Advertisement
Guest User

kmkz write-up CTF

a guest
Jan 17th, 2011
208
0
Never
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
C 10.91 KB | None | 0 0
  1. /* This file has been generated by the Hex-Rays decompiler.
  2.  
  3.    Copyright (c) 2009 Hex-Rays <info@hex-rays.com>
  4.  
  5.  
  6.  
  7.    Detected compiler: GNU C++
  8.  
  9. */
  10.  
  11.  
  12.  
  13. #include <defs.h>
  14.  
  15.  
  16.  
  17.  
  18.  
  19. //-------------------------------------------------------------------------
  20.  
  21. // Data declarations
  22.  
  23.  
  24.  
  25. extern _UNKNOWN start; // weak
  26.  
  27. extern char format[]; // idb
  28.  
  29. extern char aS[]; // idb
  30.  
  31. extern char aAlertS[]; // idb
  32.  
  33. extern char aSS[]; // idb
  34.  
  35. extern char s2[]; // idb
  36.  
  37. extern char aS_0[]; // idb
  38.  
  39. extern char aVGfrRZf_GUNg_j[73]; // weak
  40.  
  41. extern int _CTOR_LIST__; // weak
  42.  
  43. extern int _DTOR_LIST__[]; // weak
  44.  
  45. extern _UNKNOWN _DTOR_END__; // weak
  46.  
  47. extern int _JCR_LIST__; // weak
  48.  
  49. extern FILE *stdin; // idb
  50.  
  51. extern char completed_7021; // weak
  52.  
  53. extern int dtor_idx_7023; // weak
  54.  
  55. // extern _UNKNOWN _gmon_start__; weak
  56.  
  57.  
  58.  
  59. //-------------------------------------------------------------------------
  60.  
  61. // Function declarations
  62.  
  63.  
  64.  
  65. int __cdecl init_proc();
  66.  
  67. int __gmon_start__(void); // weak
  68.  
  69. char *gets(char *s);
  70.  
  71. int toupper(int c);
  72.  
  73. int fflush(FILE *stream);
  74.  
  75. size_t strlen(const char *s);
  76.  
  77. int printf(const char *format, ...);
  78.  
  79. void *malloc(size_t size);
  80.  
  81. int strcmp(const char *s1, const char *s2);
  82.  
  83. void __cdecl _do_global_dtors_aux();
  84.  
  85. int __cdecl frame_dummy();
  86.  
  87. int *__cdecl tor(int *a1);
  88.  
  89. char *__cdecl untrash(const char *s);
  90.  
  91. signed int __cdecl main();
  92.  
  93. void __cdecl _libc_csu_fini();
  94.  
  95. int *__cdecl _libc_csu_init();
  96.  
  97. void __cdecl _i686_get_pc_thunk_bx();
  98.  
  99. void (*__cdecl _do_global_ctors_aux())(void);
  100.  
  101. void __cdecl term_proc();
  102.  
  103.  
  104.  
  105.  
  106.  
  107. //----- (080483C0) --------------------------------------------------------
  108.  
  109. int __cdecl init_proc()
  110.  
  111. {
  112.  
  113.   int v1; // ST04_4@3
  114.  
  115.  
  116.  
  117.   if ( &_gmon_start__ )
  118.  
  119.     __gmon_start__();
  120.  
  121.   frame_dummy();
  122.  
  123.   _do_global_ctors_aux();
  124.  
  125.   return v1;
  126.  
  127. }
  128.  
  129. // 8048400: using guessed type int __gmon_start__(void);
  130.  
  131.  
  132.  
  133. //----- (08048490) --------------------------------------------------------
  134.  
  135. #error "8048493: positive sp value has been found (funcsize=2)"
  136.  
  137.  
  138.  
  139. //----- (080484C0) --------------------------------------------------------
  140.  
  141. void __cdecl _do_global_dtors_aux()
  142.  
  143. {
  144.  
  145.   int v0; // eax@2
  146.  
  147.   int i; // ebx@2
  148.  
  149.  
  150.  
  151.   if ( !completed_7021 )
  152.  
  153.   {
  154.  
  155.     v0 = dtor_idx_7023;
  156.  
  157.     for ( i = ((signed int)(&_DTOR_END__ - (_UNKNOWN *)_DTOR_LIST__) >> 2) - 1;
  158.  
  159.           dtor_idx_7023 < (unsigned int)i;
  160.  
  161.           v0 = dtor_idx_7023 )
  162.  
  163.     {
  164.  
  165.       dtor_idx_7023 = v0 + 1;
  166.  
  167.       ((void (*)(void))_DTOR_LIST__[dtor_idx_7023])();
  168.  
  169.     }
  170.  
  171.     completed_7021 = 1;
  172.  
  173.   }
  174.  
  175. }
  176.  
  177. // 8049F14: using guessed type int _DTOR_LIST__[];
  178.  
  179. // 804A030: using guessed type char completed_7021;
  180.  
  181. // 804A034: using guessed type int dtor_idx_7023;
  182.  
  183.  
  184.  
  185. //----- (08048520) --------------------------------------------------------
  186.  
  187. int __cdecl frame_dummy()
  188.  
  189. {
  190.  
  191.   int result; // eax@1
  192.  
  193.  
  194.  
  195.   result = _JCR_LIST__;
  196.  
  197.   if ( _JCR_LIST__ )
  198.  
  199.     result = 0;
  200.  
  201.   return result;
  202.  
  203. }
  204.  
  205. // 8049F1C: using guessed type int _JCR_LIST__;
  206.  
  207.  
  208.  
  209. //----- (08048544) --------------------------------------------------------
  210.  
  211. int *__cdecl tor(int *a1)
  212.  
  213. {
  214.  
  215.   int *i; // [sp+18h] [bp-10h]@1
  216.  
  217.   int v3; // [sp+1Ch] [bp-Ch]@2
  218.  
  219.  
  220.  
  221.   for ( i = a1; *(_BYTE *)i; i = (int *)((char *)i + 1) )
  222.  
  223.   {
  224.  
  225.     v3 = toupper(*(_BYTE *)i);
  226.  
  227.     if ( v3 <= 64 || v3 > 77 )
  228.  
  229.     {
  230.  
  231.       if ( v3 > 77 )
  232.  
  233.       {
  234.  
  235.         if ( v3 <= 90 )
  236.  
  237.           *(_BYTE *)i -= 13;
  238.  
  239.       }
  240.  
  241.     }
  242.  
  243.     else
  244.  
  245.     {
  246.  
  247.       *(_BYTE *)i += 13;
  248.  
  249.     }
  250.  
  251.   }
  252.  
  253.   return a1;
  254.  
  255. }
  256.  
  257.  
  258.  
  259. //----- (080485B3) --------------------------------------------------------
  260.  
  261. char *__cdecl untrash(const char *s)
  262.  
  263. {
  264.  
  265.   char *result; // eax@11
  266.  
  267.   signed int i; // [sp+14h] [bp-14h]@1
  268.  
  269.   int v3; // [sp+18h] [bp-10h]@1
  270.  
  271.   size_t v4; // [sp+1Ch] [bp-Ch]@1
  272.  
  273.  
  274.  
  275.   v3 = 0;
  276.  
  277.   v4 = strlen(s);
  278.  
  279.   for ( i = 0; i < (signed int)v4; ++i )
  280.  
  281.   {
  282.  
  283.     if ( s[i] > 64 && s[i] <= 90 || s[i] > 96 && s[i] <= 122 || s[i] == 32 || s[i] == 58 )
  284.  
  285.       s[v3++] = s[i];
  286.  
  287.   }
  288.  
  289.   result = (char *)&s[v3];
  290.  
  291.   s[v3] = 0;
  292.  
  293.   return result;
  294.  
  295. }
  296.  
  297.  
  298.  
  299. //----- (0804865D) --------------------------------------------------------
  300.  
  301. signed int __cdecl main()
  302.  
  303. {
  304.  
  305.   int *v0; // eax@1
  306.  
  307.   int *v1; // eax@1
  308.  
  309.   int *v2; // eax@1
  310.  
  311.   int *v3; // eax@1
  312.  
  313.   int *v4; // eax@1
  314.  
  315.   int *v5; // eax@1
  316.  
  317.   int *v6; // eax@3
  318.  
  319.   signed int result; // eax@7
  320.  
  321.   int *v8; // ebx@7
  322.  
  323.   int *v9; // eax@7
  324.  
  325.   int *v10; // eax@9
  326.  
  327.   signed int v11; // [sp+1Bh] [bp-2065h]@1
  328.  
  329.   signed int v12; // [sp+1Fh] [bp-2061h]@1
  330.  
  331.   signed int v13; // [sp+23h] [bp-205Dh]@1
  332.  
  333.   signed int v14; // [sp+27h] [bp-2059h]@1
  334.  
  335.   signed int v15; // [sp+2Bh] [bp-2055h]@1
  336.  
  337.   signed int v16; // [sp+2Fh] [bp-2051h]@1
  338.  
  339.   signed int v17; // [sp+33h] [bp-204Dh]@1
  340.  
  341.   signed __int16 v18; // [sp+37h] [bp-2049h]@1
  342.  
  343.   signed int v19; // [sp+39h] [bp-2047h]@1
  344.  
  345.   signed int v20; // [sp+3Dh] [bp-2043h]@1
  346.  
  347.   signed int v21; // [sp+41h] [bp-203Fh]@1
  348.  
  349.   signed int v22; // [sp+45h] [bp-203Bh]@1
  350.  
  351.   signed __int16 v23; // [sp+49h] [bp-2037h]@1
  352.  
  353.   signed int v24; // [sp+4Bh] [bp-2035h]@1
  354.  
  355.   signed int v25; // [sp+4Fh] [bp-2031h]@1
  356.  
  357.   signed int v26; // [sp+53h] [bp-202Dh]@1
  358.  
  359.   char v27; // [sp+57h] [bp-2029h]@1
  360.  
  361.   signed int v28; // [sp+58h] [bp-2028h]@1
  362.  
  363.   signed int v29; // [sp+5Ch] [bp-2024h]@1
  364.  
  365.   signed int v30; // [sp+60h] [bp-2020h]@1
  366.  
  367.   signed int v31; // [sp+64h] [bp-201Ch]@1
  368.  
  369.   signed __int16 v32; // [sp+68h] [bp-2018h]@1
  370.  
  371.   char v33; // [sp+6Ah] [bp-2016h]@1
  372.  
  373.   signed int v34; // [sp+6Bh] [bp-2015h]@1
  374.  
  375.   signed int v35; // [sp+6Fh] [bp-2011h]@1
  376.  
  377.   signed int v36; // [sp+73h] [bp-200Dh]@1
  378.  
  379.   signed __int16 v37; // [sp+77h] [bp-2009h]@1
  380.  
  381.   signed int v38; // [sp+79h] [bp-2007h]@1
  382.  
  383.   signed int v39; // [sp+7Dh] [bp-2003h]@1
  384.  
  385.   signed int v40; // [sp+81h] [bp-1FFFh]@1
  386.  
  387.   signed int v41; // [sp+85h] [bp-1FFBh]@1
  388.  
  389.   signed int v42; // [sp+89h] [bp-1FF7h]@1
  390.  
  391.   signed int v43; // [sp+8Dh] [bp-1FF3h]@1
  392.  
  393.   signed int v44; // [sp+91h] [bp-1FEFh]@1
  394.  
  395.   signed int v45; // [sp+95h] [bp-1FEBh]@1
  396.  
  397.   signed __int16 v46; // [sp+99h] [bp-1FE7h]@1
  398.  
  399.   signed int v47; // [sp+9Bh] [bp-1FE5h]@1
  400.  
  401.   signed int v48; // [sp+9Fh] [bp-1FE1h]@1
  402.  
  403.   signed int v49; // [sp+A3h] [bp-1FDDh]@1
  404.  
  405.   signed int v50; // [sp+A7h] [bp-1FD9h]@1
  406.  
  407.   signed int v51; // [sp+ABh] [bp-1FD5h]@1
  408.  
  409.   char v52; // [sp+AFh] [bp-1FD1h]@1
  410.  
  411.   char v53; // [sp+B0h] [bp-1FD0h]@1
  412.  
  413.   char v54; // [sp+F8h] [bp-1F88h]@1
  414.  
  415.   signed int v55; // [sp+F9h] [bp-1F87h]@1
  416.  
  417.   signed int v56; // [sp+FDh] [bp-1F83h]@1
  418.  
  419.   signed int v57; // [sp+101h] [bp-1F7Fh]@1
  420.  
  421.   signed int v58; // [sp+105h] [bp-1F7Bh]@1
  422.  
  423.   signed int v59; // [sp+109h] [bp-1F77h]@1
  424.  
  425.   signed int v60; // [sp+10Dh] [bp-1F73h]@1
  426.  
  427.   char v61; // [sp+111h] [bp-1F6Fh]@1
  428.  
  429.   signed int v62; // [sp+112h] [bp-1F6Eh]@1
  430.  
  431.   signed int v63; // [sp+116h] [bp-1F6Ah]@1
  432.  
  433.   signed int v64; // [sp+11Ah] [bp-1F66h]@1
  434.  
  435.   signed int v65; // [sp+11Eh] [bp-1F62h]@1
  436.  
  437.   signed __int16 v66; // [sp+122h] [bp-1F5Eh]@1
  438.  
  439.   char v67; // [sp+124h] [bp-1F5Ch]@1
  440.  
  441.   char v68; // [sp+8F4h] [bp-178Ch]@1
  442.  
  443.   char v69; // [sp+10C4h] [bp-FBCh]@1
  444.  
  445.   char v70; // [sp+1894h] [bp-7ECh]@1
  446.  
  447.   signed int i; // [sp+2064h] [bp-1Ch]@1
  448.  
  449.   void *v72; // [sp+2068h] [bp-18h]@1
  450.  
  451.   void *v73; // [sp+206Ch] [bp-14h]@1
  452.  
  453.  
  454.  
  455.   v72 = malloc(0x7D0u);
  456.  
  457.   v73 = malloc(4u);
  458.  
  459.   v62 = 543646273;
  460.  
  461.   v63 = 1914724966;
  462.  
  463.   v64 = 745301614;
  464.  
  465.   v65 = 1902670112;
  466.  
  467.   v66 = 114;
  468.  
  469.   v55 = 1635413585;
  470.  
  471.   v56 = 560428576;
  472.  
  473.   v57 = 1179403808;
  474.  
  475.   v58 = 542790215;
  476.  
  477.   v59 = 1498828371;
  478.  
  479.   v60 = 978470216;
  480.  
  481.   v61 = 0;
  482.  
  483.   memcpy(&v53, "v\nGFr^r\n\n\nZf.,G,u/\t\t-nG\n-_J.\r..r\r[#]N\r\r\aer\n;;Abg\n\rRc}vp@a{rffN?g#N...yY", 0x48u);
  484.  
  485.   v54 = aVGfrRZf_GUNg_j[72];
  486.  
  487.   v47 = 543711820;
  488.  
  489.   v48 = 544367982;
  490.  
  491.   v49 = 543646305;
  492.  
  493.   v50 = 1887007338;
  494.  
  495.   v51 = 779254370;
  496.  
  497.   v52 = 0;
  498.  
  499.   v38 = 1886806866;
  500.  
  501.   v39 = 1918983774;
  502.  
  503.   v40 = 757948205;
  504.  
  505.   v41 = 711353951;
  506.  
  507.   v42 = 2071086624;
  508.  
  509.   v43 = 811544621;
  510.  
  511.   v44 = 1752202541;
  512.  
  513.   v45 = 1735812447;
  514.  
  515.   v46 = 108;
  516.  
  517.   v34 = 1919312214;
  518.  
  519.   v35 = 1629513573;
  520.  
  521.   v36 = 980580974;
  522.  
  523.   v37 = 32;
  524.  
  525.   v28 = 1919312214;
  526.  
  527.   v29 = 2032166757;
  528.  
  529.   v30 = 543647342;
  530.  
  531.   v31 = 1920626273;
  532.  
  533.   v32 = 8250;
  534.  
  535.   v33 = 0;
  536.  
  537.   v24 = 1919312214;
  538.  
  539.   v25 = 1713399653;
  540.  
  541.   v26 = 540699506;
  542.  
  543.   v27 = 0;
  544.  
  545.   v19 = 1919312214;
  546.  
  547.   v20 = 1864397157;
  548.  
  549.   v21 = 1969710454;
  550.  
  551.   v22 = 980184689;
  552.  
  553.   v23 = 32;
  554.  
  555.   v11 = 168452438;
  556.  
  557.   v12 = 762471946;
  558.  
  559.   v13 = 757935405;
  560.  
  561.   v14 = 707422053;
  562.  
  563.   v15 = 1579166250;
  564.  
  565.   v16 = 1717988963;
  566.  
  567.   v17 = 980511242;
  568.  
  569.   v18 = 32;
  570.  
  571.   *(_DWORD *)v73 = 0;
  572.  
  573.   untrash((const char *)&v38);
  574.  
  575.   v0 = tor(&v38);
  576.  
  577.   printf("\n--- Welcome to '%s' systems.\n", v0);
  578.  
  579.   v1 = tor(&v34);
  580.  
  581.   printf("%s", v1);
  582.  
  583.   fflush(stdin);
  584.  
  585.   gets(&v70);
  586.  
  587.   v2 = tor(&v28);
  588.  
  589.   printf("%s", v2);
  590.  
  591.   fflush(stdin);
  592.  
  593.   gets(&v69);
  594.  
  595.   v3 = tor(&v24);
  596.  
  597.   printf("%s", v3);
  598.  
  599.   fflush(stdin);
  600.  
  601.   gets((char *)v72);
  602.  
  603.   v4 = tor(&v19);
  604.  
  605.   printf("%s", v4);
  606.  
  607.   fflush(stdin);
  608.  
  609.   gets(&v68);
  610.  
  611.   untrash((const char *)&v11);
  612.  
  613.   v5 = tor(&v11);
  614.  
  615.   printf("%s", v5);
  616.  
  617.   fflush(stdin);
  618.  
  619.   gets(&v67);
  620.  
  621.   for ( i = -5; i <= 9; ++i )
  622.  
  623.   {
  624.  
  625.     if ( *(_DWORD *)v73 == i )
  626.  
  627.     {
  628.  
  629.       v6 = tor(&v47);
  630.  
  631.       printf("ALERT: %s\n", v6);
  632.  
  633.     }
  634.  
  635.   }
  636.  
  637.   if ( *(_DWORD *)v73 )
  638.  
  639.   {
  640.  
  641.     untrash(&v53);
  642.  
  643.     v8 = tor((int *)&v53);
  644.  
  645.     v9 = tor(&v55);
  646.  
  647.     printf("%s %s\n", v9, v8);
  648.  
  649.     result = 0;
  650.  
  651.   }
  652.  
  653.   else
  654.  
  655.   {
  656.  
  657.     if ( strcmp(&v67, "admin_r00t") )
  658.  
  659.     {
  660.  
  661.       result = 69;
  662.  
  663.     }
  664.  
  665.     else
  666.  
  667.     {
  668.  
  669.       v10 = tor(&v62);
  670.  
  671.       printf("%s :)\n", v10);
  672.  
  673.       result = 69;
  674.  
  675.     }
  676.  
  677.   }
  678.  
  679.   return result;
  680.  
  681. }
  682.  
  683.  
  684.  
  685. //----- (08048B00) --------------------------------------------------------
  686.  
  687. void __cdecl _libc_csu_fini()
  688.  
  689. {
  690.  
  691.   ;
  692.  
  693. }
  694.  
  695.  
  696.  
  697. //----- (08048B10) --------------------------------------------------------
  698.  
  699. int *__cdecl _libc_csu_init()
  700.  
  701. {
  702.  
  703.   init_proc();
  704.  
  705.   return &_CTOR_LIST__;
  706.  
  707. }
  708.  
  709. // 8049F0C: using guessed type int _CTOR_LIST__;
  710.  
  711.  
  712.  
  713. //----- (08048B6A) --------------------------------------------------------
  714.  
  715. void __cdecl _i686_get_pc_thunk_bx()
  716.  
  717. {
  718.  
  719.   ;
  720.  
  721. }
  722.  
  723.  
  724.  
  725. //----- (08048B70) --------------------------------------------------------
  726.  
  727. void (*__cdecl _do_global_ctors_aux())(void)
  728.  
  729. {
  730.  
  731.   void (*result)(void); // eax@1
  732.  
  733.   int *v1; // ebx@2
  734.  
  735.  
  736.  
  737.   result = (void (*)(void))_CTOR_LIST__;
  738.  
  739.   if ( _CTOR_LIST__ != -1 )
  740.  
  741.   {
  742.  
  743.     v1 = &_CTOR_LIST__;
  744.  
  745.     do
  746.  
  747.     {
  748.  
  749.       --v1;
  750.  
  751.       result();
  752.  
  753.       result = (void (*)(void))*v1;
  754.  
  755.     }
  756.  
  757.     while ( *v1 != -1 );
  758.  
  759.   }
  760.  
  761.   return result;
  762.  
  763. }
  764.  
  765. // 8049F0C: using guessed type int _CTOR_LIST__;
  766.  
  767.  
  768.  
  769. //----- (08048B9C) --------------------------------------------------------
  770.  
  771. void __cdecl term_proc()
  772.  
  773. {
  774.  
  775.   _do_global_dtors_aux();
  776.  
  777. }
  778.  
  779.  
  780.  
  781. #error "There were 1 decompilation failure(s) on 12 function(s)"
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement