XCTF 9th Final Reverse-Rewrite It In Rust WriteUp

WriteUp
3.6k 词

主函数：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
void rewrite_it_in_rust::main::h0e6472a490b21dff(void)
{
  int *param1;
  undefined8 *param3;
  int iVar1;
  uint local_18;
  undefined4 local_14;
  int *local_10;
  int *local_c;
  int *local_8 [2];
  
  param1 = (int *)gloo_utils::document::h8c9132b17b3f8613();
  local_10 = param1;
  web_sys::features::gen_Document::Document::body::h21cc6fa91e3c3e79(&local_18,&local_10);
  if ((local_18 & 1) == 0) {
    core::option::expect_failed::hf57fb2c2bc253385(0x102c0c,0x12,0x102c78);
    do {
      halt_trap();
    } while( true );
  }
  if ((int *)0x83 < param1) {
    __externref_table_dealloc(param1);
  }
  yew::renderer::set_default_panic_hook::h8d1227c725e095d3();
  param3 = (undefined8 *)__rustc[4794b31dd7191200]::__rust_alloc(8,4);
  if (param3 != (undefined8 *)0x0) {
    *param3 = 0x100000001;
    yew::app_handle::AppHandle<COMP>::mount_with_props::h8a3e847ff551c78f(&local_10,local_14,pa ram3)
    ;
    if ((local_8[0] != (int *)0x0) &&
       (iVar1 = *local_8[0], *local_8[0] = iVar1 + -1, iVar1 + -1 == 0)) {
      alloc::rc::Rc<T,A>::drop_slow::hb642d757342b5323(local_8);
    }
    iVar1 = *local_10;
    *local_10 = iVar1 + -1;
    if (iVar1 + -1 == 0) {
      alloc::rc::Rc<T,A>::drop_slow::hdeb42f8acc10ad0c(&local_10);
    }
    iVar1 = *local_c;
    *local_c = iVar1 + -1;
    if (iVar1 + -1 == 0) {
      alloc::rc::Rc<T,A>::drop_slow::h2bfda71ae8ff72a3(&local_c);
    }
    return;
  }
  alloc::alloc::handle_alloc_error::h538ce9133f14f3cc(4,8);
  do {
    halt_trap();
  } while( true );
}

COMP：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
void yew::app_handle::AppHandle<COMP>::mount_with_props::h8a3e847ff551c78f
               (undefined8 *param1,undefined4 param2,undefined4 param3)
{
  uint uVar1;
  uint uVar2;
  undefined4 param2_00;
  undefined4 param5;
  int iVar3;
  undefined4 local_64;
  undefined8 local_60;
  undefined8 local_58;
  undefined8 local_50;
  undefined8 local_48;
  undefined8 **local_40;
  undefined4 local_3c;
  undefined *local_38;
  undefined4 *local_34;
  undefined8 *local_30;
  undefined4 **local_2c;
  undefined4 local_28;
  undefined4 uStack_24;
  undefined4 local_20;
  undefined4 uStack_1c;
  int local_18;
  undefined4 uStack_14;
  undefined8 local_10;
  undefined4 local_8;
  undefined4 uStack_4;
  
  uVar1 = uRam001325ec;
  local_64 = param2;
  if (1 < uRam001325ec) goto code_r0x800d2cd0;
  if (uRam001325ec < 2) {
    uVar2 = (uint)bRam001325c4;
    if (1 < uVar2 - 1) {
      if (uVar2 != 0) {
        uVar2 = tracing_core::callsite::DefaultCallsite::register::h587df36bfed78d34
                          (&PTR_DAT_ram_0012de64_ram_001325bc);
        uVar2 = uVar2 & 0xff;
        if (uVar2 != 0) goto code_r0x800d2bb2;
      }
      goto code_r0x800d2c5b;
    }
code_r0x800d2bb2:
    iVar3 = tracing::__macro_support::__is_enabled::h1bf0adbdf59b7a92
                      (PTR_DAT_ram_0012de64_ram_001325bc,uVar2);
    if (iVar3 == 0) goto code_r0x800d2c5b;
    if (*(int *)(PTR_DAT_ram_0012de64_ram_001325bc + 0x20) == 0) {
      core::option::expect_failed::hf57fb2c2bc253385
                (s_objFieldSet_corrupted_(this_is_a_ram_00102798 + 3,0x22,0x10281c);
      do {
        halt_trap();
      } while( true );
    }
    local_58 = *(undefined8 *)(PTR_DAT_ram_0012de64_ram_001325bc + 0x24);
    local_50 = (ulonglong)local_50._4_4_ << 0x20;
    local_60 = *(undefined8 *)(PTR_DAT_ram_0012de64_ram_001325bc + 0x1c);
    local_28 = 0x10282c;
    local_3c = 1;
    local_38 = PTR_DAT_ram_0012de64_ram_001325bc + 0x1c;
    local_2c = &local_34;
    local_30 = &local_60;
    local_40 = &local_30;
    local_34 = &local_64;
    tracing::span::Span::new::hd2182acc7e8ee44c
              (&local_20,PTR_DAT_ram_0012de64_ram_001325bc,&local_40);
  }
  else {
code_r0x800d2c5b:
    local_8 = 0;
    local_18 = 2;
  }
  local_48 = CONCAT44(uStack_4,local_8);
  local_50 = local_10;
  local_58 = CONCAT44(uStack_14,local_18);
  local_60 = CONCAT44(uStack_1c,local_20);
  if (local_18 != 2) {
    tracing_core::dispatcher::Dispatch::enter::hd01e9981122d2d75(&local_58,&local_60);
  }
code_r0x800d2cd0:
  yew::app_handle::clear_element::h1b8e33ec075143e0(&local_64);
  local_20 = 0;
  yew::html::component::scope::feat_csr_ssr::<>::new::h7ba02ecb276723fe(&local_30,&local_20);
  param2_00 = yew::dom_bundle::subtree_root::BSubtree::create_root::h3f8b61dbc570e394(&local_64 );
  local_20 = 0;
  param5 = yew::dom_bundle::position::DynamicDomSlot::new_debug_trapped::h541adc254fcfe21a();
  yew::html::component::scope::feat_csr::<>::mount_in_place::h52b0dbef1aa92572
            (&local_30,param2_00,local_64,&local_20,param5,param3);
  param1[1] = CONCAT44(uStack_24,local_28);
  *param1 = CONCAT44(local_2c,local_30);
  if ((uVar1 < 2) && ((int)local_58 != 2)) {
    tracing_core::dispatcher::Dispatch::exit::ha3c04c34f6264736(&local_58,&local_60);
    iVar3 = (int)local_58;
    if (((int)local_58 != 2) &&
       (tracing_core::dispatcher::Dispatch::try_close::h85550ae3f6586bbb(&local_58,local_60),
       iVar3 != 0)) {
      iVar3 = *local_58._4_4_;
      *local_58._4_4_ = iVar3 + -1;
      if (iVar3 == 1) {
        alloc::sync::Arc<T,A>::drop_slow::h1cb5b31f44acb796((int)&local_58 + 4);
      }
    }
  }
  return;
}

在函数中发现多个名为obfstr::xref::inner::XXX的混淆函数，查看交叉引用，发现是一个巨大的闭包函数，启动live-server下断点调试：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
undefined4 <>::run::app::{{closure}}::{{closure}}::hf74361d5a37a31f8(int **param1,int *param2)
{
  cVar1 = *(char *)(param1 + 0x41);
  if (cVar1 == '\\0') {
code_r0x800304d8:
    core::str::<impl str>::trim_matches::h2fd137edc391dc3f(&local_98,param1[0x3f],param1[0x40]);
    *(undefined *)(param1 + 0x3c) = 0;
    param1[0x35] = (int *)(param1 + 3);
    param1[7] = local_94;
    param1[6] = local_98;
    param1[0x34] = (int *)param1;
code_r0x80030532:
    param1[9] = local_94;
    param1[8] = local_98;
    local_4c = CONCAT22(local_4c._2_2_,1);
    local_50 = (int **)0x0;
    local_54 = (int)local_98 + (int)local_94;
    local_68 = (int *)0x0;
    local_64 = (int **)local_94;
    local_60[0] = local_98;
    local_60[1] = local_94;
    local_60[2] = local_98;
    <>::from_iter::heef541ac3ce4e335(param1 + 0x36,&local_68,0x10008c);
    if (param1[0x38] == (int *)0x0) {
      core::panicking::panic_bounds_check::h7a037824b9c6d60f(0,0,0x100424);
      do {
        halt_trap();
      } while( true );
    }
    ppuVar15 = (ushort **)param1[0x37];
    local_68 = (int *)0xe58f4d50;
    puVar8 = (ushort *)obfstr::xref::inner::hdb5e628f314efefc(0xfb32d,0xe58f4d50);
    local_8c = *puVar8 & 0xff00 ^ 0xdf00 | (*puVar8 ^ 0x4e) & 0xff;
    if ((ppuVar15[1] == (ushort *)0x2) && (**ppuVar15 == local_8c)) {

在此处，有汇编：

1
2
3
4
5
6
7
8
ram:80030602  47              i32.ne
ram:80030603  0d  00           br_if      LAB_ram_80030615
ram:80030605  20  05           local.get  l5
ram:80030607  28  02  00       i32.load   align=0x2  offset=0x0
ram:8003060a  2f  00  00       i32.load   align=0x0  offset=0x0
ram:8003060d  20  02           local.get  l2
ram:8003060f  2f  01  14       i32.load   align=0x1  offset=0x14 => local_8c
ram:80030612  46              i32.eq

比较了输入与“cd”这个指令，继续向下寻找：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
//30684//221
      (**(code **)((ulonglong)*(uint *)(iVar10 + 0x14) * 4))
                (CONCAT44(in_register_20000004,
                          param1[0x34][1] + (*(int *)(iVar10 + 8) - 1U & 0xfffffff8) + 8),
                 CONCAT44(in_register_20000014,&local_68));
    }
    else {
      if (param1[0x38] == (int *)0x0) {
        core::panicking::panic_bounds_check::h7a037824b9c6d60f(0,0,0x100434);
        do {
          halt_trap();
        } while( true );
      }
      ppuVar15 = (ushort **)param1[0x37];
      local_68 = (int *)0x9a3dbbb3;
      puVar8 = (ushort *)obfstr::xref::inner::hc7c30050bbf6013b(0xfc7c7,0x9a3dbbb3);
      local_8c = *puVar8 & 0xff00 ^ 0x7f00 | (*puVar8 ^ 0x73) & 0xff;
      if (ppuVar15[1] == (ushort *)0x2) {
        piVar16 = param1[0x38];
        if (**ppuVar15 == local_8c) {

此处比较的指令是“su”，继续分析：

1
2
3
4
5
6
7
8
9
//31ef8//648
      ppvVar20 = (void **)param1[0x37];
      local_8c = 0xde97;
      local_8a = 0xf3;
      uStack_89 = 0x91;
      puVar9 = (uint *)obfstr::xref::inner::hd2a4b92ffc2116b0(0xfb5f6,0x91f3de97);
      local_68 = (int *)(*puVar9 ^ 0x59c31202);
      local_64 = (int **)(CONCAT31(local_64._1_3_,*(undefined *)(puVar9 + 1)) ^ 0xa3);
      if ((ppvVar20[1] == (void *)0x5) && (iVar10 = memcmp(*ppvVar20,&local_68,5), iVar10 == 0)) {

这里比较的指令是clear

1
2
3
4
5
6
7
8
//31fb2//821
          ppvVar20 = (void **)param1[0x37];
          local_68 = (int *)0x227b634a;
          puVar8 = (ushort *)obfstr::xref::inner::h9aac02de9a9e562a(0xf3517,0x227b634a);
          local_8a = *(byte *)(puVar8 + 1) ^ 0x6e;
          local_8c = *puVar8 & 0xff00 ^ 0xf900 | (*puVar8 ^ 0x90) & 0xff;
          if (ppvVar20[1] == (void *)0x3) {
            iVar10 = memcmp(*ppvVar20,&local_8c,3);

这里比较的指令是pwd

此外整个shell还有一个测试出来的ls指令，在后续的段落中有一个AES-CBC解密：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
//313de//1140
    else {
      uVar6 = 4;
      iVar10 = __rustc[4794b31dd7191200]::__rust_alloc((uint)local_3c,4);
      uVar34 = uVar33;
      if (iVar10 == 0) goto code_r0x80031bb0;
    }
    if (uVar32 != 0) {
      memory_copy(0,0,uVar32,uVar29,iVar10);
    }
    const_aes::aes::cbc::<>::decrypt::h314e8f9f5e7eb882
              (&local_18,ARRAY_ram_00100278,ARRAY_ram_00100298);
    uStack_7c = 4;
    local_80 = local_10 & 3;
    local_8c = (ushort)local_14;
    local_8a = (byte)((uint)local_14 >> 0x10);
    uStack_89 = (undefined)((uint)local_14 >> 0x18);
    local_88 = (int **)(local_10 & 0xfffffffc);
    local_84 = (int *)(local_14 + (int)local_88);
    <>::from_iter::hd7c3ceb094dad17d(&local_c,&local_8c,0x10008c);
    if (uVar33 == local_4) {

其中的const_aes::aes::cbc::<>::decrypt::h314e8f9f5e7eb882(&local_18,0x100278,0x100298); 中的278位置是key，298位置是iv.

接下来重点分析su指令中的子分支：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
    else {
      if (param1[0x38] == (int *)0x0) {
        core::panicking::panic_bounds_check::h7a037824b9c6d60f(0,0,0x100434);
        do {
          halt_trap();
        } while( true );
      }
      ppuVar15 = (ushort **)param1[0x37];
      local_68 = (int *)0x9a3dbbb3;
      puVar8 = (ushort *)obfstr::xref::inner::hc7c30050bbf6013b(0xfc7c7,0x9a3dbbb3);
      local_8c = *puVar8 & 0xff00 ^ 0x7f00 | (*puVar8 ^ 0x73) & 0xff;
      if (ppuVar15[1] == (ushort *)0x2) {
        piVar16 = param1[0x38];
        if (**ppuVar15 == local_8c) {
          if (piVar16 == (int *)0x3) {
            piVar16 = param1[0x37];
            local_68 = (int *)0x3297fb4e;
            puVar8 = (ushort *)obfstr::xref::inner::hd86f82e61b821f8f(0xf36fa,0x3297fb4e);
            local_8c = *puVar8 & 0xff00 ^ 0xe900 | (*puVar8 ^ 0x4a) & 0xff;
            if ((piVar16[3] == 2) && (*(ushort *)piVar16[2] == local_8c)) {
              piVar16 = *(int **)(*param1[0x34] + 0x10);
              uVar29 = (uint)(ZEXT48(piVar16) * 0x18);
              uVar6 = 0;
              if (((int)(ZEXT48(piVar16) * 0x18 >> 0x20) != 0) || (uVar6 = 0, 0x7ffffffc < uVar29 ))
              {
code_r0x80031b0c:
                alloc::raw_vec::handle_error::h57ad9ee517c44fc6(uVar6,uVar29,0x1001b4);
                do {
                  halt_trap();
                } while( true );
              }
              if (uVar29 == 0) {
                piVar31 = (int *)0x4;
              }
              else {
                iVar10 = *(int *)(*param1[0x34] + 0xc);
                uVar6 = 4;
                piVar31 = (int *)__rustc[4794b31dd7191200]::__rust_alloc(uVar29,4);
                if (piVar31 == (int *)0x0) goto code_r0x80031b0c;
                if (piVar16 != (int *)0x0) {
                  uVar32 = 0;
                  piVar13 = piVar16;
                  do {
                    if (uVar29 == uVar32) break;
                    <>::clone::h39c36b30d5ec6ad0(&local_68,iVar10);
                    <>::clone::h39c36b30d5ec6ad0(local_60 + 1,iVar10 + 0xc);
                    puVar30 = (undefined8 *)((int)piVar31 + uVar32);
                    puVar30[2] = CONCAT44(local_54,local_60[2]);
                    puVar30[1] = CONCAT44(local_60[1],local_60[0]);
                    *puVar30 = CONCAT44(local_64,local_68);
                    uVar32 = uVar32 + 0x18;
                    iVar10 = iVar10 + 0x18;
                    piVar13 = (int *)((int)piVar13 - 1);
                  } while (piVar13 != (int *)0x0);
                }
              }
              param1[0x3b] = piVar16;
              param1[0x3a] = piVar31;
              param1[0x39] = piVar16;
              iVar10 = *param1[0x35];
              if (*(int *)(iVar10 + 8) != 0) {
                if (param1[0x38] < (int *)0x3) {
                  core::panicking::panic_bounds_check::h7a037824b9c6d60f(2,param1[0x38],0x1004b4 );
                  do {
                    halt_trap();
                  } while( true );
                }
                piVar31 = (int *)param1[0x37][4];
                piVar16 = (int *)param1[0x37][5];
                *(undefined *)(param1 + 0x32) = 0;
                piVar13 = (int *)(iVar10 + 8);
                param1[0x2c] = piVar13;
                param1[0xb] = piVar16;
                param1[10] = piVar31;
code_r0x80030d43:
                uVar6 = 0;
                if ((int)piVar16 < 0) {
code_r0x80031b28:
                  alloc::raw_vec::handle_error::h57ad9ee517c44fc6(uVar6,piVar16,0x1001a4);
                  do {
                    halt_trap();
                  } while( true );
                }
                if (piVar16 == (int *)0x0) {
                  iVar10 = 1;
                }
                else {
                  uVar6 = 1;
                  iVar10 = __rustc[4794b31dd7191200]::__rust_alloc(piVar16,1);
                  if (iVar10 == 0) goto code_r0x80031b28;
                }
                if (piVar16 != (int *)0x0) {
                  memory_copy(0,0,piVar16,piVar31,iVar10);
                }
                uVar29 = (int)piVar16 << 2;
                uVar6 = 0;
                if (((int *)0x3fffffff < piVar16) || (uVar6 = 0, 0x7ffffffc < uVar29)) {
code_r0x80031b36:
                  alloc::raw_vec::handle_error::h57ad9ee517c44fc6(uVar6,uVar29,0x10008c);
                  do {
                    halt_trap();
                  } while( true );
                }
                if (uVar29 == 0) {
                  puVar9 = (uint *)0x4;
                  piVar31 = (int *)0x0;
                }
                else {
                  uVar6 = 4;
                  puVar9 = (uint *)__rustc[4794b31dd7191200]::__rust_alloc(uVar29,4);
                  piVar31 = piVar16;
                  if (puVar9 == (uint *)0x0) goto code_r0x80031b36;
                }
                if (piVar16 != (int *)0x0) {
                  uVar32 = (uint)piVar16 & 3;
                  uVar29 = 0;
                  if ((int *)0x3 < piVar16) {
                    uVar29 = 0;
                    puVar5 = puVar9;
                    do {
                      pbVar11 = (byte *)(iVar10 + uVar29);
                      *puVar5 = (uint)*pbVar11;
                      puVar5[1] = (uint)pbVar11[1];
                      puVar5[2] = (uint)pbVar11[2];
                      puVar5[3] = (uint)pbVar11[3];
                      puVar5 = puVar5 + 4;
                      uVar29 = uVar29 + 4;
                    } while (((uint)piVar16 & 0x3ffffffc) != uVar29);
                  }
                  if (uVar32 != 0) {
                    pbVar11 = (byte *)(iVar10 + uVar29);
                    puVar5 = puVar9 + uVar29;
                    do {
                      *puVar5 = (uint)*pbVar11;
                      pbVar11 = pbVar11 + 1;
                      puVar5 = puVar5 + 1;
                      uVar32 = uVar32 - 1;
                    } while (uVar32 != 0);
                  }
                }
                param1[0x2d] = piVar31;
                param1[0x2f] = piVar16;
                param1[0x2e] = (int *)puVar9;
                if (piVar16 == (int *)0x0) {
                  piVar16 = (int *)0x0;
                }
                else {
                  __rustc[4794b31dd7191200]::__rust_dealloc(iVar10,piVar16,1);
                  piVar16 = param1[0x2f];
                }
                if (((uint)piVar16 & 3) != 0) {
                  iVar10 = (int)piVar16 << 2;
                  do {
                    if (piVar16 == param1[0x2d]) {
                      alloc::raw_vec::RawVec<T,A>::grow_one::h04fd587adc811a62
                                (param1 + 0x2d,0x100248);
                    }
                    *(undefined4 *)((int)param1[0x2e] + iVar10) = 0;
                    piVar16 = (int *)((int)piVar16 + 1);
                    param1[0x2f] = piVar16;
                    iVar10 = iVar10 + 4;
                  } while (((uint)piVar16 & 3) != 0);
                }
                local_60[0] = (int *)0x0;
                local_60[2] = (int *)0x80;
                local_64 = (int **)((int)piVar16 << 2);
                local_68 = param1[0x2e];
                <>::create_buffer_init::hbb181a01ac286abf(param1 + 0xc,piVar13,&local_68);
                local_54 = local_54 & 0xffffff00;
                local_68 = (int *)0x0;
                ppiVar36 = param1 + 0x2f;
                local_60[0] = (int *)((int)*ppiVar36 << 2);
                local_60[1] = (int *)0x0;
                local_60[2] = (int *)0x84;
                wgpu::api::device::Device::create_buffer::h03df2c229309e0eb
                          (param1 + 0x12,piVar13,&local_68);
                local_54 = local_54 & 0xffffff00;
                local_60[2] = (int *)0x9;
                local_68 = (int *)0x0;
                local_60[0] = (int *)((int)*ppiVar36 << 2);
                local_60[1] = (int *)0x0;
                param1_00 = (longlong *)(param1 + 0x18);
                wgpu::api::device::Device::create_buffer::h03df2c229309e0eb
                          (param1_00,piVar13,&local_68);
                local_60[1] = (int *)0x0;
                local_60[2] = (int *)0x0;
                local_54 = 0;
                local_64 = (int **)CONCAT13(uStack_89,CONCAT12(local_8a,local_8c));
                local_60[0] = (int *)0x0;
                uStack_7c = 0;
                local_34 = 0;
                local_2c = 0;
                local_3c = (ulonglong)CONCAT13(uStack_89,CONCAT12(local_8a,local_8c));
                local_20 = 1;
                local_40 = 0;
                local_48 = 0;
                local_68 = (int *)0x0;
                local_80 = 0;
                local_84 = (int *)0x2;
                piVar16 = piVar13 + 3;
                local_8c = (ushort)piVar16;
                local_8a = (byte)((uint)piVar16 >> 0x10);
                uStack_89 = (undefined)((uint)piVar16 >> 0x18);
                local_88 = &local_68;
                local_50 = param1 + 0xc;
                local_28 = param1 + 0x12;
                piVar16 = (int *)wgpu::api::device::Device::create_bind_group::h4cd1f04fce69212c
                                           (piVar13,&local_8c);
                param1[0x30] = piVar16;
                ppiVar12 = param1 + 0x1e;
                wgpu::api::device::Device::create_command_encoder::h6addd7f44e30f5ef
                          (ppiVar12,piVar13,0x10009c);
                param1_01 = param1 + 0x22;
                wgpu::api::command_encoder::CommandEncoder::begin_compute_pass::h61a8bf77e85d7c0b
                          (param1_01,ppiVar12,0x100200);
                wgpu::api::compute_pass::ComputePass::set_pipeline::h0d6c2b1d2934a353
                          (param1_01,piVar13 + 2);
                <>::set_bind_group::hec64875674344809(param1_01,0,param1 + 0x30,4,0);
                wgpu::api::compute_pass::ComputePass::dispatch_workgroups::ha737b439e9f7097c
                          (param1_01,1,1,1);
                local_60[0] = param1[0x24];
                local_68 = (int *)*(undefined8 *)(param1 + 0x22);
                local_64 = (int **)((ulonglong)*(undefined8 *)(param1 + 0x22) >> 0x20);
                <>::end::h048228e6e198fc9e(&local_68);
                if ((int *)0x83 < local_60[0]) {
                  __externref_table_dealloc(local_60[0]);
                }
                <>::copy_buffer_to_buffer::h8061d77ed5ba0590
                          (ppiVar12,param1 + 0x15,0,param1 + 0x1b,0,1,
                           (ulonglong)(uint)((int)*ppiVar36 << 2));
                local_60[0] = (int *)wgpu::api::command_encoder::CommandEncoder::finish::h0b201577a b2fd6bd
                                               (*(undefined8 *)(param1 + 0x1e),param1[0x20]);
                local_68 = (int *)0x0;
                local_64 = (int **)0x1;
                <>::submit::hb3176f4e770d665e(piVar13[1] + 8,&local_68,0x10283c);
                if (local_64 != (int **)local_68) {
                  iVar10 = (int)local_64 - (int)local_68;
                  ppiVar12 = local_60 + (int)local_68;
                  do {
                    iVar18 = **ppiVar12;
                    **ppiVar12 = iVar18 + -1;
                    if (iVar18 == 1) {
                      alloc::sync::Arc<T,A>::drop_slow::h1f8c037807479379(ppiVar12);
                    }
                    ppiVar12 = ppiVar12 + 1;
                    iVar10 = iVar10 + -1;
                  } while (iVar10 != 0);
                }
                puVar30 = (undefined8 *)__rustc[4794b31dd7191200]::__rust_alloc(0x14,4);
                if (puVar30 == (undefined8 *)0x0) {
                  alloc::alloc::handle_alloc_error::h538ce9133f14f3cc(4,0x14);
                  do {
                    halt_trap();
                  } while( true );
                }
                *(undefined2 *)(puVar30 + 2) = 0;
                *(undefined4 *)(puVar30 + 1) = 0;
                *puVar30 = 0x100000002;
                param1_02 = *param1_00;
                if (param1_02 == 0) {
                  core::option::expect_failed::hf57fb2c2bc253385
                            (s_buffer_slices_can_not_be_emptyEr_ram_00102e20,0x1e,0x100228);
                  do {
                    halt_trap();
                  } while( true );
                }
                lVar7 = param1_02;
                wgpu::api::buffer::check_buffer_bounds::h74b2b954531fa420
                          (param1_02,0,param1_02,0x100228);
                *(undefined8 *)(param1 + 0x28) = 0;
                param1[0x2a] = (int *)param1_00;
                *(longlong *)(param1 + 0x26) = param1_02;
                in_register_20000004 = (undefined4)((ulonglong)lVar7 >> 0x20);
                wgpu::api::buffer::BufferSlice::map_async::h68fedab47de0c62e
                          (param1 + 0x26,0,puVar30);
                in_register_20000014 = 0;
                uVar29 = wgpu::api::device::Device::poll::hdac8a3578e196cc3(piVar13,1,param1_02) ;
                if ((uVar29 & 0xff) == 3) {
                  core::result::unwrap_failed::h4e312bd8e5eb4431
                            (s_called_`Result::unwrap()`_on_an_`_ram_001000b4,0x2b,&local_68,
                             0x1000a4,0x100238);
                  do {
                    halt_trap();
                  } while( true );
                }
                param1[0x31] = (int *)puVar30;
                goto code_r0x80031288;
              }
              <>::to_string::h27962b96b52f479b(&local_8c,param1[8],param1[9]);
              local_68 = (int *)0x52ffd9d;
              puVar9 = (uint *)obfstr::xref::inner::he4173613b5df758f(0xfcd43,0x52ffd9d);
              local_68 = (int *)(*puVar9 ^ 0x95982767);
              local_64 = (int **)(puVar9[1] ^ 0xbfe5747d);
              local_60[0] = (int *)(puVar9[2] ^ 0x3c3145c8);
              local_60[1] = (int *)(puVar9[3] ^ 0x8581be0c);
              local_60[2] = (int *)(puVar9[4] ^ 0xfa4c82ac);
              local_54 = puVar9[5] ^ 0x293fc3a0;
              local_50 = (int **)(puVar9[6] ^ 0xf83ecba5);
              local_4c = puVar9[7] ^ 0x8051b00;
              local_48 = puVar9[8] ^ 0xc7cc98f2;
              <>::from::h47f18e32fcec2aad(&local_80,&local_68,0x24);
              piVar16 = param1[0x3b];
              if (piVar16 == param1[0x39]) {
                alloc::raw_vec::RawVec<T,A>::grow_one::hcdfd56f134901a1d(param1 + 0x39,0x1004c4) ;
              }
              puVar30 = (undefined8 *)(param1[0x3a] + (int)piVar16 * 6);
              *puVar30 = CONCAT44(local_88,CONCAT13(uStack_89,CONCAT12(local_8a,local_8c)));
              puVar30[2] = CONCAT44(uStack_78,uStack_7c);
              puVar30[1] = CONCAT44(local_80,local_84);
              param1[0x3b] = (int *)((int)piVar16 + 1);
              goto code_r0x80031a6c;
            }
          }
          uVar29 = *(uint *)(*param1[0x34] + 0x10);
          uVar32 = (uint)((ulonglong)uVar29 * 0x18);
          uVar6 = 0;
          if (((int)((ulonglong)uVar29 * 0x18 >> 0x20) != 0) || (uVar6 = 0, 0x7ffffffc < uVar32))  {
code_r0x80031e51:
            alloc::raw_vec::handle_error::h57ad9ee517c44fc6(uVar6,uVar32,0x1001b4);
            do {
              halt_trap();
            } while( true );
          }
          if (uVar32 == 0) {
            ppiVar12 = (int **)0x4;
          }
          else {
            iVar10 = *(int *)(*param1[0x34] + 0xc);
            uVar6 = 4;
            ppiVar12 = (int **)__rustc[4794b31dd7191200]::__rust_alloc(uVar32,4);
            if (ppiVar12 == (int **)0x0) goto code_r0x80031e51;
            if (uVar29 != 0) {
              uVar34 = 0;
              uVar33 = uVar29;
              do {
                if (uVar32 == uVar34) break;
                <>::clone::h39c36b30d5ec6ad0(&local_68,iVar10);
                <>::clone::h39c36b30d5ec6ad0(local_60 + 1,iVar10 + 0xc);
                puVar30 = (undefined8 *)((int)ppiVar12 + uVar34);
                puVar30[2] = CONCAT44(local_54,local_60[2]);
                puVar30[1] = CONCAT44(local_60[1],local_60[0]);
                *puVar30 = CONCAT44(local_64,local_68);
                uVar34 = uVar34 + 0x18;
                iVar10 = iVar10 + 0x18;
                uVar33 = uVar33 - 1;
              } while (uVar33 != 0);
            }
          }
          local_8c = (ushort)uVar29;
          local_8a = (byte)(uVar29 >> 0x10);
          uStack_89 = (undefined)(uVar29 >> 0x18);
          uVar6 = 0;
          piVar16 = param1[9];
          local_88 = ppiVar12;
          local_84 = (int *)uVar29;
          if ((int)piVar16 < 0) {
code_r0x80031e5f:
            alloc::raw_vec::handle_error::h57ad9ee517c44fc6(uVar6,piVar16,0x1001a4);
            do {
              halt_trap();
            } while( true );
          }
          piVar31 = param1[8];
          if (piVar16 == (int *)0x0) {
            piVar13 = (int *)0x1;
          }
          else {
            uVar6 = 1;
            piVar13 = (int *)__rustc[4794b31dd7191200]::__rust_alloc(piVar16,1);
            if (piVar13 == (int *)0x0) goto code_r0x80031e5f;
          }
          if (piVar16 != (int *)0x0) {
            memory_copy(0,0,piVar16,piVar31,piVar13);
          }
          local_68 = (int *)0x7cefaa3d;
          puVar9 = (uint *)obfstr::xref::inner::hb151e368f2d7f60a(0xf4413,0x7cefaa3d);
          uVar32 = *puVar9;
          uVar33 = puVar9[1];
          uVar34 = puVar9[2];
          uVar35 = puVar9[3];
          bVar2 = *(byte *)(puVar9 + 4);
          puVar9 = (uint *)__rustc[4794b31dd7191200]::__rust_alloc(0x11,1);
          if (puVar9 == (uint *)0x0) {
            alloc::raw_vec::handle_error::h57ad9ee517c44fc6(1,0x11,0x1001a4);
            do {
              halt_trap();
            } while( true );
          }
          *(byte *)(puVar9 + 4) = bVar2 ^ 4;
          puVar9[3] = uVar35 ^ 0x76469e43;
          puVar9[2] = uVar34 ^ 0x82265edd;
          puVar9[1] = uVar33 ^ 0xcb7562e9;
          *puVar9 = uVar32 ^ 0xf1146512;
          alloc::raw_vec::RawVec<T,A>::grow_one::hcdfd56f134901a1d(&local_8c,0x1004d4);
          ppiVar12 = local_88 + uVar29 * 6;
          ppiVar12[5] = (int *)0x11;
          ppiVar12[4] = (int *)puVar9;
          ppiVar12[3] = (int *)0x11;
          ppiVar12[2] = piVar16;
          ppiVar12[1] = piVar13;
          *ppiVar12 = piVar16;
          local_84 = (int *)(uVar29 + 1);
          local_68 = (int *)CONCAT13(uStack_89,CONCAT12(local_8a,local_8c));
          local_64 = local_88;
          iVar10 = param1[0x34][2];
          local_60[0] = local_84;
          (**(code **)((ulonglong)*(uint *)(iVar10 + 0x14) * 4))
                    (CONCAT44(in_register_20000004,
                              param1[0x34][1] + (*(int *)(iVar10 + 8) - 1U & 0xfffffff8) + 8),
                     CONCAT44(in_register_20000014,&local_68));
          goto code_r0x80032a57;
        }
      }
      else {
        piVar16 = param1[0x38];
      }
      if (piVar16 == (int *)0x0) {
        core::panicking::panic_bounds_check::h7a037824b9c6d60f(0,0,0x100444);
        do {
          halt_trap();
        } while( true );
      }
      ppvVar20 = (void **)param1[0x37];
      local_8c = 0xde97;
      local_8a = 0xf3;
      uStack_89 = 0x91;
      puVar9 = (uint *)obfstr::xref::inner::hd2a4b92ffc2116b0(0xfb5f6,0x91f3de97);
      local_68 = (int *)(*puVar9 ^ 0x59c31202);
      local_64 = (int **)(CONCAT31(local_64._1_3_,*(undefined *)(puVar9 + 1)) ^ 0xa3);
      if ((ppvVar20[1] == (void *)0x5) && (iVar10 = memcmp(*ppvVar20,&local_68,5), iVar10 == 0)) {
        iVar10 = param1[0x34][2];
        local_60[0] = (int *)0x0;
        local_68 = (int *)0x0;
        local_64 = (int **)0x4;
        (**(code **)((ulonglong)*(uint *)(iVar10 + 0x14) * 4))
                  (CONCAT44(in_register_20000004,
                            param1[0x34][1] + (*(int *)(iVar10 + 8) - 1U & 0xfffffff8) + 8),
                   CONCAT44(in_register_20000014,&local_68));
      }

比较了总arg数（带su本身）是否是3，经过调试发现是su -p <明文>，在接下来的代码中：

1
2
3
4
5
//30e7c//359
*puVar5   = (uint)payload[i+0];
puVar5[1] = (uint)payload[i+1];
puVar5[2] = (uint)payload[i+2];
puVar5[3] = (uint)payload[i+3];

循环加载了传入的payload，一个字节扩展为一个uint32，之后建立GPU运算：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
//30f70//393
<> ::create_buffer_init(param1 + 0xc, /*device*/piVar13, &local_68);
wgpu::api::device::Device::create_buffer(param1 + 0x12, ... /*usage 0x84*/);
wgpu::api::device::Device::create_buffer(param1 + 0x18, ... /*usage 0x09*/);
wgpu::api::device::Device::create_bind_group(piVar13, &bind_group_desc);
begin_compute_pass(...)
set_pipeline(...)
set_bind_group(...)
dispatch_workgroups(1,1,1);
end(...)
copy_buffer_to_buffer(...);
finish(...); submit(...);
map_async(...); poll(...);
...

执行了WGSL代码，在js中断点：

1
2
3
imports.wbg.__wbg_setcode_e66de35c80aa100f = function(arg0, arg1, arg2) {
    arg0.code = getStringFromWasm0(arg1, arg2);
};

arg1是内存偏移量：0x001561A8，arg2是大小，dump内存：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
struct _in_block {
    inner: array<u32>,
}

var<private> g_1_1: vec3<u32>;
@group(0) @binding(0) 
var<storage> _in: _in_block;
@group(0) @binding(1) 
var<storage, read_write> _out: _in_block;

fn qR(s: ptr<function, array<u32, 16>>, a: u32, b: u32, c: u32, d: u32) {
    let _e57 = (*s)[a];
    let _e59 = (*s)[b];
    (*s)[a] = (_e57 + _e59);
    let _e63 = (*s)[d];
    let _e65 = (*s)[a];
    (*s)[d] = (_e63 ^ _e65);
    let _e69 = (*s)[d];
    let _e73 = (*s)[d];
    (*s)[d] = ((_e69 << bitcast<u32>(16u)) | (_e73 >> bitcast<u32>(16u)));
    let _e79 = (*s)[c];
    let _e81 = (*s)[d];
    (*s)[c] = (_e79 + _e81);
    let _e85 = (*s)[b];
    let _e87 = (*s)[c];
    (*s)[b] = (_e85 ^ _e87);
    let _e91 = (*s)[b];
    let _e95 = (*s)[b];
    (*s)[b] = ((_e91 << bitcast<u32>(12u)) | (_e95 >> bitcast<u32>(20u)));
    let _e101 = (*s)[a];
    let _e103 = (*s)[b];
    (*s)[a] = (_e101 + _e103);
    let _e107 = (*s)[d];
    let _e109 = (*s)[a];
    (*s)[d] = (_e107 ^ _e109);
    let _e113 = (*s)[d];
    let _e117 = (*s)[d];
    (*s)[d] = ((_e113 << bitcast<u32>(8u)) | (_e117 >> bitcast<u32>(24u)));
    let _e123 = (*s)[c];
    let _e125 = (*s)[d];
    (*s)[c] = (_e123 + _e125);
    let _e129 = (*s)[b];
    let _e131 = (*s)[c];
    (*s)[b] = (_e129 ^ _e131);
    let _e135 = (*s)[b];
    let _e139 = (*s)[b];
    (*s)[b] = ((_e135 << bitcast<u32>(7u)) | (_e139 >> bitcast<u32>(25u)));
    return;
}

fn xY(z: u32) -> array<u32, 16> {
    var t: array<u32, 16> = array<u32, 16>();
    var i: u32 = u32();
    var var_for_index: array<u32, 8> = array<u32, 8>();
    var w: array<u32, 16> = array<u32, 16>();
    var r: u32 = u32();
    var j: u32 = u32();

    t[i32()] = 1768978533u;
    t[1i] = 1948281188u;
    t[2i] = 1701603695u;
    t[3i] = 2054299764u;
    i = u32();
    loop {
        let _e67 = i;
        if !((_e67 < 8u)) {
            break;
        }
        var_for_index = array<u32, 8>(2778944304u, 2710134585u, 1612543563u, 1172917921u, 3846223579u, 2389091675u, 972033108u, 274738666u);
        let _e70 = i;
        let _e73 = i;
        let _e75 = var_for_index[_e73];
        t[(4u + _e70)] = _e75;
        continue;
        continuing {
            let _e76 = i;
            i = (_e76 + 1u);
        }
    }
    t[12i] = z;
    t[13i] = 888566743u;
    t[14i] = 3797923964u;
    t[15i] = 2911175433u;
    let _e82 = t;
    w = _e82;
    r = u32();
    loop {
        let _e83 = r;
        if !((_e83 < 10u)) {
            break;
        }
        qR((&w), u32(), 1u, 2u, 3u);
        qR((&w), 4u, 5u, 6u, 7u);
        qR((&w), 8u, 9u, 10u, 11u);
        qR((&w), 12u, 13u, 14u, 15u);
        qR((&w), u32(), 4u, 8u, 12u);
        qR((&w), 1u, 5u, 9u, 13u);
        qR((&w), 2u, 6u, 10u, 14u);
        qR((&w), 3u, 7u, 11u, 15u);
        qR((&w), u32(), 5u, 10u, 15u);
        qR((&w), 1u, 6u, 11u, 12u);
        qR((&w), 2u, 7u, 8u, 13u);
        qR((&w), 3u, 4u, 9u, 14u);
        continue;
        continuing {
            let _e86 = r;
            r = (_e86 + 1u);
        }
    }
    j = u32();
    loop {
        let _e88 = j;
        if !((_e88 < 16u)) {
            break;
        }
        let _e91 = j;
        let _e94 = w[_e91];
        let _e95 = j;
        let _e97 = t[_e95];
        w[_e91] = (_e94 + _e97);
        continue;
        continuing {
            let _e99 = j;
            j = (_e99 + 1u);
        }
    }
    let _e101 = w;
    return _e101;
}

fn m_inner(g: vec3<u32>) {
    var k: u32 = u32();
    var var_for_index_1_: array<u32, 16> = array<u32, 16>();

    let _e56 = (g.x * 16u);
    if (_e56 >= arrayLength((&_in.inner))) {
        return;
    }
    let _e60 = xY(g.x);
    k = u32();
    loop {
        let _e61 = k;
        if !((_e61 < 16u)) {
            break;
        }
        var_for_index_1_ = _e60;
        let _e64 = k;
        let _e68 = k;
        let _e72 = _in.inner[(_e56 + _e68)];
        let _e73 = k;
        let _e75 = var_for_index_1_[_e73];
        _out.inner[(_e56 + _e64)] = (_e72 ^ _e75);
        continue;
        continuing {
            let _e77 = k;
            k = (_e77 + 1u);
        }
    }
    return;
}

fn m_1() {
    let _e50 = g_1_1;
    m_inner(_e50);
    return;
}

@compute @workgroup_size(64, 1, 1) 
fn m(@builtin(global_invocation_id) g_1_: vec3<u32>) {
    g_1_1 = g_1_;
    m_1();
}

是一个加密函数，比较加密结果的位置似乎位于AES下方：

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
//31420//1149
    const_aes::aes::cbc::<>::decrypt::h314e8f9f5e7eb882
              (&local_18,ARRAY_ram_00100278,ARRAY_ram_00100298);
    uStack_7c = 4;
    local_80 = local_10 & 3;
    local_8c = (ushort)local_14;
    local_8a = (byte)((uint)local_14 >> 0x10);
    uStack_89 = (undefined)((uint)local_14 >> 0x18);
    local_88 = (int **)(local_10 & 0xfffffffc);
    local_84 = (int *)(local_14 + (int)local_88);
    <>::from_iter::hd7c3ceb094dad17d(&local_c,&local_8c,0x10008c);
    if (uVar33 == local_4) { //这里比较了密钥的长度为72
      iVar18 = 0;
      uVar33 = uVar33 - 1;
      if (uVar32 == 0) {
        uVar33 = 0;
      }
      if ((uVar33 & 0x3fffffff) <= uVar33) {
        uVar33 = uVar33 & 0x3fffffff;
      }
      iVar17 = uVar33 + 1;
      do {
        iVar17 = iVar17 + -1;
        if (iVar17 == 0) {
          if (local_c != 0) {
            __rustc[4794b31dd7191200]::__rust_dealloc(local_8,local_c << 2,4);
          }
          if (local_18 != 0) {
            __rustc[4794b31dd7191200]::__rust_dealloc(local_14,local_18,1);
          }
          if (uVar34 != 0) {
            __rustc[4794b31dd7191200]::__rust_dealloc(iVar10,uVar34 << 2,4);
          }
          <>::drop::hc1c5bd6c16f8e0b2(&local_68);
          <>::drop::h189c4e2bbb2b69d6(&local_50);
          if (0x83 < local_48) {
            __externref_table_dealloc(local_48);
          }
          if ((local_44 != -0x80000000) && (local_44 != 0)) {
            __rustc[4794b31dd7191200]::__rust_dealloc(local_40,local_44,1);
          }
          iVar10 = *param1[0x30];
          *param1[0x30] = iVar10 + -1;
          if (iVar10 == 1) {
            alloc::sync::Arc<T,A>::drop_slow::h1f8c037807479379(param1 + 0x30);
          }
          iVar10 = *param1[0x1b];
          *param1[0x1b] = iVar10 + -1;
          if (iVar10 == 1) {
            alloc::sync::Arc<T,A>::drop_slow::h763270cd5bad1138(param1 + 0x1b);
          }
          iVar10 = *param1[0x1c];
          *param1[0x1c] = iVar10 + -1;
          if (iVar10 == 1) {
            alloc::sync::Arc<T,A>::drop_slow::hfe2599c5b325ef41(param1 + 0x1c);
          }
          iVar10 = *param1[0x15];
          *param1[0x15] = iVar10 + -1;
          if (iVar10 == 1) {
            alloc::sync::Arc<T,A>::drop_slow::h763270cd5bad1138(param1 + 0x15);
          }
          iVar10 = *param1[0x16];
          *param1[0x16] = iVar10 + -1;
          if (iVar10 == 1) {
            alloc::sync::Arc<T,A>::drop_slow::hfe2599c5b325ef41(param1 + 0x16);
          }
          iVar10 = *param1[0xf];
          *param1[0xf] = iVar10 + -1;
          if (iVar10 == 1) {
            alloc::sync::Arc<T,A>::drop_slow::h763270cd5bad1138(param1 + 0xf);
          }
          iVar10 = *param1[0x10];
          *param1[0x10] = iVar10 + -1;
          bVar3 = true;
          if (iVar10 != 1) goto code_r0x8003182d;
          goto code_r0x80031825;
        }
        piVar16 = (int *)(local_8 + iVar18);
        piVar31 = (int *)(iVar10 + iVar18);
        iVar18 = iVar18 + 4;
      } while (*piVar31 == *piVar16); // 比较
    }

在这个比较位置下断点，将要比较的两个值取低8位后相互xor再xor输入的字符即为所求，例如，在第一位输入“W”，得到-1957371933，和要比较的密文-1957371950相互xor后再xor输入的“W”即得到第一个字符“f”：(-1957371950 & 0xFF) ^ (-1957371933 & 0xFF) ^ ord("W") == ord(”f”)

最终得到flag：

flag{de8d8a8b52f772de6647625b60b5fbf8b90706919ae7d331f3bb324faf2c0537}