, 0x8FB8D001, 0x11153E6E, 0x530ED15C, 0xF4214811, 0xBEB517E0, 0x63F91634, 0x4D96F8A5, 0xFE23EAC8, 0x2C607ADF, 0xCC43D85C, 0xFF186C5B, 0x8763E1A5, 0x9187BD58, 0x87D1069B, 0xD7878D7B, 0x836E6B68, 0x55A0C63F, 0xD979FDB3, 0x3E524DEE, 0x7AB35C82, 0xA2F4DA8D, 0x1708BA4C, 0x710653E6)
59
    result = bytearray()
60
    for i in range(0, len(ct), 2):
61
        dt = decrypt_hybrid((ct[i], ct[i + 1]), key)
62
        result.append(dt[0] & 0xFF)
63
        result.append(dt[1] & 0xFF)
64
    result = bytes(result).rstrip(b'\x00')
65
    printable = ''.join(chr(b) if 0x20 <= b < 0x7f else '.' for b in result)
66
    solve(list(result))
67
# [+] 最终 Flag: ACE_We1C0me!T0Z0Z5GamESecur1t9*CTf