1
.text:00401804 ; [00000001 BYTES: COLLAPSED FUNCTION nullsub_1]
2
.text:00401805 ; ---------------------------------------------------------------------------
3
.text:00401805                 push    ebp
4
.text:00401806                 mov     ebp, esp
5
.text:00401808                 sub     esp, 0C8h
6
.text:0040180E                 nop
7

8
...
9

10
.text:00402872                 sub     esp, 8
11
.text:00402878                 fstp    qword ptr [esp+0]
12
.text:0040287C                 call    sub_4032F1
13
.text:00402881                 add     esp, 8
14
.text:00402884                 and     eax, 0FFh
15
.text:0040288A                 cmp     eax, 36h ; '6'
16
.text:0040288D                 jz      loc_40289D
17
.text:00402893                 mov     eax, 0
18
.text:00402898                 jmp     locret_4028A2
19
.text:0040289D ; ---------------------------------------------------------------------------
20
.text:0040289D
21
.text:0040289D loc_40289D:                             ; CODE XREF: .text:0040288D↑j
22
.text:0040289D                 mov     eax, 1
23
.text:004028A2
24
.text:004028A2 locret_4028A2:                          ; CODE XREF: .text:004018B3↑j
25
.text:004028A2                                         ; .text:00401959↑j ...
26
.text:004028A2                 leave
27
.text:004028A3                 retn
28
.text:004028A4

1
import struct
2
from typing import Dict, List, Tuple
3

4
from unicorn import Uc, UC_ARCH_X86, UC_MODE_32, UC_HOOK_CODE, UcError
5
from unicorn.x86_const import UC_X86_REG_EAX, UC_X86_REG_EBP, UC_X86_REG_EIP, UC_X86_REG_ESP
6
import pefile
7

8
PE_PATH = "problem.exe"
9

10
CMP_INFO: List[Tuple[int, int, int]] = [
11
    (0x4018A2, 0x98, 23),
12
    (0x40194B, 0x30, 15),
13
    (0x4019F1, 0xBC, 16),
14
    (0x401A9A, 0xAE,  9),
15
    (0x401B43, 0xE7, 20),
16
    (0x401BEC, 0x6D,  5),
17
    (0x401C92, 0x48, 24),
18
    (0x401D38, 0xBA, 17),
19
    (0x401DE1, 0x30,  2),
20
    (0x401E87, 0xA8,  3),
21
    (0x401F30, 0xBB,  4),
22
    (0x401FD9, 0x8D, 22),
23
    (0x402082, 0x0E, 11),
24
    (0x402128, 0x05,  8),
25
    (0x4021CE, 0x2F, 12),
26
    (0x402272, 0x1E,  1),
27
    (0x40231E, 0xC4,  7),
28
    (0x4023CD, 0x25, 13),
29
    (0x402479, 0xCD, 21),
30
    (0x402528, 0x79, 19),
31
    (0x4025D1, 0xF8,  0),
32
    (0x402680, 0x17, 10),
33
    (0x40272C, 0xAC, 18),
34
    (0x4027DB, 0xB1, 14),
35
    (0x40288A, 0x36,  6),
36
]
37

38

39
def load_binary() -> Tuple[Uc, int, bytes, List[pefile.SectionStructure]]:
40
    pe = pefile.PE(PE_PATH)
41
    base = pe.OPTIONAL_HEADER.ImageBase
42
    sections = list(pe.sections)
43

44
    with open(PE_PATH, "rb") as f:
45
        blob = f.read()
46

47
    max_va = 0
48
    for sec in sections:
49
        va = base + sec.VirtualAddress
50
        size = sec.Misc_VirtualSize
51
        limit = va + ((size + 0xFFF) & ~0xFFF)
52
        max_va = max(max_va, limit)
53

54
    mem_size = (max_va - base) + 0x1000
55

56
    uc = Uc(UC_ARCH_X86, UC_MODE_32)
57
    uc.mem_map(base, mem_size)
58

59
    for sec in sections:
60
        va = base + sec.VirtualAddress
61
        raw = sec.PointerToRawData
62
        size = sec.SizeOfRawData
63
        uc.mem_write(va, blob[raw:raw + size])
64

65
    return uc, base, blob, sections
66

67

68
def prepare_context(uc: Uc, base: int, flag: bytes) -> int:
69
    stack_top = 0x900000
70
    stack_size = 0x20000
71
    uc.mem_map(stack_top - stack_size, stack_size)
72

73
    inp_addr = 0x800000
74
    uc.mem_map(inp_addr, 0x1000)
75
    uc.mem_write(inp_addr, flag + b"\x00")
76

77
    esp = stack_top - 0x10
78
    uc.mem_write(esp, struct.pack("<I", 0xDEADBEEF))
79
    uc.mem_write(esp + 4, struct.pack("<I", inp_addr))
80
    uc.reg_write(UC_X86_REG_ESP, esp)
81
    uc.reg_write(UC_X86_REG_EBP, 0)
82
    uc.reg_write(UC_X86_REG_EIP, 0x401805)
83

84
    return inp_addr
85

86

87
def run_with_flag(flag: bytes, force_expected: bool = False) -> Dict[int, int]:
88
    uc, base, _, _ = load_binary()
89
    prepare_context(uc, base, flag)
90

91
    cmp_map = {addr: expected for addr, expected, _ in CMP_INFO}
92
    observed: Dict[int, int] = {}
93

94
    def hook(emu: Uc, address: int, size: int, user_data: object) -> None:
95
        if address in cmp_map and address not in observed:
96
            eax = emu.reg_read(UC_X86_REG_EAX) & 0xFF
97
            observed[address] = eax
98
            if force_expected:
99
                emu.reg_write(UC_X86_REG_EAX, cmp_map[address])
100

101
    uc.hook_add(UC_HOOK_CODE, hook)
102
    try:
103
        uc.emu_start(0x401805, 0x4028A4)
104
    except UcError:
105
        pass
106

107
    return observed
108

109

110
def brute_force_flag() -> str:
111
    cmp_order = [addr for addr, _, _ in CMP_INFO]
112
    mapping: List[Dict[int, int]] = [dict() for _ in CMP_INFO]
113

114
    for byte in range(256):
115
        flag = bytes([byte]) * 25
116
        observed = run_with_flag(flag, force_expected=True)
117
        values = [observed.get(addr, None) for addr in cmp_order]
118
        if None in values:
119
            raise RuntimeError("Failed to record all cmp values.")
120
        for idx, val in enumerate(values):
121
            mapping[idx][val] = byte
122

123
    recovered = ["?"] * 25
124
    for idx, (addr, expected, pos) in enumerate(CMP_INFO):
125
        guess = mapping[idx].get(expected)
126
        if guess is None:
127
            raise RuntimeError(f"No byte matched cmp at {addr:#x}.")
128
        recovered[pos] = chr(guess)
129

130
    return "".join(recovered)
131

132

133
def main() -> None:
134
    flag = brute_force_flag()
135
    print("Recovered flag:", flag)
136

137
    observed = run_with_flag(flag.encode(), force_expected=False)
138
    for addr, expected, _ in CMP_INFO:
139
        if observed.get(addr) != expected:
140
            raise RuntimeError("Validation failed.")
141
    print("Validation passed.")
142

143

144
if __name__ == "__main__":
145
    main()

1
python3 solve.py
2
Recovered flag: hspace{d8a928b2043db77e3}
3
Validation passed.