_BOOL8 __fastcall sub_140001000(const char *a1)
{
int i; // [rsp+20h] [rbp-18h]
int v3; // [rsp+24h] [rbp-14h]
v3 = strlen(a1);
if ( (v3 + 1) % 8 )
return 0i64;
for ( i = 0; i < v3 + 1; i += 8 )
sub_1400010A0(&a1[i]);
return memcmp(a1, &unk_140004000, 0x19ui64) == 0;
}
입력을 받고 올바른 입력값인지 확인하는 함수의 부분이며 디컴파일한 결과이다.
sub_1400010A0 함수 또한 존재하므로 이 또한 분석해야 한다.
__int64 __fastcall sub_1400010A0(unsigned __int8 *a1)
{
__int64 result; // rax
unsigned __int8 v2; // [rsp+0h] [rbp-48h]
int j; // [rsp+4h] [rbp-44h]
int i; // [rsp+8h] [rbp-40h]
char v5[16]; // [rsp+10h] [rbp-38h] BYREF
strcpy(v5, "I_am_KEY");
result = *a1;
v2 = *a1;
for ( i = 0; i < 16; ++i )
{
for ( j = 0; j < 8; ++j )
{
v2 = __ROR1__(a1[((_BYTE)j + 1) & 7] + byte_140004020[(unsigned __int8)v5[j] ^ v2], 5);
a1[((_BYTE)j + 1) & 7] = v2;
}
result = (unsigned int)(i + 1);
}
return result;
}
이중 For문과 조건문을 역산식을 만들면 된다.
#include <stdio.h>
#include <string.h>
const int TABLE[] = {
99, 124, 119, 123, 242, 107, 111, 197, 48, 1, 103, 43,
254, 215, 171, 118, 202, 130, 201, 125, 250, 89, 71,
240, 173, 212, 162, 175, 156, 164, 114, 192, 183, 253,
147, 38, 54, 63, 247, 204, 52, 165, 229, 241, 113, 216,
49, 21, 4, 199, 35, 195, 24, 150, 5, 154, 7, 18, 128,
226, 235, 39, 178, 117, 9, 131, 44, 26, 27, 110, 90,
160, 82, 59, 214, 179, 41, 227, 47, 132, 83, 209, 0,
237, 32, 252, 177, 91, 106, 203, 190, 57, 74, 76, 88,
207, 208, 239, 170, 251, 67, 77, 51, 133, 69, 249, 2,
127, 80, 60, 159, 168, 81, 163, 64, 143, 146, 157, 56,
245, 188, 182, 218, 33, 16, 255, 243, 210, 205, 12,
19, 236, 95, 151, 68, 23, 196, 167, 126, 61, 100, 93,
25, 115, 96, 129, 79, 220, 34, 42, 144, 136, 70, 238,
184, 20, 222, 94, 11, 219, 224, 50, 58, 10, 73, 6, 36,
92, 194, 211, 172, 98, 145, 149, 228, 121, 231, 200,
55, 109, 141, 213, 78, 169, 108, 86, 244, 234, 101,
122, 174, 8, 186, 120, 37, 46, 28, 166, 180, 198, 232,
221, 116, 31, 75, 189, 139, 138, 112, 62, 181, 102,
72, 3, 246, 14, 97, 53, 87, 185, 134, 193, 29, 158,
225, 248, 152, 17, 105, 217, 142, 148, 155, 30, 135,
233, 206, 85, 40, 223, 140, 161, 137, 13, 191, 230,
66, 104, 65, 153, 45, 15, 176, 84, 187, 22
};
const char key[] = "I_am_KEY";
int rol(int x, int c) {
int a = (x << c) & 0xff;
int b = x >> (8 - c);
return a | b;
}
void decrypt(unsigned char *b) {
int i, j, idx;
for (i = 0; i < 16; ++i) {
for (j = 7; j >= 0; --j) {
idx = (j + 1) % 8;
b[idx] = rol(b[idx], 5) - TABLE[key[j] ^ b[j]];
}
}
}
void printAsAscii(const unsigned char *bytes, int size) {
printf("Decrypted: ");
for (int i = 0; i < size; i++) {
printf("%c", bytes[i]);
}
printf("\\n");
}
int main() {
unsigned char bytes[] = {
0x7E, 0x7D, 0x9A, 0x8B, 0x25, 0x2D, 0xD5, 0x3D,
0x03, 0x2B, 0x38, 0x98, 0x27, 0x9F, 0x4F, 0xBC,
0x2A, 0x79, 0x00, 0x7D, 0xC4, 0x2A, 0x4F, 0x58,
};
int i;
for (i = 0; i < sizeof(bytes); i += 8) {
decrypt(&bytes[i]);
}
// 최종 결과물 출력
printAsAscii(bytes, sizeof(bytes));
return 0;
}