Reverse [Writeup] EIS2016 Chkflag-. NET program Reverse

This is a relatively simple inverse problem, the difficulty is that Chkflag.exe is generated by. NET compilation, if it is difficult to converse with IDA, the main topic is to investigate the use of. NET reverse tools. The binary files used in the topic can be downloaded from my github: Https://github.com/gsharpsh00ter/reverse

0x01 Tool Preparation

In the right. NET program to decompile, a commonly used tool is. NET Reflector, but the tool is currently charged. In this example we use another open source. NET anti-compilation tool Dnspy. Dnspy is an open source, Ilspy-based, edit, decompile, and debug artifact for. NET programs. NET program for anti-compilation and dynamic debugging, friendly interface, powerful.

Dnspy:

Https://github.com/0xd4d/dnSpy/releases

After downloading, the decompression can be run directly, but it needs to be installed first. NET Framework. The interface for reverse analysis and debugging after installation is as follows:

0x02 Reverse

Drag the Chkflag.exe into the Dnspy to see the entry function as follows:

1 //Chkflag. Module12 //token:0x06000001 rid:1 rva:0x00002048 File offset:0x000002483 [STAThread]4  Public Static voidMain ()5 {6readonlycollection<string> CommandLineArgs =MyProject.Application.CommandLineArgs;7     ULONGnum =91713730301111000uL;8     string@string = Resources.ResourceManager.GetString ("F");9     stringstring2 = Resources.ResourceManager.GetString ("I");Ten     stringDescription =MyProject.Application.Info.Description; One     //command line must have 8 parameters A     if(Commandlineargs.count! =8) -     { - Console.WriteLine (string2); the         return; -     } -     string[] array = Resources.ResourceManager.GetString ("P"). Split (New Char[] -     { +         ' ' -     }); +     checked A     { at         intnum2 = Commandlineargs.count-1; -         //each parameter of the command line needs to conform to the format specified in the array -          for(inti =0; I <= num2; i++) -         { -             if(!likeoperator.likestring (Commandlineargs[i], array[i], comparemethod.binary)) -             { in Console.WriteLine (@string); -                 return; to             } +         } -         //Stitch All command-line arguments into a single string the         stringText =string. Join ("", CommandLineArgs); *         stringText2 =""; $         stringText3 ="";Panax Notoginseng         intnum3 = text. Length-1; -         //The concatenation of the string processing, if a character is a number, then stitching to Text3, and vice versa stitching to Text2 the          for(intj =0; J <= Num3; J + +) +         { A             Charc =Text[j]; the             if(Char. IsDigit (c)) +             { -Text3 + =conversions.tostring (c); $             } $             Else -             { -Text2 + =conversions.tostring (c); the             } -         }Wuyi         //If the stitched text3 is converted to an integer of num (91713730301111000uL) After the reverse order, and Text2 is followed by description, the flag is printed on the command line the         if(ULONG. Parse (Strings.strreverse (text3)) = = num &&Strings.strreverse (TEXT2). Equals (description)) -         { WuConsole.WriteLine ("eis{"+string. Join ("_", CommandLineArgs) +"}"); -             return; About         } $ Console.WriteLine (@string); -     } -}

0x03 Analysis

Processing logic is relatively straightforward. First, the program checks the number of command-line arguments, the parameter must be 8, otherwise it will print "parameter Error" and exit.

Then, the program checks whether each parameter conforms to the specified format, the parameter format is specified in the array, and the contents of the array can be obtained by dynamic debugging, as follows:

That is: ["? #?", "? #", "? #?? #?##?","?#","?#?#?#?","#?#","?#?? # ","? #?# "], where '? ' Denotes a letter, ' # ' denotes a number, such as "? #?" Indicates that the first parameter should be in the form of "letter + number + letter".

The program then stitching all the parameters of the command line into a string.

After stitching the command line arguments, the concatenation of the string will continue to be processed, if a character is a number, then stitching to Text3, and vice versa stitching to Text2

Finally, Text2 and Text3 are judged. If TEXT3 is converted to num after reverse order and Text2 is description after reverse order, flag is printed on the command line.

The value of NUM can be seen in the deserialized code, which is 91713730301111000UL.

Description can be obtained by dynamic debugging, for "AFHGRHRVCRTTCFFDTTN"

With the above logic, we can get the command-line arguments passed to Chkflag by using the following Python code for inverse calculation:

1 #!/usr/bin/python22 3patterns = ["?#?","?##","?#?? #?##?","?#","?#?#?#?","#?#","?#?? #","?#?#"]4num ="91713730301111000"5desc ="AFHGRHRVCRTTCFFDTTN"6args = []7Numidx =08Descidx =09  forPatterninchPatterns:Tenarg ="" One      forKinchxrange (0, Len (pattern)): A         ifPattern[k] = ='?': -arg + = Desc[::-1][descidx] -Descidx + = 1 the         Else: -arg + = Num[::-1][numidx] -Numidx + = 1 - Args.append (ARG) + PrintArgs

The printed command-line arguments are:

[' n0t ', ' T00 ', ' d1ff1c11t ', ' t0 ', ' r3c0v3r ', ' 7h3 ', ' r1gh7 ', ' f1a9 ']

Run Chkflag at the command line and pass the above parameters to flag:

The final flag is:

EIS{N0T_T00_D1FF1C11T_T0_R3C0V3R_7H3_R1GH7_F1A9}

Reverse [Writeup] EIS2016 Chkflag-. NET program Reverse