from binascii import hexlify as tohex, unhexlify as unhex
import aes as crypto # Tiré de https://github.com/p4-team/crypto-commons/blob/master/crypto_commons/symmetrical/aes.py
if len(sys.argv) > 1 and sys.argv[1] == '--disassembly':
if len(sys.argv) > 1 and sys.argv[1] == '--debug':
decode = lambda u: (u[3] << 24) | (u[2] << 16) | (u[1] << 8) | u[0]
# Contient un dump du C généré par Ghidra pour la fonction principale
code = open('code.txt', 'r').read()
code = code.replace(' ', '').replace('\t', '').replace('\n', '')
s = re.findall(r'if\(type\_op\=\=((?:0x)?[0-9a-f]{1,3})\)\{(?:\_)?DAT\_003030[0-9a-f]{2}\=(?:\_)?DAT\_003030([0-9a-f]{2})\^0x([0-9a-f]{1,8})\;', code)
for opcode, reg_i, magic in s:
xor_opcodes[eval(opcode)] = ((int(reg_i, 16) - 0x40) // 4, int(magic, 16))
print('{:04x}'.format(pc) + ' ' + ins)
return decode(text[offset:offset + 4])
def read128(text, offset):
return b''.join(bytes([text[offset + i]]) for i in range(16))
def write(text, offset, value):
text[offset] = value & 0xff
text[offset + 1] = (value >> 8) & 0xff
text[offset + 2] = (value >> 16) & 0xff
text[offset + 3] = (value >> 24) & 0xff
def write_bytes(text, offset, value):
for i in range(len(value)):
text[offset + i] = value[i]
return ((x & 0xff) << 24) | (((x >> 8) & 0xff) << 16) | (((x >> 16) & 0xff) << 8) | ((x >> 24) & 0xff)
text = "6e 18 b0 17 c9 f5 bf 08 74 00 00 0a 37 52 0a 00 98 95 1c 00 74 03 00 06 88 1c 00 08 74 00 00 0a 3f 9e 08 00 56 94 1c 00 ad 06 18 0c c6 0f 20 02 88 02 00 06 89 97 0c 00 7c 02 08 0c c9 73 1c 00 5b 00 19 0c 7c 00 00 06 fa 1b 0c 00 f7 01 10 00 a7 f3 1f 0c 4b 19 10 0c fc 00 00 06 5a 41 0c 00 09 95 1c 00 8e 08 18 0c 28 0b 26 02 e8 02 00 06 64 34 7b ff 05 0c 00 02 af b4 68 ff de 24 f2 1a 05 88 f4 0c fd 5c dd 12 c0 49 df 13 b9 82 d0 1d 5a 3a de 13 ea 8f d0 1d c1 2f dd 13 37 86 d0 1d c0 1f dc 13 02 c4 ef 1b 64 91 ed 12 0a 33 fe 1c db 8a e1 1d 40 81 e1 19 28 fe e7 08 c8 00 00 15 1a 46 f0 0c a4 00 00 18 be e2 e2 c3 b8 2b f2 c1 04 a2 f0 c0 29 de f2 cf c7 18 fd d2 c1 5b c0 c2 f5 30 e5 ce 4c ec e7 c9 0c e3 d2 c8 fc d7 d9 ce 08 b2 cf ce 38 e3 d2 d9 5e 3d 4c 3f 4e 65 ff 1a c0 85 f4 0c eb 87 dd 12 bf 15 da 13 f2 82 d0 1d c3 2c db 13 be 80 d0 1d f0 32 dc 13 1c 8d d0 1d 88 49 dd 13 6f 26 ef 1b 54 13 ed 12 1f ad fe 1c cc 8d e1 1d d8 80 e1 19 23 f2 e7 08 48 01 00 15 44 44 f0 0c 24 01 00 18 11 07 a3 d4 ab bd a5 d8 54 f2 b3 d4 54 bb 33 d6 44 b0 93 d6 66 8d 83 d4 7a 9c 86 df a5 59 f7 d5 03 a0 82 d4 0d b4 86 df d6 f6 80 d7 21 2b 96 db 27 b5 92 dc 25 b3 c3 dd fd b3 c3 cc 75 78 f3 d4 97 b8 f6 d8 3a f3 83 d4 c0 13 94 d4 9b f2 90 ca d2 81 f3 d4 35 bf f7 d8 39 99 85 d4 37 b8 82 d8 b9 e4 94 d4 51 ba 96 d8 50 f4 90 ca 9e 13 f3 d4 19 bd f0 d8 51 33 85 d4 aa be 82 d8 dd 87 94 d4 27 be 97 d8 53 fc 90 ca 7b e7 f3 d4 15 b4 f1 d8 b5 e9 83 d4 63 b1 80 d8 35 d9 94 d4 a6 bc 90 d8 20 fc 90 ca f1 b8 f3 d4 c0 bd f2 d8 41 b3 85 d4 cb 4c 94 d4 d9 b6 91 d8 d1 f0 90 ca 83 17 f2 d4 b7 87 85 d4 e6 65 94 d4 36 b3 92 d8 ff f9 90 ca 31 7c 34 db 6d b3 31 dc 89 b0 c3 dd f9 b3 c3 cc 83 ee 5a 2a 34 f0 0f 0f 85 eb 02 0f 7f 82 0a 0f 44 7d 00 0f 9a 88 03 0f 1a ba 0f 0f 8b 89 0f 0f f4 2d 09 0f 97 0a 08 0f 66 55 0f 0f b3 23 0c 0f fb d6 0b 0f 33 83 09 0f 3f 94 0a 0f e3 c1 00 0f 5f c8 00 0f 88 d4 07 0f 23 5c 06 0f 43 de 0e 0f 25 fa af 62 7c 94 2c cf 8d a5 9c bc 67 70 de f4 c6 7e 70 01 e2 0c 70 08 98 02 00 0a e4 02 00 18 c5 0c 60 02 9b 85 37 00 54 65 36 0b 58 d6 30 0e e7 50 32 13 4b f6 3f 11 9c 4d 46 00 a3 a9 42 0b a6 06 41 11 7e 8a 41 0b f5 ff 54 01 0e 42 53 12 65 92 45 03 57 e2 69 0f ac 0e 61 08 9c 02 00 0a 7c ca 07 0f 99 f1 25 0f 88 02 00 06 fe 32 5b fe e8 59 fd 1a 2f 83 f4 0c 27 b8 dd 12 b0 a8 da 13 36 82 d0 1d 6b bc db 13 b5 84 d0 1d 28 cb dc 13 de 88 d0 1d 39 d2 dd 13 37 3d ef 1b e5 59 ed 12 0c 7d fe 1c 5e 89 e1 1d 74 8f e1 19 c9 f6 e7 08 34 03 00 15 16 4a f0 0c 10 03 00 18 9f bb fc df 30 78 8c dd 32 dc 9d dd b8 dd 8f d6 ad 2c 9f d6 da 35 88 dc 59 b0 99 dc 14 fe 89 da c6 b8 cc d7 81 24 fa d2 f9 6a fe da 92 b8 cc d7 56 ae cc df da b8 cc c5 dd b1 cc df e5 79 c6 23 36 01 30 02 01 c9 20 00 0a 27 23 0b 5f 56 22 01 1c 09 20 08 f0 03 00 09 af 99 23 08 a4 03 00 15 89 09 23 08 f8 03 00 14 7c 08 23 17 b8 03 00 18 68 67 26 08 f8 03 00 15 3e 17 26 08 f8 03 00 14 f9 73 25 17 3a 47 43 00 25 22 40 11 a4 1c 40 08 d4 03 00 09 b5 0c 21 0e 86 93 52 00 e8 03 00 18 29 d6 25 12 59 80 43 00 55 19 40 19 b6 02 41 0b c3 39 42 03 d7 54 35 0f 78 03 00 18 1b 13 00 02 fc 03 00 18 dc 00 00 02 a0 a1 31 fe"
text = [int(x, 16) for x in text.split(' ')]
if debug_mode or not disassembly_mode:
username = input('Username: ').encode()
serial = input('Serial: ').encode()
text += [0] * 0x400 # Heap
write_bytes(text, 0x400 + 0x20 + 0x10, serial)
reg[8] = 0x400 + 0x10 # Adresse username
write_bytes(text, reg[8], username)
reg[10] = 0x400 + 0x20 + (reg[9] & 0xfffffff0) # Adresse serial
write_bytes(text, reg[10], serial)
reg[12] = reg[10] + 0x10 + (reg[11] & 0xfffffff0) # Adresse something
while (debug_mode or not disassembly_mode) or (pc < len(text)):
type_op = decode(text[pc:pc + 4])
k = (type_op >> 20) & 0xf
m = (type_op >> 16) & 0xf
p = (type_op >> 12) & 0xf
kmpq = type_op & 0xffffff
s = (type_op >> 0xc) & 0x1f
if no_stop and pc in breakpoints:
if debug_mode and not no_stop:
print("Regs: %s" % (','.join('{:08x}'.format(_) for _ in reg)))
print("Heap: %s" % tohex(bytes(text[0x400:0x400+0x300])))
if disassembly_mode and not no_stop:
dis(pc, 'mov r%s, r%s' % (k, m))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'mov r%s, (char) [r%s]' % (k, m))
if debug_mode or not disassembly_mode:
reg[k] = read(text, reg[m]) & 0xff
if disassembly_mode and not no_stop:
dis(pc, 'mov r%s, %s' % (k, imm))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'mov [r%s], (char) r%s' % (k, m))
if debug_mode or not disassembly_mode:
write_bytes(text, reg[k], bytes([reg[m] & 0xff]))
if disassembly_mode and not no_stop:
dis(pc, 'mov [r%s], [r%s]' % (k, m))
if debug_mode or not disassembly_mode:
write(text, reg[k], read(text, reg[m]))
if disassembly_mode and not no_stop:
dis(pc, 'mov [r%s], (char) %s' % (k, imm))
if debug_mode or not disassembly_mode:
write_bytes(text, reg[k], bytes([reg[m] & 0xff]))
if disassembly_mode and not no_stop:
dis(pc, 'call %s' % ('{:04x}'.format(kmpq)))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'cmp r%s, r%s' % (k, m))
if debug_mode or not disassembly_mode:
jump_flag = reg[k] - reg[m]
if disassembly_mode and not no_stop:
dis(pc, 'cmp r%s, %s' % (k, imm))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'je %s' % ('{:04x}'.format(kmpq)))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'jne %s' % ('{:04x}'.format(kmpq)))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'add r%s, r%s' % (k, m))
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] + reg[m]) & 0xffffffff
if disassembly_mode and not no_stop:
dis(pc, 'add r%s, %s' % (k, imm))
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] + imm) & 0xffffffff
if disassembly_mode and not no_stop:
dis(pc, 'mul r%s, r%s' % (k, m))
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] * reg[m]) & 0xffffffff
if disassembly_mode and not no_stop:
dis(pc, 'mul r%s, %s' % (k, imm))
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] * imm) & 0xffffffff
if disassembly_mode and not no_stop:
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] + 1) & 0xffffffff
if disassembly_mode and not no_stop:
dis(pc, 'mod r%s, r%s' % (k, m))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'mod r%s, %s' % (k, imm))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'xor r%s, r%s' % (k, m))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'xor r%s, %s' % (k, imm))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'jl %s' % ('{:04x}'.format(kmpq)))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'jg %s' % ('{:04x}'.format(kmpq)))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'sub r%s, r%s' % (k, m))
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] - reg[m]) % 2**32
if disassembly_mode and not no_stop:
dis(pc, 'sub r%s, %s' % (k, imm))
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] - imm) % 2**32
if disassembly_mode and not no_stop:
dis(pc, 'jmp %s' % ('{:04x}'.format(kmpq)))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'shr r%s, %s' % (k, s))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'loadpc r%s' % k)
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
dis(pc, 'mov r%s, swap([r%s])' % (k, m))
if debug_mode or not disassembly_mode:
reg[k] = swap(read(text, reg[m]))
if disassembly_mode and not no_stop:
dis(pc, 'mov [r%s], swap(r%s)' % (k, m))
if debug_mode or not disassembly_mode:
write(text, reg[k], swap(reg[m]))
if disassembly_mode and not no_stop:
dis(pc, 'shl r%s, %s' % (k, s))
if debug_mode or not disassembly_mode:
reg[k] = (reg[k] << s) & 0xffffffff
if disassembly_mode and not no_stop:
dis(pc, 'mov [r%s], aes([r%s], [r%s])' % (k, m, p))
if debug_mode or not disassembly_mode:
write_bytes(text, reg[k], cipher.AESENC(read128(text, reg[m]), read128(text, reg[p])))
elif opcode in xor_opcodes.keys():
reg_i, value = xor_opcodes[opcode]
if disassembly_mode and not no_stop:
dis(pc, 'xor r%s, %s' % (reg_i, hex(value)))
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
if debug_mode or not disassembly_mode:
if disassembly_mode and not no_stop:
if debug_mode or not disassembly_mode:
print("[-] %s: opcode %s not supported" % (pc, hex(opcode)))
if debug_mode and not no_stop:
if command == '' or command == 'n':
elif command[:2] == 'b ':
breakpoints.append(int(command[2:], 16))
if not disassembly_mode or debug_mode:
print('[+] Program ended with %s' % reg[0])