1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
import ida_funcs
import ida_gdl
import ida_kernwin
import idaapi

def dump_bb_starts(func_ea=0x401C60, out_path=None):
    f = ida_funcs.get_func(func_ea)
    if not f:
        raise RuntimeError("No function at 0x%X" % func_ea)

    starts = []
    fc = ida_gdl.FlowChart(f, flags=ida_gdl.FC_PREDS)  # 基本块图
    for b in fc:
        starts.append(b.start_ea)

    starts = sorted(set(starts))

    lines = [("0x%X" % ea) for ea in starts]
    text = "\n".join(lines)

    print("[sub_401C60] basic blocks:", len(starts))
    print(text)

    if out_path:
        with open(out_path, "w", encoding="utf-8") as fp:
            fp.write(text + "\n")
        print("written to:", out_path)

    # 方便你直接粘贴到 writeup
    try:
        ida_kernwin.set_clipboard_text(text)
        print("copied to clipboard")
    except Exception:
        pass


dump_bb_starts(0x401C60)

#output
block_list = [{"block_start":0x401C60,"block_end":0x401DD6},{"block_start":0x401DD8,"block_end":0x401DEF},{"block_start":0x401DF2,"block_end":0x401DFD},{"block_start":0x401E00,"block_end":0x401E0B},{"block_start":0x401E0E,"block_end":0x401E1C},{"block_start":0x401E1F,"block_end":0x401E36},{"block_start":0x401E39,"block_end":0x401E50},{"block_start":0x401E53,"block_end":0x401E6A},{"block_start":0x401E6D,"block_end":0x401E80},{"block_start":0x401E83,"block_end":0x401EA4},{"block_start":0x401EB0,"block_end":0x401EC7},{"block_start":0x401ECA,"block_end":0x401EE1},{"block_start":0x401EE4,"block_end":0x401EF7},{"block_start":0x401EFA,"block_end":0x401F21},{"block_start":0x401F30,"block_end":0x401F47},{"block_start":0x401F4A,"block_end":0x401F6C},{"block_start":0x401F70,"block_end":0x401F87},{"block_start":0x401F8A,"block_end":0x4021B2},{"block_start":0x4021B5,"block_end":0x4021CC},{"block_start":0x4021CF,"block_end":0x40704F},{"block_start":0x407052,"block_end":0x40706E}]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
import glob
import idaapi
import ida_dbg
import ida_bytes
import idc

block_list = [{"block_start":0x401C60,"block_end":0x401DD6},{"block_start":0x401DD8,"block_end":0x401DEF},{"block_start":0x401DF2,"block_end":0x401DFD},{"block_start":0x401E00,"block_end":0x401E0B},{"block_start":0x401E0E,"block_end":0x401E1C},{"block_start":0x401E1F,"block_end":0x401E36},{"block_start":0x401E39,"block_end":0x401E50},{"block_start":0x401E53,"block_end":0x401E6A},{"block_start":0x401E6D,"block_end":0x401E80},{"block_start":0x401E83,"block_end":0x401EA4},{"block_start":0x401EB0,"block_end":0x401EC7},{"block_start":0x401ECA,"block_end":0x401EE1},{"block_start":0x401EE4,"block_end":0x401EF7},{"block_start":0x401EFA,"block_end":0x401F21},{"block_start":0x401F30,"block_end":0x401F47},{"block_start":0x401F4A,"block_end":0x401F6C},{"block_start":0x401F70,"block_end":0x401F87},{"block_start":0x401F8A,"block_end":0x4021B2},{"block_start":0x4021B5,"block_end":0x4021CC},{"block_start":0x4021CF,"block_end":0x40704F},{"block_start":0x407052,"block_end":0x40706E}]
index = 0

class hook_all(ida_dbg.DBG_Hooks):

    
    def dbg_bpt(self, tid, ea):
        global index
        for block in block_list:
            if ea == block['block_start']:
                print(f'{index} : {hex(ea)}')
                index += 1
        
        
        
        return 0
def add_breakpoint():
    for block in block_list:
        addr = block['block_start']
        ida_dbg.add_bpt(addr)
        print(f"Breakpoint set at {hex(addr)}")

def install_hook():
    # 清理旧的 hook (如果存在于全局变量中)
    global my_hook
    try:
        if 'my_hook' in globals():
            my_hook.unhook()
            print("Removed old hook")
    except:
        pass

    # 安装新的 hook
    my_hook = hook_all()
    my_hook.hook()
    print("Hook installed. Please set the breakpoint manually.")


if __name__ == "__main__":
    add_breakpoint()
    install_hook()

#output:
''''
[0x401e0e,
0x401e1f,
0x401e39,
0x401f30,
0x401f4a,   
0x401e00,
0x401e0e,
0x401e1f,
0x401e39,
0x401e53,
0x4021b5,
0x4021cf,  
0x401e00,
0x401e0e,
0x401e1f,
0x401eb0,
0x401f70,
0x401f8a, 
0x401e00,
0x401e0e,
0x401e1f,
0x401e39,
0x401e53,
0x401e6d,
0x401e83,
0x401e00,
0x401e0e,
0x401e1f,
0x401eb0,
0x401eca,
0x401dd8,
0x407052   
]
'''

1
2
3
4
5
6
flow = [
    0x401f4a,
    0x4021cf,
    0x401f8a,
    0x407052
]

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
from __future__ import annotations

import argparse
from pathlib import Path

from ida_db_dump import build_blob, parse_ida_db_dump


def _parse_hex_int(s: str) -> int:
    s = s.strip().lower()
    if s.startswith("0x"):
        return int(s, 16)
    return int(s, 10)


def main() -> int:
    ap = argparse.ArgumentParser(description="Re-run the embedded Unicorn VM from opcode_dump")
    ap.add_argument("--dump", default="opcode_dump", help="path to opcode_dump text")
    ap.add_argument(
        "--input",
        default="",
        help="ASCII input string (will be written to 0x10000000, like the binary)",
    )
    ap.add_argument(
        "--arch",
        default="riscv",
        choices=["riscv"],
        help="unicorn arch to use (based on uc_open(8,8) this should be RISCV)",
    )
    ap.add_argument(
        "--mode",
        default="64",
        choices=["32", "64"],
        help="riscv mode (IDA decompile shows uc_open(8,8); in practice this matches RISCV64)",
    )
    ap.add_argument("--trace", action="store_true", help="trace a few instructions")
    ap.add_argument("--trace-count", type=int, default=200, help="max traced instructions")
    args = ap.parse_args()

    # Layout recovered from decompile around 0x401F8A
    CODE_SRC_ADDR = 0x64C3F0
    CODE_SIZE = 662  # 0x296
    KEY_SRC_ADDR = 0x64C6C0
    KEY_SIZE = 32

    CODE_DST_ADDR = 0x0
    STACK_BASE = 0x70000000
    STACK_SIZE = 0x10000
    STACK_INIT = 0x7000FF00

    INPUT_ADDR = 0x10000000
    INPUT_MAP_SIZE = 0x1000
    KEY_ADDR = 0x10001000
    KEY_MAP_SIZE = 0x1000

    # Register IDs are used as raw integers in the binary: uc_reg_write(engine, 3/11/12, &val)
    REG_STACK = 3
    REG_ARG1 = 11
    REG_ARG2 = 12

    mapping, stats = parse_ida_db_dump(args.dump)
    code = build_blob(mapping, CODE_SRC_ADDR, CODE_SIZE)
    key = build_blob(mapping, KEY_SRC_ADDR, KEY_SIZE)

    try:
        from unicorn import Uc, UcError
        from unicorn import UC_ARCH_RISCV
        from unicorn import UC_PROT_ALL
        from unicorn import UC_MODE_RISCV32, UC_MODE_RISCV64
        from unicorn import UC_HOOK_CODE
    except Exception as e:  # pragma: no cover
        raise SystemExit(
            "Python unicorn 未安装。\n"
            "在当前环境执行：pip install unicorn\n"
            f"原始错误: {e}"
        )

    mode = UC_MODE_RISCV32 if args.mode == "32" else UC_MODE_RISCV64
    uc = Uc(UC_ARCH_RISCV, mode)

    # Map memory
    uc.mem_map(0x0, 0x1000, UC_PROT_ALL)
    uc.mem_write(CODE_DST_ADDR, code)

    uc.mem_map(STACK_BASE, STACK_SIZE, UC_PROT_ALL)
    uc.mem_map(INPUT_ADDR, INPUT_MAP_SIZE, UC_PROT_ALL)
    uc.mem_map(KEY_ADDR, KEY_MAP_SIZE, UC_PROT_ALL)

    # Seed data
    user_bytes = args.input.encode("ascii", errors="ignore")
    if len(user_bytes) > 48:
        user_bytes = user_bytes[:48]
    uc.mem_write(INPUT_ADDR, user_bytes + b"\x00")
    uc.mem_write(KEY_ADDR, key)

    # Set regs (match the binary: raw numeric IDs)
    uc.reg_write(REG_STACK, STACK_INIT)
    uc.reg_write(REG_ARG1, INPUT_ADDR)
    uc.reg_write(REG_ARG2, KEY_ADDR)

    if args.trace:
        state = {"n": 0}

        def _hook_code(_uc, address, size, _user):
            n = state["n"]
            if n < args.trace_count:
                print(f"[trace] pc=0x{address:X} size={size}")
            state["n"] = n + 1

        uc.hook_add(UC_HOOK_CODE, _hook_code)

    # vm_run(engine, begin=0, until=662, timeout=2000000, count=0)
    try:
        uc.emu_start(0x0, CODE_SIZE, timeout=2_000_000, count=0)
    except UcError as e:
        print(f"[emu] stopped with error: {e}")

    r11 = uc.reg_read(REG_ARG1)
    print(f"[result] reg11(A0) = 0x{r11:X}")
    if r11 != 0:
        print("[result] looks like SUCCESS path (binary checks reg11!=0)")
    else:
        print("[result] looks like FAIL path (binary checks reg11!=0)")

    return 0


if __name__ == "__main__":
    raise SystemExit(main())

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
from __future__ import annotations

import struct


def u32(x: int) -> int:
    return x & 0xFFFFFFFF


# 来自前面提取到的数据：
# mask_u32：VM 在输入全 0 时生成/写出的 12 个 dword（小端）
MASK_U32 = [
    0x104D0E05,
    0x0B773197,
    0x06EB3870,
    0x0BA1A82E,
    0x018F13E8,
    0x06F98421,
    0x0B8A4D0E,
    0x08B41876,
    0x0160D893,
    0x0CE8C305,
    0x12A0DA32,
    0x091559D9,
]

# expected_u32：RISC-V 校验阶段硬编码的 12 个目标常量（小端 dword）
EXPECTED_U32 = [
    0x45034F63,
    0x534762D2,
    0x44B36D04,
    0x44C3ED6A,
    0x79BB60B0,
    0x42A1E767,
    0x3EDB7E6C,
    0x30E1551D,
    0x4D3ABAA4,
    0x6AA29948,
    0x51CE8847,
    0x51623FAF,
]


def derive_input_bytes() -> bytes:
    if len(MASK_U32) != 12 or len(EXPECTED_U32) != 12:
        raise ValueError("MASK_U32/EXPECTED_U32 must be 12 dwords each")

    inp_u32 = [u32(m ^ e) for m, e in zip(MASK_U32, EXPECTED_U32)]
    return struct.pack("<12I", *inp_u32)


def main() -> int:
    b = derive_input_bytes()

    try:
        s = b.decode("ascii")
    except UnicodeDecodeError:
        # 如果不是纯可打印 ASCII，就用 \x?? 形式展示
        s = "".join(chr(x) if 32 <= x < 127 else f"\\x{x:02x}" for x in b)

    print("[input-bytes-hex]", b.hex())
    print("[flag-body]", s)
    print("[flag]", f"flag{{{s}}}")
    return 0


if __name__ == "__main__":
    raise SystemExit(main())