in reversing/matryoshka/src/gen_downloader.c [132:233]
int main(int argc, char** argv)
{
int psocket;
void * response_data = NULL;
void * shellcode1 = NULL;
void * shellcode2 = NULL;
int ret = 0;
uint64_t flag_integer, png_offset, png_offset2, A, B, C;
uint32_t D;
uint64_t VERIFY, VERIFYA, VERIFYB, VERIFYC, VERIFYD;
unsigned char flag_text[] = FLAG_TEXT;
unsigned char final_flag[FINAL_FLAG_LEN+1] = FLAG;
unsigned char key[FLAG_SIZE+2];
send_request(&psocket);
receive_response(&psocket, &response_data);
close(psocket);
png_offset = check_png_header(response_data);
if (png_offset == 0)
exit(EXIT_FAILURE);
/* prepare rot13 shellcode */
shellcode1 = mmap(
NULL,
SHELLCODE_SIZE,
PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_ANON|MAP_PRIVATE,
-1,0);
memcpy(shellcode1, (response_data+png_offset), SHELLCODE_SIZE);
uint64_t(*sc1)(uint64_t) = (uint64_t(*)(uint64_t))shellcode1;
png_offset2 = sc1(0);
munmap(shellcode1, SHELLCODE_SIZE);
/* prepare cipher shellcode */
shellcode2 = mmap(
NULL,
SHELLCODE_SIZE,
PROT_READ|PROT_WRITE|PROT_EXEC,
MAP_ANON|MAP_PRIVATE,
-1,0);
memcpy(
shellcode2,
(response_data+png_offset+png_offset2),
SHELLCODE_SIZE);
uint64_t(*sc2)(uint64_t) = (uint64_t(*)(uint64_t))shellcode2;
flag_integer = sc2(0);
munmap(shellcode2, SHELLCODE_SIZE);
munmap(response_data, MAX_MMAP_SIZE);
VERIFY = bswap_64(flag_integer);
__asm__(
"movq $0x2000004, %%rax \n\t"
"movq $1, %%rdi \n\t"
"movq %1, %%rsi \n\t"
"movl $24, %%edx \n\t"
"syscall \n\t"
: "=g"(ret)
: "g"(&flag_text));
__asm__(
"movq $0x2000003, %%rax \n\t"
"movq $0, %%rdi \n\t"
"movq %1, %%rsi \n\t"
"movl $30, %%edx \n\t"
"syscall \n\t"
: "=g"(ret)
: "g"(&key));
for (int i= 7; i >= 0; i--)
A = A << 8 | (uint64_t)key[i];
for (int i= 15; i >= 8; i--)
B = (B << 8) | (uint64_t)key[i];
for (int i= 23; i >= 16; i--)
C = (C << 8) | (uint64_t)key[i];
for (int i= 27; i >= 24; i--)
D = (D << 8) | (uint32_t)key[i];
VERIFYA = A ^ B;
VERIFYB = B ^ C;
VERIFYC = C ^ D;
VERIFYD = D ^ SEED;
if (VERIFY_INTA == VERIFYA && \
VERIFY_INTB == VERIFYB && \
VERIFY_INTC == VERIFYC && \
VERIFYD == VERIFY)
{
for (int i= 3, j= 0; i < FINAL_FLAG_LEN-1; i++, j++)
{
final_flag[i] = key[j];
}
final_flag[FINAL_FLAG_LEN] = '\n';
printf("\n%s\n", final_flag);
printf("\nCongratulations!!\n");
printf("Created by @malwareunicorn\n");
}
else
{
printf("\nDOH!! try harder :( \n");
}
exit(EXIT_SUCCESS);
}