mirror of
https://github.com/qilingframework/qiling.git
synced 2026-10-12 02:21:40 +00:00
62 lines
1.6 KiB
Python
62 lines
1.6 KiB
Python
#!/usr/bin/env python3
|
|
#
|
|
# Cross Platform and Multi Architecture Advanced Binary Emulation Framework
|
|
#
|
|
|
|
from typing import Sequence
|
|
|
|
import sys
|
|
sys.path.append("..")
|
|
|
|
from qiling import Qiling
|
|
from qiling.const import QL_VERBOSE
|
|
from qiling.extensions import pipe
|
|
|
|
|
|
def instruction_count(ql: Qiling, address: int, size: int, user_data):
|
|
user_data[0] += 1
|
|
|
|
|
|
def get_count(flag: Sequence[str]):
|
|
ql = Qiling(["../examples/rootfs/x86_windows/bin/crackme.exe"], "../examples/rootfs/x86_windows", verbose=QL_VERBOSE.OFF, libcache = True)
|
|
ql.os.stdin = pipe.SimpleStringBuffer()
|
|
ql.os.stdout = pipe.SimpleStringBuffer()
|
|
|
|
count = [0]
|
|
ql.hook_code(instruction_count, count)
|
|
|
|
ql.os.stdin.write(bytes("".join(flag) + "\n", 'utf-8'))
|
|
ql.run()
|
|
|
|
print(ql.os.stdout.read().decode('utf-8'), end='')
|
|
print(f' ============ count: {count[0]:d} ============ ')
|
|
|
|
return count[0]
|
|
|
|
|
|
def solve():
|
|
# BJWXB_CTF{C5307D46-E70E-4038-B6F9-8C3F698B7C53}
|
|
prefix = list("BJWXB_CTF{C5307D46-E70E-4038-B6F9-8C3F698B7C")
|
|
flag = list("\x00" * 100)
|
|
base = get_count(prefix + flag)
|
|
i = 0
|
|
|
|
try:
|
|
for i in range(len(flag)):
|
|
for j in "}5353535353":
|
|
flag[i] = j
|
|
data = get_count(prefix + flag)
|
|
if data > base:
|
|
base = data
|
|
print("\n\n\n>>> FLAG: " + "".join(prefix + flag) + "\n\n\n")
|
|
break
|
|
if flag[i] == "}":
|
|
break
|
|
print("SOLVED!!!")
|
|
except KeyboardInterrupt:
|
|
print("STOP: KeyboardInterrupt")
|
|
|
|
|
|
if __name__ == "__main__":
|
|
solve()
|