{"id":1723,"date":"2024-03-04T17:57:55","date_gmt":"2024-03-04T08:57:55","guid":{"rendered":"https:\/\/h4ck.kr\/?p=1723"},"modified":"2024-05-20T13:28:19","modified_gmt":"2024-05-20T04:28:19","slug":"twist1","status":"publish","type":"post","link":"https:\/\/h4ck.kr\/?p=1723","title":{"rendered":"Twist1"},"content":{"rendered":"\n

ReadMe.txt<\/h2>\n\n\n\n

Twist1.exe is run in x86 windows.<\/p>\n\n\n\n

32\ube44\ud2b8 \uc708\ub3c4\uc6b0\uc5d0\uc11c\ub9cc \uc2e4\ud589 \uac00\ub2a5\ud558\ub2e4<\/p>\n\n\n\n

\n\n\n\n

ExeInfo PE<\/h2>\n\n\n\n

\"\"<\/p>\n\n\n\n

\uc54c\ub824\uc9c0\uc9c0 \uc54a\uc740 \ud504\ub85c\uadf8\ub7a8\uc73c\ub85c \ud328\ud0b9\ub418\uc5b4\uc788\ub294 \uac83 \uac19\ub2e4.<\/p>\n\n\n\n

\ub514\ubc84\uae45\uc744 \ud1b5\ud574 \ud558\ub098\uc529 \uc0b4\ud3b4\ubcf4\uc790.<\/p>\n\n\n\n

\n\n\n\n

Analysis (Packed)<\/h2>\n\n\n\n

\uc708\ub3c4\uc6b0 xp\uc5d0\uc11c \ud504\ub85c\uadf8\ub7a8\uc744 \uc2e4\ud589\uc2dc\ud0a4\ub3c4\ub85d \ud574\ubcf4\uc558\ub2e4.<\/p>\n\n\n\n

\uc6b0\uc120 \ucc98\uc74c\uc5d0 \uc2e4\ud589\ud558\ub2e4\ubcf4\uba74 \uc544\ub798\uc640 \uac19\uc740 \uc5d0\ub7ec\uac00 \ubc1c\uc0dd\ud55c\ub2e4.<\/p>\n\n\n\n

(\uc0ac\uc9c4)<\/p>\n\n\n\n

\uc548\ud2f0 \ub514\ubc84\uae45\uc774 \ud0d1\uc7ac\ub418\uc788\ub294 \ub4ef \ud558\ub2e4.<\/p>\n\n\n\n

<\/p>\n\n\n\n

\ud558\ub098\uc529 \uc2a4\ud15d\uc744 \ubc1f\uc544\ubcf4\uba74,
sub_40709F, sub_4070C7 \ud568\uc218\ub97c \ud1b5\ud574 \ub514\ubc84\uae45\uc744 \ud0d0\uc9c0\ud558\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

sub_40709F \ud568\uc218\ub97c \ud638\ucd9c\ud558\uae30 \uc804\uc5d0 2\ubc88\uca30 \ub9e4\uac1c\ubcc0\uc218\uc778 a2\uc5d0 \ub300\ud574 \uc54c\uc544\ubcf4\uc790\uba74,

.text:00407077 mov eax, large fs:30h
https:\/\/sanseolab.tistory.com\/47<\/a><\/p>\n\n\n\n

\uc704 fs:[30]\uc740 PEB \ud14c\uc774\ube14\uc758 \uc8fc\uc18c\ub97c \uc758\ubbf8\ud558\ub294\ub370,
Process Environment Block\uc73c\ub85c, \uc708\ub3c4\uc6b0\uc5d0\uc11c \ud504\ub85c\uc81c\uc2a4 \uc815\ubcf4\ub97c \ub2f4\uace0\uc788\ub294 \uad6c\uc870\uccb4\ub77c\uace0 \ubcf4\uba74 \ub41c\ub2e4.<\/p>\n\n\n\n

\uadf8 \uc8fc\uc18c\uc5d0\ub2e4\uac00 0x28\uacfc 0x30\uc744 XOR\ud55c 0x18\uc744 \ub354\ud558\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n

0x18\uc740 \uc5b4\ub5a4 \ud544\ub4dc\ub97c \uac00\ub9ac\ud0a4\ub294\uac74 windbg\ub85c \ud655\uc778\ud574\ubcf4\uba74,<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

ProcessHeap \ud544\ub4dc\ub97c \uac00\ub9ac\ud0a4\uace0 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n

Pseudo Code\ub85c \ub098\ud0c0\ub0b4\uba74 \uc544\ub798\uc640 \uac19\uc558\ub2e4.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

sub_40709F<\/h3>\n\n\n\n

\uc774\uc81c \ub9e4\uac1c\ubcc0\uc218 a2\ub294 &NtCurrentPeb()->ProcessHeap\ub77c\ub294 \uac83\uc744 \uc54c\uc558\ub2e4.
\ud558\ub098\uc529 \uc0b4\ud3b4\ubcf4\uba74,<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

\uba87\uac00\uc9c0 \ubd84\uae30\ubb38\uc774 \uc788\ub294\ub370,
\uc5ec\uae30\uc11c .text:004070BC call loc_407300\uc744 \uc0b4\ud3b4\ubcf4\uba74,
<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

retn\ub3c4 \uc5c6\uc774 \uadf8\ub0e5 \uad6c\ub801\ud145\uc774\ub85c \ube60\uc9c0\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.<\/p>\n\n\n\n

Pseudo Code\ub85c \ub098\ud0c0\ub0b4\uba74 \uc544\ub798\uc640 \uac19\ub2e4.<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

https:\/\/m.blog.naver.com\/719121812\/20177549572<\/a><\/p>\n\n\n\n

+0xC\ub294 \uc708\ub3c4\uc6b0xp\uc5d0\uc11c\uc758 Flags \ud544\ub4dc \uc624\ud504\uc14b, +0x40\uc740 \uc708\ub3c4\uc6b07\uc5d0\uc11c\uc758 Flags \ud544\ub4dc \uc624\ud504\uc14b\uc744 \uc758\ubbf8\ud55c\ub2e4.
Flags\uac00 2\uac00 \uc544\ub2c8\uba74 \uad6c\ub801\ud145\uc774\ub85c \ube60\uc9c0\ub294\ub370,

\uc5ec\uae30\uc11c 2\ub294
https:\/\/h3rm1t.tistory.com\/7<\/a>
https:\/\/learn.microsoft.com\/ko-kr\/windows-hardware\/drivers\/ddi\/ntifs\/nf-ntifs-rtlcreateheap<\/a><\/p>\n\n\n\n

HEAP_GROWABLE \uc744 \uc758\ubbf8\ud55c\ub2e4.<\/p>\n\n\n\n

\uadf8\ub7ec\ub098 \ub514\ubc84\uae45\uc774 \ub418\uc5b4\uc788\uc5b4 \uc2e4\uc81c\ub85c \uac12\uc744 \ud655\uc778\ud574\ubcf4\uba74,
2\uac00 \uc544\ub2cc<\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

ECX\uac12\uc774 0x50000062\uc774\ub77c\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/p>\n\n\n\n

HEAP_GROWABLE (0x02)
HEAP_TAIL_CHECKING_ENABLED (0x20)
HEAP_FREE_CHECKING_ENABLED (0x40)
HEAP_SKIP_VALIDATION_CHECKS (0x10000000)
HEAP_VALIDATE_PARAMETERS_ENABLED (0x40000000)<\/p>\n\n\n\n

\uc704 \ud50c\ub798\uadf8\uac00 \ubaa8\ub450 \ud65c\uc131\ud654\ub418\uc5c8\ub2e4\uace0 \ubcf4\uba74 \ub41c\ub2e4.<\/p>\n\n\n\n

\n
\n
>>> hex(0x2 | 0x20 | 0x40 | 0x10000000 | 0x40000000)\n'0x50000062'<\/pre>\n<\/div>\n<\/div>\n\n\n\n
\uc544\ub798\uc640 \uac19\uc774 0x004070AC \uc9c0\uc810\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 0x004070C1\ub85c EIP\ub97c \uc218\uc815\ud574\uc11c \uc6b0\ud68c\ud558\uba74 \ub41c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_4070C7<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc810\ud504\ub97c \uc5ec\ub7ec\ubc88\ud558\uc5ec \ub9c8\uc9c0\ub9c9\uc5d0\ub294 0x004070CB\ub85c \uc810\ud504\ud55c\ub2e4.<\/p>\n\n\n\n
Pseudo Code\ub85c \ub098\ud0c0\ub0b4\uba74 \uc544\ub798\uc640 \uac19\uc740\ub370,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc774\ubc88\uc5d0\ub294 ForceFlags \ud544\ub4dc\uac12\uc744 \ud1b5\ud574 \ub514\ubc84\uae45\uc744 \uccb4\ud06c\ud558\uace0 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
0x04070DD \uc9c0\uc810\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0,
\uac78\ub838\uc744\ub54c EIP\ub97c 0x4070F0\uc73c\ub85c \uc218\uc815\ud558\uba74 \uc6b0\ud68c\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\uc774\uc81c \ucb49\ucb49 \ub530\ub77c\uac00\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
https:\/\/www.vergiliusproject.com\/kernels\/x86\/Windows%20XP\/SP3\/_LDR_DATA_TABLE_ENTRY<\/a><\/p>\n\n\n\n
+0x10 \uc624\ud504\uc14b\uc740 InInitializationOrderLinks\uc744 \uc758\ubbf8\ud55c\ub2e4.<\/p>\n\n\n\n
Ldr\uc744 \ud1b5\ud574 \ud504\ub85c\uc138\uc2a4\uac00 \ub514\ubc84\uae45 \uc911\uc778\uc9c0 \ud655\uc778\ud560 \uc218 \uc788\ub294\ub370, 
\ub514\ubc84\uae45 \uc911\uc778 \ud504\ub85c\uc138\uc2a4\ub294 \ud799 \uba54\ubaa8\ub9ac \uc601\uc5ed\uc5d0 \uc790\uc2e0\uc774 \ub514\ubc84\uae45 \uc218\ud589 \uc911\uc778 \ud504\ub85c\uc138\uc2a4\ub77c\ub294 \ud45c\uc2dc\ud558\uae30 \uc704\ud574 \uc0ac\uc6a9\ub418\uc9c0 \uc54a\uc740 \ubd80\ubd84\uc5d0\ub294 0xFEEEFEEE\uc774\ub098 0xABABABAB\ub85c \ucc44\uc6b4\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
00407139 \uc9c0\uc810\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0,
\uac78\ub838\uc744\ub54c EIP\ub97c 0x40715D\ub85c \uc218\uc815\ud558\uba74 \uc6b0\ud68c\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc5ec\uae30\uae4c\uc9c0 \uc6b0\ud68c\ud588\ub2e4\uba74 0x407179\ub85c \uc810\ud504\ub41c \uac83\uc744 \uc54c \uc218 \uc788\ub294\ub370,
\ubd84\uae30\ubb38\uc5d0 \uc758\ud574 \ubc18\ubcf5\uc774 \uc5ec\ub7ec\ubc88 \uc9c4\ud589\ub418\ubbc0\ub85c 0x4071A4\uc5d0 \ube0c\ub808\uc774\ud06c\ub97c \uac78\uace0 \ub2e4\uc2dc \ud655\uc778\ud574\ubcf4\uc790. <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
0x4071BD\uc5d0\uc11c \uba48\ucce4\uc744\ub54c 
0x4071AF, 0x4071B6\uc5d0 \uc788\ub294 \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 0x4071BD\uc758 \uba85\ub839\uc5b4\uac00 \ubc14\uaef4
jmp\ubb38\uc774 \uc0dd\uae34 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
OEP\ub294 0x40157C\uc600\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
Scylla \ud504\ub85c\uadf8\ub7a8\uc73c\ub85c \ub364\ud504\ud574\uc11c \uc5b8\ud328\ud0b9\ub41c \ubc14\uc774\ub108\ub9ac\ub97c \uad6c\ud560 \uc218 \uc788\ub2e4.
OEP\ub97c 0x40157C\ub85c \uc218\uc815\ud558\uace0, IAT AutoSerach, Get Imports, Dump, FixDump \ucc28\ub840\ub300\ub85c \ub204\ub974\uba74 \ub41c\ub2e4.<\/p>\n\n\n\n
\uadf8\ub7ec\uba74 Twist1_dump_SCY.exe \uc2e4\ud589 \ud30c\uc77c\uc774 \uc0dd\uae34\ub2e4.
\uc774\uc81c \uc774 \uc2e4\ud589\ud30c\uc77c\ub85c IDA\ub97c \ud1b5\ud574 \ub2e4\uc2dc \ubd84\uc11d\ud574\ubcf4\uc790.<\/s><\/p>\n\n\n\n
\ud560\ub824\uace0 \ud588\uc73c\ub098 \ubb34\uc2a8\uc77c\uc5d0\uc120\uc9c0 \uc0ac\uc6a9\uc790 \uc778\ud48b\uac12\uc744 \ud655\uc778\ud558\ub294 sub_401240 \ud568\uc218\uac00 \uc774\uc0c1\ud558\uac8c \ub098\uc628\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ub530\ub77c\uc11c \uc0ac\uc6a9\uc790 \uc778\ud48b\uac12\uc774 \ub9de\ub294\uc9c0 \uc544\ub2cc\uc9c0 Wrong \ucd9c\ub825 \ubb38\uad6c\uac00 \ub728\uc9c0 \uc54a\ub294\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\uacb0\uad6d \ub514\ubc84\uae45\ud574\uc11c \ud574\uacb0\ud558\uae30\ub85c \ud558\uc600\ub2e4.<\/s><\/p>\n\n\n\n
https:\/\/doongdangdoongdangdong.tistory.com\/201<\/a><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
OllyDumpEx \ud504\ub85c\uadf8\ub7a8\uc73c\ub85c \ub364\ud504\ub5a0\uc11c \ud574\uacb0!<\/p>\n\n\n\n
\uc2e4\ud589 \uc911\uc778 Twist1 \ud504\ub85c\uc138\uc2a4\uc5d0\uc11c OEP\uc5d0\uc11c Image Base\ub97c \ube80 \uac12\uc73c\ub85c, Entry Point\ub97c 0x157c\ub85c \uc124\uc815\ud558\uace0 Dump \ubc84\ud2bc\uc744 \ub204\ub974\uba74 \ub41c\ub2e4.<\/p>\n\n\n\n
Anlaysis 2 (Unpacked)<\/h2>\n\n\n\n
\uc5b8\ud329\ub41c \ubc14\uc774\ub108\ub9ac\ub85c \ub2e4\uc2dc\ud55c\ubc88 \ubd84\uc11d\ud574\ubcf4\uc790.<\/p>\n\n\n\n
main<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ucd5c\uc885\uc801\uc73c\ub85c sub_401240 \ud568\uc218\uc5d0\uc11c \uc0ac\uc6a9\uc790 \uc778\ud48b\uac12\uc774 \ub9de\ub294\uc9c0 \uc544\ub2cc\uc9c0 \ud655\uc778\ud558\uace0 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n
sub_401160<\/h3>\n\n\n\n
nop \uba85\ub839\uc5b4\uac00 \uc5ec\ub7ec\ubc88 \ub098\uc624\uace0 \ub9c8\uc9c0\ub9c9\uc5d0 retn \uba85\ub839\uc5b4\ubc16\uc5d0 \uc5c6\ub2e4.
\ubb34\uc758\ubbf8\ud55c \ucf54\ub4dc\uc774\ub2e4.<\/p>\n\n\n\n
sub_401000<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
dword_40B968\uc5d0\ub294 kernel32.dll\uc758 base \uc8fc\uc18c,
dword_40B964\uc5d0\ub294 ntdll.dll\uc758 base \uc8fc\uc18c\uac00 \uac01\uac01 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
sub_401090<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_401090 \ud568\uc218\uac00 \ub05d\ub098\uace0 \ubcf5\uadc0\ud588\uc744\ub584\uc758 0040128A \uc9c0\uc810\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 eax\ub97c \ud655\uc778\ud574\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_401090\ud568\uc218\ub294 kernel32_SetUnhandledExceptionFilter \uc8fc\uc18c\ub97c \ubc18\ud658\ud55c\ub2e4\ub294 \uac83\uc744 \uc54c \uc218 \uc788\uc5c8\ub2e4.
\uc774\ub807\uac8c \ubc18\ud658\ub41c \uc8fc\uc18c\ub294 dword_40B960\uc5d0 \uc800\uc7a5\ud55c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uadf8\ub9ac\uace0 sub_401140\uc744 \ub9e4\uac1c\ubcc0\uc218 a1\uc73c\ub85c \uc9c0\uc815\ud558\uc5ec, SetUnhandledExceptionFilter\uc744 \ud638\ucd9c\ud55c\ub2e4.<\/p>\n\n\n\n
sub_4011D0<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
“Reversing.Kr CrackMe” \ubb38\uad6c\ub97c \ucd9c\ub825\ud55c\ub2e4.<\/p>\n\n\n\n
sub_401200<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
“Input: ” \ubb38\uad6c\ub97c \ucd9c\ub825\ud55c\ub2e4.<\/p>\n\n\n\n
sub_401220<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc0ac\uc6a9\uc790 \uc778\ud48b\uc744 dword_40B970 \uc800\uc7a5\ud55c\ub2e4.<\/p>\n\n\n\n
sub_401240<\/h3>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc0ac\uc6a9\uc790 \uc778\ud48b \uc911 10\ubc14\uc774\ud2b8\uae4c\uc9c0\ub9cc  v7\uc5d0 \uc800\uc7a5\ud55c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
https:\/\/ruinick.tistory.com\/27<\/a>
https:\/\/jeep-shoes.tistory.com\/49<\/a>
https:\/\/jeongzzang.com\/156<\/a>
https:\/\/learn.microsoft.com\/ko-kr\/windows\/win32\/procthread\/zwqueryinformationprocess<\/a><\/p>\n\n\n\n
\n
\n
NTSTATUS WINAPI ZwQueryInformationProcess(\n  _In_      HANDLE           ProcessHandle,\n  _In_      PROCESSINFOCLASS ProcessInformationClass,\n  _Out_     PVOID            ProcessInformation,\n  _In_      ULONG            ProcessInformationLength,\n  _Out_opt_ PULONG           ReturnLength\n);<\/pre>\n<\/div>\n<\/div>\n\n\n\n
ZwQueryInformationProcess \ud568\uc218\uc5d0\uc11c \ub514\ubc84\uae45\uc744 \ud655\uc778\ud55c\ub2e4.
\ud568\uc218\uc758 \ub450\ubc88\uc9f8 \uba64\ubc84\uc778 ProcessInformationClass\uac12\uc774 ProcessDebugPort\uc744 \uc758\ubbf8\ud558\ub294 7\uc774\uba74, \uc138\ubc88\uc9f8\uc5d0 \uc788\ub294 output\uc778 ProcessInformation\uc774 \uac00\ub974\ud0a4\ub294 \uc8fc\uc18c\uc5d0 0xFFFFFFFF\uac12\uc774 \ub098\uc628\ub2e4\uace0 \ud558\ub294\ub370,<\/p>\n\n\n\n
\ub514\ubc84\uae45\uc911\uc774\uae30\uc5d0 \uc2e4\uc81c\ub85c dword_409180\uc5d0 \uadf8 \uac12\uc774 \uc800\uc7a5\ub418\uc788\ub294 \uac83\uc744 \ud655\uc778\ud560 \uc218 \uc788\uc5c8\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c, 00407299\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uc5b4 
\uadf8 \uc9c0\uc810\uc5d0 \uac78\ub838\uc744\ub54c, dword_409180\uac12\uc744 0\uc73c\ub85c \uc218\uc815\ud574\uc11c \uc6b0\ud68c\ud558\ub3c4\ub85d \ud55c\ub2e4.<\/strong><\/p>\n\n\n\n
004072C4 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\uac78\uace0 \uacc4\uc18d \uc5f0\uad6c… TO BE CONTINUED>>>><\/s><\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
https:\/\/nightohl.tistory.com\/entry\/NtQueryInformationProcess-ProcessDebugObjectHandle-%EC%9A%B0%ED%9A%8C%EB%B0%A9%EB%B2%95<\/a><\/p>\n\n\n\n
\uc5ec\uae30\uae4c\uc9c0 \ub118\uc5b4\uac14\ub2e4\uba74 \uc774\uc81c\ub294 ZwQueryInformationProcess \ud568\uc218\uc5d0 2\ubc88\uca30 \uc778\uc790\uac12\uc778 ProcessInformationClass\uc5d0 ProcessDebugObjectHandle\uc744 \uc758\ubbf8\ud558\ub294 0x1e<\/code>\ub97c \ub118\uaca8 \ub514\ubc84\uae45\uc744 \ud55c\ubc88 \ub354 \ud655\uc778\ud55c\ub2e4.<\/p>\n\n\n\n
\uc6b0\ud68c\ud558\ub294 \ubc29\ubc95\uc740 004072C4\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0,
\uac78\ub838\uc744\ub54c ZwQueryInformationProcess \ub9ac\ud134\uac12\uc774 \ub4e4\uc5b4\uc788\ub294 eax\ub97c 0xC0000353 (STATUS_PORT_NOT_SET)\uc73c\ub85c \uc218\uc815\ud574\uc8fc\uba74 \ub41c\ub2e4.<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
0x409150\uc73c\ub85c\ubd80\ud130 \uba54\ubaa8\ub9ac\ub97c 1\ubc14\uc774\ud2b8\ub97c \uc77d\uc5b4\uc640  0xB8\uc778\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/p>\n\n\n\n
0x409150\ub97c \ud655\uc778\ud574\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
opcode\ub97c \ud655\uc778\ud558\ub294 \uac83\uc73c\ub85c \ubcf4\uc778\ub2e4.
\ubcc4\ub2e4\ub978 \uc6b0\ud68c\uc5c6\uc774 \uadf8\ub0e5 \ub118\uc5b4\uac08 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
https:\/\/ddatg.tistory.com\/80<\/a><\/p>\n\n\n\n
\ub118\uc5b4\uac14\ub2e4\uba74 \uc774\uc81c\ub294 ZwQueryInformationProcess \ud568\uc218\uc5d0 2\ubc88\uca30 \uc778\uc790\uac12\uc778 ProcessInformationClass\uc5d0 ProcessDebugFlags\uc744 \uc758\ubbf8\ud558\ub294 0x1f<\/code>\ub97c \ub118\uaca8 \ub514\ubc84\uae45\uc744 \ud55c\ubc88 \ub354 \ud655\uc778\ud55c\ub2e4.<\/p>\n\n\n\n
\ub514\ubc84\uae45\uc774 \ub418\uc5b4\uc788\ub2e4\uba74, 3\ubc88\uc9f8 \uc778\uc790(dword_409130, DebugFlags)\uc5d0 0\uc774 \ub4e4\uc5b4\uac00\uae30 \ub54c\ubb38\uc5d0
1\ub85c \uc218\uc815\ud55c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c \uc6b0\ud68c\ud558\ub294 \ubc29\ubc95\uc740 00407459 \uc9c0\uc810\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0, <\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc704\uc640 \uac19\uc774 0x409130\uc5d0 1\ub85c \uc218\uc815\ud574\uc8fc\uba74 \ub41c\ub2e4.<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
byte_40B991\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 7\ubc88\uca30 \uae00\uc790, 
byte_40B990\uc5d0\ub294 1\ubc88\uca30 \uae00\uc790\uac00 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\uc774\ub97c\ud14c\uba74, \uc0ac\uc6a9\uc790 \uc778\ud48b\uc774 “ABCDEFG…”\ub77c\uba74,
byte_40B991\uc5d0\ub294 ‘G’,
byte_40B990\uc5d0\ub294 ‘A’ \uae00\uc790\uac00 \uac01\uac01 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\ub2e4\uc2dc \uc774\uc804 \ud568\uc218\ub85c \ubcf5\uadc0\ud574\uc11c \ud655\uc778\ud574\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
opcode\ub97c \uc218\uc815\ud558\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\uc218\uc815\ud588\uc744\ub54c\uc758 \uc804\uacfc \ud6c4\ub97c \ube44\uad50\ud574\ubcf4\uba74, \uc544\ub798\uc640 \uac19\ub2e4.
<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc704\ucc98\ub7fc \ucf54\ub4dc\uac00 \uc218\uc815\ub418\uc5c8\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
byte_40B991\uc5d0 \uc788\ub294 1\ubc14\uc774\ud2b8\uc640 0x36\uc744 XOR\ud55c \uac12\uc774 byte_40C450\uc5d0 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n
byte_40B991\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 7\ubc88\uc9f8 \uae00\uc790\ub97c \uc758\ubbf8\ud558\uace0,<\/p>\n\n\n\n
\uc774\ub97c\ud14c\uba74, \uc0ac\uc6a9\uc790 \uc778\ud48b\uc774 “ABCDEFG…”\ub77c\uba74,
byte_40C450\uc5d0\ub294 0x47(‘G’)\uacfc 0x36\uc744 XOR\ud55c 0x71\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
EIP\ub97c 00407497\uc5ec\uae30\uae4c\uc9c0 \uba48\ucd94\uace0, TO BE CONTINUE>>><\/s><\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
dword_40B964\uc5d0\ub294 kernel32.dll\uc758 base \uc8fc\uc18c\uac00 \ub4e4\uc5b4\uac00\uc788\uace0,
dword_409200\uc5d0\ub294 “GetCurrentThread” \ubb38\uc790\uc5f4\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
.text:004074C2 mov dword ptr ds:loc_407471, 15975623h
.text:004074CC mov dword ptr ds:loc_407471+4, 1ABCD562h
.text:004074D6 mov dword ptr ds:loc_40749A, 1A25CFDAh
.text:004074E0 mov dword ptr ds:loc_40748E, 9CA565AAh<\/p>\n\n\n\n
\ucd94\uac00\ub85c, \uc704 4\uac00\uc9c0\uc758 mov \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 
loc_407471, loc_407471+4, loc_40749A, loc_40748E \uc8fc\uc18c\uc5d0 \uc788\ub294 opcode\uac00 \uc218\uc815\ub41c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uadf8\ub9ac\uace0 sub_401090 \ud638\ucd9c\uc744 \ud1b5\ud574 kernel32.dll\uc758 GetCurrentThread \ud568\uc218 \uc8fc\uc18c\ub97c \uac00\uc838\uc628\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
dword_409200\uc5d0\ub294 “GetThreadContext” \ubb38\uc790\uc5f4\uc774 \ub4e4\uc5b4\uac00\uace0,<\/p>\n\n\n\n
.text:00407522                 mov     dword ptr ds:loc_4074EF, 15975623h .text:0040752C                 mov     dword ptr ds:loc_4074F5, 1ABCD562h .text:00407536                 mov     dword ptr ds:loc_407400+4, 1A25CFDAh .text:00407540                 mov     dword ptr ds:loc_4074AE, 9CA565AAh<\/p>\n\n\n\n
\ub9c8\ucc2c\uac00\uc9c0\ub85c \uc704 4\uac00\uc9c0\uc758 mov \uba85\ub839\uc5b4\uc5d0 \uc758\ud574
loc_4074EF, loc_4074F5, loc_407400+4, loc_4074AE \uc8fc\uc18c\uc5d0 \uc788\ub294 opcode\uac00 \uc218\uc815\ub41c\ub2e4.<\/p>\n\n\n\n
dword_409240\uc5d0\ub294 kernel32_GetCurrentThread \uc8fc\uc18c\uac00 \uc800\uc7a5\ub41c\ub2e4.<\/p>\n\n\n\n
\uadf8\ub9ac\uace0 dword_40B964\uc5d0 \uc788\ub294 kernel32.dll\uc758 base \uc8fc\uc18c\ub97c eax\ub85c \uac00\uc838\uc624\uba74\uc11c,
sub_401090 \ud638\ucd9c\uc744 \ud1b5\ud574 kernel32.dll\uc758 GetThreadContext \ud568\uc218 \uc8fc\uc18c\ub97c \uac00\uc838\uc628\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
https:\/\/ruinick.tistory.com\/53<\/a>
https:\/\/www.vergiliusproject.com\/kernels\/x86\/Windows%20XP\/SP3\/_CONTEXT<\/a>
https:\/\/codemachine.com\/downloads\/win71\/winnt.h<\/a><\/p>\n\n\n\n
\n
\n
CONTEXT ct; \nct.ContextFlags = (CONTEXT_CONTROL | CONTEXT_INTEGER | CONTEXT_SEGMENTS | CONTEXT_FLOATING_POINT | CONTEXT_DEBUG_REGISTERS); \/\/0x1001F\n\nGetThreadContext(GetCurrentThread(), &ct);<\/pre>\n<\/div>\n<\/div>\n\n\n\n
Hardware BreakPoint \uae30\ubc18 \uc548\ud2f0 \ub514\ubc84\uae45\uc73c\ub85c GetThreadContext, GetCurrentThread API\ub97c \ud1b5\ud574 \ub514\ubc84\uae45\uc744 \uc7a1\uc544\ub0b8\ub2e4. <\/p>\n\n\n\n
Dr0 ~ Dr3 : Hardware BP\ub97c \uc124\uc815\ud560 \uc120\ud615 \uc8fc\uc18c
Dr4 ~ Dr5 : Reserved(\uc608\uc57d\ub428)
Dr6 : Debug Status
Dr7 : Debug Control<\/p>\n\n\n\n
\uc704 6\uac00\uc9c0\ub97c \ubaa8\ub450 \uccb4\ud06c\ud55c\ub2e4.<\/p>\n\n\n\n
dword_4092A4\uc5d0\ub294 Dr0,
dword_4092A8\uc5d0\ub294 Dr1,
dword_4092AC\uc5d0\ub294 Dr2,
dword_4092B0\uc5d0\ub294 Dr3,
dword_4092B4\uc5d0\ub294 Dr6,
dword_4092B8\uc5d0\ub294 Dr7 \ud544\ub4dc\uac12\uc5d0 \ud574\ub2f9\ub41c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ub530\ub77c\uc11c \uc6b0\ud68c\ud558\ub824\uba74, 00407580 \uc9c0\uc810\uc5d0 \ube0c\ub808\uc774\ud06c\ud3ec\uc778\ud2b8\ub97c \uac78\uace0
\uac78\ub838\uc744\ub54c \uc704 6\uac00\uc9c0\uc758 dword_4092A4~dword_4092B8\uac12\uc744 \ubaa8\ub450 0\uc73c\ub85c \uc218\uc815\ud574\uc918\uc57c \ud55c\ub2e4.<\/strong><\/p>\n\n\n\n
\uc774\uc81c \uc774 \ud504\ub85c\uadf8\ub7a8\uc5d0 \uc788\ub294 \ubaa8\ub4e0 \uc548\ud2f0\ub514\ubc84\uae45\uc744 \uc6b0\ud68c\ud558\uc600\ub2e4!<\/p>\n\n\n\n
\uc0ac\uc6a9\uc790 \uc778\ud48b\uac12\uc744 \uac80\uc99d\ud558\ub294 \uc694\uc18c\ub85c \ub118\uc5b4\uac00\ub294\ub370 \ud55c\ubc88 \ud655\uc778\ud574\ubcf4\uc790.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
byte_40C450\uc740 0x36\uc774\uc5ec\uc57c \ub41c\ub2e4.<\/p>\n\n\n\n
\uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 7\ubc88\uc9f8 \uae00\uc790\uc778 byte_40B991\uacfc 0x36\uc744 XOR\ud55c \uac12\uc774 byte_40C450\ub85c \ub4e4\uc5b4\uac00\ubbc0\ub85c,
\uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 7\ubc88\uc9f8 \uae00\uc790\ub294 0x36\uacfc 0x36\uc744 XOR\ud55c \uac12\uc778 0x00 (=NULL),
\uc989 \uc774\ub97c \ud1b5\ud574 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 \uae00\uc790\uc218\ub294 6\uc790\ub9ac\uc5ec\uc57c \ub41c\ub2e4\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
loc_40762B \ud568\uc218\ub97c \ud638\ucd9c\ud558\uc5ec \uc0ac\uc6a9\uc790 \uc778\ud48b\uac12\uc744 \ub9c8\uc800 \uac80\uc99d\ud55c\ub2e4.<\/p>\n\n\n\n
mov al, byte_40B990\uc5d0 \uc758\ud574
\ub9e4\uac1c\ubcc0\uc218\uc778 a1(al \ub808\uc9c0\uc2a4\ud130)\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 1\ubc88\uc9f8 \uae00\uc790\uac00 \ub4e4\uc5b4\uac00\ub294\ub370, 
ror al, 6\uc5d0 \uc758\ud574
\uc624\ub978\ucabd\uc73c\ub85c 6\ub9cc\ud07c \ud68c\uc804\ud558\uace0,
mov byte_40B000, al\uc5d0 \uc758\ud574
\uadf8 \ud68c\uc804\ud55c \uac12\uc744 byte_40B000\uc5d0 \uc800\uc7a5\ud55c\ub2e4.<\/p>\n\n\n\n
\uc774\ub97c \ud14c\uba74, \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 \uccab\ubc88\uc9f8 \uae00\uc790\uac00 “A”, 0x41\uc774\uc600\ub2e4\uba74,
6\ub9cc\ud07c \ud68c\uc804\ud574\uc11c 5\ub77c\ub294 \uac12\uc774 \ub098\uc628\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ub9e4\uac1c\ubcc0\uc218\uc778 a1\uc5d0\ub294 \uc774\uc81c \uc0ac\uc6a9\uc790\uc778\ud48b\uc758 1\ubc88\uca30 \uae00\uc790\uc640 6\ub9cc\ud07c ROR\ud55c \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
byte_40B001\uc5d0\ub294 a1 \uac12\uacfc 4\ub9cc\ud07c ROL\ud55c \uac12\uc774 \ub4e4\uc5b4\uac00\uace0,
byte_40B002\uc5d0\ub294 \ubc29\uae08 ROL \uc5f0\uc0b0\ud55c \uac12\uc5d0 0x34\ub97c XOR\ud55c \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
.text:00407700 mov cl, byte_40B000\uc5d0 \uc758\ud574<\/p>\n\n\n\n
\ub530\ub77c\uac00\ubcf4\uba74, cl \ub808\uc9c0\uc2a4\ud130\uac12\uc744 \uc758\ubbf8\ud558\ub294 a3\uc5d0\ub294 byte_40B000 \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4, 
\uadf8\ub7ec\ub2c8\uae4c \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 1\ubc88\uc9f8 \uae00\uc790\uc5d0 6\ub9cc\ud07c ROR\ud55c \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4\ub294 \uc758\ubbf8\uc774\ub2e4.<\/p>\n\n\n\n
\uc774 \uac12\uc774 0x49\uc5ec\uc57c\ud558\ubbc0\ub85c, 0x49 \uac12\uc5d0 6\ub9cc\ud07c ROL \uc5f0\uc0b0\uc744 \ud558\uba74,
\uccab\ubc88\uc9f8 \uae00\uc790\ub294 0x52, \uc989 R\uc774\uc5ec\uc57c \ud55c\ub2e4.<\/strong><\/p>\n\n\n\n
\uc774\uc804\uc5d0 .text:0040762B xor edx, edx \uba85\ub839\uc5b4\uc5d0 \uc758\ud574 
edx\ub294 0 \uac12\uc774 \ub4e4\uc5b4\uac00\uace0, \uc774 \uac12\uc740 dword_4076CC\uc5d0 \uc800\uc7a5\ub41c\ub2e4.
\uc774\uc804\uc5d0 sub_407619 \ud568\uc218 \uc218\ud589\uc5d0 \uc758\ud574
eax\ub294 \uccab\ubc88\uc9f8 \uae00\uc790\uac12\uacfc 6\ub9cc\ud07c ROR, 4\ub9cc\ud07c ROL, 0x34 XOR \ud55c \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
.text:004076DF mov dword ptr ds:sub_4076D0, eax
\uadfc\ub370 \ubb34\uc758\ubbf8\ud55c \ucf54\ub4dc\ub85c, \ub610 opcode\ub97c eax\uac12\uc73c\ub85c \uc218\uc815\ud55c\ub2e4.<\/p>\n\n\n\n
.text:004076E4 xor eax, eax
.text:004076E6 xor ecx, ecx
\uc5d0 \uc758\ud574 eax\uc640 ecx\ub294 0 \uac12\uc73c\ub85c \ub9cc\ub4e4\uc5b4\ubc84\ub9ac\uace0, ecx \uc5ed\uc2dc 0\uc774\ub2e4.<\/p>\n\n\n\n
.text:004076E9 mov al, byte ptr dword_40B970
.text:004076EE mov dl, byte ptr dword_40B970+1
.text:004076F4 mov cl, byte ptr dword_40B970+2<\/p>\n\n\n\n
al\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 1\ubc88\uc9f8 \uae00\uc790,
dl\uc5d0\ub294 2\ubc88\uc9f8, cl\uc5d0\ub294 3\ubc88\uc9f8 \uae00\uc790\uac00 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\uadf8\ub9ac\uace0 loc_40771B \uc8fc\uc18c\ub85c \uc810\ud504\ud55c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uac01\uac01 dh \ub808\uc9c0\uc2a4\ud130\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 4\ubc88\uc9f8 \uae00\uc790\uac12,
bh \ub808\uc9c0\uc2a4\ud130\uc5d0\ub294 5\ubc88\uc9f8 \uae00\uc790\uac12,
bl \ub808\uc9c0\uc2a4\ud130\uc5d0\ub294 6\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
byte_40B970\uc5d0\ub294 \uc6d0\ub798\ub294 1\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uc788\uc5c8\ub294\ub370,
0x12\uc640 XOR \uc5f0\uc0b0\ud55c \uac12\uc774 \ub4e4\uc5b4\uac00\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n
\uadf8\ub9ac\uace0 loc_407750 \uc8fc\uc18c\ub85c \uc810\ud504\ud55c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uac01\uac01 byte_40CCE0\uc5d0\ub294 \uc0ac\uc6a9\uc790\uc778\ud48b\uc758 3\ubc88\uca30 \uae00\uc790\uac12,
byte_40CCE4\uc5d0\ub294 6\ubc88\uc9f8
byte_40CCE8\uc5d0\ub294 1\ubc88\uc9f8, 
byte_40CCECE\uc5d0\ub294 2\ubc88\uc9f8,
byte_40CCF0\uc5d0\ub294 5\ubc88\uc9f8,
byte_40CCF4\uc5d0\ub294 4\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\uadf8\ub9ac\uace0 al \ub808\uc9c0\uc2a4\ud130\uc5d0 \uc0ac\uc6a9\uc790\uc778\ud48b\uc758 3\ubc88\uca30 \uae00\uc790\uac12\uacfc 0x77\uc744 XOR\ud55c \uac12\uc774 \ub4e4\uc5b4\uac00\uace0,
loc_4077A3\ub85c \uc810\ud504\ud55c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc0ac\uc6a9\uc790\uc778\ud48b\uc758 3\ubc88\uca30 \uae00\uc790\uac12\uacfc 0x77\uc744 XOR\ud55c \uac12\uc778 al\uc774 0x35\uc5ec\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c 0x77\uacfc 0x35\ub97c XOR \uc5f0\uc0b0\ud55c \uac12\uc778 0x42, 
\uc989 3\ubc88\uc9f8 \uae00\uc790\ub294 “B”\uc5ec\uc57c \ud55c\ub2e4.<\/strong><\/p>\n\n\n\n
\uadfc\ub370 \uc774\ub7ec\ub098\uc800\ub7ec\ub098, sub_407800\ub85c \uc774\ub3d9\ud558\uae30 \ub54c\ubb38\uc5d0 \ud398\uc774\ud06c\uc778 \uac83 \uac19\ub2e4…<\/s>|
\ud398\uc774\ud06c\uc778\uc904 \uc54c\uc558\ub294\ub370, \uc870\uac74\uc774 \ub9de\uc544\uc57c jnz\uc5d0 \uc758\ud574 \ubd84\uae30\ub418\uc9c0 \uc54a\uace0, call\ub85c \ub118\uc5b4\uac00 \ub2e4\uc2dc \uac80\uc99d\ud560 \uc218 \uc788\ub294 \ud568\uc218\ub85c \ubcf5\uadc0\ud560 \uc218 \uc788\uae30 \ub54c\ubb38\uc5d0 \ud398\uc774\ud06c\uac00 \uc544\ub2c8\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
dword_40CD80\uc5d0 2\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac00\uace0, ecx \ub610\ud55c \uadf8\ub807\ub2e4.<\/p>\n\n\n\n
.text:004077AC xor cl, 20h
\ubcf5\uadc0\ud558\uace0\ub098\uc11c \uadf8\ub807\uac8c 2\ubc88\uc9f8 \uae00\uc790\uac12\uacfc 0x20\uc744 XOR\ud55c \uac12\uc774 cl \ub808\uc9c0\uc2a4\ud130\uc5d0 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc0ac\uc6a9\uc790\uc778\ud48b\uc758 2\ubc88\uca30 \uae00\uc790\uac12\uacfc 0x20\uc744 XOR\ud55c \uac12\uc778 cl\uc774 0x69\uc5ec\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c 0x20\uacfc 0x69\ub97c XOR \uc5f0\uc0b0\ud55c \uac12\uc778 0x49, 
\uc989 2\ubc88\uc9f8 \uae00\uc790\ub294 “I”\uc5ec\uc57c \ud55c\ub2e4.<\/strong><\/p>\n\n\n\n
dword_40CD30\uc5d0\ub294 5\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac00\uace0,
byte_40CCE0\uc5d0\ub294 \uc22b\uc790 2\uac00 \ub4e4\uc5b4\uac00\uace0,
dl \ub808\uc9c0\uc2a4\ud130\uc5d0\ub294 \uccab\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n

\ud398\uc774\ud06c \ucf54\ub4dc\uac00 \ub4e4\uc5b4\uc788\ub2e4.<\/p>\n\n\n\n
1\ubc88\uc9f8 \uae00\uc790\uac12\uacfc 0x10\uc744 XOR\ud55c \uac12\uc774 0x43\uc778\uc9c0 \ud655\uc778\ud558\ub294\ub370, 
\uc774 \uc870\uac74\uc774 \ub9cc\uc871\ud558\uc9c0 \uc54a\uc544\uc57c \ud55c\ub2e4.<\/p>\n\n\n\n
\uc989, .text:0040781A jnz short loc_407824 \ub85c \ubd84\uae30\ud574\uc57c \ub2e4\uc74c \uac80\uc99d\uc744 \uc9c4\ud589\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
 <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc774\ud6c4 sub_407838\uc744 \ud638\ucd9c\ud558\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub294\ub370,
dl \ub808\uc9c0\uc2a4\ud130\uac12\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 4\ubc88\uc9f8 \uae00\uc790\uac12,
al \ub610\ud55c 4\ubc88\uc9f8,
byte_40C400 \ub610\ud55c 4\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\uadf8\ub807\uac8c \uc810\ud504\ub97c \uc5ec\ub7ec\ubc88 \uac70\uce58\ub2e4\ubcf4\uba74, <\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
byte_40C401\uc5d0 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 4\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac00\uace0,
dword_40B084\uc5d0 1\uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.
\uadf8\ub9ac\uace0 \uc810\ud504\ub97c \ub610 \uac70\uce58\ub2e4\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
byte_40CFF4\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 6\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uadf8\ub807\uac8c \uc5ec\ub7ec\ubc88 \ub8e8\ud504\ub97c \uac70\uce58\uace0\ub098\uba74,
.text:004078BF jmp short loc_4078DB\uc5d0 \uc758\ud574,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
004078DB \uc8fc\uc18c\ub85c \uc810\ud504\ud55c\ub2e4.
\ud558\ub098\uc529 call\ud558\ub294 \ud568\uc218\uc5d0 \ub300\ud574 \uc0b4\ud3b4\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_4078FD<\/strong>
edx \ub808\uc9c0\uc2a4\ud130\uac12\uc744 0\uc73c\ub85c \ucd08\uae30\ud654\ud55c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_40790E<\/strong>
dl \ub808\uc9c0\uc2a4\ud130\uac12\uc5d0 \uc0ac\uc6a9\uc790\uc758 4\ubc88\uc9f8 \uc778\ud48b\uac12\uacfc 0x21\uc744 XOR \uc5f0\uc0b0\ud55c \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uadf8\ub807\uac8c XOR \uc5f0\uc0b0\ub41c \uac12\uc778 dl \ub808\uc9c0\uc2a4\ud130\uac12\uc774 0x64\uc5ec\uc57c \ub41c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c 0x21\uacfc 0x64\ub97c XOR \uc5f0\uc0b0\ud55c \uac12\uc778 0x45, 
\uc989 4\ubc88\uc9f8 \uae00\uc790\ub294 “E”\uc5ec\uc57c \ub41c\ub2e4.<\/strong>
\uadf8\ub7ec\uba74 loc_409DCE\ub85c \ubd84\uae30\ud560 \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
dl \ub808\uc9c0\uc2a4\ud130\uac12\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 5\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uac00\uace0,
eax, edi, ecx \ub808\uc9c0\uc2a4\ud130\uac12 \ubaa8\ub450 0\uc73c\ub85c \ucd08\uae30\ud654\ud55c\ub2e4.<\/p>\n\n\n\n
call\ud558\ub294 3\uac00\uc9c0 \ud568\uc218\uac00 \uc788\ub294\ub370, \ub610 \uc0b4\ud3b4\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_407E10<\/strong>
\ubb34\uc758\ubbf8\ud55c \ucf54\ub4dc<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_407E0C<\/strong>
\ubb34\uc758\ubbf8\ud55c \ucf54\ub4dc2<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_407E02<\/strong>
\uc0ac\uc6a9\uc790\uc758 \uc778\ud48b 5\ubc88\uc9f8 \uae00\uc790\uac12\uc774 \ub4e4\uc5b4\uc788\ub294 dl \ub808\uc9c0\uc2a4\ud130\uac12\uc5d0\ub2e4\uac00 
0x46\uc744 XOR \uc5f0\uc0b0\ud55c \uac12\uc774 \ub4e4\uc5b4\uac04\ub2e4.<\/p>\n\n\n\n
\ubcf5\uadc0\ud558\uba74, \uc774\uc81c loc_407DF4\ub85c \uc810\ud504\ud558\uace0 \ub610 \uc810\ud504, \uc5ec\ub7ec\ubc88 \uc810\ud504\ud55c\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\ub3c4\ucc29\ud558\uba74 sub_407E18 \ud568\uc218\ub97c \ud638\ucd9c\ud558\ub294 \uac83\uc744 \ubcfc \uc218 \uc788\ub2e4.<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
sub_407E02 \ud568\uc218\uc5d0 \uc758\ud574 \ubc18\ud658\ub41c \uac12\uc774 \uc0ac\uc6a9\uc790\uc758 \uc778\ud48b 5\ubc88\uc9f8 \uae00\uc790\uac12\uacfc 0x46\uc744 XOR\ud55c \uac12\uc774\ubbc0\ub85c, al \uac12\uc774 \uadf8\ub807\uac8c \ub41c\ub2e4.<\/p>\n\n\n\n
\uadf8\ub807\uac8c XOR \uc5f0\uc0b0\ub41c \uac12\uc778 al \ub808\uc9c0\uc2a4\ud130\uac12\uc774 8\uc774\uc5ec\uc57c \ub41c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c 0x46\uacfc 0x8 XOR \uc5f0\uc0b0\ud55c \uac12\uc778 0x4e, 
\uc989 5\ubc88\uc9f8 \uae00\uc790\ub294 “N”\uc774\uc5ec\uc57c \ub41c\ub2e4.<\/strong><\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
retn\uc5d0 \uc758\ud574 \uc774\uc81c loc_4078A6 \uc8fc\uc18c\ub85c \ubcf5\uadc0\ud55c\ub2e4.<\/p>\n\n\n\n
byte_40CFF4\uc5d0\ub294 \uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 6\ubc88\uc9f8 \uac12\uc774 \ub4e4\uc5b4\uac00\uc788\ub294\ub370,
\uadf8 \uac12\uacfc 4\ub9cc\ud07c rol \ud68c\uc804\ud55c \uac12\uc73c\ub85c byte_40CFF4\uc5d0 \ub2e4\uc2dc \uc800\uc7a5\ud55c\ub2e4.
\uadf8\ub9ac\uace0 loc_4078C1\uc73c\ub85c \uc810\ud504, \ub610 \uc810\ud504\ud558\uace0 <\/p>\n\n\n\n
.text:00407F60 call loc_407F6E
call\ud558\ub294 \uacf3\uc73c\ub85c \uac00\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc0ac\uc6a9\uc790 \uc778\ud48b\uc758 6\ubc88\uc9f8 \uac12\uacfc 4\ub9cc\ud07c rol \ud68c\uc804\ud55c \uac12\uc774 \ub4e4\uc5b4\uc788\ub294 byte_40CFF4\uac00 0x14\uc778\uc9c0 \ud655\uc778\ud55c\ub2e4.<\/p>\n\n\n\n
\ub530\ub77c\uc11c 0x14\uc744 4\ub9cc\ud07c ROR \ud68c\uc804\ud55c \uac12\uc778 0x41, 
\uc989 6\ubc88\uc9f8 \uae00\uc790\ub294 “A”\uc774\uc5ec\uc57c \ub41c\ub2e4.<\/strong><\/p>\n\n\n\n
\uc870\uac74\uc744 \ub9cc\uc871\uc2dc\ud0a4\uace0 step\uc744 \ubc1f\uc544 \ub118\uc5b4\uac00\ub2e4\ubcf4\uba74,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
eax\ub294 1\ub85c set\ub418\uace0,<\/p>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\"\"<\/figure>\n\n\n\n
\uc774\uc81c 0x4012CB\ub85c \ubcf5\uadc0\ud558\uc5ec \uac80\uc99d \uacb0\uacfc\ub97c \ubcf4\uc5ec\uc900\ub2e4!<\/p>\n\n\n\n
\uae34 \uc5ec\uc815\uc774\uc5c8\ub2e4…….<\/p>\n\n\n\n
solve.py<\/h2>\n\n\n\n
\n
\n
def rol(n, m):\n    shift = n << m\n    shift &= 255\n    src = n >> (8 - m)\n    return shift | src\n    \ndef ror(n, m):\n    shift = n >> m\n    src = n << (8 - m)\n    src &= 255\n    return shift | src\n\nglyph1 = chr(rol(0x49, 6))\nglyph2 = chr(0x20 ^ 0x69)\nglyph3 = chr(0x77 ^ 0x35)\nglyph4 = chr(0x21 ^ 0x64)\nglyph5 = chr(0x46 ^ 0x8)\nglyph6 = chr(ror(0x14, 0x4))\n\nkey = glyph1 + glyph2 + glyph3 + glyph4 + glyph5 + glyph6\n\nprint(f\"key: {key}\")<\/pre>\n<\/div>\n<\/div>\n\n\n\n
Result<\/h2>\n\n\n\n
\n
\n
PS C:\\Users\\Seo Hyun-gyu\\Desktop> python3 .\\solve_twist1.py\nkey: RIBENA<\/pre>\n<\/div>\n<\/div>\n\n\n\n
\"\"<\/figure>\n","protected":false},"excerpt":{"rendered":"
ReadMe.txt Twist1.exe is run in x86 windows. 32\ube44\ud2b8 \uc708\ub3c4\uc6b0\uc5d0\uc11c\ub9cc \uc2e4\ud589 \uac00\ub2a5\ud558\ub2e4 ExeInfo PE \uc54c\ub824\uc9c0\uc9c0 \uc54a\uc740 \ud504\ub85c\uadf8\ub7a8\uc73c\ub85c \ud328\ud0b9\ub418\uc5b4\uc788\ub294 \uac83 \uac19\ub2e4. \ub514\ubc84\uae45\uc744 \ud1b5\ud574 \ud558\ub098\uc529 \uc0b4\ud3b4\ubcf4\uc790. Analysis (Packed) \uc708\ub3c4\uc6b0 xp\uc5d0\uc11c \ud504\ub85c\uadf8\ub7a8\uc744 \uc2e4\ud589\uc2dc\ud0a4\ub3c4\ub85d \ud574\ubcf4\uc558\ub2e4. \uc6b0\uc120 \ucc98\uc74c\uc5d0 \uc2e4\ud589\ud558\ub2e4\ubcf4\uba74 \uc544\ub798\uc640 \uac19\uc740 \uc5d0\ub7ec\uac00 \ubc1c\uc0dd\ud55c\ub2e4. (\uc0ac\uc9c4) \uc548\ud2f0 \ub514\ubc84\uae45\uc774 \ud0d1\uc7ac\ub418\uc788\ub294 \ub4ef \ud558\ub2e4. \ud558\ub098\uc529 \uc2a4\ud15d\uc744 \ubc1f\uc544\ubcf4\uba74,sub_40709F, sub_4070C7 \ud568\uc218\ub97c \ud1b5\ud574 \ub514\ubc84\uae45\uc744 \ud0d0\uc9c0\ud558\ub294 \uac83\uc744 \uc54c \uc218 \uc788\ub2e4.… \ub354 \ubcf4\uae30 »Twist1<\/span><\/a><\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"neve_meta_sidebar":"","neve_meta_container":"","neve_meta_enable_content_width":"","neve_meta_content_width":0,"neve_meta_title_alignment":"","neve_meta_author_avatar":"","neve_post_elements_order":"","neve_meta_disable_header":"","neve_meta_disable_footer":"","neve_meta_disable_title":"","_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[16],"tags":[24],"class_list":["post-1723","post","type-post","status-publish","format-standard","hentry","category-reversing-kr","tag-reversing"],"jetpack_featured_media_url":"","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1723","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=1723"}],"version-history":[{"count":30,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1723\/revisions"}],"predecessor-version":[{"id":1885,"href":"https:\/\/h4ck.kr\/index.php?rest_route=\/wp\/v2\/posts\/1723\/revisions\/1885"}],"wp:attachment":[{"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=1723"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=1723"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/h4ck.kr\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=1723"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}