main.cpp<\/code><\/p>\n#include <iostream>\n#include <string>\n#include <Windows.h>\n#include <cmath>\n#include <sstream>\n#include "md5.h"\n\nusing namespace std;\n\nunsigned int time0 = 0;\n\nunsigned int arr[] = {\n\t0xCC, 0xB4, 0xFFFFFF94, 0xFFFFFF86, 0xFFFFFF9A, 0xFFFFFF8A, 0xFFFFFF9A, 0xFFFFFF8E, 0xFFE7AC2D, \n\t0xA2,0xFFFFFF9A, 0xAE, 0xFFB70487, 0xD2, 0xCC, 0xDE, 0xFFFFFF96, 0xCC, 0xCC, 0xFFFFE65F, 0xFFF7E40F, \n\t0xFFFFFF86, 0xB4, 0xFFFFE65F, 0xFFFF1957, 0xFFFFFF94, 0xFFFFFF8C, 0xFFFFFF88, 0xC6, 0xFFFFFF98, \n\t0xFFFFFF92, 0xFFFD4C05\n};\n\n\/\/ ========== \u5168\u5c40\u67e5\u8868\u8868\uff08\u6839\u636e\u5b9e\u9645\u503c\u521d\u59cb\u5316\uff09 ==========\nuint8_t SBox[16] = { 0xE,0x4,0xD,0x1,0x2,0xF,0xB,0x8,0x3,0xA,0x6,0xC,0x5,0x9,0x0,0x7 }; \/\/ dword_7FF6ABB6C020\nuint8_t Perm[16] = { 0x1,0x5,0x9,0xD,0x2,0x6,0xA,0xE,0x3,0x7,0xB,0xF,0x4,0x8,0xC,0x10 }; \/\/ dword_7FF6ABB6C0A0\n\nint encode_0(int index, int random) {\n return (random << (4 * (index - 1))) >> 16;\n}\n\nint scramble(int val) {\n for (int i = 0; i < 4; ++i) {\n int high_nibble = (val >> 12) & 0xF;\n val = (val << 4) | SBox[high_nibble];\n }\n return val;\n}\n\nint permute_bits(int val) {\n int result = 0;\n for (int i = 0; i < 16; ++i) {\n int src_bit = (val >> (Perm[i] - 1)) & 1;\n result |= (src_bit << i);\n }\n return result;\n}\n\nint mix_round(int input) {\n int mixed = scramble(input);\n return permute_bits(mixed);\n}\n\nuint32_t generate_cipher(uint32_t time, int random) {\n uint32_t val = time;\n\n \/\/ 3\u8f6e\u6270\u52a8\n for (int i = 1; i <= 3; ++i) {\n val ^= encode_0(i, random);\n val = mix_round(val);\n }\n\n \/\/ \u7b2c4\u8f6e\u5355\u72ec\u6270\u52a8\n val ^= encode_0(4, random);\n val = scramble(val);\n\n \/\/ \u6700\u7ec8 XOR\n val ^= encode_0(5, random);\n return val;\n}\n\n\nstring init_salt() {\n\tstd::stringstream ss;\n\tfor (int i = 0; i <= 31; i++) {\n\t\tint v = arr[i];\n\t\tint c;\n\n if (v >= 0)\n {\n c = v \/ 3 + '0';\n }\n else if (v >= -728)\n {\n c = ~v;\n }\n else\n {\n double f = log(static_cast<double>(-v)); \/\/ \u5047\u8bbe sub_7FF6ABB631D0 \u662f log()\n c = static_cast<int>(f \/ 1.09861228866811 - 6.0 + 48.0);\n }\n\n ss << static_cast<char>(c);\n }\n return ss.str();\n}\n\nvoid init_time0(__time64_t current_time) {\n\tif (!current_time) {\n\t\ttime0 = 1;\n\t}\n\telse {\n\t\ttime0 = current_time;\n\t}\n}\n\nint encode() {\n\tunsigned int tmp;\n\n\ttmp = (((time0 << 13) ^ time0) >> 17) ^ (time0 << 13) ^ time0;\n\ttime0 = (tmp << 5) ^ tmp;\n\n\treturn time0 & 0x7FFFFFFF;\n}\n\nvoid bruteforce() {\n\tconst std::string target_md5 = "8a2fc1e9e2830c37f8a7f51572a640aa";\n\tstring salt_str = init_salt();\n\n\tfor (__time64_t current_time = 0x686D4081; current_time <= 0x686E3153; ++current_time) {\n\t\tinit_time0(current_time);\n\n\t\tunsigned int key[4] = { 0 };\n\t\tfor (int i = 0; i < encode(); i++) {\n\t\t\tkey[0] = encode();\n\t\t\tkey[1] = encode();\n\t\t\tkey[2] = encode();\n\t\t\tkey[3] = encode();\n\t\t}\n\n\t\tunsigned int random_val = encode();\n\t\tdouble val_a = 0x61;\n\t\tdouble val_b = val_a * pow((key[0] | key[2]), 2.0);\n\t\tdouble val_c = 0xb;\n\n\t\tstd::stringstream ss;\n\n\t\tif (val_b == pow((key[1] | key[3]), 2.0) * val_c) {\n\t\t\tuint32_t cipher = generate_cipher(current_time, random_val);\n\n\t\t\tss << "salt=" << salt_str\n\t\t\t << "&t=" << current_time\n\t\t\t << "&r=" << random_val\n\t\t\t << "&cipher" << cipher;\n\t\t} else {\n\t\t\tss << "salt=" << salt_str\n\t\t\t << "&t=" << current_time\n\t\t\t << "&r=" << random_val\n\t\t\t << "&a=" << key[0]\n\t\t\t << "&b=" << key[1]\n\t\t\t << "&x=" << key[2]\n\t\t\t << "&y=" << key[3];\n\t\t}\n\n\t\tstd::string full = ss.str();\n\t\tstd::string hash = md5(full);\n\n\t\tif (hash == target_md5) {\n\t\t\tcout << "[*] Match found!" << endl;\n\t\t\tcout << "Time: " << current_time << " (0x" << std::hex << current_time << ")" << endl;\n\t\t\tcout << "Raw string: " << full << endl;\n\t\t\tcout << "MD5: " << hash << endl;\n\t\t\treturn;\n\t\t}\n\t}\n\tcout << "[*] No match found in given time range." << endl;\n}\n\nint main() {\n\tbruteforce();\n\treturn 0;\n}\n<\/code><\/pre>\n\u5176\u4e2dmd5\u7684\u5b9e\u73b0\u5c31\u4e0d\u8d34\u4e0a\u6765\u4e86,\u4ece\u7f51\u4e0a\u6284\u4e00\u4efd\u5c31\u884c,\u6216\u8005\u76f4\u63a5ai\u751f\u6210.<\/p>\n
\u7ec8\u7109\u4e4b\u95e8<\/h1>\n
\u8fd9\u9053\u9898\u76ee\u662f\u548copengl\u76f8\u5173\u7684,\u6bd4\u8d5b\u7684\u65f6\u5019\u5b8c\u5168\u4e0d\u77e5\u9053\u7740\u8272\u5668\u51fd\u6570\u903b\u8f91,\u5c31\u6ca1\u505a\u51fa\u6765(\u252d\u252e\ufe4f\u252d\u252e)<\/p>\n
![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/687e434858cb8da5c8ca0d52.png\")
<\/p>\n
\u95ee\u4e86\u4e00\u4e0bGPT,\u8fd9\u4e2a\u5e94\u8be5\u5c31\u662f\u7740\u8272\u5668\u51fd\u6570\u542f\u52a8\u7684\u5730\u65b9\u4e86,\u7136\u540e\u4ece\u522b\u4eba\u7684WP\u4e0a\u770b\u5230\u4e86\u8fd9\u91cc\u5c31\u662f\u6700\u540e\u7740\u8272\u5668\u5185\u90e8\u4ee3\u7801\u89e3\u5bc6\u51fa\u6765\u7684\u5730\u65b9<\/p>\n
__int64 __fastcall sub_7FF63580E700(__int64 a1, unsigned int a2)\n{\n __int64 v3; \/\/ rbx\n unsigned int v4; \/\/ esi\n char *v5; \/\/ rdi\n __int64 v6; \/\/ rcx\n int v8; \/\/ [rsp+24h] [rbp-24h] BYREF\n int v9; \/\/ [rsp+28h] [rbp-20h] BYREF\n int v10[7]; \/\/ [rsp+2Ch] [rbp-1Ch] BYREF\n __int64 v11; \/\/ [rsp+50h] [rbp+8h] BYREF\n\n v11 = a1;\n v3 = qword_7FF6358F1B70(a2);\n qword_7FF6358F09A0(v3, 1i64, &v11, 0i64);\n v8 = 0;\n qword_7FF6358F1CA8(v3);\n qword_7FF6358F13B0(v3, 35713i64, &v8);\n if ( !v8 )\n {\n switch ( a2 )\n {\n case 0x8B31u:\n sub_7FF63588D460(4i64, "SHADER: [ID %i] Failed to compile vertex shader code", v3);\n break;\n case 0x91B9u:\n sub_7FF63588D460(4i64, "SHADER: [ID %i] Failed to compile compute shader code", v3);\n break;\n case 0x8B30u:\n sub_7FF63588D460(4i64, "SHADER: [ID %i] Failed to compile fragment shader code", v3);\n break;\n }\n v9 = 0;\n qword_7FF6358F13B0(v3, 35716i64, &v9);\n v4 = v9;\n if ( v9 > 0 )\n {\n v10[0] = 0;\n v5 = calloc(v9, 1ui64);\n qword_7FF6358F13D0(v3, v4, v10, v5);\n sub_7FF63588D460(4i64, "SHADER: [ID %i] Compile error: %s", v3, v5);\n free(v5);\n }\n v6 = v3;\n LODWORD(v3) = 0;\n qword_7FF6358F1A98(v6);\n return v3;\n }\n switch ( a2 )\n {\n case 0x8B31u:\n sub_7FF63588D460(3i64, "SHADER: [ID %i] Vertex shader compiled successfully", v3);\n return v3;\n case 0x91B9u:\n sub_7FF63588D460(3i64, "SHADER: [ID %i] Compute shader compiled successfully", v3);\n return v3;\n case 0x8B30u:\n sub_7FF63588D460(3i64, "SHADER: [ID %i] Fragment shader compiled successfully", v3);\n return v3;\n default:\n return v3;\n }\n}\n<\/code><\/pre>\n\u8ddf\u8e2a\u8fdb\u53bb\u53ef\u4ee5\u770b\u5230\u4e00\u5927\u4e32\u6570\u636e,\u8f6c\u5316\u6210\u6570\u7ec4\u540edump\u51fa\u6765<\/p>\n
![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/687e441758cb8da5c8ca0dad.png\")
<\/p>\n
#version 430 core\n\nlayout(local_size_x = 1, local_size_y = 1, local_size_z = 1) in;\nlayout(std430, binding = 0) buffer OpCodes { int opcodes[]; };\nlayout(std430, binding = 2) buffer CoConsts { int co_consts[]; };\nlayout(std430, binding = 3) buffer Cipher { int cipher[16]; };\nlayout(std430, binding = 4) buffer Stack { int stack_data[256]; };\nlayout(std430, binding = 5) buffer Out { int verdict; };\n\nconst int MaxInstructionCount = 1000;\n\n\nvoid main()\n{\n if (gl_GlobalInvocationID.x > 0) return;\n\n uint ip = 0u;\n int sp = 0;\n verdict = -233;\n\n while (ip < uint(MaxInstructionCount))\n {\n int opcode = opcodes[int(ip)];\n int arg = opcodes[int(ip)+1];\n\n switch (opcode)\n {\n case 2:\n stack_data[sp++] = co_consts[arg];\n break;\n case 7:\n {\n int b = stack_data[--sp];\n int a = stack_data[--sp];\n stack_data[sp++] = a + b;\n break;\n }\n case 8:\n {\n int a = stack_data[--sp];\n int b = stack_data[--sp];\n stack_data[sp++] = a - b;\n break;\n }\n case 14:\n {\n int b = stack_data[--sp];\n int a = stack_data[--sp];\n stack_data[sp++] = a ^ b;\n break;\n }\n\n case 15:\n {\n int b = stack_data[--sp];\n int a = stack_data[--sp];\n stack_data[sp++] = int(a == b);\n break;\n }\n\n case 16:\n {\n bool ok = true;\n for (int i = 0; i < 16; i++)\n {\n if (stack_data[i] != (cipher[i] - 20))\n { \n ok = false; \n break; \n }\n }\n verdict = ok ? 1 : -1;\n return;\n }\n\n case 18:\n {\n int c = stack_data[--sp];\n if (c == 0) ip = uint(arg);\n break;\n }\n\n default:\n verdict = 500;\n return;\n }\n\n ip+=2;\n }\n verdict = 501;\n}\n\n<\/code><\/pre>\n\u89c2\u5bdf\u8fd9\u91cc\u7684\u6570\u636e,\u7ed3\u5408\u91cc\u8fb9\u7684binding\u503c,\u5728\u4ee3\u7801\u4e2d\u6807\u8bb0\u51fa\u53d8\u91cf<\/p>\n
layout(local_size_x = 1, local_size_y = 1, local_size_z = 1) in;\nlayout(std430, binding = 0) buffer OpCodes { int opcodes[]; };\nlayout(std430, binding = 2) buffer CoConsts { int co_consts[]; };\nlayout(std430, binding = 3) buffer Cipher { int cipher[16]; };\nlayout(std430, binding = 4) buffer Stack { int stack_data[256]; };\nlayout(std430, binding = 5) buffer Out { int verdict; }; \n<\/code><\/pre>\n![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/687e44e658cb8da5c8ca0e01.png\")
<\/p>\n
![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/687e451e58cb8da5c8ca0e14.png\")
<\/p>\n
\u8ddf\u8e2a\u8fdb\u53bb\u628a\u91cc\u9762\u7684\u503cdump\u51fa\u6765,\u518d\u6839\u636e\u539f\u6765\u7684\u903b\u8f91\u8fd8\u539f\u4ee3\u7801,\u662f\u4e00\u4e2a\u7b80\u5355\u7684\u865a\u62df\u673a<\/p>\n
#include <stdio.h>\n#include <stdlib.h>\n\n#define STACK_SIZE 256\n#define MAX_INSTRUCTIONS 1000\n\nunsigned char opcodes[] = {\n 0x2, 0x0, 0x2, 0x1, 0x2, 0x0, 0xE, 0x0, 0x2, 0x10, 0x8, 0x0, 0x2, 0x2, 0x2, 0x1, 0xE, 0x0, 0x2, 0x11,\n 0x8, 0x0, 0x2, 0x3, 0x2, 0x2, 0xE, 0x0, 0x2, 0x12, 0x7, 0x0, 0x2, 0x4, 0x2, 0x3, 0xE, 0x0, 0x2, 0x13,\n 0x7, 0x0, 0x2, 0x5, 0x2, 0x4, 0xE, 0x0, 0x2, 0x14, 0x8, 0x0, 0x2, 0x6, 0x2, 0x5, 0xE, 0x0, 0x2, 0x15,\n 0x7, 0x0, 0x2, 0x7, 0x2, 0x6, 0xE, 0x0, 0x2, 0x16, 0x7, 0x0, 0x2, 0x8, 0x2, 0x7, 0xE, 0x0, 0x2, 0x17,\n 0x7, 0x0, 0x2, 0x9, 0x2, 0x8, 0xE, 0x0, 0x2, 0x18, 0x7, 0x0, 0x2, 0xA, 0x2, 0x9, 0xE, 0x0, 0x2, 0x19,\n 0x7, 0x0, 0x2, 0xB, 0x2, 0xA, 0xE, 0x0, 0x2, 0x1A, 0x7, 0x0, 0x2, 0xC, 0x2, 0xB, 0xE, 0x0, 0x2, 0x1B,\n 0x8, 0x0, 0x2, 0xD, 0x2, 0xC, 0xE, 0x0, 0x2, 0x1C, 0x8, 0x0, 0x2, 0xE, 0x2, 0xD, 0xE, 0x0, 0x2, 0x1D,\n 0x7, 0x0, 0x2, 0xF, 0x2, 0xE, 0xE, 0x0, 0x2, 0x1E, 0x8, 0x0, 0x10, 0x0, 0x2, 0x10, 0x2, 0x11, 0xF, 0x0,\n 0x12, 0x54, 0x2, 0x1F, 0x1, 0x0, 0x3, 0x1\n};\n\nunsigned char co_consts[] = {\n 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0, 0x0,\n 0xB0, 0xC8, 0xFA, 0x86, 0x6E, 0x8F, 0xAF, 0xBF, 0xC9, 0x64, 0xD7, 0xC3, 0xE3, 0xEF, 0x87, 0x0\n};\n\nunsigned char cipher[] = {\n 0xF3, 0x82, 0x6, 0x1FD, 0x150, 0x38, 0xB2, 0xDE, 0x15A, 0x197, 0x9C, 0x1D7, 0x6E, 0x28, 0x146, 0x97\n};\n\nint stack[STACK_SIZE];\nint verdict = -233;\n\nint main() {\n unsigned int ip = 0;\n int sp = 0;\n\n while (ip < MAX_INSTRUCTIONS) {\n int opcode = opcodes[ip];\n int arg = opcodes[ip + 1];\n\n printf("ip=%03d: ", ip); \/\/ \u8f93\u51fa\u6307\u4ee4\u5730\u5740\n\n switch (opcode) {\n case 2: \/\/ PUSH\n stack[sp++] = co_consts[arg];\n printf("PUSH co_consts[%d] = %d\\n", arg, co_consts[arg]);\n break;\n\n case 7: \/\/ ADD\n {\n int b = stack[--sp];\n int a = stack[--sp];\n stack[sp++] = a + b;\n printf("ADD => %d + %d = %d\\n", a, b, a + b);\n break;\n }\n\n case 8: \/\/ SUB\n {\n int a = stack[--sp];\n int b = stack[--sp];\n stack[sp++] = a - b;\n printf("SUB => %d - %d = %d\\n", a, b, a - b);\n break;\n }\n\n case 14: \/\/ XOR\n {\n int b = stack[--sp];\n int a = stack[--sp];\n stack[sp++] = a ^ b;\n printf("XOR => %d ^ %d = %d\\n", a, b, a ^ b);\n break;\n }\n\n case 15: \/\/ CMP_EQ\n {\n int b = stack[--sp];\n int a = stack[--sp];\n int eq = (a == b) ? 1 : 0;\n stack[sp++] = eq;\n printf("CMP_EQ => %d == %d => %d\\n", a, b, eq);\n break;\n }\n\n case 16: \/\/ CHECK\n {\n int ok = 1;\n for (int i = 0; i < 16; ++i) {\n if (stack[i] != (cipher[i] - 20)) {\n ok = 0;\n break;\n }\n }\n verdict = ok ? 1 : -1;\n printf("CHECK => %s\\n", ok ? "SUCCESS" : "FAIL");\n goto end;\n }\n\n case 18: \/\/ JUMP_IF_ZERO\n {\n int c = stack[--sp];\n if (c == 0) {\n printf("JUMP_IF_ZERO to %d (taken)\\n", arg);\n ip = arg;\n continue;\n } else {\n printf("JUMP_IF_ZERO to %d (skipped)\\n", arg);\n }\n break;\n }\n\n default:\n verdict = 500;\n printf("INVALID OPCODE %d at ip=%d\\n", opcode, ip);\n goto end;\n }\n\n ip += 2;\n }\n\n verdict = 501;\n\nend:\n printf("Verdict: %d\\n", verdict);\n if (verdict == 1) {\n printf("Final stack[0..15]:\\n");\n for (int i = 0; i < 16; ++i) {\n printf("%d ", stack[i]);\n }\n printf("\\n");\n }\n\n return 0;\n}\n\n<\/code><\/pre>\nco_consts\u7684\u524d16\u4e2a\u5b57\u7b26\u662f\u7a7a\u7684,\u7ed3\u5408\u524d\u9762\u6211\u4eec\u8f93\u5165\u768432\u4e2a\u5b57\u7b26\u7684\u6570\u636e,\u548c\u4ee3\u7801\u5c06\u4e24\u4e2a\u5b57\u7b26\u5408\u5e76\u7684\u903b\u8f91,\u9006\u5411\u51fa\u80fd\u4f7f\u8fd9\u91cc\u7684\u4ee3\u7801\u901a\u8fc7\u68c0\u6d4b\u7684input<\/p>\n
L3HCTF{df6ef2e93c249eca468388c35a143283}<\/p>\n
easyvm<\/h1>\n
\u4e3b\u51fd\u6570\u5f88\u7b80\u5355,\u6700\u91cd\u8981\u7684\u5c31\u662f\u8fd9\u4e09\u4e2a\u51fd\u6570<\/p>\n
![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/6885aaae58cb8da5c8e36ef8.png\")
<\/p>\n
\u7531\u4e8eVM\u51fd\u6570\u5185\u90e8\u4f53\u79ef\u5e9e\u5927,\u7a0b\u5e8f\u5904\u7406\u6d41\u7a0b\u4e5f\u5f88\u590d\u6742\u96be\u4ee5\u8ddf\u8e2a,\u6211\u4eec\u9009\u62e9\u8ddf\u8e2a\u8fd0\u7b97\u7b26\u7684\u6267\u884c\u6d41\u7a0b,\u67e5\u770b\u76f8\u5173\u7684\u6570\u636e\u5904\u7406\u8fc7\u7a0b,\u4ece\u800c\u63a8\u65ad\u51fa\u52a0\u5bc6\u7b97\u6cd5.<\/p>\n
![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/6885acff58cb8da5c8e3707d.png\")
<\/p>\n![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/6886287758cb8da5c8e5035c.png\")
<\/p>\n![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/688747ff58cb8da5c8e8c345.png\")
<\/p>\n![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/688754f458cb8da5c8e9061a.png\")
<\/p>\n![\"\"](\"https:\/\/pic1.imgdb.cn\/item\/688756e558cb8da5c8e90cad.png\")
<\/p>\n