Hgame Final 2026

https://hgame.vidar.club/games/10

juncrypt#

汇编，好看爱看

main有一段诡异的逻辑

1
  v4 = sub_12B0(s_1, _r_n);
2
  if ( v4 < 0 )
3
  {
4
    puts("runtime error");
5
    return 1;
6
  }
7
  Wrong = "Wrong";
8
  if ( v4 )
9
    Wrong = "Correct";
10
  puts(Wrong);

在sub_12B0函数的最后有

1
    munmap(addr_1, 0x2DAu);
2
  }
3
  return 0xFFFFFFFFLL;
4
}

v4 < 0恒成立，Wrong = 'Correct'不可能执行

所以真正的校验没有在pseudocode里体现

sub_12B0调用sub_1260完成了对shellcode的加载，存入mmap申请的内存

只要获得shellcode，就能恢复校验逻辑

因为地址的动态性，只能下断点在转移控制流的位置dump shellcode

看一下mprotect附近的汇编

1
.text:0000000000001394 push    rax
2
.text:0000000000001395 mov     rax, rbx
3
.text:0000000000001398 jmp     short loc_13A2
4

5
.text:00000000000013A2 push    rax ; 把 Shellcode 的动态地址压入栈顶
6
.text:00000000000013A3 retn

断在loc_13A2即可

1
set disable-randomization on
2
starti
3

4
b *0x5555555553a2
5

6
commands
7
    dump binary memory shellcode.bin $rax $rax+0x2da
8
    quit
9
end
10
continue

dump下shellcode.bin，拖进ida恢复函数

是一个自定义加密逻辑，解密逻辑为

1
ROL1( ROL1(v, s1) ^ flag_char ^ c, s2 ) == t
2
=> ROL1(v, s1) ^ flag_char ^ c == ROR1(t, s2)
3
=> flag_char == ROL1(v, s1) ^ c ^ ROR1(t, s2)

1
def ror1(val, shift):
2
    return ((val & 0xFF) >> shift) | ((val << (8 - shift)) & 0xFF)
3

4
def rol1(val, shift):
5
    return (((val & 0xFF) << shift) & 0xFF) | ((val & 0xFF) >> (8 - shift))
6

7
def ror4(val, shift):
8
    return ((val & 0xFFFFFFFF) >> shift) | ((val << (32 - shift)) & 0xFFFFFFFF)
9

10
def rol4(val, shift):
11
    return (((val & 0xFFFFFFFF) << shift) & 0xFFFFFFFF) | ((val & 0xFFFFFFFF) >> (32 - shift))
12

13
a2 = 27
14
v = rol4(a2, 3)
15

16
targets = [
17
    7, 0x9A, 0xCC, 75, 0x80, 6, 0x97, 38, 44, 95,
18
    119, 44, 0x95, 0xE4, 0, 34, 109, 8, 0x97, 91,
19
    0xE7, 0xDD, 55, 50, 0x8B, 1, 0x8E
20
]
21

22
c_vals = [(0x5A + i * 0x0D) & 0xFF for i in range(27)]
23

24
shift1_pattern = [1, 2, 3, 4, 5]
25
shift2_pattern = [1, 2, 3, 4, 5, 6, 7]
26

27
flag = []
28

29
for i in range(27):
30
    s1 = shift1_pattern[i % 5]
31
    s2 = shift2_pattern[i % 7]
32
    c = c_vals[i]
33
    t = targets[i]
34

35
    part1 = rol1(v & 0xFF, s1)
36
    part2 = ror1(t, s2)
37

38
    char_code = part1 ^ c ^ part2
39
    flag.append(chr(char_code))
40

41
    v = (ror4(v, 1) + 61) & 0xFFFFFFFF
42

43
print(''.join(flag))
44
# hgame{junk_asm_and_selfdec}

ez_drv#

VM + AES + XOR

ida分析 vuln.sys

VM解释器：sub_14000219C，字节码：qword_140004230

AES加密：sub_140001210，S-box：RijnDael_AES_LONG_140004300

AES密文：xmmword_140004210 、xmmword_140004220

逆字节码发现在AES后还有一个XOR处理，XOR key：byte_140004410

1
from Crypto.Cipher import AES
2
from itertools import cycle
3

4
key = b"EzDrvK3y!@#$%^&*"
5
xor = [0xde, 0xad, 0xbe, 0xef, 0xca, 0xfe, 0xba, 0xbe]
6

7
aes_encrypted = [
8
    0x32, 0x9a, 0xb6, 0xc, 0x79, 0xf, 0x3b, 0x33,
9
    0x7, 0x4c, 0x8b, 0x55, 0x96, 0x7c, 0xad, 0x25,
10
    0x8c, 0x9d, 0xdc, 0x5a, 0xf7, 0xe7, 0x61, 0xf2,
11
    0xaf, 0x8e, 0x57, 0xfa, 0xa7, 0x4c, 0x25, 0xa
12
]
13

14
ciphertext = bytes([a ^ b for a, b in zip(aes_encrypted, cycle(xor))])
15
cipher = AES.new(key, AES.MODE_ECB)
16
flag = cipher.decrypt(ciphertext)
17

18
print(flag)
19
# hgame{vM_AES_XoR_r1ng0_noDbg}