Skip to content

Commit dbdc2a8

Browse files
awengarawengar
committed
Added Hidden hash task (rev 250)
1 parent d1cfd9c commit dbdc2a8

File tree

8 files changed

+470
-0
lines changed

8 files changed

+470
-0
lines changed

‎HiddenHash/create/hhsh.elf

7.88 KB
Binary file not shown.

‎HiddenHash/create/make.sh

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
#!/bin/sh
2+
3+
g++ -m32 -o hhsh.elf task.cpp
4+
execstack -s hhsh.elf
5+

‎HiddenHash/create/parse_code.py

+51
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
#!/usr/bin/python
2+
import sys
3+
from re import *
4+
from scipy.fftpack import *
5+
6+
def getNum(s_num):
7+
tk = findall(r'\S\S',s_num)
8+
ssum=0
9+
for i in range(len(tk)):
10+
cc = int(tk[len(tk)-i-1],16)
11+
ssum = (ssum << 8) + cc
12+
return ssum
13+
def getProcCode(fn,fname):
14+
ff = open(fn,"r")
15+
seq=[]
16+
start=0
17+
for line in ff:
18+
if (fname in line) and ("ENDP" in line):
19+
start = 0
20+
if start == 1:
21+
if line[0] == ';':
22+
continue
23+
data = findall(r'\S{5}\s+(.+?)\t',line)
24+
print fname,"! ",data,hex(getNum(data[0]))
25+
seq.append(getNum(data[0]) * 1.0)
26+
27+
if (fname in line) and ("PROC" in line):
28+
start = 1
29+
ff.close();
30+
return seq
31+
32+
start = 0
33+
seq1 = getProcCode(sys.argv[1],"hash1")
34+
seq2 = getProcCode(sys.argv[1],"hash2")
35+
seq1=seq1[6:-5]
36+
seq2=seq2[6:-5]
37+
print seq1
38+
print seq2
39+
40+
dseq1 = dct(seq1,1)
41+
dseq2 = dct(seq2,1)
42+
print seq1
43+
print "double q1 [] = {"+",".join(map(str,dseq1))+"};"
44+
print "unsigned int q1_len = %d;" % len(dseq1)
45+
print map(lambda x:round(x/(2.0*(len(seq1)-1))),idct(dseq1,1))
46+
print seq2
47+
print "double q2 [] = {"+",".join(map(str,dseq2))+"};"
48+
print "unsigned int q2_len = %d;" % len(dseq2)
49+
print map(lambda x:round(x/(2.0*(len(seq2)-1))),idct(dseq2,1))
50+
51+

‎HiddenHash/create/task.cpp

+87
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,87 @@
1+
#include <stdio.h>
2+
#include <math.h>
3+
#include <string.h>
4+
#define PI 3.1415926535897932384626433832795
5+
double q1 [] = {255037122.0,21228535.6118,-31222210.0099,32787438.909,-67417641.7612,-74270237.8351,-20427819.8469,-6292819.17092,-16225114.2612,-20437144.9698,-28156796.7643,-34376782.6837,11241782.3525,115468022.912,4863824.80768,26436635.1965,62538224.0342,-33011432.1142,-39764910.7944,-8608542.09469,-3089987.61241,-11055025.7609,1304209.85595,-15692216.0};
6+
unsigned int q1_len = 24;
7+
double q2 [] = {254612100.0,14027280.6281,-18784685.5744,35210085.7106,-60778878.333,-54393839.4879,-31986439.8741,-28616874.5518,-15757295.0602,2670129.26556,-79931500.0356,-6838426.50206,68760875.0765,16732018.0,582881.752764,51517017.2399,4467959.98166,17323759.1217,29756440.1578,-33108393.768,52029323.5888,-23700083.7673,-108993287.426,-36736303.4412,29052879.7462,45939111.5525,11178756.0};
8+
unsigned int q2_len = 27;
9+
10+
11+
double MakeMagic (double * x,int k,int N){
12+
/*
13+
N-2
14+
y[k] = x[0] + (-1)**k x[N-1] + 2 * sum x[n]*cos(pi*k*n/(N-1))
15+
n=1
16+
*/
17+
double res = 0.0f;
18+
res = x[0];
19+
double oone=1.0;
20+
for (int i=0;i<k; i++)
21+
oone = oone * (-1.0);
22+
res = res + oone * x[N-1];
23+
for (int n=1; n<N-1;n++){
24+
res = res + 2.0*x[n] * cos(PI * k * 1.0 * n * 1.0 / (1.0*(N-1.0)));
25+
}
26+
res = res /(2*(N-1.0));
27+
return res;
28+
}
29+
void fix (long long int &cmd){
30+
if ((cmd & 0xFF00) == 0){
31+
cmd = cmd | 0xC300;
32+
33+
}
34+
else if ((cmd & 0xFF0000L) == 0){
35+
cmd = cmd | 0xC30000L;
36+
37+
}
38+
else if ((cmd & 0xFF000000L) == 0){
39+
cmd = cmd | 0xC3000000L;
40+
41+
}
42+
else if ((cmd & 0xFF00000000L) == 0){
43+
cmd = cmd | 0xC300000000L;
44+
45+
}
46+
else if ((cmd & 0xFF0000000000L) == 0){
47+
cmd = cmd | 0xC30000000000L;
48+
}
49+
}
50+
unsigned int getHash(double *data,unsigned int data_len,char * st){
51+
long long int cmd;
52+
void * ccmd = &cmd;
53+
unsigned int s_eax,s_ecx;
54+
for (int i=0; i<data_len; i++){
55+
double qw = MakeMagic(data,i,data_len);
56+
//printf("%f\n",qw);
57+
cmd = round(qw);
58+
//printf("%llx \n", cmd);
59+
fix(cmd);
60+
__asm__ __volatile__ ("mov %0,%%esi"::"m"(st));
61+
__asm__ __volatile__ ("mov %0,%%ecx"::"m"(s_ecx));
62+
__asm__ __volatile__ ("mov %0,%%eax"::"m"(s_eax));
63+
__asm__ __volatile__ ("lea %0,%%edi"::"m"(ccmd));
64+
__asm__ __volatile__ ("call *0x0(%edi)");
65+
__asm__ __volatile__ ("movl %%esi,%0":"=m"(st));
66+
__asm__ __volatile__ ("movl %%ecx,%0":"=m"(s_ecx));
67+
__asm__ __volatile__ ("movl %%eax,%0":"=m"(s_eax));
68+
69+
}
70+
return s_eax;
71+
}
72+
int main (int argc, char * argv[] ){
73+
if (argc <2){
74+
printf("Usage: <progname> <key>\n");
75+
return 0;
76+
}
77+
unsigned int hash1 = getHash(q1,q1_len,argv[1]);
78+
unsigned int hash2 = getHash(q2,q2_len,argv[1]);
79+
//printf("%x %x\n",hash1,hash2); bffeefac 213f522
80+
if (hash1 == 0xbffeefac && hash2 == 0x213f522){//53Kur3dh
81+
printf("Correct key: STCTF#%s#\n",argv[1]);
82+
}
83+
else{
84+
printf("Incorrect key\n");
85+
}
86+
return 0;
87+
}

‎HiddenHash/create/task_cod.cod

+211
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,211 @@
1+
; Listing generated by Microsoft (R) Optimizing Compiler Version 17.00.50727.1
2+
3+
TITLE C:\stepCTF\rev300\task_cod.cpp
4+
.686P
5+
.XMM
6+
include listing.inc
7+
.model flat
8+
9+
INCLUDELIB LIBCMT
10+
INCLUDELIB OLDNAMES
11+
12+
CONST SEGMENT
13+
$SG4305 DB '%x %x', 0aH, 00H
14+
CONST ENDS
15+
PUBLIC ?hash1@@YAIPAD@Z ; hash1
16+
PUBLIC ?hash2@@YAIPAD@Z ; hash2
17+
PUBLIC _main
18+
EXTRN _printf:PROC
19+
; Function compile flags: /Odtp
20+
_TEXT SEGMENT
21+
_argc$ = 8 ; size = 4
22+
_argv$ = 12 ; size = 4
23+
_main PROC
24+
; File c:\stepctf\rev300\task_cod.cpp
25+
; Line 85
26+
00000 55 push ebp
27+
00001 8b ec mov ebp, esp
28+
; Line 86
29+
00003 83 7d 08 01 cmp DWORD PTR _argc$[ebp], 1
30+
00007 7e 3d jle SHORT $LN1@main
31+
; Line 87
32+
00009 b8 04 00 00 00 mov eax, 4
33+
0000e c1 e0 00 shl eax, 0
34+
00011 8b 4d 0c mov ecx, DWORD PTR _argv$[ebp]
35+
00014 8b 14 01 mov edx, DWORD PTR [ecx+eax]
36+
00017 52 push edx
37+
00018 e8 00 00 00 00 call ?hash2@@YAIPAD@Z ; hash2
38+
0001d 83 c4 04 add esp, 4
39+
00020 50 push eax
40+
00021 b8 04 00 00 00 mov eax, 4
41+
00026 c1 e0 00 shl eax, 0
42+
00029 8b 4d 0c mov ecx, DWORD PTR _argv$[ebp]
43+
0002c 8b 14 01 mov edx, DWORD PTR [ecx+eax]
44+
0002f 52 push edx
45+
00030 e8 00 00 00 00 call ?hash1@@YAIPAD@Z ; hash1
46+
00035 83 c4 04 add esp, 4
47+
00038 50 push eax
48+
00039 68 00 00 00 00 push OFFSET $SG4305
49+
0003e e8 00 00 00 00 call _printf
50+
00043 83 c4 0c add esp, 12 ; 0000000cH
51+
$LN1@main:
52+
; Line 90
53+
00046 33 c0 xor eax, eax
54+
; Line 91
55+
00048 5d pop ebp
56+
00049 c3 ret 0
57+
_main ENDP
58+
_TEXT ENDS
59+
; Function compile flags: /Odtp
60+
_TEXT SEGMENT
61+
_key_val_ref$ = 8 ; size = 4
62+
?hash2@@YAIPAD@Z PROC ; hash2
63+
; File c:\stepctf\rev300\task_cod.cpp
64+
; Line 42
65+
00000 55 push ebp
66+
00001 8b ec mov ebp, esp
67+
00003 56 push esi
68+
; Line 45
69+
00004 51 push ecx
70+
; Line 46
71+
00005 56 push esi
72+
; Line 47
73+
00006 8b 75 08 mov esi, DWORD PTR _key_val_ref$[ebp]
74+
; Line 49
75+
00009 33 c9 xor ecx, ecx
76+
; Line 50
77+
0000b 8b 06 mov eax, DWORD PTR [esi]
78+
; Line 51
79+
0000d 33 c8 xor ecx, eax
80+
; Line 52
81+
0000f 80 f1 ac xor cl, -84 ; ffffffacH
82+
; Line 53
83+
00012 80 f5 fa xor ch, -6 ; fffffffaH
84+
; Line 54
85+
00015 c1 c9 08 ror ecx, 8
86+
; Line 55
87+
00018 80 f1 af xor cl, -81 ; ffffffafH
88+
; Line 56
89+
0001b 90 npad 1
90+
; Line 57
91+
0001c 80 f5 ca xor ch, -54 ; ffffffcaH
92+
; Line 58
93+
0001f c1 c9 08 ror ecx, 8
94+
; Line 60
95+
00022 8b 46 04 mov eax, DWORD PTR [esi+4]
96+
; Line 61
97+
00025 c1 c0 08 rol eax, 8
98+
; Line 62
99+
00028 33 c8 xor ecx, eax
100+
; Line 63
101+
0002a 80 f1 ef xor cl, -17 ; ffffffefH
102+
; Line 64
103+
0002d 90 npad 1
104+
; Line 65
105+
0002e 80 f5 5e xor ch, 94 ; 0000005eH
106+
; Line 66
107+
00031 c1 c9 08 ror ecx, 8
108+
; Line 67
109+
00034 80 f1 ac xor cl, -84 ; ffffffacH
110+
; Line 68
111+
00037 80 f5 fc xor ch, -4 ; fffffffcH
112+
; Line 69
113+
0003a c1 c9 08 ror ecx, 8
114+
; Line 71
115+
0003d 80 f1 45 xor cl, 69 ; 00000045H
116+
; Line 72
117+
00040 80 f5 65 xor ch, 101 ; 00000065H
118+
; Line 73
119+
00043 c1 c9 08 ror ecx, 8
120+
; Line 74
121+
00046 80 f1 65 xor cl, 101 ; 00000065H
122+
; Line 75
123+
00049 80 f5 24 xor ch, 36 ; 00000024H
124+
; Line 76
125+
0004c c1 c9 08 ror ecx, 8
126+
; Line 78
127+
0004f 8b c1 mov eax, ecx
128+
; Line 79
129+
00051 5e pop esi
130+
; Line 80
131+
00052 59 pop ecx
132+
; Line 82
133+
00053 5e pop esi
134+
00054 5d pop ebp
135+
00055 c3 ret 0
136+
?hash2@@YAIPAD@Z ENDP ; hash2
137+
_TEXT ENDS
138+
; Function compile flags: /Odtp
139+
_TEXT SEGMENT
140+
_key_val_ref$ = 8 ; size = 4
141+
?hash1@@YAIPAD@Z PROC ; hash1
142+
; File c:\stepctf\rev300\task_cod.cpp
143+
; Line 4
144+
00000 55 push ebp
145+
00001 8b ec mov ebp, esp
146+
00003 56 push esi
147+
; Line 7
148+
00004 51 push ecx
149+
; Line 8
150+
00005 56 push esi
151+
; Line 9
152+
00006 8b 75 08 mov esi, DWORD PTR _key_val_ref$[ebp]
153+
; Line 11
154+
00009 33 c9 xor ecx, ecx
155+
; Line 12
156+
0000b 8b 06 mov eax, DWORD PTR [esi]
157+
; Line 13
158+
0000d 33 c8 xor ecx, eax
159+
; Line 14
160+
0000f 80 f1 fe xor cl, -2 ; fffffffeH
161+
; Line 15
162+
00012 80 f5 ca xor ch, -54 ; ffffffcaH
163+
; Line 16
164+
00015 c1 c9 08 ror ecx, 8
165+
; Line 17
166+
00018 80 f1 be xor cl, -66 ; ffffffbeH
167+
; Line 18
168+
0001b 80 f5 ba xor ch, -70 ; ffffffbaH
169+
; Line 19
170+
0001e c1 c9 08 ror ecx, 8
171+
; Line 21
172+
00021 8b 46 04 mov eax, DWORD PTR [esi+4]
173+
; Line 22
174+
00024 33 c8 xor ecx, eax
175+
; Line 23
176+
00026 80 f1 7f xor cl, 127 ; 0000007fH
177+
; Line 24
178+
00029 80 f5 5c xor ch, 92 ; 0000005cH
179+
; Line 25
180+
0002c c1 c9 08 ror ecx, 8
181+
; Line 26
182+
0002f 80 f1 f5 xor cl, -11 ; fffffff5H
183+
; Line 27
184+
00032 80 f5 c7 xor ch, -57 ; ffffffc7H
185+
; Line 28
186+
00035 c1 c9 08 ror ecx, 8
187+
; Line 30
188+
00038 80 f1 96 xor cl, -106 ; ffffff96H
189+
; Line 31
190+
0003b 80 f5 83 xor ch, -125 ; ffffff83H
191+
; Line 32
192+
0003e c1 c9 08 ror ecx, 8
193+
; Line 33
194+
00041 80 f1 13 xor cl, 19 ; 00000013H
195+
; Line 34
196+
00044 80 f5 50 xor ch, 80 ; 00000050H
197+
; Line 35
198+
00047 c1 c9 08 ror ecx, 8
199+
; Line 37
200+
0004a 8b c1 mov eax, ecx
201+
; Line 38
202+
0004c 5e pop esi
203+
; Line 39
204+
0004d 59 pop ecx
205+
; Line 41
206+
0004e 5e pop esi
207+
0004f 5d pop ebp
208+
00050 c3 ret 0
209+
?hash1@@YAIPAD@Z ENDP ; hash1
210+
_TEXT ENDS
211+
END

0 commit comments

Comments
 (0)