{"id":496,"date":"2024-10-09T23:35:18","date_gmt":"2024-10-09T15:35:18","guid":{"rendered":"https:\/\/www.94i.top\/?p=496"},"modified":"2024-11-04T16:59:37","modified_gmt":"2024-11-04T08:59:37","slug":"%e6%9f%90%e7%8c%bf%e5%8f%a3%e7%ae%97sign%e5%88%86%e6%9e%90","status":"publish","type":"post","link":"https:\/\/www.94i.top\/index.php\/2024\/10\/09\/%e6%9f%90%e7%8c%bf%e5%8f%a3%e7%ae%97sign%e5%88%86%e6%9e%90\/","title":{"rendered":"\u67d0\u733f\u53e3\u7b97sign\u5206\u6790"},"content":{"rendered":"

\u524d\u8a00<\/h1>\n

\u672c\u6587\u7ae0\u4ec5\u505a\u79fb\u52a8\u5b89\u5168\u5b66\u4e60\u4ea4\u6d41\u7528\u9014\uff0c\u4e25\u7981\u4f5c\u5176\u4ed6\u7528\u9014\uff0c\u5982\u679c\u4fb5\u72af\u60a8\u7684\u6743\u76ca\u8bf7\u8054\u7cfb\u6211\u5220\u9664\u3002<\/p>\n

\u6240\u7528\u5de5\u5177: IDA Pro, frida, jadx<\/p>\n

\u5206\u6790<\/h1>\n

\u8be5app\u5e26\u6709\u53cd\u8c03\u8bd5\uff0c\u5728libmaoaidesc.so\u6587\u4ef6\u4e2d\uff0c\u7528dlsym\u51fd\u6570\u53ef\u4ee5hook\u5230\u8c03\u7528\u4e86pthread_create\uff0c\u4e0e\u67d0\u9ed1\u76d2\uff0cbili\u662f\u4e00\u6837\u7684\uff0c\u8fc7\u68c0\u6d4b\u4ee3\u7801<\/a><\/p>\n

Point<\/h1>\n

1.sub_64960\u4e2d\u7684sub_6551C<\/p>\n

jadx<\/h2>\n

\u5728jadx\u4e2d\u641c\u7d22\u5173\u952e\u8bcdisBackground<\/code>

\"\"<\/div>
\n\u8fdb\u53bb\u770b\u5230
\n
\"\"<\/div>
\n\u6309x\u67e5\u770bsign<\/code>\u7684\u8c03\u7528
\n
\"\"<\/div>
\n\u53d1\u73b0\u4e24\u5904\uff0c\u8fdb\u7b2c\u4e8c\u5904\u53d1\u73b0
\n
\"\"<\/div>
\nhook\u8fd9\u4e2a\u65b9\u6cd5
\n
\"\"<\/div>
\n\u7ecf\u8fc7\u5bf9\u6bd4\u53d1\u73b0
\n
\"\"<\/div>
\n\u90a3\u4e48\u53ef\u4ee5\u786e\u5b9a\u8fd9\u4e2a\u5c31\u662fsign<\/code>\u503c\uff0c\u6309d\u67e5\u770b\u8fd9\u4e2am51046b\u65b9\u6cd5
\n
\"\"<\/div>
\n\u53d1\u73b0\u4f20\u8fdb\u4e86\u4e09\u4e2a\u53c2\u6570\uff0c\u7b2c\u4e00\u4e2a\u662furl\u63a5\u53e3\uff0c\u7b2c\u4e8c\u4e2a\u662f\u56fa\u5b9a\u5b57\u7b26\u4e32wdi4n2t8edr<\/code>\uff0c\u7b2c\u4e09\u4e2a\u6682\u65f6\u4e0d\u77e5\u9053\u662f\u600e\u4e48\u751f\u6210\u7684\uff0c\u4f46\u662f\u5927\u591a\u6570\u65f6\u5019\u503c\u4e3a-1<\/code>\uff0c\u6309d\u8fdb\u5165\u51fd\u6570zcvsd1wr2t<\/code>\uff0c\u53d1\u73b0
\n
\"\"<\/div>\uff0c\u52a0\u8f7d\u4e86RequestEncoder\u8fd9\u4e2aso\u6587\u4ef6\uff0c\u8fdb\u5165native\u5c42<\/p>\n

IDA<\/h2>\n

\u76f4\u63a5\u7528findhash\u63d2\u4ef6\u641c\u7d22\uff0c\u5b9a\u4f4d\u5230\u51fd\u6570sub_64A84<\/code>
\n

\"\"<\/div>
\n\u53ef\u4ee5\u770b\u51fa\u662f\u4e00\u4e2aMD5\u51fd\u6570\uff0c\u67e5\u770b\u6b64\u51fd\u6570\u8c03\u7528
\n
\"\"<\/div>
\n\u5728sub_6551C<\/code>\u51fd\u6570\u4e2d\uff0chook\u8be5\u51fd\u6570\uff0chook\u4ee3\u7801<\/p>\n
function hook_sub_6551C(){\n    Java.perform(function () {\n        var a45d = Module.findBaseAddress("libRequestEncoder.so")\n        a45d = a45d.add(0x6551C)\n        Interceptor.attach(a45d,{\n            onEnter:function(arg){\n                var c_arg1 = arg[1].readCString();\n                var c_arg2 = arg[2];\n                console.log("\u53c2\u65701\uff1a",(arg[1]),c_arg1);\n                console.log("\u53c2\u65702\uff1a",arg[2],c_arg1);\n            },\n            onLeave:function(ret){\n                console.log("\u8fd4\u56de\u503c\uff1b",(ret),ptr(ret).readCString());\/\/.add(0x1)\n                console.log();\n            }\n        })\n    });\n}<\/code><\/pre>\n
\u53ef\u4ee5\u5f97\u5230
\n
\"\"<\/div><\/p>\n
\/leo-exam\/android\/photograph\/paper\/experiencewdi4n2t8edr7816b3677e8e2e81e2db7602f38a223c\/leo-exam\/android\/photograph\/paper\/experience2e88d87168558127e673cd8596596cae576175548014621528808779773355443228808783155761755132880877428808783288087697480146228808777155761755576175515181532009753200976576175524007312880877713960292596029252880877915288087799602925288087799602925288087761677721628808779715151515401537985928962618979152400731288087155761755480146201828808737985928962880876971533554432288087772216059480146215261897915221605928808776320097532009761677721628808779ab24139cfb96a255c09ab23cccb986c8wdi4n2t8edr<\/code><\/pre>\n
\u5c06\u8be5\u53c2\u6570\u5206\u4e3a4\u6bb5\uff1a
\n\u5b57\u6bb51\uff1a\/leo-exam\/android\/photograph\/paper\/experiencewdi4n2t8edr<\/code>\u4e3a\u63a5\u53e3\uff0b\u56fa\u5b9a\u5b57\u7b26\u4e32wdi4n2t8edr<\/code>\uff0c\u5176MD5\u7684\u503c\u4e3a7816b3677e8e2e81e2db7602f38a223c<\/code>
\n\u5b57\u6bb52\uff1a\u5b57\u6bb51+MD5(\u5b57\u6bb51)+\u63a5\u53e3+MD5(\u5b57\u6bb51+MD5(\u5b57\u6bb51)+\u63a5\u53e3)
\n\u5b57\u6bb53\uff1a576175548014621528808779773355443228808783155761755132880877428808783288087697480146228808777155761755576175515181532009753200976576175524007312880877713960292596029252880877915288087799602925288087799602925288087761677721628808779715151515401537985928962618979152400731288087155761755480146201828808737985928962880876971533554432288087772216059480146215261897915221605928808776320097532009761677721628808779<\/code>\uff0c\u4e0d\u77e5\u9053\u751f\u6210\u65b9\u5f0f
\n\u5b57\u6bb54\uff1aab24139cfb96a255c09ab23cccb986c8wdi4n2t8edr<\/code>\uff0c\u4e3aMD5(\u5b57\u6bb51+\u5b57\u6bb52+\u5b57\u6bb53)+wdi4n2t8edr<\/p>\n
\"\"<\/div>
\n\u5728sub_6551C<\/code>\u7684\u4e0b\u9762\u6709\u4e00\u4e2asub_655E4<\/code>\uff0chook\u8fd9\u4e2a\u51fd\u6570\u53d1\u73b0
\n
\"\"<\/div>
\n\u5176\u6700\u7ec8\u8fd4\u56de\u503c\u548csign\u503c\u76f8\u540c\u3002<\/p>\n
\n
\u4e3a\u4e86hook\u5230\u6ce8\u518c\u7684RegisterNatives\u51fd\u6570\uff0c\u5728\u8fc7\u68c0\u6d4b\u4ee3\u7801\u4e2d\u4fee\u6539\u51fd\u6570hook_dlopen<\/code>\u4e3a<\/p>\n
function hook_dlopen() {\n    var interceptor = Interceptor.attach(Module.findExportByName(null, "android_dlopen_ext"),\n        {\n            onEnter: function (args) {\n                var pathptr = args[0];\n                if (pathptr !== undefined && pathptr != null) {\n                    var path = ptr(pathptr).readCString();\n                    console.log("[LOAD]", path)\n                    if (path.indexOf("libmsaoaidsec.so") > -1) {\n                        hook_dlsym()\n                    }else if(path.indexOf("libRequestEncoder.so") > -1){\n                        hook_RegisterNatives();\n                    }\n                }\n            },\n        }\n    )\n    return interceptor\n}<\/code><\/pre>\n
\u6ce8\u5165\u542f\u52a8app\uff0c\u63a7\u5236\u53f0\u641c\u7d22zcvsd1wr2t<\/code>\uff0c\u5f97\u5230
\n
\"\"<\/div>
\n\u5373native\u51fd\u6570zcvsd1wr2t<\/code>\u5bf9\u5e94\u4e3asub_0x61bd4<\/p>\n
[RegisterNatives] java_class: com.fenbi.android.leo.utils.e name: zcvsd1wr2t sig: (Ljava\/lang\/String;Ljava\/lang\/String;I)Ljava\/lang\/String; fnPtr: 0x7af4fb2bd4 module_name: libRequestEncoder.so module_base: 0x7af4f51000 offset: 0x61bd4<\/code><\/pre>\n
hook\u8be5\u51fd\u6570\uff0c\u5176\u8fd4\u56de\u503c\u5c31\u662fsign\u53c2\u6570
\n
\"\"<\/div>
\n\u5904\u7406\u4e00\u4e0b\u53c2\u6570\u7684\u6253\u5370
\n
\"\"<\/div>
\n\u53d1\u73b0\u53c2\u65702\u548c\u53c2\u65703\u548c\u53c2\u65704\u6b63\u662f\u5728java\u5c42\u4e2d\u4f20\u5165\u7684\u53c2\u6570\u3002\uff08\u6ce8\uff1a\u56e0\u4e3a\u53c2\u65704\u65f6\u5e26\u7b26\u53f7\u4f4d\uff0c\u56e0\u6b64\u662f-1\uff09
\n
\"\"<\/div>
\nhook\u4ee3\u7801<\/p>\n
function hook_sub_61BD4(){\n    Java.perform(function () {\n        let C14561e = Java.use("com.fenbi.android.leo.utils.e");\n        C14561e["zcvsd1wr2t"].implementation = function (str, str2, i) {\n            console.log(`C14561e.zcvsd1wr2t is called: str=${str}, str2=${str2}, i=${i}`);\n            let result = this["zcvsd1wr2t"](str, str2, i);\n            console.log(`C14561e.zcvsd1wr2t result=${result}`);\n            return result;\n        };\n\n        var a45d = Module.findBaseAddress("libRequestEncoder.so")\n        a45d = a45d.add(0x61BD4)\n        Interceptor.attach(a45d,{\n            onEnter:function(arg){\n                var c_arg0 = ptr(arg[0]).readCString();\n                var c_arg1 = ptr(arg[1]).readCString();\n                var c_arg2 = ptr(arg[2]).readCString();\n                var c_arg3 = ptr(arg[3]).readCString();\n                var c_arg4 = ptr(arg[4]);\n                console.log("\u53c2\u65700\uff1a",arg[0],getAsciiLog(arg[0],16), (arg[0]));\n                console.log("\u53c2\u65701\uff1a",(arg[1]),getAsciiLog(arg[1],16),objectToString(arg[1]));\n                console.log("\u53c2\u65702\uff1a",(arg[2]),getAsciiLog(arg[2],16),objectToString(arg[2]));\n                console.log("\u53c2\u65703\uff1a",(arg[3]),getAsciiLog(arg[3],16),objectToString(arg[3]));\n                console.log("\u53c2\u65704\uff1a",(arg[4]),(arg[4]),(arg[4]));\n            },\n            onLeave:function(ret){\n                console.log("\u8fd4\u56de\u503c\uff1b",ret, objectToString(ret));\/\/.add(0x1)\n                console.log();\n            }\n        })\n\n    });\n}<\/code><\/pre>\n
2024-10-11<\/h2>\n
\u7b80\u5355\u5206\u6790\u5224\u65ad\u52a0\u5bc6\u6d41\u7a0b\uff1a
\n\u4f20\u63a5\u53e3\u5b57\u7b26\u4e32\u548c\u56fa\u5b9a\u5b57\u7b26\u4e32\u4e8esub_61BD4\uff0c\u8c03\u7528\u4e94\u6b21sub_64960\uff0c\u5728\u6bcf\u6b21sub_64960\u6267\u884c\u4e2d\uff0c\u53c8\u8c03\u7528\u4e09\u6b21sub_6551C\uff0c\u5373\u4e00\u5171\u8c03\u752815\u6b21sub_6551C\uff0c\u901a\u8fc7hook\u51fd\u6570sub_6551C\uff0c\u53d1\u73b0\u786e\u5b9e\u8c03\u7528\u4e8615\u6b21\uff0c\u90a3\u4e48\u6309\u7167\u6267\u884c\u987a\u5e8f\uff0c\u53ef\u4ee5\u77e5\u9053\u6bcf\u6b21\u8c03\u7528\u5bf9\u5e94\u7684\u662f\u54ea\u4e2a\u4f4d\u7f6e\u3002<\/p>\n
\/leo-exam\/android\/photograph\/paper\/experiencewdi4n2t8edr7816b3677e8e2e81e2db7602f38a223c\/leo-exam\/android\/photograph\/paper\/experience2e88d87168558127e673cd8596596cae5762155480179616288107817733554432288107831657621552028810774288107832881077774801796288107811657621555762155162116320119732011985762155240089828810774720960359396035932881078116288107819603593288107819603593288107801677721628810781471616161640163631869312261916118240089828810716576215548017960212881073631869312288107777183355443228810781221621348017961626191611622162132881078032011973201198167772162881078196be3984368a5948474cd19ec491c759wdi4n2t8edr<\/code>
\n\u5bf9\u5e94sign\u503cea1af8b12973ab36e8d8f5ca59fffc47<\/code>
\n\/bh5\/leo-web-search\/search.htmlwdi4n2t8edrabe0f1a802d83316b79e5f1e51d14d56\/bh5\/leo-web-search\/search.html0483ea40bbbcbdb568adcf6f0e9add5d57621564801797132881081677335544322881078713576215617288107842881078728810784748017972881078613576215657621561317133201198320119957621562400898288107851179603594960359428810816132881081696035942881081696035942881078516777216288108165113131313451375099520261916215240089828810713576215648017975172881077509952028810784715335544322881078622162144801797132619162132216214288107853201198320119916777216288108165998389161498beaf124128a56231d3awdi4n2t8edr<\/code>
\n\u5bf9\u5e94sign\u503c6aa4b41358961a5b0ec944285507e69b<\/code><\/p>\n
\u5c06\u6b64\u7c7b\u578b\u503c\u76f4\u63a5MD5\u53ef\u5f97\u5230sign<\/p>\n
\u5206\u6790\u6b64\u53c2\u6570<\/h3>\n
\u7b2c\u4e00\u6bb5\uff1a
\n\u7b2c\u4e00\u6bb5\u4e3a\u63a5\u53e3+\u56fa\u5b9a\u5b57\u7b26\u4e32wdi4n2t8edr<\/code>
\n\/bh5\/leo-web-search\/search.htmlwdi4n2t8edr<\/code>
\n\u7b2c\u4e8c\u6bb5\uff1a
\nabe0f1a802d83316b79e5f1e51d14d56<\/code>\uff0c\u4e3a\u7b2c\u4e00\u6bb5MD5\u503c
\n\u7b2c\u4e09\u6bb5\uff1a
\n\/bh5\/leo-web-search\/search.htmlwdi4n2t8edrabe0f1a802d83316b79e5f1e51d14d56\/bh5\/leo-web-search\/search.html<\/code>\uff0c\u4e3a\uff1a\u7b2c\u4e00\u6bb5+\u7b2c\u4e8c\u6bb5+\u63a5\u53e3\u7684MD5\u503c
\n\u7b2c\u56db\u6bb5\uff1a
\n\/bh5\/leo-web-search\/search.htmlwdi4n2t8edrabe0f1a802d83316b79e5f1e51d14d56\/bh5\/leo-web-search\/search.html0483ea40bbbcbdb568adcf6f0e9add5d<\/code>\uff0c\u4e3a\uff1a\u7b2c\u4e09\u6bb5+\u7b2c\u4e09\u6bb5\u7684MD5\u503c
\n\u7b2c\u4e94\u6bb5\uff1a
\n\/bh5\/leo-web-search\/search.htmlwdi4n2t8edrabe0f1a802d83316b79e5f1e51d14d56\/bh5\/leo-web-search\/search.html0483ea40bbbcbdb568adcf6f0e9add5d5762156480179713288108167733554432288107871357621561728810784288107872881078474801797288107861357621565762156131713320119832011995762156240089828810785117960359496035942881081613288108169603594288108169603594288107851677721628810816511313131345137509952026191621524008982881071357621564801797517288107750995202881078471533554432288107862216214480179713261916213221621428810785320119832011991677721628810816<\/code>\uff0c\u4e3a\u7b2c\u56db\u6bb5
\n\u7b2c\u516d\u6bb5\uff1a
\n5998389161498beaf124128a56231d3a<\/code>\uff0c\u4e3a\u7b2c\u56db\u6bb5MD5\u503c<\/p>\n
\u5b8c\u6574\u4e3a\uff1a\u7b2c\u4e94\u6bb5+\u7b2c\u516d\u6bb5+wdi4n2t8edr<\/code><\/p>\n
\u73b0\u5728\u53ea\u9700\u8981\u5206\u6790\u51fa5762156480179713288108167733554432288107871357621561728810784288107872881078474801797288107861357621565762156131713320119832011995762156240089828810785117960359496035942881081613288108169603594288108169603594288107851677721628810816511313131345137509952026191621524008982881071357621564801797517288107750995202881078471533554432288107862216214480179713261916213221621428810785320119832011991677721628810816<\/code>\u7684\u751f\u6210\u5373\u53ef\u8fd8\u539f\u51fasign\u7b97\u6cd5<\/p>\n
2024-10-12<\/h2>\n
\u4e0a\u6587\u63d0\u5230 <\/p>\n
\n
\u4f20\u63a5\u53e3\u5b57\u7b26\u4e32\u548c\u56fa\u5b9a\u5b57\u7b26\u4e32\u4e8esub_61BD4\uff0c\u8c03\u7528\u4e94\u6b21sub_64960\uff0c\u5728\u6bcf\u6b21sub_64960\u6267\u884c\u4e2d\uff0c\u53c8\u8c03\u7528\u4e09\u6b21sub_6551C\uff0c\u5373\u4e00\u5171\u8c03\u752815\u6b21sub_6551C\uff0c\u901a\u8fc7hook\u51fd\u6570sub_6551C\uff0c\u53d1\u73b0\u786e\u5b9e\u8c03\u7528\u4e8615\u6b21\uff0c\u90a3\u4e48\u6309\u7167\u6267\u884c\u987a\u5e8f\uff0c\u53ef\u4ee5\u77e5\u9053\u6bcf\u6b21\u8c03\u7528\u5bf9\u5e94\u7684\u662f\u54ea\u4e2a\u4f4d\u7f6e\u3002<\/p>\n<\/blockquote>\n
\u5728\u7b2c\u56db\u6b21\u8c03\u7528sub_64960\u7684\u65f6\u5019\uff0c\u53c2\u6570\u540e\u52a0\u4e86\u4e00\u4e2a\u4e0d\u77e5\u9053\u7684\u957f\u6570\u7ec4\u5b57\u7b26\u4e32\u3002<\/p>\n
sub_61BD4\u8c03\u7528\u4e86\u4e00\u6b21sub_64960\uff0c\u800c\u5269\u4f59\u56db\u6b21\u5bf9sub_64960\u7684\u8c03\u7528\u5728sub_66A1C\u4e2d\uff0csub_61BD4\u4e2d\u8c03\u7528\u7684sub_64960\u4f20\u5165\u7684\u53c2\u65700\u4e3atoChars\uff0c\u53c2\u65701\u4e0d\u77e5\u9053\u3002<\/p>\n
\u5728\u6574\u4e2asign\u751f\u6210\u7684\u8fc7\u7a0b\u4e2d\uff0c\u6267\u884c\u4e865\u6b21sub_64960\uff0c\u9996\u6b21\u662fsub_61BD4\u4e2d\u7684\u4e00\u6b21\uff0c\u5176\u4f59\u56db\u6b21\u4f3c\u4e4e\u51fa\u73b0\u5728\u4e86sub_66A1C\u4e2d\uff0c\u5728\u7b2c\u56db\u6b21\u6267\u884csub_64960\u65f6\uff0c\u53c2\u65701\u591a\u4e86\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32<\/strong>
\nida\u5173\u952e\u4ee3\u7801\u5e94\u8be5\u662f<\/p>\n
std::string::append((int)v33, v20, v21);\nsub_64960((__int64)v38, (__int64)v33);<\/code><\/pre>\n
\u7b2c\u4e00\u53e5\u4ee3\u7801\u4f5c\u7528\u662f\u5c06v20\u7684\u5b57\u7b26\u4e32\u62fc\u63a5\u5230v33\u6240\u6307\u5b57\u7b26\u4e32\u7684\u540e\u9762\uff0c\u957f\u5ea6\u4e3av21\uff0c\u5c1d\u8bd5\u53bbhook\u4e00\u4e0b\u8fd9append\u51fd\u6570\u3002hook\u4ee3\u7801\u5982\u4e0b\uff1a<\/p>\n
function hook_append(){\n    Java.perform(function(){\n        var a45d = Module.findBaseAddress("libRequestEncoder.so")\n        \/\/ \u5047\u8bbe SO \u6587\u4ef6\u8def\u5f84\u4e3a "libyourlibrary.so"\uff0c\u4ee5\u53ca\u51fd\u6570\u5730\u5740\n        var moduleName = "libRequestEncoder.so";\n        var symbolName = "_ZNSt6__ndk112basic_stringIcNS_11char_traitsIcEENS_9allocatorIcEEE6appendEPKcm"; \/\/ C++ \u7684\u4fee\u9970\u540d\n\n        Interceptor.attach(Module.findExportByName(moduleName, symbolName), {\n            onEnter: function (args) {\n                \/\/ args[0] \u662f\u7b2c\u4e00\u4e2a\u53c2\u6570 _QWORD *a1\n                \/\/ args[1] \u662f\u7b2c\u4e8c\u4e2a\u53c2\u6570 void *src\n                \/\/ args[2] \u662f\u7b2c\u4e09\u4e2a\u53c2\u6570 unsigned __int64 n\n                console.log("std::string::append called");\n                console.log("a1: " + args[0]); \/\/ \u6253\u5370 a1\n                console.log("src: " + Memory.readUtf8String(args[1])); \/\/ \u6253\u5370 src \u5185\u5bb9\n                console.log("n: " + args[2].toInt32()); \/\/ \u6253\u5370 n \u7684\u503c\n            },\n            onLeave: function (retval) {\n                console.log("Return value: " + retval); \/\/ \u6253\u5370\u8fd4\u56de\u503c\n            }\n        });\n\n    })\n}<\/code><\/pre>\n
hook\u7ed3\u679c
\n
\"\"<\/div>
\nsub_66A1C\u4e2d\u4e00\u5171\u51fa\u73b0\u4e867\u6b21append\u51fd\u6570\uff0c\u6211\u4eec\u4e5fhook\u5230\u4e867\u6b21append\u51fd\u6570\uff0c\u4e14\u7b2c\u4e94\u6b21\u6dfb\u52a0\u4e86\u672a\u77e5\u5b57\u7b26\u4e32\uff0c\u800c\u7b2c\u4e94\u6b21\u5bf9\u5e94\u7684\u6b63\u597d\u5c31\u662f\u4e0a\u9762\u8d34\u51fa\u7684\u4f2a\u4ee3\u7801\uff0c\u56e0\u6b64\u53ef\u4ee5\u786e\u5b9a\uff0cv20\u5c31\u662f\u8fd9\u4e2a\u672a\u77e5\u5b57\u7b26\u4e32\u7684\u5730\u5740\u3002<\/p>\n
\u90a3\u4e48\u73b0\u5728\u7684\u4efb\u52a1\u5c31\u662f\u5206\u6790v20\u662f\u600e\u4e48\u6765\u7684<\/p>\n
2024-10-13
\n\u901a\u8fc7\u5bf9java\u5c42hook\u51fd\u6570\u5165\u53c2\u7684\u4fee\u6539\uff0c\u53d1\u73b0\u5f53\u4f20\u5165\u63a5\u53e3\u5b57\u7b26\u4e32\u56fa\u5b9a\u65f6\uff0c\u5728\u4e00\u5c0f\u6bb5\u65f6\u95f4\u5185\uff0c\u6240\u6709sign\u503c\u76f8\u540c\uff0c\u4e00\u6bb5\u65f6\u95f4\u540e\uff0csign\u503c\u5f00\u59cb\u53d8\u5316\u6210\u53e6\u5916\u4e00\u4e2asign\uff0c\u5e76\u6301\u7eed\u4e00\u5c0f\u6bb5\u65f6\u95f4\u3002<\/p>\n
\u7ecf\u8fc7\u89c2\u5bdf\u53d1\u73b0\uff0c\u8fd9\u4e00\u5c0f\u6bb5\u65f6\u95f4<\/strong>\u662f60\u79d2\uff0c\u6bcf60\u79d2\u5185\uff0c\u65e0\u8bba\u63a5\u53e3\u5b57\u7b26\u4e32\u662f\u4ec0\u4e48\uff0c\u6240\u6709\u672a\u89e3\u5bc6\u53c2\u6570\u7684\u503c\u90fd\u662f\u76f8\u540c\u7684\uff0c\u4e14\u5373\u4f7f\u5c06\u56fa\u5b9a\u5b57\u7b26\u4e32\u4fee\u6539\u4e3a\u4e0d\u540c\u7684\u503c\uff0c\u6240\u6709\u672a\u89e3\u5bc6\u53c2\u6570\u7684\u503c\u4e5f\u90fd\u662f\u76f8\u540c\u7684\uff0c\u4e5f\u5c31\u662f\u8bf4\uff0c\u672a\u89e3\u5bc6\u5b57\u7b26\u4e32\u7684\u751f\u6210\u4e0e\u65f6\u95f4\u6709\u5173\uff0c\u4e0e\u63a5\u53e3\u5b57\u7b26\u4e32\u548c\u56fa\u5b9a\u5b57\u7b26\u4e32\u65e0\u5173\u3002<\/p>\n
\u770b\u6c47\u7f16\u4ee3\u7801<\/p>\n
.text:0000000000066B5C 41 01 89 9A                   CSEL            X1, X10, X9, EQ         ; src<\/code><\/pre>\n
\n
CSEL X1, X10, X9, EQ \u7684\u610f\u601d\u662f\uff1a
\n\u5982\u679c\u4e4b\u524d\u7684\u6761\u4ef6\uff08\u901a\u5e38\u662f\u7531 CMP \u6307\u4ee4\u4ea7\u751f\u7684\uff09\u6ee1\u8db3 EQ\uff0c\u5219 X1 \u5c06\u53d6 X10 \u7684\u503c\u3002
\n\u5426\u5219\uff0cX1 \u5c06\u53d6 X9 \u7684\u503c\u3002
\n\u8fd9\u6761\u6307\u4ee4\u53ef\u4ee5\u7528\u4e8e\u6839\u636e\u6761\u4ef6\u6765\u51b3\u5b9a\u8d4b\u503c\u7ed9\u76ee\u6807\u5bc4\u5b58\u5668\u7684\u5185\u5bb9\u3002<\/p>\n<\/blockquote>\n
\u518d\u901a\u8fc7\u4ee3\u7801\u67e5\u770b\u5bc4\u5b58\u5668\u7684\u503c<\/p>\n
\/\/\u5728hook_append\u51fd\u6570\u4e2d\nconsole.log('X10:', this.context.x10.readCString());    \/\/ X10 \u5bc4\u5b58\u5668\u7684\u503c\nconsole.log('X9:', this.context.x9.readCString());    \/\/ X9 \u5bc4\u5b58\u5668\u7684\u503c<\/code><\/pre>\n
\"\"<\/div>
\n\u53ef\u4ee5\u770b\u5230\uff0cX9\u5bc4\u5b58\u5668\u4e2d\u5b58\u653e\u7740\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32\u3002\u90a3\u4e48\u5c31\u662f\uff0c\u524d\u9762\u7684\u4ee3\u7801\u4e2d\u5b58\u5728\u5c06\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32\u653e\u5230\u5bc4\u5b58\u5668X9\u7684\u64cd\u4f5c\uff0c\u90a3\u4e48\u6211\u4eec\u53ef\u4ee5\u518dhook\u4e00\u4e0b\u8fd9\u4e2asub_66A1C\u51fd\u6570\uff0c\u770b\u4e00\u4e0b\u5728\u521a\u5f00\u59cb\u8c03\u7528\u65f6X9\u5bc4\u5b58\u5668\u662f\u5426\u5c31\u5df2\u7ecf\u653e\u7740\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32\uff0c\u5982\u679c\u6ca1\u6709\uff0c\u90a3\u4e48\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32\u7684\u6765\u6e90\u5c31\u53ef\u4ee5\u9501\u5b9a\u5728\u8fd9\u4e2asub_66A1C\u7684\u5185\u90e8\uff1b\u5982\u679c\u6709\uff0c\u90a3\u4e48\u5c31\u9700\u8981\u505a\u53e6\u5916\u7684\u5206\u6790\u4e86\u3002<\/p>\n
\"\"<\/div>
\nhook\u53d1\u73b0\u5176\u4e2d\u5e76\u6ca1\u6709\u653e\u7740\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32\uff0c\u800c\u662fapi\u63a5\u53e3\uff0c\u90a3\u4e48\u6b63\u5982\u524d\u9762\u6240\u8bf4\uff0c\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32\u7684\u6765\u6e90\u5c31\u9501\u5b9a\u5728\u8fd9\u5757\u4ee3\u7801\u4e2d\u4e86\u3002<\/p>\n
sub_61BD4\u8c03\u7528\u4e86sub_66A1C<\/p>\n
sp+0x40\uff0cbp-0x80<\/p>\n
2024-10-14<\/h2>\n
sub_67198\u6bcf\u6b21\u7684\u8fd4\u56de\u503c\u90fd\u4e3a\u5f85\u89e3\u5bc6\u5b57\u7b26\u4e32<\/p>\n
\u89c2\u5bdfsub_65784\u51fd\u6570\uff0c\u5176\u4e3asub_67198\u6240\u8c03\u7528
\n5762156480179713288108167733554432288107871357621561728810784288107872881078474801797288107861357621565762156131713320119832011995762156240089828810785117960359496035942881081613288108169603594288108169603594288107851677721628810816511313131345137509952026191621524008982881071357621564801797517288107750995202881078471533554432288107862216214480179713261916213221621428810785320119832011991677721628810816<\/code>
\n\u518d\u770b\u8fd9\u6bb5\u5b57\u7b26\u4e32\uff0c\u5176\u4e2d\u768428810785<\/code>\u4e3a(\u65f6\u95f4\u6233-1)\/60<\/p>\n
2024-10-15<\/h2>\n
\u6211\u4eec\u8fd9\u91cc\u62ff57632614802717162881630877335544322881631116576326118288163042881631128816304748027172881631016576326157632611619163201811320181257632612401358288163021189605435960543528816308162881630896054352881630896054352881630516777216288163082116161616411613053413122619664172401358288163165763261480271711928816313053413122881630471733554432288163102216638480271716261966416221663828816305320181132018121677721628816308<\/code>\u6765\u4f5c\u4e3a\u4f8b\u5b50\u5206\u6790\u5176\u662f\u5982\u4f55\u6784\u9020\u7ec4\u6210\u7684\u3002<\/p>\n
\u9996\u5148\u9700\u8981\u8bf4\u660e\u7684\u662f\uff0c\u6b64\u4f8b\u5b50\u53c2\u6570\u5bf9\u5e94\u7684\u65f6\u95f4\u6233\u4e3a1728978392<\/code>
\n
\"\"<\/div><\/p>\n
\u8fd9\u91cc\u8bbea2<\/code>\u4e3a-1<\/code>\u901a\u8fc7\u4ee3\u7801*(_QWORD *)timer = (*(_QWORD *)timer + a2) \/ 60LL;<\/code>\u8ba1\u7b97\u540e\uff0ctimer<\/code>\u88ab\u8d4b\u503c\u4e3a28816306<\/code>\u3002<\/p>\n
\u5148\u5b9a\u4e49\u4e00\u4e9b\u51fd\u6570<\/h3>\n
def HIWORD(value):\n    return (value >> 16) & 0xFFFF\n\ndef LOBYTE(value):\n    return value & 0xFF  # \u53d6\u4f4e8\u4f4d\n\ndef HIBYTE(value):\n    return (value >> 8) & 0xFF  # \u53f3\u79fb8\u4f4d\u540e\u53d6\u4f4e8\u4f4d\n\ndef LOBYTE(w):\n    return w & 0xFF<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u57571<\/h3>\n
\"\"<\/div>
\n\u7136\u540e\u5c06\u6b64\u503c\u8d4b\u7ed9v3<\/code>\uff0c\u5e76\u8fdb\u884c\u8ba1\u7b97\uff0c\u8fd9\u91cc\u7684\u4f2a\u4ee3\u7801\u7528Python\u5b9e\u73b0\u4e3a\uff1a<\/p>\n
# block 1\ntimer_0 = 28816306\nv3 = timer_0\nv167 = timer_0 >> 4\nv157 = timer_0 >> 3\nv4 = v157 + v167 + ((v157 + v167) >> 4) + ((v157 + v167 + ((v157 + v167) >> 4)) >> 8)\nv5 = v4 + HIWORD(v4) + ((13 * (timer_0 - 5 * (v4 + HIWORD(v4)))) >> 6)\nprint("\u7b2c\u4e00\u4e2a => ",v5)\n# \u8f93\u51fa => 5763261<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u57572<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v6 = v3 + (v3 >> 31)\nv170 = v6\nv160 = v6 >> 3\nv7 = (v6 >> 3) + (v6 >> 5) + (((v6 >> 3) + (v6 >> 5)) >> 4)\nv8 = v7 + (v7 >> 8) + ((v7 + (v7 >> 8)) >> 16)\nv9 = v8 + ((11 * (v6 - 6 * v8)) >> 6)\nprint("\u7b2c\u4e8c\u4e2a => ",v9)\n# \u8f93\u51fa => 4802717<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u57573<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v171 = v3 >> 1\nv10 = ((((v171 & 0x55555555) + (v3 & 0x55555555)) >> 2) & 0x33333333)+ (((v171 & 0x55555555) + (v3 & 0x55555555)) & 0x33333333)\nv11 = (((((v10 >> 4) & 0x7070707) + (v10 & 0x7070707)) >> 8) & 0xF000F)+ ((((v10 >> 4) & 0x7070707) + (v10 & 0x7070707)) & 0xF000F)\nv12 = (v11 & 0x1F) + HIWORD(v11)\nprint("\u7b2c\u4e09\u5757 => ",v12)\n# \u8f93\u51fa => 16<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u57574<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v13 = HIWORD(v3)\nv169 = v13\nv165 = -v3 & v3\nv172 = v165 + v3\n\nif v3 != 0:\n    if v3 & 0xFFFF:\n        v13 = v3\n    if v3 & 0xFFFF:\n        v14 = 1\n    else:\n        v14 = 17\n    v15 = (v13 & 0xFF) == 0\n    if (v13 & 0xFF) == 0:\n        v13 >>= 8\n    if v15:\n        v14 |= 8\n    v16 = (v13 & 0xF) == 0\n    if (v13 & 0xF) == 0:\n        v13 >>= 4\n    if v16:\n        v14 |= 4\n    v17 = (v13 & 3) == 0\n    if (v13 & 3) == 0:\n        v13 >>= 2  # LOBYTE(v13) = v13 >> 2\n    if v17:\n        v14 |= 2\n    v18 = v14 - (v13 & 1) + 2\nelse:\n    v18 = 34\nblock4_value = ((v172 ^ v3) >> v18) | v172\nprint("\u7b2c\u56db\u5757 => ",block4_value)\n# \u8f93\u51fa => 28816308<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u57575,6<\/h3>\n
\"\"<\/div>
\n\u6ce8\uff1a\u8fd9\u91cc\u6267\u884c\u4e86\u4e24\u904dstd::ostream::operator<<(&v174, v24);<\/code>\uff0c\u4e5f\u5c31\u662f\u62fc\u63a5\u4e86\u4e24\u6b21\uff0c\u7b2c5\u548c6\u662f\u91cd\u590d\u7684\u3002
\nPython\u5b9e\u73b0\uff1a<\/p>\n
if ( v3 ):\n    v19 = v3 << 16\n    if ( v3 >= 0x10000 ):\n        v19 = v3\n    v20 = HIBYTE(v19) == 0\n    if ( not HIBYTE(v19) ):\n        v19 <<= 8\n    if ( v20 ):\n        v21 = (16 * (v3 < 0x10000)) | 8\n    else:\n        v21 = 16 * (v3 < 0x10000)\n    v22 = v19 >> 28 == 0\n    if ( not (v19 >> 28) ):\n        v19 *= 16\n    if ( v22 ):\n        v21 |= 4\n    v23 = v19 >> 30 == 0\n    if ( not (v19 >> 30) ):\n        v19 *= 4\n    if ( v23 ):\n        v21 |= 2\n    v24 = v21 + ((v19 & 0x80000000) == 0)\nelse:\n    v24 = 32\nprint("\u7b2c\u4e94\u5757 => ",v24)\nprint("\u7b2c\u516d\u5757 => ",v24)\n# \u8f93\u51fa => 7\n# \u8f93\u51fa => 7<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u57577<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v25 = (v3 - 1) | ((v3 - 1) >> 1) | (((v3 - 1) | ((v3 - 1) >> 1)) >> 2)\nv26 = v25 | (v25 >> 4) | ((v25 | (v25 >> 4)) >> 8)\nv159 = (v26 | HIWORD(v26)) + 1\nprint("\u7b2c\u4e03\u5757 => ",v159)\n# \u8f93\u51fa => 33554432<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u57578,9,10<\/h3>\n
\"\"<\/div>
\nv12<\/code>\u548cv5<\/code>\u90fd\u662f\u5df2\u77e5\u503c\uff0c\u53ea\u9700\u5173\u6ce8v33 | v34<\/code>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v27 = v3 + 1\nv28 = v3 + 3\nv29 = v3 + 2\nv30 = (v3 + 3) & (v3 + 1)\nv31 = 0x80000000  # \u76f8\u5f53\u4e8e 2^31\n\nwhile v31 > 1:\n    if (v31 & v30) != 0:\n        v34 = (v27 - v31) | (v31 - 1)\n        if v34 >= v3:\n            v33 = v3 + 3\n            break\n        v33 = (v28 - v31) | (v31 - 1)\n        if v33 >= v29:\n            v34 = v3 + 1\n            break\n    v31 >>= 1  # \u76f8\u5f53\u4e8e\u53f3\u79fb\u4e00\u4f4d\n\n# \u5982\u679c\u5faa\u73af\u7ed3\u675f\uff0c\u8ba1\u7b97\u9ed8\u8ba4\u503c\nif v31 == 1:\n    v34 = v3 + 1\n    v33 = v3 + 3\nblock8_value = v33 | v34\nprint("\u7b2c\u516b\u5757 => ",block8_value)\nprint("\u7b2c\u4e5d\u5757 => ",v12)\nprint("\u7b2c\u5341\u5757 => ",v5)\n# \u8f93\u51fa => 28816311\n# \u8f93\u51fa => 16\n# \u8f93\u51fa => 5763261<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u575711\uff08\u6682\u672a\u590d\u73b0\uff09<\/h3>\n
\"\"<\/div><\/p>\n
\u4f2a\u4ee3\u7801\u575712<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v142 = v170 >> 1\nv36 = (v170 >> 1) + (v170 >> 2) + (((v170 >> 1) + (v170 >> 2)) >> 4)\nv37 = (v36 + (v36 >> 8) + ((v36 + (v36 >> 8)) >> 16)) >> 3\nv135 = v37 + ((v170 - 10 * v37 + 6) >> 4)\nprint("\u7b2c\u5341\u4e8c\u5757 => ",v135)\n# \u8f93\u51fa => 2881630<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u575713\uff08\u6682\u672a\u590d\u73b0\uff09<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u575714<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v41 = 0x80000000\nwhile True:\n    if (v41 & v30) != 0:\n        v43 = (v27 - v41) | (v41 - 1)\n        if v43 >= v3:\n            break  # LABEL_59\n        v42 = (v28 - v41) | (v41 - 1)\n        if v42 >= v29:\n            v43 = v3 + 1\n            break  # LABEL_60\n    v32 = v41 > 1\n    v41 >>= 1\n    if not v32:\n        v43 = v3 + 1\n        break\n\nv42 = v3 + 3  # After LABEL_59\nresult = v42 | v43  # After LABEL_60\nprint("\u7b2c\u5341\u56db\u5757 => ",result)\n# \u8f93\u51fa => 28816311<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u575715\uff08\u6682\u672a\u590d\u73b0\uff09<\/h3>\n
\"\"<\/div><\/p>\n
\u4f2a\u4ee3\u7801\u575716,17<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
dword_42BE0 = [0, 9, 0x63, 0x3E7, 0x270F, 0x1869F, 0xF423F, 0x98967F, 0x5F5E0FF, 0x3B9AC9FF, 0xFFFFFFFF]\nv47 = -2\nwhile True:\n    v48 = v47 + 2\n    v47 = v47 + 1\n    if dword_42BE0[v48] >= v3:\n        break\nprint("\u7b2c\u5341\u516d\u5757 => ",v47)\nprint("\u7b2c\u5341\u4e03\u5757 => ",v9)\n# \u8f93\u51fa => 7\n# \u8f93\u51fa => 4802717<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u575718\uff08\u6682\u672a\u590d\u73b0\uff09<\/h3>\n
\"\"<\/div><\/p>\n
\u4f2a\u4ee3\u7801\u575719\uff08\u6682\u672a\u590d\u73b0\uff09<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
\u4f2a\u4ee3\u7801\u575720<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
v54 = v3 >> 2\nv55 = v171 + (v3 >> 2)\nv56 = v55 + (v55 >> 4) + ((v55 + (v55 >> 4)) >> 8)\nv57 = (v56 + (v56 >> 16)) >> 2  # Assuming HIWORD is equivalent to shifting right by 16 bits\nv58 = v3 - 5 * v57\nv140 = v57 + ((7 * v58) >> 5)\nprint("\u7b2c\u4e8c\u5341\u5757 => ",v140)  # Assuming v174 is a file-like object\n# \u8f93\u51fa => 5763261<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u575721<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
if v58 <= 4:\n    v59 = v57\nelse:\n    v59 = v57 + 1\n\nif v58 <= 9:\n    v60 = v59\nelse:\n    v60 = v59 + 1\n\nv148 = v60\nprint("\u7b2c\u4e8c\u5341\u4e00\u5757",v60)\n# \u8f93\u51fa => 5763261<\/code><\/pre>\n
\u4f2a\u4ee3\u7801\u575722<\/h3>\n
\"\"<\/div>
\nPython\u5b9e\u73b0\uff1a<\/p>\n
<\/code><\/pre>\n
2024-10-18<\/h2>\n
\u4f2a\u4ee3\u7801\u5757<\/h3>\n
\u4e2d\u95f4\u5199\u7740\u592a\u9ebb\u70e6\u4e86\uff0c\u9053\u7406\u662f\u4e00\u6837\u7684\uff0c\u8fd9\u91cc\u5c31\u7701\u53bb\u4e86\uff0c\u53ea\u5bf9\u4f2a\u4ee3\u7801\u575730\u8fdb\u884c\u5206\u6790\u3002<\/p>\n
\u4f2a\u4ee3\u7801\u575730<\/h3>\n
\"\"<\/div><\/p>\n
v66.n64_u64[0] = veor_s8((int8x8_t)__PAIR64__(v171, v54), vdup_n_s32(v3)).n64_u64[0];\nv67 = v66.n64_u32[1];\nv68.n128_u64[0] = veor_s8(vshr_n_u32(v66, 4uLL), v66).n64_u64[0];\nv68.n128_u32[2] = v67 ^ (v67 >> 2);\nv68.n128_u32[3] = v68.n128_u32[2];\nv69 = veorq_s8(vshlq_u32(v68, (uint32x4_t)xmmword_42890), v68);\nv70 = vandq_s8(\n    veorq_s8(vshlq_u32(v69, (uint32x4_t)xmmword_42870), vshlq_u32(v69, (uint32x4_t)xmmword_42850)),\n    (int8x16_t)xmmword_42910);\nv69.n128_u64[0] = vorr_s8((int8x8_t)v70.n128_u64[0], (int8x8_t)vextq_s8(v70, v70, 8uLL).n128_u64[0]).n64_u64[0];\nv136 = (v69.n128_u32[0] | v69.n128_u32[1] | ((v69.n128_u32[3] ^ (v69.n128_u32[3] >> 8)) >> 12) & 0x10 | (32 * (((unsigned __int8)(v69.n128_u8[12] ^ v69.n128_u8[13]) ^ (unsigned __int8)((v69.n128_u32[3] ^ (v69.n128_u32[3] >> 8)) >> 16)) & 1))) ^ -(v3 & 1) & 0x3F;\nstd::ostream::operator<<(&v174, v136);<\/code><\/pre>\n
\u6b64\u4ee3\u7801\u6d89\u53ca\u5230\u5411\u91cf\u6570\u7ec4\u8fd0\u7b97\uff0c\u4e14v66<\/code>,v68<\/code>,v69<\/code>,v70<\/code>\u4e3ac++\u4e2d\u7684\u8054\u5408\u4f53\u3002<\/p>\n
PAIR64<\/strong><\/h4>\n
\u5728IDA\u7684\u5934\u6587\u4ef6\u6458\u5f55\u4e2d\u53ef\u4ee5\u627e\u5230<\/p>\n
#define __PAIR64__(high, low)   (((uint64) (high) << 32) | (uint32)(low))<\/code><\/pre>\n
\u8be6\u7ec6\u53ef\u4ee5\u770b\u8fd9\u7bc7\u6587\u7ae0\uff0cIDA\u5934\u6587\u4ef6\u6458\u5f55<\/a><\/p>\n
veor_s8,vdup_n_s32,vshr_n_u32,veorq_s8,vshlq_u32,vandq_s8,vorr_s8,vextq_s8<\/h4>\n
\u8fd9\u4e9b\u51fd\u6570\u5728SIMD\u6307\u4ee4\u96c6\u4e2d\u53ef\u4ee5\u627e\u5230\uff0c\u53ef\u4ee5\u53bb\u8fd9\u4e2a\u7f51\u7ad9\u627e\u6307\u4ee4\u96c6<\/a><\/p>\n
veor_s8<\/h5>\n
\n
Bitwise Exclusive OR (vector). This instruction performs a bitwise Exclusive OR operation between the two source SIMD&FP registers, and places the result in the destination SIMD&FP register.<\/p>\n<\/blockquote>\n
\u6307\u7684\u662f\u5411\u91cf\u6309\u4f4d\u5f02\u6216\u8fd0\u7b97\u3002\u53ef\u4ee5\u7528Python\u6765\u5b9e\u73b0
\nnp.logical_xor(a, b)<\/code><\/p>\n
vdup_n_s32<\/h5>\n
\n
vdup_n_s32 \u7684\u4f5c\u7528\u662f\u5c06\u7ed9\u5b9a\u7684\u6807\u91cf\uff08\u4e00\u4e2a 32 \u4f4d\u7684\u6574\u6570\uff09\u586b\u5145\u5230\u4e00\u4e2a 128 \u4f4d\u7684\u5411\u91cf\u4e2d\u7684\u6bcf\u4e2a\u4f4d\u7f6e\uff0c\u5177\u4f53\u6765\u8bf4\uff0c\u5b83\u4f1a\u751f\u6210\u4e00\u4e2a\u5305\u542b 4 \u4e2a 32 \u4f4d\u5143\u7d20\u7684\u5411\u91cf\uff0c\u800c\u8fd9 4 \u4e2a\u5143\u7d20\u7684\u503c\u662f\u4e00\u6837\u7684\u3002<\/p>\n<\/blockquote>\n
Python\u5b9e\u73b0\uff1a<\/p>\n
# vdup_n_s32(v3)\nnp.array([v3,v3,v3,v3])<\/code><\/pre>\n
2024-10-26<\/h2>\n
\"\"<\/div>
\n\uff08\u4e0a\u9762\u6709\u5177\u4f53\u4ee3\u7801\uff09
\n\u770b\u4e86\u597d\u51e0\u5929\uff0c\u8fd9\u90e8\u5206\u5b9e\u5728\u662f\u590d\u73b0\u4e0d\u51fa\u6765\uff0c\u5176\u4ed6\u90e8\u5206\u7684\u90fd\u5df2\u7ecf\u5b9e\u73b0\uff0c\u5982\u679c\u6709\u80fd\u590d\u73b0\u51fa\u6765\u8fd9\u6bb5\u7684\u53ef\u4ee5\u8ddf\u6211\u4ea4\u6362\u4e00\u4e0b\u5176\u4ed6\u90e8\u5206\u7684\uff0c\u6216\u8005\u6709\u601d\u8def\u7684\u4e5f\u53ef\u4ee5\u4e00\u8d77\u4ea4\u6d41\u4e00\u4e0b\u3002<\/p>\n
\"\"<\/div>
\n\uff08\u90e8\u5206\u590d\u73b0\u4ee3\u7801\uff09<\/p>\n
\u8fd9\u91cc\u7ed9\u51fa\u4e00\u4e2a\u53ef\u4ee5\u7528\u6765\u590d\u73b0\u65f6\u9a8c\u8bc1\u7684\u4f8b\u5b50<\/p>\n
# \u90a3\u6bb5\u4ee3\u7801\u4e2d\u4f1a\u7528\u5230\u7684\u53c2\u6570\nv3 = 28818947\nv171 = v3 >> 1\nv54  = v3 >> 2\n# \u6709\u4e86\u8fd9\u4e9b\u53c2\u6570\u540e\uff0c\u7ecf\u8fc7\u90a3\u6bb5\u4ee3\u7801\u8ba1\u7b97\u540e\u53ef\u4ee5\u5f97\u5230v136\u7684\u503c\u4e3a5\n# \u6ce8\uff1a\u4f60\u53ef\u80fd\u7b97\u51fa\u6765\u7684\u7ed3\u679c\u662f0\u621663\uff0c\u8fd9\u4e24\u4e2a\u503c\u662f\u4e0d\u6b63\u786e\u7684\uff0c\u8bf4\u660e\u8fd8\u6ca1\u6709\u590d\u73b0\u6210\u529f<\/code><\/pre>\n
\u5173\u4e8e\u8fd9\u56db\u4e2a\u53c2\u6570\uff1axmmword_42890,xmmword_42870,xmmword_42850,xmmword_42910
\n\u5728IDA\u4e2d\u4e3a<\/p>\n
.rodata:0000000000042890 F8 FF FF FF F8 FF FF FF F8 FF+xmmword_42890 DCB 0xF8, 0xFF, 0xFF, 0xFF, 0xF8, 0xFF, 0xFF, 0xFF, 0xF8, 0xFF, 0xFF, 0xFF, 0xFC, 0xFF, 0xFF, 0xFF\n.rodata:0000000000042870 FF FF FF FF EF FF FF FF EE FF+xmmword_42870 DCB 0xFF, 0xFF, 0xFF, 0xFF, 0xEF, 0xFF, 0xFF, 0xFF, 0xEE, 0xFF, 0xFF, 0xFF, 0xEB, 0xFF, 0xFF, 0xFF\n.rodata:0000000000042850 EF FF FF FF FF FF FF FF FE FF+xmmword_42850 DCB 0xEF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFE, 0xFF, 0xFF, 0xFF, 0xFB, 0xFF, 0xFF, 0xFF\n.rodata:0000000000042910 01 00 00 00 02 00 00 00 04 00+xmmword_42910 DCB 1, 0, 0, 0, 2, 0, 0, 0, 4, 0, 0, 0, 8, 0, 0, 0<\/code><\/pre>\n","protected":false},"excerpt":{"rendered":"
\u524d\u8a00 \u672c\u6587\u7ae0\u4ec5\u505a\u79fb\u52a8\u5b89\u5168\u5b66\u4e60\u4ea4\u6d41\u7528\u9014\uff0c\u4e25\u7981\u4f5c\u5176\u4ed6\u7528\u9014\uff0c\u5982\u679c\u4fb5\u72af\u60a8\u7684\u6743\u76ca\u8bf7\u8054\u7cfb\u6211\u5220\u9664\u3002 \u6240\u7528\u5de5\u5177: IDA Pr […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[],"class_list":["post-496","post","type-post","status-publish","format-standard","hentry","category-uncategorized"],"_links":{"self":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts\/496","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/comments?post=496"}],"version-history":[{"count":31,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts\/496\/revisions"}],"predecessor-version":[{"id":580,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/posts\/496\/revisions\/580"}],"wp:attachment":[{"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/media?parent=496"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/categories?post=496"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.94i.top\/index.php\/wp-json\/wp\/v2\/tags?post=496"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}