ewrok01 - 超级玉米人的博客

超级玉米人

公告

欢迎来到我的博客！这里将分享我的日常与技术学习笔记。~(∠・ω< )⌒★

Learn More

标签

超级玉米人

公告

欢迎来到我的博客！这里将分享我的日常与技术学习笔记。~(∠・ω< )⌒★

Learn More

标签

超级玉米人

公告

欢迎来到我的博客！这里将分享我的日常与技术学习笔记。~(∠・ω< )⌒★

Learn More

标签

646 字

2 分钟

ewrok01

2025-10-22

ctf

/

c

/

pwn

3. 现在有一段神秘的伪代码，但是不用管这个函数实现了啥功能，根据上面回复出来的伪代码与下面没有进行回复的代码进行比较，恢复这个名为VM的结构体,结构如下:#

1
struct VM
2
{
3
  unsigned char mem[4096];
4

5
  unsigned short stack[256];
6
  unsigned short pc；
7
  unsigned short sp；
8
  unsigned short flags；
9

10
  unsigned short reg[3];
11
}

代码1

1
unsigned __int16 __fastcall vm::step(VM *this)
2
{
3
  unsigned int n0xFC; // eax
4
  unsigned __int16 v2; // dx
5
  unsigned __int16 sp; // ax
6
  unsigned __int16 v4; // cx
7
  unsigned __int16 v5; // cx
8
  unsigned __int16 v6; // ax
9
  unsigned __int16 result; // ax
10
  unsigned __int16 v8; // [rsp+1Eh] [rbp-2h]
11

12
  v8 = this->regs[this->mem[this->pc + 2]];
13
  n0xFC = this->mem[this->pc];
14
  if ( n0xFC > 0xFC )
15
    return 0;
16
  if ( this->mem[this->pc] < 0xB0u )
17
  {
18
    if ( this->mem[this->pc] <= 0xA0u )
19
    {
20
      if ( this->mem[this->pc] >= 0x80u )
21
      {
22
        switch ( this->mem[this->pc] )
23
        {
24
          case 0x80u:
25
            this->regs[this->mem[this->pc + 1]] = v8;
26
            this->pc += 3;
27
            break;
28
          case 0x81u:
29
            this->regs[this->mem[this->pc + 1]] = (this->mem[this->pc + 3] << 8) | this->mem[this->pc + 2];
30
            this->pc += 4;
31
            break;
32
          case 0x90u:
33
            this->regs[this->mem[this->pc + 1]] += v8;
34
            this->pc += 3;
35
            break;
36
          case 0x91u:
37
            this->regs[this->mem[this->pc + 1]] += this->mem[this->pc + 2] | (this->mem[this->pc + 3] << 8);
38
            this->pc += 4;
39
            break;
40
          case 0xA0u:
41
            this->regs[this->mem[this->pc + 1]] -= v8;
42
            this->pc += 3;
43
            break;
44
          default:
45
            return 0;
46
        }
47
      }
48
      else if ( n0xFC == 0x4C )
49
      {
50
        sp = this->sp;
51
        this->sp = sp - 1;
52
        this->regs[this->mem[this->pc + 1]] = this->stack[sp]; /// STACK !!!!!!!!!!!
53
        this->pc += 2;
54
      }
55
      else if ( this->mem[this->pc] <= 0x4Cu )
56
      {
57
        if ( this->mem[this->pc] > 0x29u )
58
        {
59
          if ( n0xFC == 0x48 )
60
          {
61
            v2 = this->regs[this->mem[this->pc + 1]];
62
            this->stack[++this->sp] = v2;
63
            this->pc += 2;
64
          }
65
        }
66
        else if ( this->mem[this->pc] >= 8u )
67
        {
68
          switch ( this->mem[this->pc] )
69
          {
70
            case 8u:
71
              this->regs[this->mem[this->pc + 1]] = this->mem[v8];
72
              this->pc += 3;
73
              break;
74
            case 0xAu:
75
              this->regs[this->mem[this->pc + 1]] = (this->mem[v8 + 1] << 8) | this->mem[v8];
76
              this->pc += 3;
77
              break;
78
            case 0x18u:
79
              this->mem[this->regs[this->mem[this->pc + 1]]] = v8;
80
              this->pc += 3;
81
              break;
82
            case 0x1Au:
83
              this->mem[this->regs[this->mem[this->pc + 1]]] = v8;
84
              this->mem[this->regs[this->mem[this->pc + 1]] + 1] = HIBYTE(v8);
85
              this->pc += 3;
86
              break;
87
            case 0x28u:
88
              this->flags = v8 == this->regs[this->mem[this->pc + 1]];
89
              this->pc += 3;
90
              break;
91
            case 0x29u:
92
              this->flags = this->regs[this->mem[this->pc + 1]] == (this->mem[this->pc + 2]
93
                                                                  | (this->mem[this->pc + 3] << 8));
94
              this->pc += 4;
95
              break;
96
            default:
97
              return 0;
98
          }
99
        }
100
      }
101
    }
102
    return 0;
103
  }
104
  switch ( this->mem[this->pc] )
105
  {
106
    case 0xB0u:
107
      this->regs[this->mem[this->pc + 1]] ^= v8;
108
      this->pc += 3;
109
      return 0;
110
    case 0xC1u:                           //  uint16        |
111
      this->regs[this->mem[this->pc + 1]] *= this->mem[this->pc + 2] | (unsigned __int16)(this->mem[this->pc + 3] << 8);
112
      this->pc += 4;
113
      return 0;
114
    case 0xE0u:
115
      this->pc = this->mem[this->pc + 1] | (this->mem[this->pc + 2] << 8);
116
      return 0;
117
    case 0xE8u:
118
      if ( this->flags )
119
        this->pc = this->mem[this->pc + 1] | (this->mem[this->pc + 2] << 8);
120
      else
121
        this->pc += 3;
122
      return 0;
123
    case 0xECu:
124
      if ( this->flags )
125
        this->pc += 3;
126
      else
127
        this->pc = this->mem[this->pc + 1] | (this->mem[this->pc + 2] << 8);
128
      return 0;
129
    case 0xEEu:
130
      v4 = this->pc + 2;
131
      this->stack[++this->sp] = v4;
132
      this->pc = this->regs[this->mem[this->pc + 1]];
133
      return 0;
134
    case 0xEFu:
135
      v5 = this->pc + 3;
136
      this->stack[++this->sp] = v5;
137
      this->pc = this->mem[this->pc + 1] | (this->mem[this->pc + 2] << 8);
138
      return 0;
139
    case 0xF0u:
140
      v6 = this->sp;
141
      this->sp = v6 - 1;
142
      this->pc = this->stack[v6];
143
      return 0;
144
    case 0xF8u:
145
      result = -1;
146
      break;
147
    case 0xFCu:
148
      if ( this->regs[0] )
149
        this->regs[0] = read(0, &this->mem[this->regs[1]], this->regs[2]);
150
      else
151
        write(1, &this->mem[this->regs[1]], this->regs[2]);
152
      ++this->pc;
153
      return 0;
154
    default:
155
      return 0;
156
  }
157
  return result;
158
}

代码2

1
unsigned __int16 __fastcall vm::step(unsigned __int8 *this)
2
{
3
  unsigned int n0xFC; // eax
4
  __int16 v2; // dx
5
  unsigned __int16 v3; // ax
6
  __int16 v4; // cx
7
  __int16 v5; // cx
8
  unsigned __int16 v6; // ax
9
  unsigned __int16 result; // ax
10
  unsigned __int16 v8; // [rsp+1Eh] [rbp-2h]
11

12
  v8 = *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 2) + 2307);
13
  n0xFC = *(this + *((unsigned __int16 *)this + 2304));
14
  if ( n0xFC > 0xFC )
15
    return 0;
16
  if ( *(this + *((unsigned __int16 *)this + 2304)) < 0xB0u )
17
  {
18
    if ( *(this + *((unsigned __int16 *)this + 2304)) <= 0xA0u )
19
    {
20
      if ( *(this + *((unsigned __int16 *)this + 2304)) >= 0x80u )
21
      {
22
        switch ( *(this + *((unsigned __int16 *)this + 2304)) )
23
        {
24
          case 0x80u:
25
            *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) = v8;
26
            *((_WORD *)this + 2304) += 3;
27
            break;
28
          case 0x81u:
29
            *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) = (*(this
30
                                                                                          + *((unsigned __int16 *)this
31
                                                                                            + 2304)
32
                                                                                          + 3) << 8)
33
                                                                                       | *(this
34
                                                                                         + *((unsigned __int16 *)this
35
                                                                                           + 2304)
36
                                                                                         + 2);
37
            *((_WORD *)this + 2304) += 4;
38
            break;
39
          case 0x90u:
40
            *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) += v8;
41
            *((_WORD *)this + 2304) += 3;
42
            break;
43
          case 0x91u:
44
            *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) += *(this
45
                                                                                          + *((unsigned __int16 *)this
46
                                                                                            + 2304)
47
                                                                                          + 2)
48
                                                                                        | (*(this
49
                                                                                           + *((unsigned __int16 *)this
50
                                                                                             + 2304)
51
                                                                                           + 3) << 8);
52
            *((_WORD *)this + 2304) += 4;
53
            break;
54
          case 0xA0u:
55
            *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) -= v8;
56
            *((_WORD *)this + 2304) += 3;
57
            break;
58
          default:
59
            return 0;
60
        }
61
      }
62
      else if ( n0xFC == 0x4C )
63
      {
64
        v3 = *((_WORD *)this + 2305);
65
        *((_WORD *)this + 2305) = v3 - 1;
66
        *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) = *((_WORD *)this + v3 + 2048);
67
        *((_WORD *)this + 2304) += 2;
68
      }
69
      else if ( *(this + *((unsigned __int16 *)this + 2304)) <= 0x4Cu )
70
      {
71
        if ( *(this + *((unsigned __int16 *)this + 2304)) > 0x29u )
72
        {
73
          if ( n0xFC == 0x48 )
74
          {
75
            v2 = *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307);
76
            *((_WORD *)this + (unsigned __int16)++*((_WORD *)this + 2305) + 2048) = v2;
77
            *((_WORD *)this + 2304) += 2;
78
          }
79
        }
80
        else if ( *(this + *((unsigned __int16 *)this + 2304)) >= 8u )
81
        {
82
          switch ( *(this + *((unsigned __int16 *)this + 2304)) )
83
          {
84
            case 8u:
85
              *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) = *(this + v8);
86
              *((_WORD *)this + 2304) += 3;
87
              break;
88
            case 0xAu:
89
              *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) = (*(this + v8 + 1) << 8)
90
                                                                                         | *(this + v8);
91
              *((_WORD *)this + 2304) += 3;
92
              break;
93
            case 0x18u:
94
              *(this + *((unsigned __int16 *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307)) = v8;
95
              *((_WORD *)this + 2304) += 3;
96
              break;
97
            case 0x1Au:
98
              *(this + *((unsigned __int16 *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307)) = v8;
99
              *(this + *((unsigned __int16 *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) + 1) = HIBYTE(v8);
100
              *((_WORD *)this + 2304) += 3;
101
              break;
102
            case 0x28u:
103
              *((_WORD *)this + 2306) = v8 == *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307);
104
              *((_WORD *)this + 2304) += 3;
105
              break;
106
            case 0x29u:
107
              *((_WORD *)this + 2306) = *((unsigned __int16 *)this
108
                                        + *(this + *((unsigned __int16 *)this + 2304) + 1)
109
                                        + 2307) == (*(this + *((unsigned __int16 *)this + 2304) + 2)
110
                                                  | (*(this + *((unsigned __int16 *)this + 2304) + 3) << 8));
111
              *((_WORD *)this + 2304) += 4;
112
              break;
113
            default:
114
              return 0;
115
          }
116
        }
117
      }
118
    }
119
    return 0;
120
  }
121
  switch ( *(this + *((unsigned __int16 *)this + 2304)) )
122
  {
123
    case 0xB0u:
124
      *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) ^= v8;
125
      *((_WORD *)this + 2304) += 3;
126
      return 0;
127
    case 0xC1u:
128
      *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) *= *(this
129
                                                                                    + *((unsigned __int16 *)this + 2304)
130
                                                                                    + 2)
131
                                                                                  | (unsigned __int16)(*(this + *((unsigned __int16 *)this + 2304) + 3) << 8);
132
      *((_WORD *)this + 2304) += 4;
133
      return 0;
134
    case 0xE0u:
135
      *((_WORD *)this + 2304) = *(this + *((unsigned __int16 *)this + 2304) + 1)
136
                              | (*(this + *((unsigned __int16 *)this + 2304) + 2) << 8);
137
      return 0;
138
    case 0xE8u:
139
      if ( *((_WORD *)this + 2306) )
140
        *((_WORD *)this + 2304) = *(this + *((unsigned __int16 *)this + 2304) + 1)
141
                                | (*(this + *((unsigned __int16 *)this + 2304) + 2) << 8);
142
      else
143
        *((_WORD *)this + 2304) += 3;
144
      return 0;
145
    case 0xECu:
146
      if ( *((_WORD *)this + 2306) )
147
        *((_WORD *)this + 2304) += 3;
148
      else
149
        *((_WORD *)this + 2304) = *(this + *((unsigned __int16 *)this + 2304) + 1)
150
                                | (*(this + *((unsigned __int16 *)this + 2304) + 2) << 8);
151
      return 0;
152
    case 0xEEu:
153
      v4 = *((_WORD *)this + 2304) + 2;
154
      *((_WORD *)this + (unsigned __int16)++*((_WORD *)this + 2305) + 2048) = v4;
155
      *((_WORD *)this + 2304) = *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307);
156
      return 0;
157
    case 0xEFu:
158
      v5 = *((_WORD *)this + 2304) + 3;
159
      *((_WORD *)this + (unsigned __int16)++*((_WORD *)this + 2305) + 2048) = v5;
160
      *((_WORD *)this + 2304) = *(this + *((unsigned __int16 *)this + 2304) + 1)
161
                              | (*(this + *((unsigned __int16 *)this + 2304) + 2) << 8);
162
      return 0;
163
    case 0xF0u:
164
      v6 = *((_WORD *)this + 2305);
165
      *((_WORD *)this + 2305) = v6 - 1;
166
      *((_WORD *)this + 2304) = *((_WORD *)this + v6 + 2048);
167
      return 0;
168
    case 0xF8u:
169
      result = -1;
170
      break;
171
    case 0xFCu:
172
      if ( *((_WORD *)this + 2307) )
173
        *((_WORD *)this + 2307) = read(0, this + *((unsigned __int16 *)this + 2308), *((unsigned __int16 *)this + 2309));
174
      else
175
        write(1, this + *((unsigned __int16 *)this + 2308), *((unsigned __int16 *)this + 2309));
176
      ++*((_WORD *)this + 2304);
177
      return 0;
178
    default:
179
      return 0;
180
  }
181
  return result;
182
}

通过分析

1
  unsigned int n0xFC; // eax
2
  __int16 v2; // dx
3
  unsigned __int16 v3; // ax
4
  __int16 v4; // cx
5
  __int16 v5; // cx
6
  unsigned __int16 v6; // ax
7
  unsigned __int16 result; // ax
8
  unsigned __int16 v8; // [rsp+1Eh] [rbp-2h]

和结构体各个变量的交互发现结构体VM中存在pc sp flags stack[] regs[] mem[] 这6个成员

通过程序基传入指针this 进行指针运算发现推测该this指针为传入VM参数的基地址先推出pc sp flags 所在相对于基地址的偏移量,

pc:

从程序

1
this->pc += 2;
2
*((_WORD *)this + 2304) += 2;

发现 this->pc 等价于*((_WORD *)this + 2304)，所以可以知道 2034 为 pc 相当于基地址的偏移量

sp: 从程序

1
v6 = this->sp;
2
v6 = *((_WORD *)this + 2305);

同理发现 sp 的偏移量为 2305

flags:

1
this->flags = v8 == this->regs[this->mem[this->pc + 1]];
2
*((_WORD *)this + 2306) = v8 == *((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307);

同理发现 flags 的偏移量是 2306

stack: 程序

1
this->stack[sp];
2
*((_WORD *)this + 2305 + 2048);
3

4
this->regs[this->mem[this->pc + 1]] = this->stack[sp];
5
*((_WORD *)this + *(this + *((unsigned __int16 *)this + 2304) + 1) + 2307) = *((_WORD *)this + 2305 + 2048);
6

7
...

发现所有关于 stack的访问存在2048这个数字，由此可以知道 2048 是 stack的基址, 而他到最近的pc(2304) 相差 256，也符合栈的所以stack大小为 256,

mem:

通过

1
n0xFC = *(this + *((unsigned __int16 *)this + 2304));
2
n0xFC = this->mem[this->pc];

发现 mem是从 0 开始的,到最近的 stack(2048) 结束,但是通过代码中reg 的赋值为

1
this->regs[this->mem[this->pc + 1]] = (this->mem[this->pc + 3] << 8) | this->mem[this->pc + 2];

发现: 存放一个 regs[i] 的存放需要两个 mem 分别放在高8，和低8位，而regs[i] 的类型是 uint16(16位) 所以合理猜测 mem 的类型为uint8(8位), 所以 0-2048 一共占用 4096 个字节, 而一个 uint8 占用一个字节所以mem 的长度 4096

regs:

1
*((_WORD *)this + 2307)
2
this->regs[0]

通过以上代码发现 regs[0] 的地址是 2307, 但是没有找到明显的边界,但是确定regs的长度一定大于等于3

汇总以上信息

1
0:      uint8  -> unsigned char mem[4096]
2

3
2048:   uint16 -> unsigned short stack[256]
4
2304:   uint16 -> unsigned short pc
5
2305:   uint16 -> unsigned short sp
6
2306:   uint16 -> unsigned short flags
7

8
2307:   uint16 -> unsigned short reg[3+]

由于最后一个reg 看不出所以需要自己补上从表达式

1
this->regs[this->mem[this->pc + 1]] ^= v8;

发现理论上 this->mem 的值为 0~255 一共256个值所以 regs 在设计上应该也要能装下这些索引，所以 reg的大小应该为 256

所以最终得到的结果是

1
struct VM
2
{
3
  unsigned char mem[4096];
4

5
  unsigned short stack[256];
6
  unsigned short pc；
7
  unsigned short sp；
8
  unsigned short flags；
9

10
  unsigned short reg[256];
11
}

1. 定义一个字符串，实现一个功能要求输入字符串可以输出字符串的长度，不要使用strlen等函数#

实现效果如下:

1
input:10d2n821 ma&@&@ 93cdw1!
2
string Length:24

由于C语言中的字符串是以\0 为结尾的所以通过这个特性我们可以实现字符串长度的获取

1
size_t mystrlen(char* arr)
2
{
3
  int l = 0;
4
  char* ptr = arr;
5
  while(*(ptr++) != '\0')
6
  {
7
    l++;
8
  }
9
  return l;
10
}
11

12
int main(void)
13
{
14
  char* input_str = (char*)malloc(sizeof(char) * 1000);
15

16
  printf("input:");
17
  if(fgets(input_str, sizeof(char) * 1000, stdin))
18
  {
19
    printf("string Length: %d", mystrlen(input_str));
20
  }
21
  free(input_str);
22
  return 0;
23

24
}

IMPORTANT
注意：这里不适用scanf 是因为scanf 在读取到空白符制表符和换行符等，会直接截断

如果这篇文章对你有帮助，欢迎分享给更多人！

ewrok01

https://yoyolp.github.io/posts/other/ework01/

作者

超级玉米人

发布于

2025-10-22

许可协议

CC BY-NC-SA 4.0

部分信息可能已经过时

day7

正则表达式速查表

超级玉米人の部屋

3. 现在有一段神秘的伪代码，但是不用管这个函数实现了啥功能，根据上面回复出来的伪代码与下面没有进行回复的代码进行比较，恢复这个名为VM的结构体,结构如下:#

1. 定义一个字符串，实现一个功能要求输入字符串可以输出字符串的长度，不要使用strlen等函数#

目录