看雪·众安 2021 KCTF 秋季赛 | 第十题设计思路及解析

struct CodeLineToExpand{OrderType m_Type;//原来代码的类型Param1;Param2;OldAddr;  //原来代码的地址OldAddrToJmpOrCall;//原来代码中要跳转的目标地址OldIndexValue;NewSize;//已经加入了远相对jmp后的大小NewAddr;NewAddrToJmpOrCall;RamdomValue;//随机值NewCode;//新的代码}CTE[nCodeLines];
int MapNewToOld[nCodeLines];//存储新的Line和旧的Line之间的对应关系int CodeLineOldAddrBegin;//原来代码地址的开始int CodeLineOldAddrEnd;//原来代码地址的结束（不包含本地址）

// 第一种  长度：6push Addrret
// 第二种  长度：0x1Cpush eaxmov eax,Addrpush eaxmov [esp-4],eaxmov eax,[esp+4]mov [esp],eaxmov eax,[esp-4]mov [esp+4],eaxpop eaxret
// 第三种1 长度：0xCmov dword ptr[esp-4],Addrjmp[esp - 4]         // 第三种2 长度：Cmov dword ptr[esp-4],Addrsub esp,4ret
// 第四种  长度：0x2Dpush eaxmov dword ptr[esp-4],Addrmov eax,[esp-4]mov [esp-8],eaxsub esp,4mov eax,[esp+4]mov [esp],eaxmov eax,[esp-4]mov [esp+4],eaxmov eax,[esp]add esp,8   //add esp,4jmp [esp-4] //ret
// 第五种  长度：0x34push Addrpush eaxmov eax,Addrmov eax,[esp]//push eaxmov eax,Addrpush eaxmov [esp-4],eaxmov eax,[esp+4]mov [esp],eaxmov eax,[esp-4]mov [esp+4],eaxpop eax//add esp,4pop eaxadd esp,4jmp [esp-4]
// 第六种（4+5） 长度：0x86push Addrpush eaxmov eax,Addrpush eaxmov dword ptr [esp-4],Addrmov eax,[esp-4]mov [esp-8],eaxsub esp,4mov eax,[esp+4]mov [esp],eaxmov eax,[esp-4]mov [esp+4],eaxmov eax,[esp]add esp,8   //add esp,4mov eax,[esp]push eaxmov eax,Addrpush eaxmov [esp-4],eaxmov eax,[esp+4]push eaxmov dword ptr[esp-4],Addrmov eax,[esp-4]mov [esp-8],eaxsub esp,4mov eax,[esp+4]mov [esp],eaxmov eax,[esp-4]mov [esp+4],eaxmov eax,[esp]add esp,8   //add esp,4mov [esp],eaxmov eax,[esp-4]mov [esp+4],eaxpop eaxadd esp,4pop eaxadd esp,4jmp [esp-4]
// 第7种  长度：0x59push Addrpush 0x7FFA08ACjmp [esp]nopnopnopnopnopnopnopnopnopnopnopnopnoppush ebpmov ebp,espadd esp,-34push ebxpush ecxpush eaxpush esipush edilea edi,[ebp-34h]mov ecx,Dmov eax,0x0CCCCCCCCrep stos dword ptr [edi]mov [ebp-4],ecxmov eax,[ebp+8]mov edx,dword ptr [esp+4]mov ecx,dword ptr [esp+8]mov dword ptr [ebp-30h],1mov edx,dword ptr [ebp-30h]mov dword ptr [ebp-34h],edxmov ecx,[ebp-4h]pop edipop esipop eaxpop ecxpop ebxleaveret
// 第8种  长度：0x42pushfdpush eaxmov eax, 4mul eaxlea eax, [4 * eax]mov[esp - 4], eaxmov eax, 4shl eax, 4sub eax, 4sub[esp - 4], eaxmov eax, [esp - 4]sub eax, 4mov[esp - 4], eaxpop eaxjne $ + 0x13call $+5add dword ptr [esp],0x13mov eax,[esp+4]mov [esp-4],eaxpopfdadd esp,4mov dword ptr[esp - 4], Addrsub esp, 4ret
// 第9种（7+8） 长度：0x99
// 第10种 长度：0x46pushfdpush eaxxor eax,Addrxor eax,64test eax,eax//push eaxmov eax,Addrpush eaxmov [esp-4],eaxmov eax,[esp+4]mov [esp],eaxmov eax,[esp-4]mov [esp+4],eaxpop eaxadd esp,4//xor eax,64xor eax,[esp]push eaxadd esp,8popfdsub esp,8pop eaxpop [esp-4]jmp [esp-C]7FFBDD3B pushfd + retn7FFAF6DF popfd + retnaddreaxfd

// 第1种 长度：0x2dpushfdnpush eaxnpush $1nadd dword ptr[esp], $2nshl dword ptr[esp], $3nxor dword ptr[esp], $4nadd dword ptr[esp], $5nxchg eax,[esp]nxchg eax,[esp+8]nxchg eax,[esp]npopfdnpop eaxnret 
// 第2种 长度：0x31push eaxnmov eax, $1nlea eax, [eax + $2]npush eaxnmov[esp - 4], eaxnmov eax, [esp + 4]nmov[esp], eaxnmov eax, dword ptr[esp - 4]npushfdnshl eax, $3nadd eax, $4nxor eax, $5npopfdnmov[esp + 4], eaxnpop eaxnret
// 第3种 长度：0x2fpushfdnpushfdnadd esp,8nmov dword ptr[esp - 4], $1nshl dword ptr[esp - 4], $2nadd dword ptr[esp - 4], $3nxor dword ptr[esp - 4], $4nadd dword ptr[esp - 4], $5nsub esp, 8npopfdnret
// 第4种 长度：0x65pushfdnpush eaxnmov dword ptr[esp - 4], $1nmov eax, [esp - 4]nmov[esp - 8], eaxnsub esp, 4nshl dword ptr[esp - 4], $2nmov eax, [esp + 4]nadd dword ptr[esp - 4], $3nmov dword ptr[esp], eaxnmov eax, [esp - 4]nmov[esp + 4], eaxnmov eax, [esp]nmov [esp-8],eaxnadd dword ptr[esp + 4], $4nxor dword ptr[esp + 4], $5nmov eax,[esp+4]nmov [esp-8],eaxnlea esp, [esp + 8]npopfdnlea esp,[esp-4]nmov eax,[esp-4]nmov [esp],eaxnmov eax,[esp-8]nret
// 第5种 长度：0x5dpushfdnpush $1npush eaxnmov eax, $2nmov eax, [esp]nshl dword ptr[esp + 4], $2npush eaxnmov eax, 1npush eaxnmov[esp - 4], eaxnmov eax, [esp + 4]nmov[esp], eaxnmov eax, [esp - 4]nmov[esp + 4], eaxnpop eaxnxor dword ptr[esp + 8], $3nadd esp, 4nmov eax, $4nadd eax, $5nadd dword ptr[esp + 4], eaxnpop eaxnadd esp,4npopfdnlea esp,[esp-4]nmov eax,[esp-4]nmov [esp],eaxnmov eax,[esp-8]nret
// 第6种 长度：0x82push $1npush eaxnmov eax, edinpush eaxnpushfdnpushfdnpushfdnadd esp, 0chnmov dword ptr[esp - 4], $3nmov eax, [esp - 4]nmov[esp - 8], eaxnsub esp, 4nmov eax, [esp + 4]nmov[esp], eaxnmov eax, [esp - 4]nmov[esp + 4], eaxnmov eax, [esp]nadd esp, 8nmov eax, [esp]nxor eax, [esp]nmov eax, [esp + 4]nadd eax, $2nxor eax, $3nmov[esp + 4], eaxnpush eaxnmov eax, $4npush eaxnmov[esp - 4], eaxnmov eax, [esp + 4]nmov[esp], eaxnmov eax, [esp - 4]nmov[esp + 4], eaxnpop eaxnadd esp, 4npop eaxnshl dword ptr[esp], $4nadd dword ptr[esp], $5nsub esp,14hnpopfdnlea esp,[esp + 10h]nret
// 第7种 长度：0x98push $1npush eaxnmov eax, $4npush eaxnmov[esp - 4], eaxnmov eax, [esp + 4]nmov[esp], eaxnmov eax, [esp - 4]nmov[esp + 4], eaxnpop eaxnlea esp, [esp + 4]nnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnpush ebpnmov ebp, espnlea esp, [esp - 34h]npushfdnpush ebxnpush ecxnpush eaxnpush esinpush edinpush edxnlea edi, [ebp - 34h]nmov ecx, 0xDnmov eax, 0x0CCCCCCCCnrep stos dword ptr[edi]nmov[ebp - 4], ecxnmov eax, [ebp + 8]nmov eax, ebpnmov edx, dword ptr[esp + 4]nmov ecx, [eax + 4]nadd ecx, $2nxchg ecx, edxnmov ecx, dword ptr[esp + 8]nmov dword ptr[ebp - 30h], 1nadd edx, $3nshl edx, $4nmov ecx, edxnmov edx, dword ptr[ebp - 30h]nxor ecx, $5nlea ebx, [eax + 4]nmov dword ptr[ebp - 34h], edxnmov [ebx], ecxnmov ecx, [ebp - 4h]npop edxnpop edinpop esinpop eaxnpop ecxnpop ebxnpopfdnleavenret
// 第8种 长度：0xafpushfdnpush $1npush eaxnpush edxnmov eax, 4nmul eaxnlea eax, [4 * eax]nmov[esp - 4], eaxnmov eax, 4nshl eax, 4nsub eax, 4nsub[esp - 4], eaxnmov eax, [esp - 4]nsub eax, 4nmov[esp - 4], eaxnpop edxnpop eaxnnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnnopnpush ebpnmov ebp, espnadd esp, -34hnpush edxnpush ebxnpush ecxnpush eaxnpush esinpush edinlea edi, [ebp - 34h]nmov ecx, 0xDnmov eax, 0xCCCCCCCCnrep stos dword ptr[edi]nmov[ebp - 4], ecxnmov eax, [ebp + 8]nmov edx, dword ptr[esp + 4]nmov ecx, dword ptr[ebp + 4]ntest edx, 3nlea ebx, [ebp + 8]nmov dword ptr[ebp - 30h], 1nmov edx, ecxnxor edx, $2nshl edx, $3nmov eax, edxnmov edx, dword ptr[ebp - 30h]nmov dword ptr[ebp - 34h], edxncmp dword ptr[ebp - 34h], 0nadd eax, $4nadd eax, $5n

1、长度 58push ebpmov ebp, esplea esp, [esp - 34h]push ecxpush edxpush ebxpush esipush edipushfdmov edi, fs: [30h]lea edi, [edi + 8h]mov edi, [edi]lea ebx, [ebp]mov ecx, edixchg edx, [ebp]add ecx, 3chmov ecx,[ecx]add edi, ecxcall $ + 5pop ecxlea edi,[edi + 74h]lea ecx,[ecx + 29h]sub ebp, 4mov[ebp], edxlea ebx,[ebp]mov[ebx + 4], ecxcmp edi, 12hje $ - 55hpopfdpop edipop esipop ebxpop edxpop ecxleaveretnopnopnopnopnopnopnop        2、长度 21push ebpmov ebp,espsub esp,-34hpushadmov edi,fs:[30h]lea edi,[edi+8h]mov edi,[edi]mov eax,edilea eax,[4*eax]push eaxpop edipopadleave
3、长度 21mov edi,edipush ebpmov ebp,esplea esp,[esp-22h]mov dword ptr [ebp-4h],ecxmov dword ptr [ebp-8h],ecxmov dword ptr [ebp-ch],ecxmov dword ptr [ebp-1ch],ecxmov esp,ebppop ebpjmp $+8nopnopnop
4、长度 42call $ +0x2Emov eax, eaxcall $ +0xBmov eax, eaxlea esp, [esp + 12]lea esp, [esp + 10h]mov eax, eaxmov eax, eaxcall $ +0x24mov eax, eaxmov eax, eaxcall $ +0x14mov eax, eaxlea esp, [esp - 4]call $ -0xDmov eax, eaxmov eax, eaxcall $ -0x30mov eax, eaxlea esp, [esp + 8h]
5、长度 42call $ +0x2Emov eax, eaxcall $ +0x37mov eax, eaxlea esp, [esp + 12]lea esp, [esp + 10h]mov eax, eaxmov eax, eaxcall $ +0x24mov eax, eaxmov eax, eaxcall $ +0x14mov eax, eaxlea esp, [esp - 4]call $ -0xDmov eax, eaxmov eax, eaxcall $ -0x30mov eax, eaxlea esp, [esp + 8h]