CFCS Challange 1

Q1:

UPX1:0041E89B                 jmp     near ptr word_4026F2 ; Tail jump to OEP.

Q2:

Algorithmen er en simpel XOR pad, hvor

84963145865 er key

Hvor padden, som er stored som 32bit integers for some reason er:

0x52 ; 0
0x5B ; 1
0x5B ; 2
0x76 ; 3
0x50 ; 4
0x57 ; 5
0x57 ; 6
0x46 ; 7
0x16 ; 8
0x52 ; 9
0x5E ; A


Fra blocken i memory kan man let se det:

00414590  52 00 00 00 5B 00 00 00  5B 00 00 00 76 00 00 00  R...[...[...v...
004145A0  50 00 00 00 57 00 00 00  57 00 00 00 46 00 00 00  P...W...W...F...
004145B0  16 00 00 00 52 00 00 00  5E 00 00 00 00 00 00 00  ....R...^.......
004145C0  00 00 00 00 38 34 39 36  33 31 34 35 38 36 35 00  ....84963145865.

Som det kan ses:

.text:00401320 loc_401320:                             ; CODE XREF: sub_4012F0+62j
.text:00401320 movzx   eax, byte ptr [eax+edx]
.text:00401324 lea     edx, [edx+1]
.text:00401327 xor     [edx-1], al
.text:0040132A xor     ebx, ebx
.text:0040132C movzx   eax, byte ptr [edx-1]
.text:00401330 movsx   eax, al
.text:00401333 cmp     ds:dword_414590[edi*4], eax
.text:0040133A cmovnz  esi, ebx
.text:0040133D inc     edi
.text:0040133E lea     ebx, [ecx+1]
.text:00401341
.text:00401341 loc_401341:                             ; CODE XREF: sub_4012F0+56j
.text:00401341 mov     al, [ecx]
.text:00401343 inc     ecx
.text:00401344 test    al, al
.text:00401346 jnz     short loc_401341
.text:00401348 mov     eax, [ebp+var_8]
.text:0040134B sub     ecx, ebx
.text:0040134D cmp     edi, ecx
.text:0040134F mov     ecx, [ebp+var_4]
.text:00401352 jb      short loc_401320


Kan man grovt set bryde ned til:

key = "84963145865"
solution = []
xorpad = [0x52, 0x5b, 0x5b, 0x76, 0x50, 0x57, 0x57, 0x46, 0x16, 0x52, 0x5e]
for x in range(len(key)):
	solution.append( chr(ord(key[x]) ^ xorpad[x]))

print "".join(solution)
#job@cfcs.dk