quasar_reverse

Posted Jan 25, 2024 Updated Nov 12, 2024

By bamuwe

4 min read

  
bamuwe@bamuwe:~$ file quasar
quasar: ELF 64-bit LSB pie executable, x86-64, version 1 (SYSV), dynamically linked, interpreter /lib64/ld-linux-x86-64.so.2, BuildID[sha1]=00a219f57c37379e9a7d16a82edc8463bf5c4b8e, for GNU/Linux 4.4.0, stripped

64位程序

  
__int64 __fastcall main(int a1, char **a2, char **a3)
{
  char s1[80]; // [rsp+10h] [rbp-A8h] BYREF
  char s2[72]; // [rsp+60h] [rbp-58h] BYREF
  unsigned __int64 v6; // [rsp+A8h] [rbp-10h]

  v6 = __readfsqword(0x28u);
  if ( a1 == 2 )			//判断命令行输入参数个数是否等于2
  {
    sub_1219(s1);			//生成s1
    sub_1414(s1, s1);					//对s1进行加密
    sub_1414(a2[1], s2);				//对s2(~输入)进行相同的加密
    if ( !strcmp(s1, s2) )			//检查点
      system("/scripts/print.sh");
    else
      printf(&byte_2038);
  }
  else
  {
    puts("Uso: ./Quasar <password>");
  }
  return 0LL;
}

main函数伪代码

s1没有现成的数据,我们需要得到程序运行过程中生成的s1,简单分析发现s1在sub_1219(s1);函数中生成

  
__int64 __fastcall sub_1219(__int64 a1)
{
  double v1; // xmm0_8
  double v2; // xmm0_8
  int v3; // eax
  __int64 result; // rax
  double v5; // [rsp+8h] [rbp-30h]
  double v6; // [rsp+8h] [rbp-30h]
  double v7; // [rsp+8h] [rbp-30h]
  int i; // [rsp+20h] [rbp-18h]
  int j; // [rsp+24h] [rbp-14h]
  double v10; // [rsp+28h] [rbp-10h]

  for ( i = 0; i <= 9; ++i )
  {
    v10 = 0.0;
    for ( j = 0; j <= 4; ++j )
    {
      v1 = sin(3.141592653589793 * i / 3.0 + j);
      v5 = pow(v1, 2.0);
      v6 = log((i + j + 3)) * v5;
      v2 = sqrt((i + j + 1));
      v7 = exp(v2) + v6;
      v3 = i + j + 1;
      if ( (i + j) < 0xFFFFFFFE && i + j != 0 )
        v3 = 0;
      v10 = tgamma((i + j + 1)) * v3 + v7 + v10;
    }
    *(i + a1) = (100.0 * v10) % 10 + 48;
  }
  result = a1 + 10;
  *(a1 + 10) = 0;
  return result;
}