2018湖湘杯

Author Avatar
Xzhah 11月 18, 2018
  • 在其它设备中阅读本文章

reverse_哈希爆破

呵呵，这比赛歧视穷人，台式爆破十分钟，笔记本一个小时

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
#include "stdafx.h"
#include<stdio.h>
#include<windows.h>
#include<string.h>
typedef __int64 (* main_t)(__int64 a,int b);
#define TIME_IAT 0x17A0
//#define CHECK_IAT 0x2268
//#define CHAT_1 0x5020
//int the_time=1526720400;


//__time64_t mygets(__time64_t *the_time_tmp)
//{
//	return the_time;
//}
/*void changeIAT(UINT64* iat, UINT64 newVal) //64位的函数实际地址为8字节，ida里time最后是[0x40a38c]里存着这个实际地址
{
	DWORD oldProtect;
	VirtualProtect(iat, sizeof(DWORD), PAGE_EXECUTE_READWRITE, &oldProtect);//保护内容就4字节
	*iat = newVal;
	VirtualProtect(iat, sizeof(DWORD), oldProtect, &oldProtect);
}*/
int main()
{
	printf("ok?");
	char chat_tmp[256]={0};
	HMODULE hMod = LoadLibraryA("reverse.dll");
	PBYTE pBase=(PBYTE)hMod;
	//memcpy(chat_tmp,pBase+CHAT_1,256);
	if (pBase == NULL)
	{
		printf("cannot LoadLibrary");
		auto err = GetLastError();
		printf("%d",err); //193错误就是dll错误，有可能是位数不对 ，126错误是找不到dll
		return -1;
		
	}

	//UINT64* timeiat = (UINT64* )(pBase + TIME_IAT);
	//changeIAT(timeiat, (UINT64)&mygets);
    
	main_t check_time=(main_t)(pBase + TIME_IAT);
	char time[10]={0};
	for (time[0]='0';time[0]<='9';time[0]++)
		for (time[1]='0';time[1]<='9';time[1]++)
			for (time[2]='0';time[2]<='9';time[2]++)
				for (time[3]='0';time[3]<='9';time[3]++)
					for (time[4]='0';time[4]<='9';time[4]++)
						for (time[5]='0';time[5]<='9';time[5]++)
							for (time[6]='0';time[6]<='9';time[6]++)
								for (time[7]='0';time[7]<='9';time[7]++)
									for (time[8]='0';time[8]<='9';time[8]++)
										for (time[9]='0';time[9]<='9';time[9]++)

										{
											//printf("%d\n",check_time((__int64)time,10));
		//printf("%d\n",the_time);
		if (check_time((__int64)time,10) ==0x42100A76DD5BEDC0)
		{
			printf("%s",time);
		}
	
										}
	
	getchar();
	system("pause");
	return 0;
}