数证杯2025决赛团体赛程序功能分析

  hModule = LoadLibraryA("nvcuda.dll");
  if ( !hModule )
    return 0;
  v7 = &cuCtxCreateV2;
  for ( i = 0; (&Source)[i]; ++i )
  {
    ProcAddress = GetProcAddress(hModule, (&Source)[i]);
    *v7 = ProcAddress;
    if ( !*v7 )
    {
      strcpy(Destination, (&Source)[i]);
      v4 = strstr(Destination, "_v2");
      if ( v4 )
      {
        *v4 = 0;
        v2 = GetProcAddress(hModule, Destination);
        *v7 = v2;
      }
    }
    if ( !*v7 )
    {
      FreeLibrary(hModule);
      return 0;
    }
    ++v7;
  }
  return hModule;
}

v8 = sub_401500(0x10000000u, 0x4000000u, dwBytes);
if ( !v8 )
  return MessageBoxA(0, "Failed to allocate GPU memory.", "err", 0x40010u);

int __cdecl sub_401500(unsigned int a1, unsigned int a2, unsigned int *a3)
{
  _DWORD v4[3]; // [esp+1Ch] [ebp-Ch] BYREF

  for ( *a3 = a1; *a3 >= a2; *a3 >>= 2 )
  {
    if ( !cuMemAlloc_v2(v4, *a3) )
      return v4[0];
  }
  *a3 = 0;
  return 0;
}

Src = v9;
*v9 = 0x5DAB355;                                // [0:4]字节Magic 55BDA05
*(Src + 1) = nNumberOfBytesToRead;              // [4:8]字节为文件大小
v3 = sub_401FAE(Src + 12, nNumberOfBytesToRead);// 计算校验值
*(Src + 2) = v3;                                // [8:12]字节为校验值
nNumberOfBytesToRead += 12;                     // 写入大小为文件大小+12

unsigned int __cdecl sub_401FAE(unsigned __int8 *a1, int a2)
{
  unsigned __int8 *v2; // eax
  unsigned int i; // [esp+18h] [ebp-10h]

  for ( i = 0; a2--; i = rotr(i ^ *v2, 8) )
    v2 = a1++;
  return i;
}

v17 = *(a1 + 0x3C) + a1;             // 0x3C偏移为IMAGE_DOS_HEADER中的e_lfanew
                                     // 指向IMAGE_NT_HEADER    
v16 = VirtualAlloc(0, *(v17 + 0x50), 0x3000u, PAGE_EXECUTE_READWRITE);
                                     // IMAGE_NT_HEADER的0x50偏移
                                     // 为Optional Header中的SizeOfImage
                                     // 表示文件在内存中应占用的大小
v29 = *(v17 + 0x54);                 // 0x54偏移为SizeOfHeaders，整个PE文件所有头部分的大小
v26 = a1;
for ( i = v16; v29--; ++i )
{
  v1 = v26++;
  v2 = i;
  *v2 = *v1;
}

v22 = (v17 + 0x18 + *(v17 + 0x14));           // (NT Header + 0x18)
                                              // (OptionalHeader偏移)
                                              //  + SizeOfOptionalHeader
                                              // 得到SectionHeaders偏移
v30 = *(v17 + 6);                             // NumberOfSections
while ( v30-- )
{
  v25 = &v16[v22[3]];                         // v22的第4个DWORD, VirtualAddress
                                              // 新分配的内存基地址+VirtualAddress
  v27 = (v22[5] + a1);                        // v22第6个DWORD, PointerToRawData
                                              // 原始文件中的节偏移+文件基地址
  v28 = v22[4];                               // v22第5个DWORD, SizeOfRawData
                                              // 节的原始大小
  while ( v28-- )                             // 复制节数据
  {
    v4 = v27++;
    v5 = v25++;
    *v5 = *v4;
  }
  v22 += 10;                                  // 一个SectionHeader共10个DWORD
                                              // 移动到下一个节
}

if ( *(v17 + 0x84) )                          // 导入表的Size
{
  for ( j = &v16[*(v17 + 0x80)]; *(j + 3); j += 20 )// v17+0x80导入表的VirtualAddress
                                              // 在内存中遍历导入描述符
                                              // 每个描述符20字节，第4个DWORD指向DLL名称
  {
    hModule = LoadLibraryA(&v16[*(j + 3)]);   // 加载DLL
    v19 = &v16[*j];                           // OriginalFirstThunk
    for ( k = &v16[*(j + 4)]; *k; ++k )       // 第5个DWORD是FirstThunk
    {
      if ( v19 && *v19 < 0 )                  // *v19<0 表示序号导入 Ordinal Import
      {
        v14 = hModule + *(hModule + *(hModule + 15) + 120);
        *k = (hModule + *(hModule + 4 * (*v19 - *(v14 + 4)) + *(v14 + 7)));
      }
      else                                    // 名称导入 Name Import
      {
        *k = GetProcAddress(hModule, &v16[*k + 2]);
      }
      if ( v19 )
        ++v19;
    }
  }
}

if ( *(v17 + 0xA4) )                          // 重定位表
{
  v13 = &v16[-*(v17 + 0x34)];                 // 实际内存基地址-原始ImageBase
  for ( m = &v16[*(v17 + 0xA0)]; *(m + 1); m += *(m + 1) )// 遍历重定位块
  {
    v12 = &v16[*m];                           // 内存基地址+当前重定位块的VirtualAddress
    v31 = (*(m + 1) - 8) >> 1;                // 计算重定位项数量
    for ( n = m + 8; v31--; n = (n + 2) )     // 遍历重定位项
    {
      switch ( *(n + 1) & 0xF0 )              // 检查重定位块并执行写操作
      {
        case 0xA0:
          *&v12[*n & 0xFFF] += v13;
          break;
        case 0x30:
          *&v12[*n & 0xFFF] += v13;
          break;
        case 0x10:
          *&v12[*n & 0xFFF] += HIWORD(v13);
          break;
        case 0x20:
          *&v12[*n & 0xFFF] += v13;
          break;
      }
    }
  }
}