API tools faq
paste
Advertisement
Guest User

kmkz write-up CTF

a guest
Jan 17th, 2011
201
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 10.91 KB | None | 0 0
raw download clone embed print report
  1. /* This file has been generated by the Hex-Rays decompiler.
  2.  
  3.    Copyright (c) 2009 Hex-Rays <info@hex-rays.com>
  4.  
  5.  
  6.  
  7.    Detected compiler: GNU C++
  8.  
  9. */
  10.  
  11.  
  12.  
  13. #include <defs.h>
  14.  
  15.  
  16.  
  17.  
  18.  
  19. //-------------------------------------------------------------------------
  20.  
  21. // Data declarations
  22.  
  23.  
  24.  
  25. extern _UNKNOWN start; // weak
  26.  
  27. extern char format[]; // idb
  28.  
  29. extern char aS[]; // idb
  30.  
  31. extern char aAlertS[]; // idb
  32.  
  33. extern char aSS[]; // idb
  34.  
  35. extern char s2[]; // idb
  36.  
  37. extern char aS_0[]; // idb
  38.  
  39. extern char aVGfrRZf_GUNg_j[73]; // weak
  40.  
  41. extern int _CTOR_LIST__; // weak
  42.  
  43. extern int _DTOR_LIST__[]; // weak
  44.  
  45. extern _UNKNOWN _DTOR_END__; // weak
  46.  
  47. extern int _JCR_LIST__; // weak
  48.  
  49. extern FILE *stdin; // idb
  50.  
  51. extern char completed_7021; // weak
  52.  
  53. extern int dtor_idx_7023; // weak
  54.  
  55. // extern _UNKNOWN _gmon_start__; weak
  56.  
  57.  
  58.  
  59. //-------------------------------------------------------------------------
  60.  
  61. // Function declarations
  62.  
  63.  
  64.  
  65. int __cdecl init_proc();
  66.  
  67. int __gmon_start__(void); // weak
  68.  
  69. char *gets(char *s);
  70.  
  71. int toupper(int c);
  72.  
  73. int fflush(FILE *stream);
  74.  
  75. size_t strlen(const char *s);
  76.  
  77. int printf(const char *format, ...);
  78.  
  79. void *malloc(size_t size);
  80.  
  81. int strcmp(const char *s1, const char *s2);
  82.  
  83. void __cdecl _do_global_dtors_aux();
  84.  
  85. int __cdecl frame_dummy();
  86.  
  87. int *__cdecl tor(int *a1);
  88.  
  89. char *__cdecl untrash(const char *s);
  90.  
  91. signed int __cdecl main();
  92.  
  93. void __cdecl _libc_csu_fini();
  94.  
  95. int *__cdecl _libc_csu_init();
  96.  
  97. void __cdecl _i686_get_pc_thunk_bx();
  98.  
  99. void (*__cdecl _do_global_ctors_aux())(void);
  100.  
  101. void __cdecl term_proc();
  102.  
  103.  
  104.  
  105.  
  106.  
  107. //----- (080483C0) --------------------------------------------------------
  108.  
  109. int __cdecl init_proc()
  110.  
  111. {
  112.  
  113.   int v1; // ST04_4@3
  114.  
  115.  
  116.  
  117.   if ( &_gmon_start__ )
  118.  
  119.     __gmon_start__();
  120.  
  121.   frame_dummy();
  122.  
  123.   _do_global_ctors_aux();
  124.  
  125.   return v1;
  126.  
  127. }
  128.  
  129. // 8048400: using guessed type int __gmon_start__(void);
  130.  
  131.  
  132.  
  133. //----- (08048490) --------------------------------------------------------
  134.  
  135. #error "8048493: positive sp value has been found (funcsize=2)"
  136.  
  137.  
  138.  
  139. //----- (080484C0) --------------------------------------------------------
  140.  
  141. void __cdecl _do_global_dtors_aux()
  142.  
  143. {
  144.  
  145.   int v0; // eax@2
  146.  
  147.   int i; // ebx@2
  148.  
  149.  
  150.  
  151.   if ( !completed_7021 )
  152.  
  153.   {
  154.  
  155.     v0 = dtor_idx_7023;
  156.  
  157.     for ( i = ((signed int)(&_DTOR_END__ - (_UNKNOWN *)_DTOR_LIST__) >> 2) - 1;
  158.  
  159.           dtor_idx_7023 < (unsigned int)i;
  160.  
  161.           v0 = dtor_idx_7023 )
  162.  
  163.     {
  164.  
  165.       dtor_idx_7023 = v0 + 1;
  166.  
  167.       ((void (*)(void))_DTOR_LIST__[dtor_idx_7023])();
  168.  
  169.     }
  170.  
  171.     completed_7021 = 1;
  172.  
  173.   }
  174.  
  175. }
  176.  
  177. // 8049F14: using guessed type int _DTOR_LIST__[];
  178.  
  179. // 804A030: using guessed type char completed_7021;
  180.  
  181. // 804A034: using guessed type int dtor_idx_7023;
  182.  
  183.  
  184.  
  185. //----- (08048520) --------------------------------------------------------
  186.  
  187. int __cdecl frame_dummy()
  188.  
  189. {
  190.  
  191.   int result; // eax@1
  192.  
  193.  
  194.  
  195.   result = _JCR_LIST__;
  196.  
  197.   if ( _JCR_LIST__ )
  198.  
  199.     result = 0;
  200.  
  201.   return result;
  202.  
  203. }
  204.  
  205. // 8049F1C: using guessed type int _JCR_LIST__;
  206.  
  207.  
  208.  
  209. //----- (08048544) --------------------------------------------------------
  210.  
  211. int *__cdecl tor(int *a1)
  212.  
  213. {
  214.  
  215.   int *i; // [sp+18h] [bp-10h]@1
  216.  
  217.   int v3; // [sp+1Ch] [bp-Ch]@2
  218.  
  219.  
  220.  
  221.   for ( i = a1; *(_BYTE *)i; i = (int *)((char *)i + 1) )
  222.  
  223.   {
  224.  
  225.     v3 = toupper(*(_BYTE *)i);
  226.  
  227.     if ( v3 <= 64 || v3 > 77 )
  228.  
  229.     {
  230.  
  231.       if ( v3 > 77 )
  232.  
  233.       {
  234.  
  235.         if ( v3 <= 90 )
  236.  
  237.           *(_BYTE *)i -= 13;
  238.  
  239.       }
  240.  
  241.     }
  242.  
  243.     else
  244.  
  245.     {
  246.  
  247.       *(_BYTE *)i += 13;
  248.  
  249.     }
  250.  
  251.   }
  252.  
  253.   return a1;
  254.  
  255. }
  256.  
  257.  
  258.  
  259. //----- (080485B3) --------------------------------------------------------
  260.  
  261. char *__cdecl untrash(const char *s)
  262.  
  263. {
  264.  
  265.   char *result; // eax@11
  266.  
  267.   signed int i; // [sp+14h] [bp-14h]@1
  268.  
  269.   int v3; // [sp+18h] [bp-10h]@1
  270.  
  271.   size_t v4; // [sp+1Ch] [bp-Ch]@1
  272.  
  273.  
  274.  
  275.   v3 = 0;
  276.  
  277.   v4 = strlen(s);
  278.  
  279.   for ( i = 0; i < (signed int)v4; ++i )
  280.  
  281.   {
  282.  
  283.     if ( s[i] > 64 && s[i] <= 90 || s[i] > 96 && s[i] <= 122 || s[i] == 32 || s[i] == 58 )
  284.  
  285.       s[v3++] = s[i];
  286.  
  287.   }
  288.  
  289.   result = (char *)&s[v3];
  290.  
  291.   s[v3] = 0;
  292.  
  293.   return result;
  294.  
  295. }
  296.  
  297.  
  298.  
  299. //----- (0804865D) --------------------------------------------------------
  300.  
  301. signed int __cdecl main()
  302.  
  303. {
  304.  
  305.   int *v0; // eax@1
  306.  
  307.   int *v1; // eax@1
  308.  
  309.   int *v2; // eax@1
  310.  
  311.   int *v3; // eax@1
  312.  
  313.   int *v4; // eax@1
  314.  
  315.   int *v5; // eax@1
  316.  
  317.   int *v6; // eax@3
  318.  
  319.   signed int result; // eax@7
  320.  
  321.   int *v8; // ebx@7
  322.  
  323.   int *v9; // eax@7
  324.  
  325.   int *v10; // eax@9
  326.  
  327.   signed int v11; // [sp+1Bh] [bp-2065h]@1
  328.  
  329.   signed int v12; // [sp+1Fh] [bp-2061h]@1
  330.  
  331.   signed int v13; // [sp+23h] [bp-205Dh]@1
  332.  
  333.   signed int v14; // [sp+27h] [bp-2059h]@1
  334.  
  335.   signed int v15; // [sp+2Bh] [bp-2055h]@1
  336.  
  337.   signed int v16; // [sp+2Fh] [bp-2051h]@1
  338.  
  339.   signed int v17; // [sp+33h] [bp-204Dh]@1
  340.  
  341.   signed __int16 v18; // [sp+37h] [bp-2049h]@1
  342.  
  343.   signed int v19; // [sp+39h] [bp-2047h]@1
  344.  
  345.   signed int v20; // [sp+3Dh] [bp-2043h]@1
  346.  
  347.   signed int v21; // [sp+41h] [bp-203Fh]@1
  348.  
  349.   signed int v22; // [sp+45h] [bp-203Bh]@1
  350.  
  351.   signed __int16 v23; // [sp+49h] [bp-2037h]@1
  352.  
  353.   signed int v24; // [sp+4Bh] [bp-2035h]@1
  354.  
  355.   signed int v25; // [sp+4Fh] [bp-2031h]@1
  356.  
  357.   signed int v26; // [sp+53h] [bp-202Dh]@1
  358.  
  359.   char v27; // [sp+57h] [bp-2029h]@1
  360.  
  361.   signed int v28; // [sp+58h] [bp-2028h]@1
  362.  
  363.   signed int v29; // [sp+5Ch] [bp-2024h]@1
  364.  
  365.   signed int v30; // [sp+60h] [bp-2020h]@1
  366.  
  367.   signed int v31; // [sp+64h] [bp-201Ch]@1
  368.  
  369.   signed __int16 v32; // [sp+68h] [bp-2018h]@1
  370.  
  371.   char v33; // [sp+6Ah] [bp-2016h]@1
  372.  
  373.   signed int v34; // [sp+6Bh] [bp-2015h]@1
  374.  
  375.   signed int v35; // [sp+6Fh] [bp-2011h]@1
  376.  
  377.   signed int v36; // [sp+73h] [bp-200Dh]@1
  378.  
  379.   signed __int16 v37; // [sp+77h] [bp-2009h]@1
  380.  
  381.   signed int v38; // [sp+79h] [bp-2007h]@1
  382.  
  383.   signed int v39; // [sp+7Dh] [bp-2003h]@1
  384.  
  385.   signed int v40; // [sp+81h] [bp-1FFFh]@1
  386.  
  387.   signed int v41; // [sp+85h] [bp-1FFBh]@1
  388.  
  389.   signed int v42; // [sp+89h] [bp-1FF7h]@1
  390.  
  391.   signed int v43; // [sp+8Dh] [bp-1FF3h]@1
  392.  
  393.   signed int v44; // [sp+91h] [bp-1FEFh]@1
  394.  
  395.   signed int v45; // [sp+95h] [bp-1FEBh]@1
  396.  
  397.   signed __int16 v46; // [sp+99h] [bp-1FE7h]@1
  398.  
  399.   signed int v47; // [sp+9Bh] [bp-1FE5h]@1
  400.  
  401.   signed int v48; // [sp+9Fh] [bp-1FE1h]@1
  402.  
  403.   signed int v49; // [sp+A3h] [bp-1FDDh]@1
  404.  
  405.   signed int v50; // [sp+A7h] [bp-1FD9h]@1
  406.  
  407.   signed int v51; // [sp+ABh] [bp-1FD5h]@1
  408.  
  409.   char v52; // [sp+AFh] [bp-1FD1h]@1
  410.  
  411.   char v53; // [sp+B0h] [bp-1FD0h]@1
  412.  
  413.   char v54; // [sp+F8h] [bp-1F88h]@1
  414.  
  415.   signed int v55; // [sp+F9h] [bp-1F87h]@1
  416.  
  417.   signed int v56; // [sp+FDh] [bp-1F83h]@1
  418.  
  419.   signed int v57; // [sp+101h] [bp-1F7Fh]@1
  420.  
  421.   signed int v58; // [sp+105h] [bp-1F7Bh]@1
  422.  
  423.   signed int v59; // [sp+109h] [bp-1F77h]@1
  424.  
  425.   signed int v60; // [sp+10Dh] [bp-1F73h]@1
  426.  
  427.   char v61; // [sp+111h] [bp-1F6Fh]@1
  428.  
  429.   signed int v62; // [sp+112h] [bp-1F6Eh]@1
  430.  
  431.   signed int v63; // [sp+116h] [bp-1F6Ah]@1
  432.  
  433.   signed int v64; // [sp+11Ah] [bp-1F66h]@1
  434.  
  435.   signed int v65; // [sp+11Eh] [bp-1F62h]@1
  436.  
  437.   signed __int16 v66; // [sp+122h] [bp-1F5Eh]@1
  438.  
  439.   char v67; // [sp+124h] [bp-1F5Ch]@1
  440.  
  441.   char v68; // [sp+8F4h] [bp-178Ch]@1
  442.  
  443.   char v69; // [sp+10C4h] [bp-FBCh]@1
  444.  
  445.   char v70; // [sp+1894h] [bp-7ECh]@1
  446.  
  447.   signed int i; // [sp+2064h] [bp-1Ch]@1
  448.  
  449.   void *v72; // [sp+2068h] [bp-18h]@1
  450.  
  451.   void *v73; // [sp+206Ch] [bp-14h]@1
  452.  
  453.  
  454.  
  455.   v72 = malloc(0x7D0u);
  456.  
  457.   v73 = malloc(4u);
  458.  
  459.   v62 = 543646273;
  460.  
  461.   v63 = 1914724966;
  462.  
  463.   v64 = 745301614;
  464.  
  465.   v65 = 1902670112;
  466.  
  467.   v66 = 114;
  468.  
  469.   v55 = 1635413585;
  470.  
  471.   v56 = 560428576;
  472.  
  473.   v57 = 1179403808;
  474.  
  475.   v58 = 542790215;
  476.  
  477.   v59 = 1498828371;
  478.  
  479.   v60 = 978470216;
  480.  
  481.   v61 = 0;
  482.  
  483.   memcpy(&v53, "v\nGFr^r\n\n\nZf.,G,u/\t\t-nG\n-_J.\r..r\r[#]N\r\r\aer\n;;Abg\n\rRc}vp@a{rffN?g#N...yY", 0x48u);
  484.  
  485.   v54 = aVGfrRZf_GUNg_j[72];
  486.  
  487.   v47 = 543711820;
  488.  
  489.   v48 = 544367982;
  490.  
  491.   v49 = 543646305;
  492.  
  493.   v50 = 1887007338;
  494.  
  495.   v51 = 779254370;
  496.  
  497.   v52 = 0;
  498.  
  499.   v38 = 1886806866;
  500.  
  501.   v39 = 1918983774;
  502.  
  503.   v40 = 757948205;
  504.  
  505.   v41 = 711353951;
  506.  
  507.   v42 = 2071086624;
  508.  
  509.   v43 = 811544621;
  510.  
  511.   v44 = 1752202541;
  512.  
  513.   v45 = 1735812447;
  514.  
  515.   v46 = 108;
  516.  
  517.   v34 = 1919312214;
  518.  
  519.   v35 = 1629513573;
  520.  
  521.   v36 = 980580974;
  522.  
  523.   v37 = 32;
  524.  
  525.   v28 = 1919312214;
  526.  
  527.   v29 = 2032166757;
  528.  
  529.   v30 = 543647342;
  530.  
  531.   v31 = 1920626273;
  532.  
  533.   v32 = 8250;
  534.  
  535.   v33 = 0;
  536.  
  537.   v24 = 1919312214;
  538.  
  539.   v25 = 1713399653;
  540.  
  541.   v26 = 540699506;
  542.  
  543.   v27 = 0;
  544.  
  545.   v19 = 1919312214;
  546.  
  547.   v20 = 1864397157;
  548.  
  549.   v21 = 1969710454;
  550.  
  551.   v22 = 980184689;
  552.  
  553.   v23 = 32;
  554.  
  555.   v11 = 168452438;
  556.  
  557.   v12 = 762471946;
  558.  
  559.   v13 = 757935405;
  560.  
  561.   v14 = 707422053;
  562.  
  563.   v15 = 1579166250;
  564.  
  565.   v16 = 1717988963;
  566.  
  567.   v17 = 980511242;
  568.  
  569.   v18 = 32;
  570.  
  571.   *(_DWORD *)v73 = 0;
  572.  
  573.   untrash((const char *)&v38);
  574.  
  575.   v0 = tor(&v38);
  576.  
  577.   printf("\n--- Welcome to '%s' systems.\n", v0);
  578.  
  579.   v1 = tor(&v34);
  580.  
  581.   printf("%s", v1);
  582.  
  583.   fflush(stdin);
  584.  
  585.   gets(&v70);
  586.  
  587.   v2 = tor(&v28);
  588.  
  589.   printf("%s", v2);
  590.  
  591.   fflush(stdin);
  592.  
  593.   gets(&v69);
  594.  
  595.   v3 = tor(&v24);
  596.  
  597.   printf("%s", v3);
  598.  
  599.   fflush(stdin);
  600.  
  601.   gets((char *)v72);
  602.  
  603.   v4 = tor(&v19);
  604.  
  605.   printf("%s", v4);
  606.  
  607.   fflush(stdin);
  608.  
  609.   gets(&v68);
  610.  
  611.   untrash((const char *)&v11);
  612.  
  613.   v5 = tor(&v11);
  614.  
  615.   printf("%s", v5);
  616.  
  617.   fflush(stdin);
  618.  
  619.   gets(&v67);
  620.  
  621.   for ( i = -5; i <= 9; ++i )
  622.  
  623.   {
  624.  
  625.     if ( *(_DWORD *)v73 == i )
  626.  
  627.     {
  628.  
  629.       v6 = tor(&v47);
  630.  
  631.       printf("ALERT: %s\n", v6);
  632.  
  633.     }
  634.  
  635.   }
  636.  
  637.   if ( *(_DWORD *)v73 )
  638.  
  639.   {
  640.  
  641.     untrash(&v53);
  642.  
  643.     v8 = tor((int *)&v53);
  644.  
  645.     v9 = tor(&v55);
  646.  
  647.     printf("%s %s\n", v9, v8);
  648.  
  649.     result = 0;
  650.  
  651.   }
  652.  
  653.   else
  654.  
  655.   {
  656.  
  657.     if ( strcmp(&v67, "admin_r00t") )
  658.  
  659.     {
  660.  
  661.       result = 69;
  662.  
  663.     }
  664.  
  665.     else
  666.  
  667.     {
  668.  
  669.       v10 = tor(&v62);
  670.  
  671.       printf("%s :)\n", v10);
  672.  
  673.       result = 69;
  674.  
  675.     }
  676.  
  677.   }
  678.  
  679.   return result;
  680.  
  681. }
  682.  
  683.  
  684.  
  685. //----- (08048B00) --------------------------------------------------------
  686.  
  687. void __cdecl _libc_csu_fini()
  688.  
  689. {
  690.  
  691.   ;
  692.  
  693. }
  694.  
  695.  
  696.  
  697. //----- (08048B10) --------------------------------------------------------
  698.  
  699. int *__cdecl _libc_csu_init()
  700.  
  701. {
  702.  
  703.   init_proc();
  704.  
  705.   return &_CTOR_LIST__;
  706.  
  707. }
  708.  
  709. // 8049F0C: using guessed type int _CTOR_LIST__;
  710.  
  711.  
  712.  
  713. //----- (08048B6A) --------------------------------------------------------
  714.  
  715. void __cdecl _i686_get_pc_thunk_bx()
  716.  
  717. {
  718.  
  719.   ;
  720.  
  721. }
  722.  
  723.  
  724.  
  725. //----- (08048B70) --------------------------------------------------------
  726.  
  727. void (*__cdecl _do_global_ctors_aux())(void)
  728.  
  729. {
  730.  
  731.   void (*result)(void); // eax@1
  732.  
  733.   int *v1; // ebx@2
  734.  
  735.  
  736.  
  737.   result = (void (*)(void))_CTOR_LIST__;
  738.  
  739.   if ( _CTOR_LIST__ != -1 )
  740.  
  741.   {
  742.  
  743.     v1 = &_CTOR_LIST__;
  744.  
  745.     do
  746.  
  747.     {
  748.  
  749.       --v1;
  750.  
  751.       result();
  752.  
  753.       result = (void (*)(void))*v1;
  754.  
  755.     }
  756.  
  757.     while ( *v1 != -1 );
  758.  
  759.   }
  760.  
  761.   return result;
  762.  
  763. }
  764.  
  765. // 8049F0C: using guessed type int _CTOR_LIST__;
  766.  
  767.  
  768.  
  769. //----- (08048B9C) --------------------------------------------------------
  770.  
  771. void __cdecl term_proc()
  772.  
  773. {
  774.  
  775.   _do_global_dtors_aux();
  776.  
  777. }
  778.  
  779.  
  780.  
  781. #error "There were 1 decompilation failure(s) on 12 function(s)"
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!