|
| 1 | +from qiling.const import QL_INTERCEPT |
| 2 | +from qiling import Qiling |
| 3 | +import curses, logging |
| 4 | + |
| 5 | +def input_index(ql: Qiling): |
| 6 | + return ql.unpack16(ql.mem.read(0x81ba, 2)) |
| 7 | + |
| 8 | +def target(ql: Qiling): |
| 9 | + return ql.unpack16(ql.mem.read(0x81bb, 2)) |
| 10 | + |
| 11 | +def stop(ql, b, c): |
| 12 | + ql.emu_stop() |
| 13 | + |
| 14 | +def find_once(ql: Qiling, ch): |
| 15 | + old = target(ql) |
| 16 | + ql.reg.al = ch |
| 17 | + h1 = ql.hook_code(stop, begin=0x8004, end=0x8004) # Fail |
| 18 | + h2 = ql.hook_code(stop, begin=0x7fea, end=0x7fea) # Success |
| 19 | + h3 = ql.hook_code(stop, begin=0x7e37, end=0x7e37) |
| 20 | + ql.run(begin=0x7e3d) |
| 21 | + ql.hook_del(h1) |
| 22 | + ql.hook_del(h2) |
| 23 | + ql.hook_del(h3) |
| 24 | + new = target(ql) |
| 25 | + if new > old: |
| 26 | + return True |
| 27 | + else: |
| 28 | + return False |
| 29 | + |
| 30 | +def find_next(ql: Qiling): |
| 31 | + ctx = ql.save() |
| 32 | + ctx_succ = None |
| 33 | + results = [] |
| 34 | + for i in range(0x61, 0x7a + 1): |
| 35 | + if find_once(ql, i): |
| 36 | + results.append(i) |
| 37 | + ctx_succ = ql.save() |
| 38 | + ql.restore(ctx) |
| 39 | + if ctx_succ is None: |
| 40 | + logging.info("Can't find any suitbale result.") |
| 41 | + return None |
| 42 | + ql.restore(ctx_succ) |
| 43 | + return results |
| 44 | + |
| 45 | +def print_flags(results): |
| 46 | + def _impl(fl, idx, results): |
| 47 | + if idx == len(results): |
| 48 | + print(f"flag: {fl}") |
| 49 | + else: |
| 50 | + for ch in results[idx]: |
| 51 | + _impl(fl + ch, idx + 1, results) |
| 52 | + curses.echo() |
| 53 | + curses.nocbreak() |
| 54 | + curses.endwin() |
| 55 | + return _impl("", 0, results) |
| 56 | + |
| 57 | +def main(): |
| 58 | + flag = "" |
| 59 | + results = [] |
| 60 | + ql = Qiling(["rootfs/8086/dos/hfs.img"], rootfs="rootfs/8086", console=False, log_dir=".", output="off") |
| 61 | + h = ql.hook_code(stop, begin=0x7e3b, end=0x7e3b) |
| 62 | + ql.run() |
| 63 | + ql.hook_del(h) |
| 64 | + ql.reg.ip = 0x7e3d |
| 65 | + for i in range(9): |
| 66 | + r = find_next(ql) |
| 67 | + if r is None: |
| 68 | + logging.info("Fail to crack.") |
| 69 | + return |
| 70 | + else: |
| 71 | + r = list(map(lambda x: chr(x), r)) |
| 72 | + logging.info(f"Get {r}") |
| 73 | + results.append(r) |
| 74 | + print_flags(results) |
| 75 | + |
| 76 | +if __name__ == "__main__": |
| 77 | + main() |
0 commit comments