bingxuan9112

SNOWMAN

Dec 31st, 2019
278
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C++ 5.53 KB | None | 0 0
  1. int64_t __gmon_start__ = 0;
  2.  
  3. void fun_650() {
  4.     int64_t rax1;
  5.  
  6.     rax1 = __gmon_start__;
  7.     if (rax1) {
  8.         rax1();
  9.     }
  10.     return;
  11. }
  12.  
  13. int64_t __cxa_finalize = 0;
  14.  
  15. void fun_6e0(int64_t rdi) {
  16.     goto __cxa_finalize;
  17. }
  18.  
  19. int64_t puts = 0x686;
  20.  
  21. void fun_680(int64_t rdi, void* rsi) {
  22.     goto puts;
  23. }
  24.  
  25. int64_t exit = 0x6d6;
  26.  
  27. void fun_6d0(int64_t rdi, void* rsi) {
  28.     goto exit;
  29. }
  30.  
  31. int64_t printf = 0x6a6;
  32.  
  33. void fun_6a0(int64_t rdi, void* rsi) {
  34.     goto printf;
  35. }
  36.  
  37. int64_t __isoc99_scanf = 0x6c6;
  38.  
  39. void fun_6c0(int64_t rdi, void* rsi) {
  40.     goto __isoc99_scanf;
  41. }
  42.  
  43. int64_t strcmp = 0x6b6;
  44.  
  45. int32_t fun_6b0(int64_t rdi, void* rsi) {
  46.     goto strcmp;
  47. }
  48.  
  49. int64_t __stack_chk_fail = 0x696;
  50.  
  51. int64_t fun_690(int64_t rdi, void* rsi) {
  52.     goto __stack_chk_fail;
  53. }
  54.  
  55. int64_t _ITM_deregisterTMCloneTable = 0;
  56.  
  57. int64_t fun_720(int64_t rdi) {
  58.     int64_t rax2;
  59.  
  60.     rax2 = 0x201128;
  61.     if (1 || (rax2 = _ITM_deregisterTMCloneTable, rax2 == 0)) {
  62.         return rax2;
  63.     } else {
  64.         goto rax2;
  65.     }
  66. }
  67.  
  68. int64_t __libc_start_main = 0;
  69.  
  70. int64_t fun_7fa();
  71.  
  72. void fun_960(int32_t edi, int64_t rsi, int64_t rdx);
  73.  
  74. void fun_9d0();
  75.  
  76. void fun_6f0() {
  77.     void* rsp1;
  78.     int64_t rdx2;
  79.     int64_t rax3;
  80.  
  81.     rsp1 = reinterpret_cast<void*>(reinterpret_cast<int64_t>(__zero_stack_offset()) + 8);
  82.     __libc_start_main(fun_7fa, __return_address(), rsp1, fun_960, fun_9d0, rdx2, (reinterpret_cast<uint64_t>(rsp1) & 0xfffffffffffffff0) - 8 - 8, rax3);
  83.     __asm__("hlt ");
  84. }
  85.  
  86. void fun_9d4() {
  87.     return;
  88. }
  89.  
  90. void fun_797() {
  91.     int64_t v1;
  92.  
  93.     goto v1;
  94. }
  95.  
  96. void fun_960(int32_t edi, int64_t rsi, int64_t rdx) {
  97.     int64_t r15_4;
  98.     int32_t r13d5;
  99.     int64_t r14_6;
  100.     int64_t rbx7;
  101.     int64_t rdi8;
  102.  
  103.     r15_4 = rdx;
  104.     r13d5 = edi;
  105.     r14_6 = rsi;
  106.     fun_650();
  107.     if (!0) {
  108.         *reinterpret_cast<int32_t*>(&rbx7) = 0;
  109.         *reinterpret_cast<int32_t*>(reinterpret_cast<int64_t>(&rbx7) + 4) = 0;
  110.         do {
  111.             *reinterpret_cast<int32_t*>(&rdi8) = r13d5;
  112.             *reinterpret_cast<int32_t*>(reinterpret_cast<int64_t>(&rdi8) + 4) = 0;
  113.             *reinterpret_cast<int64_t*>(0x200d90 + rbx7 * 8)(rdi8, r14_6, r15_4);
  114.             ++rbx7;
  115.         } while (1 != rbx7);
  116.     }
  117.     return;
  118. }
  119.  
  120. void fun_9d0() {
  121.     return;
  122. }
  123.  
  124. int64_t _ITM_registerTMCloneTable = 0;
  125.  
  126. void fun_752() {
  127.     int64_t rax1;
  128.  
  129.     if (1)
  130.         goto 0x7a0;
  131.     rax1 = _ITM_registerTMCloneTable;
  132.     if (!rax1)
  133.         goto 0x7a0;
  134.     goto rax1;
  135. }
  136.  
  137. signed char g201121 = 0;
  138.  
  139. int64_t g201008 = 0x201008;
  140.  
  141. int64_t fun_7b0() {
  142.     int1_t zf1;
  143.     int64_t rax2;
  144.     int1_t zf3;
  145.     int64_t rdi4;
  146.     int64_t rax5;
  147.  
  148.     zf1 = g201121 == 0;
  149.     if (!zf1) {
  150.         return rax2;
  151.     } else {
  152.         zf3 = __cxa_finalize == 0;
  153.         if (!zf3) {
  154.             rdi4 = g201008;
  155.             fun_6e0(rdi4);
  156.         }
  157.         rax5 = fun_720(rdi4);
  158.         g201121 = 1;
  159.         return rax5;
  160.     }
  161. }
  162.  
  163. int64_t g200fa0 = 0;
  164.  
  165. void fun_686() {
  166.     goto g200fa0;
  167. }
  168.  
  169. void fun_6d6() {
  170.     goto 0x670;
  171. }
  172.  
  173. void fun_6a6() {
  174.     goto 0x670;
  175. }
  176.  
  177. void fun_6c6() {
  178.     goto 0x670;
  179. }
  180.  
  181. void fun_6b6() {
  182.     goto 0x670;
  183. }
  184.  
  185. void fun_696() {
  186.     goto 0x670;
  187. }
  188.  
  189. void fun_7f0() {
  190.     goto 0x760;
  191. }
  192.  
  193. uint64_t g28;
  194.  
  195. void fun_201020(int64_t rdi, void* rsi);
  196.  
  197. int64_t fun_7fa() {
  198.     void* rbp1;
  199.     uint64_t rax2;
  200.     uint64_t v3;
  201.     void* rsi4;
  202.     void* rsi5;
  203.     int32_t v6;
  204.     void* rsi7;
  205.     int32_t v8;
  206.     int32_t v9;
  207.     int32_t v10;
  208.     int64_t rax11;
  209.     int64_t rdx12;
  210.     int32_t ecx13;
  211.     void* rsi14;
  212.     int32_t eax15;
  213.     int64_t rdi16;
  214.     int64_t rax17;
  215.     uint64_t rcx18;
  216.  
  217.     rbp1 = reinterpret_cast<void*>(reinterpret_cast<int64_t>(__zero_stack_offset()) - 8);
  218.     rax2 = g28;
  219.     v3 = rax2;
  220.     fun_6a0("First give me your password: ", rsi4);
  221.     rsi5 = reinterpret_cast<void*>(reinterpret_cast<int64_t>(rbp1) - 56);
  222.     fun_6c0("%d", rsi5);
  223.     if (v6 != 0x18070) {
  224.         fun_680("You don't know static analysis !", rsi5);
  225.         fun_6d0(0, rsi5);
  226.     }
  227.     fun_6a0("Second give me your key: ", rsi5);
  228.     rsi7 = reinterpret_cast<void*>(reinterpret_cast<int64_t>(rbp1) - 56);
  229.     fun_6c0("%d", rsi7);
  230.     v8 = v9 - 49;
  231.     v10 = 0;
  232.     while (v10 <= 11) {
  233.         *reinterpret_cast<uint32_t*>(&rax11) = *reinterpret_cast<unsigned char*>(v10 + 0x201020);
  234.         *reinterpret_cast<int32_t*>(reinterpret_cast<int64_t>(&rax11) + 4) = 0;
  235.         *reinterpret_cast<int32_t*>(&rdx12) = v8;
  236.         *reinterpret_cast<int32_t*>(reinterpret_cast<int64_t>(&rdx12) + 4) = 0;
  237.         ecx13 = static_cast<int32_t>(rax11 + rdx12);
  238.         *reinterpret_cast<signed char*>(v10 + 0x201020) = *reinterpret_cast<signed char*>(&ecx13);
  239.         ++v10;
  240.     }
  241.     fun_201020(0x201100, rsi7);
  242.     fun_6a0("Then Verify your flag: ", rsi7);
  243.     fun_6c0("%s", reinterpret_cast<int64_t>(rbp1) - 48);
  244.     rsi14 = reinterpret_cast<void*>(reinterpret_cast<int64_t>(rbp1) - 48);
  245.     eax15 = fun_6b0(0x201100, rsi14);
  246.     if (eax15) {
  247.         rdi16 = reinterpret_cast<int64_t>("You don't know dynamic analysis !");
  248.         fun_680("You don't know dynamic analysis !", rsi14);
  249.     } else {
  250.         rdi16 = reinterpret_cast<int64_t>("You are right. Congratulations !!");
  251.         fun_680("You are right. Congratulations !!", rsi14);
  252.     }
  253.     *reinterpret_cast<int32_t*>(&rax17) = 0;
  254.     *reinterpret_cast<int32_t*>(reinterpret_cast<int64_t>(&rax17) + 4) = 0;
  255.     rcx18 = v3 ^ g28;
  256.     if (rcx18) {
  257.         rax17 = fun_690(rdi16, rsi14);
  258.     }
  259.     return rax17;
  260. }
Advertisement
Add Comment
Please, Sign In to add comment