0x9：a1[1] = input;0x16:a1[9] = a1[1];0x80:略过，没有影响。0x22:a1[1] >> = a1[2]  ; a1[2] = 13（这些值不是固定的）0x77:a1[1] ^= a1[9]    ; a1[9] = 输出时的a1[1]0x10:a1[9] = a1[1]       ; a1[1]计算之后出来的值又放至a1[9]0x23:a1[1] << = a1[2]  ; a1[2] = 90x31:a1[1] &=a1[2]       ; a1[2] = 0x78F396000x77:a1[1] ^a1[9]      ; a1[9] = 0x10后的a1[9]0x10:a1[9] = a1[1]       ; 0x23:a1[1] << a1[2]       ; a1[2] = 170x31:a1[1] &=a1[2]       ; a1[2] = 0x85D400000x77:a1[1] ^a1[9]       ;0x10:a1[9] = a1[1]       ;0x22:a1[1] >>=a1[2]       ;a1[2] = 190x77:a1[1] ^a1[9]       ;0xA0:a1 ==? 653840640  ;最终值是否等于653840640，不等于则退出
0xA4:存a1[1]
0xA1：print("flag:")        ;长度为33的0xC1:取输入的flag0xB1:取前边4个计算结果0x77:flag的每一位分别与四个中的一个^计算0xC2:比较。与一个地方的值比较
0xC1:取flag0xB2:取前边结果的第二个    ;B1 B2 B3 B4分别是四个前边的值0x77:^0xC2:
0xC1:取flag

操作码说明0x9：a1[1] = input;0x16:a1[9] = a1[1];0x80:略过，没有影响。0x22:a1[1] >> = a1[2]  ; a1[2] = 130x77:a1[1] ^= a1[9]    ; a1[9] = 输出时的a1[1]0x10:a1[9] = a1[1]       ; a1[1]计算之后出来的值又放至a1[9]0x23:a1[1] << = a1[2]  ; a1[2] = 90x31:a1[1] &=a1[2]       ; a1[2] = 0x78F396000x77:a1[1] ^a1[9]      ; a1[9] = 0x10后的a1[9]0x10:a1[9] = a1[1]       ; 0x23:a1[1] << a1[2]       ; a1[2] = 170x31:a1[1] &=a1[2]       ; a1[2] = 0x85D400000x77:a1[1] ^a1[9]       ;0x10:a1[9] = a1[1]       ;0x22:a1[1] >>=a1[2]       ;a1[2] = 190x77:a1[1] ^a1[9]       ;0xA0:a1 ==? 653840640  ;最终值是否等于653840640，不等于则退出-----------------------------------------------------------未知内容-a1[1]  a1[9]->该值是否是上边的计算结果？0x9:input                ; 同样是上边的输入  0xFFE8BC9A0x31:a1[1] & 0xff       ;&a1[2]0x43:a1[1] * 0x08629008 ;*a1[3] 乘法  == 0x1340x41:a1[1] + 0x180xA4:存a1[1]

下一个input开始0x9:input0x22:input >> 0x8       ; 0x31:input & 0xFF       ;这两步结合起来应该是 取3，4处，前边那里是取1，2处0x44:input / 0xBC       ;除法，没错的话，此时的input是7，结果为1A0x41:input + 0x21        ;加法 0xA4:存
下一个input开始0x9:input0x22:input >> 0x10         ;0x31:input & 0xFF       ;这两步结合起来应该是 取 5 6处0x77:input ^ 0xBB        ;0x41:input + 0xff       ; 0xA4:存
下一个input开始0x9:input0x22:input >> 0x180x31:input & 0xff        ;取 7 8 处0x42:input - 0xA0       ;0x41:input + 0x77       ;0xA4:存

再之后：0xA1：print("flag:")        ;长度为33的0xC1:取输入的flag0xB1:取前边4个计算结果0x77:flag的每一位分别与四个中的一个^计算0xC2:比较。与一个地方的值比较
0xC1:取flag0xB2:取前边结果的第二个    ;B1 B2 B3 B4分别是四个前边的值0x77:^0xC2:
0xC1:取flag0xB4:                    ;貌似不是按顺序的    cmp :0x95 0x106  .data:0804B164 db 0ADh  相差八位取值应该使用脚本提取B1/2/3/4的顺序。也用脚本提取最终的比较值 题目就能完成了

"""1.smc2.虚拟机操作：    通过一个个字节码，分为了三部分的操作：        2.1 输入一个值，经过一系列计算后，等于某个值。使用z3求解。        2.2 该值分为4部分，各自进行计算。得出四个中间值，用于后边的计算。        2.3 进行flag的输入。对输入的flag进行计算。最终与其中的一些字节码比较。得出结果    很多数据 比如 最终比较的值，中间值的选择，我都直接用idapython提取出来了。3.模拟执行的办法 要实现。"""from z3 import *s = Solver()a = BitVec("a", 34)print(type(a)) a ^= (a >> 13)a ^= (a << 9) & 0x78F39600a ^= (a << 17) & 0x85D40000a ^= a >> 19s.add(a == 0x26F8D100) print(s.check())m = s.model()print(m)[a = 4293442714]  # print("".join(list(map(chr, range(ord('a'), ord('z') + 1))))+"abcdefg")# print(len("abcdefghijklmnopqrstuvwxyzabcdef")) tmp = [0x14C, 0x3B, 0x152, 0x0D6] # 取 B = [0x1,0x2,0x4,0x3,0x2,0x4,0x1,0x3,0x1,0x1,0x3,0x3,0x4,0x2,0x3,0x1,0x3,0x3,0x2,0x1,0x3,0x1,0x3,0x4,0x1,0x4,0x1,0x3,0x2,0x3,0x1,0x2]# [0xb1,0xb2,0xb4,0xb3,0xb2,0xb4,0xb1,0xb3,0xb1,0xb1,0xb3,0xb3,0xb4,0xb2,0xb3,0xb1,0xb3,0xb3,0xb2,0xb1,0xb3,0xb1,0xb3,0xb4,0xb1,0xb4,0xb1,0xb3,0xb2,0xb3,0xb1,0xb2]print(len(B)) fin = [0x10b,0x7a,0x95,0x106,0x7d,0xad,0x12f,0x165,0x12d,0x12f,0x139,0x10d,0xbb,0x8,0x10d,0x13f,0x13a,0x161,0x57,0x120,0x10d,0x13f,0x13f,0xb5,0x113,0xa0,0x121,0x10d,0xb,0x139,0x173,0x46]print(len(fin))# for i in range(len(B)):#    print(tmp[B[i] - 1])for i in range(len(B)):    fin[i] ^= tmp[B[i] - 1] # tmp的范围是[0,3] 但B的范围是从1开始的，是[1,4]for i in fin:    print(chr(i),end="")# print(fin)

MAX_FUNCSIZE            = 64        // Functions over 64K are not decompiled // 修改为：MAX_FUNCSIZE            = 1024        // Functions over 64K are not decompiled