![]() |
#2
自由而无用2021-09-17 13:38
//online parser: https://www.bccn.net/run/
add print info to help you analyse this impressive code, good luck! ![]() #include <stdio.h> #include <stdlib.h> typedef unsigned char uint8_t; typedef unsigned short uint16_t; typedef unsigned int uint32_t; #define USR_ADD uint32_t GetRandom(uint32_t *x) { uint32_t ret; ret = rand(); *x = ~ret; return ret; } void MemCopy(uint8_t* pSrc, uint8_t* pDst, uint16_t len) { uint32_t i, loop_i; uint32_t startIndex; uint32_t and_mask, xor_mask; uint32_t randVal, invRand; startIndex = GetRandom( &invRand ) >> 1; #ifdef USR_ADD //printf("startIndex = %d\n", startIndex); #endif xor_mask = GetRandom( &invRand ); #ifdef USR_ADD //printf("xor_mask = %d\n", xor_mask); #endif and_mask = 0x1ffff; //usr add #ifdef USR_ADD loop_i = 0; #endif while((len <= (and_mask >> 1 ) + 1) && (and_mask >> 1)) { #ifdef USR_ADD printf("recur = %d\n", loop_i++); #endif and_mask = and_mask >> 1; } xor_mask &= and_mask; for( loop_i = 0; loop_i <= and_mask; loop_i++ ) { i = ( startIndex + (loop_i ^ xor_mask) ) % len; pDst[i] = (uint8_t) GetRandom( &invRand ); randVal = GetRandom(&invRand); randVal = pSrc[i]; #ifdef USR_ADD printf("randVal[%d] = 0x%x\n", loop_i, randVal); #endif pDst[i] = randVal; randVal = invRand; } return; } int main(int argc, char *argv[]) { unsigned char a1[256] = {1, 2, 3, 4, 5, 0xe9, 0x12, 0x34, 0x56, 0x78, 0xc3}; unsigned char a2; int i; MemCopy(a1, &a2, 5); for (i = 0; i < 5; i++) printf("%02x ", ((uint8_t *)&a2)[i]); return 0; } output sample: recur = 0 recur = 1 recur = 2 recur = 3 recur = 4 recur = 5 recur = 6 recur = 7 recur = 8 recur = 9 recur = 10 recur = 11 recur = 12 recur = 13 randVal[0] = 0x2 randVal[1] = 0x3 randVal[2] = 0x34 randVal[3] = 0x1 randVal[4] = 0xe9 randVal[5] = 0x12 randVal[6] = 0x4 randVal[7] = 0x5 //clear the overflow shell code ? 01 01 00 00 00 [此贴子已经被作者于2021-9-17 14:08编辑过] |

#include <stdio.h>
#include <stdlib.h>
typedef unsigned char uint8_t;
typedef unsigned short uint16_t;
typedef unsigned int uint32_t;
uint32_t GetRandom( uint32_t* x)
{
uint32_t ret;
ret = rand();
*x = ~ret;
return ret;
}
void MemCopy( uint8_t* pSrc, uint8_t* pDst, uint16_t len )
{
uint32_t i, loop_i;
uint32_t startIndex;
uint32_t and_mask, xor_mask;
uint32_t randVal, invRand;
startIndex = GetRandom( &invRand ) >> 1;
xor_mask = GetRandom( &invRand );
and_mask = 0x1ffff;
while( ( len <= (and_mask >> 1 ) + 1 ) && ( and_mask > 1 ) )
{
and_mask = and_mask >> 1;
}
xor_mask &= and_mask;
for( loop_i = 0; loop_i <= and_mask; loop_i++ )
{
i = ( startIndex + (loop_i ^ xor_mask) ) % len;
pDst[i] = (uint8_t) GetRandom( &invRand );
randVal = GetRandom(&invRand);
randVal = pSrc[i];
pDst[i] = randVal;
randVal = invRand;
}
return;
}
void main()
{
unsigned char a1[256] = {1, 2, 3, 4, 5};
unsigned char a2[256];
int i;
MemCopy(a1, a2, 5);
for (i=0; i<5; i++)
{
printf("%02x ", a2[i]);
}
printf("\n");
}
#include <stdlib.h>
typedef unsigned char uint8_t;
typedef unsigned short uint16_t;
typedef unsigned int uint32_t;
uint32_t GetRandom( uint32_t* x)
{
uint32_t ret;
ret = rand();
*x = ~ret;
return ret;
}
void MemCopy( uint8_t* pSrc, uint8_t* pDst, uint16_t len )
{
uint32_t i, loop_i;
uint32_t startIndex;
uint32_t and_mask, xor_mask;
uint32_t randVal, invRand;
startIndex = GetRandom( &invRand ) >> 1;
xor_mask = GetRandom( &invRand );
and_mask = 0x1ffff;
while( ( len <= (and_mask >> 1 ) + 1 ) && ( and_mask > 1 ) )
{
and_mask = and_mask >> 1;
}
xor_mask &= and_mask;
for( loop_i = 0; loop_i <= and_mask; loop_i++ )
{
i = ( startIndex + (loop_i ^ xor_mask) ) % len;
pDst[i] = (uint8_t) GetRandom( &invRand );
randVal = GetRandom(&invRand);
randVal = pSrc[i];
pDst[i] = randVal;
randVal = invRand;
}
return;
}
void main()
{
unsigned char a1[256] = {1, 2, 3, 4, 5};
unsigned char a2[256];
int i;
MemCopy(a1, a2, 5);
for (i=0; i<5; i++)
{
printf("%02x ", a2[i]);
}
printf("\n");
}