babyre----ogeek2019

得到两个文件，分析elf文件，主要逻辑是在sub_D40()函数，细心分析代码，是lz77压缩算法，是一个根据重复字符来压缩的算法。LZ77算法原理及实现。

其中byte_202060是滑动窗口， byte_202040是前向缓冲区。但是最大匹配长度是17。
v11为当前的匹配长度。如果v11大于1，以17 bit 存储，第 1 bit 相当于标志位，其值为0，用于表示以压缩存储，第2 ~13 bit 为重复字符的地址，14~17 bit 为存储的短语字典 ；如果v11等于0，以 9 bit 存储，第一字节也是相当于标志位，其值为1，用于表示未找到匹配字符直接存储，2~9 bit 存储数据信息。

__int64 __fastcall sub_D40(_IO_FILE *a1, __int64 a2)
{
  signed int i; // [rsp+1Ch] [rbp-24h]
  signed int j; // [rsp+1Ch] [rbp-24h]
  signed int k; // [rsp+1Ch] [rbp-24h]
  int l; // [rsp+1Ch] [rbp-24h]
  signed int m; // [rsp+20h] [rbp-20h]
  signed int v8; // [rsp+24h] [rbp-1Ch]
  int v9; // [rsp+28h] [rbp-18h]
  signed int v10; // [rsp+2Ch] [rbp-14h]
  signed int v11; // [rsp+30h] [rbp-10h]
  int v12; // [rsp+34h] [rbp-Ch]
  int v13; // [rsp+38h] [rbp-8h]
  int v14; // [rsp+38h] [rbp-8h]

  memset(byte_202060, 0, 0x1000uLL);
  v9 = 1;
  for ( i = 0; i <= 16; ++i )
  {
    v13 = _IO_getc(a1);
    if ( v13 == -1 )
      break;
    byte_202060[i + 1] = v13;
  }
  v8 = i;
  v11 = 0;
  v12 = 0;
  while ( v8 )
  {
    if ( v11 > v8 )
      v11 = v8;
    if ( v11 > 1 )
    {
      v10 = v11;
      sub_933(a2, 0);
      sub_9E0(a2, v12, 12);
      sub_9E0(a2, v11 - 2, 4);
    }
    else
    {
      v10 = 1;
      sub_933(a2, 1);
      sub_9E0(a2, byte_202060[v9], 8);
    }
    for ( j = 0; j < v10; ++j )
    {
      v14 = _IO_getc(a1);
      if ( v14 == -1 )
        --v8;
      else
        byte_202060[((_WORD)v9 + 17 + (_WORD)j) & 0xFFF] = v14;
    }
    v9 = ((_WORD)v9 + (_WORD)v10) & 0xFFF;
    if ( v8 )
    {
      for ( k = 0; k <= 16; ++k )
        byte_202040[k] = byte_202060[((_WORD)v9 + (_WORD)k) & 0xFFF];
      v11 = 0;
      for ( l = ((_WORD)v9 + 17) & 0xFFF; l != v9; l = ((_WORD)l + 1) & 0xFFF )
      {
        if ( l )
        {
          for ( m = 0; m <= 16 && byte_202060[((_WORD)l + (_WORD)m) & 0xFFF] == byte_202040[m]; ++m )
            ;
          if ( m >= v11 )
          {
            v11 = m;
            v12 = l;
          }
        }
      }
    }
  }
  sub_933(a2, 0);
  return sub_9E0(a2, 0LL, 12);
}

那么我们要做的就是写出解压算法，将我们得到的output.file文件进行解压缩。这里参考星盟安全团队

#include <stdio.h>
#include <stdlib.h>
#include <string.h>
void recover(char *out_str, unsigned int position, unsigned int num, size_t out, char *buf)
{
    int i, p, o;
    char ch;
    p = position - 1;
    o = out;
    for (i = 0; i < num; i++)
    {
        if (((p -out) & 0xfff) >= 0 && ((p - out) & 0xfff) < 17)
        {
            p = position - 1;
            buf[(o & 0xfff)] = buf[(p & 0xfff)];
            out_str[o++] =buf[(p++ & 0xfff)]; // out_str[p++];
        }
        else
        {
            buf[(o & 0xfff)] = buf[(p & 0xfff)];
            out_str[o++] =buf[(p++ & 0xfff)]; // out_str[p++]
        }
    }
}
int main(int argc, char **argv)
{
    int bit, used;
    register union{
        int value;
        char bytes[4];
    }bits;
    unsigned char ch, *in_str, *out_str, buf[0x1000]
    unsigned int position, num;
    FILE *in_fp, *out_fp;
    size_t in = 0, all_in, out = 0;
    if(argc < 3)
    {
        puts("Usage: ./uncompressin_file out_file");
        exit(0);
    }
    in_fp = fopen(argv[1], "rb");
    if(in_fp == NULL)
    {
        perror("fopen error!");
        exit(-1);
    }
    out_fp = fopen(argv[2], "wb");
    if(out_fp == NULL)
    {
        perror("fopen error!");
        exit(-1);
    }
    setbuf(out_fp, NULL);
    in_str = malloc(62914560);
    out_str = malloc(62914560);
    memset(buf, 0, 0x1000);
    all_in = fread(in_str, 1, 62914560, in_fp);
    bits.bytes[3] = in_str[in++];
    bits.bytes[2] = in_str[in++];
    bits.bytes[1] = in_str[in++];
    bits.bytes[0] = in_str[in++];
    used = 0;
    while (in <all_in)
    {
        if(bits.value& 0x80000000)
        {
            bits.value<<= 1;
            ch = bits.bytes[3];
            bits.value<<= 8;
            buf[out & 0xfff] = ch;
            out_str[out++] =ch;
            used += 9;
        }
        else
        {
            bits.value<<= 1;
            position =(bits.value & 0xfff00000) >> 20;
            bits.value<<= 12;
            num =((bits.value & 0xf0000000) >> 28) + 2;
            bits.value<<= 4;
            recover(out_str,position, num, out, buf);
            out += num;
            used += 17;
        }
        while(used / 8)
        {
            bits.value |=(in_str[in++] << (used - 8));
            used -= 8;
        }
    }
    fwrite(out_str, 1, out, out_fp);
    fclose(out_fp);
    fclose(in_fp);
    free(in_str);
    free(out_str);
    return 0;
}

root@kali:~# gcc -s -O3 1.c -o 1
root@kali:~# ./1 output.file result
解压得到一张图片，得到flag。