文章总结： 该文档详细记录了针对BVES虚拟逆向挑战的完整分析过程，作者通过逆向分析exe和bvs文件，利用IDA、010Editor等工具解析程序结构，追踪文件读取操作，最终成功解密出Flag。文章提供了具体的逆向技术方法和关键步骤，属于典型的CTF二进制逆向工程实战经验分享。 综合评分： 85 文章分类： 逆向分析,二进制安全,CTF,漏洞分析,技术标准

BVES 虚拟逆向：从 Opcode 到 Flag 的完整分析

原创

小张 小张

网络安全研习社

2026年5月15日 15:25 陕西

在小说阅读器读本章

去阅读

免责声明：涉及到的所有技术仅用来学习交流，严禁用于非法用途，未经授权请勿非法渗透，否则产生的一切后果自行承担，如有侵权，请及时联系删帖！

一、前言

下载链接：https://crackmes.one/crackme/69ffdc47d7ff92e1214c0079

二、正文

这道题给了我们两个文件，一个exe一个bvs文件。作者也给了提示如下：

使用bvessel可执行文件运行随附的.bvs 文件。接下来我们执行一下

通过运行给出了很明显的提示in.txt，以及三个变量

我们用ida查看exe，010查看bvs文件，如下：

该程序中没有main函数，且start函数看着不像如下：

__int64&nbsp;sub_140001075(){&nbsp;&nbsp;signed&nbsp;__int64 StackBase_2;&nbsp;// rcx&nbsp;&nbsp;signed&nbsp;__int64 *v1;&nbsp;// rdx&nbsp;&nbsp;int&nbsp;v3;&nbsp;// [rsp+3Ch] [rbp-54h] BYREF&nbsp; __int64 v4;&nbsp;// [rsp+40h] [rbp-50h]&nbsp;&nbsp;signed&nbsp;__int64 *v5;&nbsp;// [rsp+48h] [rbp-48h]&nbsp; __int64 v6;&nbsp;// [rsp+50h] [rbp-40h]&nbsp;&nbsp;signed&nbsp;__int64 StackBase_1;&nbsp;// [rsp+58h] [rbp-38h]&nbsp;&nbsp;signed&nbsp;__int64 *v8;&nbsp;// [rsp+60h] [rbp-30h]&nbsp;&nbsp;struct&nbsp;_TEB&nbsp;*v9;&nbsp;// [rsp+68h] [rbp-28h]&nbsp;&nbsp;int&nbsp;n48;&nbsp;// [rsp+70h] [rbp-20h]&nbsp;&nbsp;int&nbsp;Code;&nbsp;// [rsp+74h] [rbp-1Ch]&nbsp; PVOID StackBase;&nbsp;// [rsp+78h] [rbp-18h]&nbsp;&nbsp;signed&nbsp;__int64 StackBase_3;&nbsp;// [rsp+80h] [rbp-10h]&nbsp;&nbsp;int&nbsp;v14;&nbsp;// [rsp+8Ch] [rbp-4h]&nbsp;&nbsp; StackBase_3 =&nbsp;0;&nbsp; n48 =&nbsp;48;&nbsp; v9 =&nbsp;NtCurrentTeb();&nbsp; StackBase = v9->NtTib.StackBase;&nbsp; v14 =&nbsp;0;&nbsp; Code =&nbsp;0;&nbsp;&nbsp;while&nbsp;(&nbsp;1&nbsp;)&nbsp; {&nbsp; &nbsp; v8 = &qword_140010098;&nbsp; &nbsp; StackBase_1 = (signed&nbsp;__int64)StackBase;&nbsp; &nbsp; v6 =&nbsp;0;&nbsp; &nbsp; StackBase_2 = (signed&nbsp;__int64)StackBase;&nbsp; &nbsp; v1 = &qword_140010098;&nbsp; &nbsp; StackBase_3 = _InterlockedCompareExchange64(&qword_140010098, (signed&nbsp;__int64)StackBase,&nbsp;0);&nbsp; &nbsp;&nbsp;if&nbsp;( !StackBase_3 )&nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp;&nbsp;if&nbsp;( (PVOID)StackBase_3 == StackBase )&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; v14 =&nbsp;1;&nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;Sleep(0x3E8u);&nbsp; }&nbsp;&nbsp;if&nbsp;( n2 ==&nbsp;1&nbsp;)&nbsp; &nbsp;&nbsp;amsg_exit(31);&nbsp;&nbsp;if&nbsp;( n2 )&nbsp; {&nbsp; &nbsp; dword_14001001C =&nbsp;1;&nbsp; }&nbsp;&nbsp;else&nbsp; {&nbsp; &nbsp; n2 =&nbsp;1;&nbsp; &nbsp;&nbsp;sub_1400023B0();&nbsp; &nbsp; qword_140010110 = (__int64)SetUnhandledExceptionFilter((LPTOP_LEVEL_EXCEPTION_FILTER)&lpTopLevelExceptionFilter_);&nbsp; &nbsp;&nbsp;sub_1400095C0(sub_140001000);&nbsp; &nbsp;&nbsp;sub_140002A80();&nbsp; &nbsp; dword_140010018 =&nbsp;sub_140001398();&nbsp; &nbsp;&nbsp;if&nbsp;( unk_1400100D0 )&nbsp; &nbsp; &nbsp; _set_app_type(_crt_gui_app);&nbsp; &nbsp;&nbsp;else&nbsp; &nbsp; &nbsp; _set_app_type(_crt_console_app);&nbsp; &nbsp; *(_DWORD *)sub_140009470() = unk_140010100;&nbsp; &nbsp; *(_DWORD *)sub_140009480() = unk_1400100C0;&nbsp; &nbsp; Code =&nbsp;sub_140001990();&nbsp; &nbsp;&nbsp;if&nbsp;( Code <&nbsp;0&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;amsg_exit(8);&nbsp; &nbsp;&nbsp;if&nbsp;( unk_14000A060 ==&nbsp;1&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;sub_1400024CA(sub_140001AA0);&nbsp; &nbsp;&nbsp;if&nbsp;( unk_14000A040 ==&nbsp;-1&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;sub_140009600(0xFFFFFFFFLL);&nbsp; &nbsp;&nbsp;if&nbsp;( (unsigned&nbsp;int)sub_140009410(&unk_14000C928, &unk_14000C930) )&nbsp; &nbsp; &nbsp;&nbsp;return&nbsp;255;&nbsp; &nbsp; v3 = unk_1400100A0;&nbsp; &nbsp; Code = _getmainargs(&dword_140010004, &qword_140010008, &qword_140010010, unk_14000A030, &v3);&nbsp; &nbsp;&nbsp;if&nbsp;( Code <&nbsp;0&nbsp;)&nbsp; &nbsp; &nbsp;&nbsp;amsg_exit(8);&nbsp; &nbsp; Code =&nbsp;sub_14000149C((unsigned&nbsp;int)dword_140010004, &qword_140010008);&nbsp; &nbsp;&nbsp;if&nbsp;( Code )&nbsp; &nbsp; &nbsp;&nbsp;amsg_exit(8);&nbsp; &nbsp;&nbsp;initterm(&First_, &Last_);&nbsp; &nbsp;&nbsp;sub_140001967();&nbsp; &nbsp; n2 =&nbsp;2;&nbsp; }&nbsp;&nbsp;if&nbsp;( !v14 )&nbsp; {&nbsp; &nbsp; v5 = &qword_140010098;&nbsp; &nbsp; v4 =&nbsp;0;&nbsp; &nbsp; v1 = (signed&nbsp;__int64 *)_InterlockedExchange64(&qword_140010098,&nbsp;0);&nbsp; }&nbsp;&nbsp;if&nbsp;( TlsCallback_0 )&nbsp; &nbsp;&nbsp;TlsCallback_0(0,&nbsp;2,&nbsp;0);&nbsp; *(_QWORD *)sub_140009490(StackBase_2, v1) = qword_140010010;&nbsp; Code =&nbsp;sub_140009820((unsigned&nbsp;int)dword_140010004, qword_140010008, qword_140010010);&nbsp;&nbsp;if&nbsp;( !dword_140010018 )&nbsp; &nbsp;&nbsp;exit(Code);&nbsp;&nbsp;if&nbsp;( !dword_14001001C )&nbsp; &nbsp;&nbsp;cexit();&nbsp;&nbsp;return&nbsp;(unsigned&nbsp;int)Code;}

不像主逻辑，当然除了看函数还可以看导入表跟string表，同时我们通过bvs中可以看到读取文件的操作，可以通过fopen（）也来追踪。

其中这个里面很明显的主程序字符串–debug/IMPEXT/invalid bvs等，跟进快速定位到函数

__int64&nbsp;sub_140009820(){&nbsp;&nbsp;int&nbsp;n3_1;&nbsp;// ecx&nbsp;&nbsp;int&nbsp;n3;&nbsp;// ebx&nbsp; __int64 v2;&nbsp;// rdx&nbsp; __int64 v3;&nbsp;// rsi&nbsp; _DWORD *v4;&nbsp;// rdi&nbsp; __int64 i;&nbsp;// rcx&nbsp; Stream *Stream;&nbsp;// rsi&nbsp;&nbsp;unsigned&nbsp;int&nbsp;v7;&nbsp;// edi&nbsp; __int64 v8;&nbsp;// rax&nbsp; _BYTE *v9;&nbsp;// r14&nbsp;&nbsp;int&nbsp;n_3;&nbsp;// r13d&nbsp;&nbsp;int&nbsp;n62;&nbsp;// r15d&nbsp; __int64 j;&nbsp;// r12&nbsp;&nbsp;int&nbsp;j_1;&nbsp;// ebp&nbsp;&nbsp;int&nbsp;n62_1;&nbsp;// eax&nbsp;&nbsp;unsigned&nbsp;__int64 n512_1;&nbsp;// rbp&nbsp;&nbsp;unsigned&nbsp;__int64 n512;&nbsp;// r12&nbsp;&nbsp;size_t&nbsp;Size;&nbsp;// rdx&nbsp; _DWORD *v18;&nbsp;// rcx&nbsp; __int64 k;&nbsp;// rax&nbsp;&nbsp;char&nbsp;*v20;&nbsp;// rax&nbsp; __int64 v21;&nbsp;// r15&nbsp;&nbsp;char&nbsp;v22;&nbsp;// cl&nbsp;&nbsp;char&nbsp;*v23;&nbsp;// rdx&nbsp; __int64 m;&nbsp;// r14&nbsp; __int64 v25;&nbsp;// rdx&nbsp;&nbsp;int&nbsp;n_8;&nbsp;// ebp&nbsp;&nbsp;char&nbsp;*v27;&nbsp;// rdx&nbsp;&nbsp;int&nbsp;n_6;&nbsp;// esi&nbsp; __int64 (__fastcall *psub_140009620)();&nbsp;// r13&nbsp; __int64 v30;&nbsp;// rax&nbsp;&nbsp;int&nbsp;n_7;&nbsp;// r8d&nbsp; _BYTE *v32;&nbsp;// rsi&nbsp;&nbsp;const&nbsp;char&nbsp;*mutable;&nbsp;// r14&nbsp; __int64 v34;&nbsp;// r15&nbsp; __int64 v35;&nbsp;// rax&nbsp;&nbsp;const&nbsp;char&nbsp;*v36;&nbsp;// r9&nbsp;&nbsp;int&nbsp;v37;&nbsp;// r8d&nbsp;&nbsp;const&nbsp;char&nbsp;*v38;&nbsp;// rbx&nbsp;&nbsp;int&nbsp;n;&nbsp;// esi&nbsp; __int64 n_4;&nbsp;// rsi&nbsp; __int64 v41;&nbsp;// rsi&nbsp;&nbsp;char&nbsp;*FileName;&nbsp;// r15&nbsp; Stream *Stream_1;&nbsp;// rax&nbsp; Stream *Stream_2;&nbsp;// r14&nbsp;&nbsp;size_t&nbsp;v45;&nbsp;// rax&nbsp; __int16 v46;&nbsp;// ax&nbsp; __int64 v47;&nbsp;// r13&nbsp; __int64 v48;&nbsp;// rsi&nbsp;&nbsp;char&nbsp;*Destination;&nbsp;// rcx&nbsp; __int64 v50;&nbsp;// rax&nbsp; __int64 v51;&nbsp;// r8&nbsp; __int64 n6;&nbsp;// r8&nbsp; __int64 n_5;&nbsp;// rdx&nbsp;&nbsp;const&nbsp;char&nbsp;*v54;&nbsp;// r8&nbsp;&nbsp;int&nbsp;n_1;&nbsp;// edx&nbsp;&nbsp;unsigned&nbsp;__int16 Buffer_;&nbsp;// [rsp+3Ah] [rbp-7F86Eh] BYREF&nbsp; _BYTE Buffer[4];&nbsp;// [rsp+3Ch] [rbp-7F86Ch] BYREF&nbsp; _BYTE v59[8];&nbsp;// [rsp+40h] [rbp-7F868h] BYREF&nbsp; _BYTE v60[522224];&nbsp;// [rsp+48h] [rbp-7F860h] BYREF&nbsp;&nbsp;int&nbsp;n_2;&nbsp;// [rsp+7F838h] [rbp-70h]&nbsp;&nbsp;char&nbsp;*v62;&nbsp;// [rsp+7F840h] [rbp-68h]&nbsp;&nbsp;unsigned&nbsp;__int64 n512_2;&nbsp;// [rsp+7F848h] [rbp-60h]&nbsp;&nbsp;unsigned&nbsp;__int64 n512_3;&nbsp;// [rsp+7F850h] [rbp-58h]&nbsp;&nbsp;int&nbsp;n_9;&nbsp;// [rsp+7F858h] [rbp-50h]&nbsp;&nbsp;int&nbsp;v66;&nbsp;// [rsp+7F85Ch] [rbp-4Ch]&nbsp; _BYTE v67[40];&nbsp;// [rsp+7F860h] [rbp-48h] BYREF&nbsp;&nbsp;&nbsp;sub_140002F40();&nbsp; n3 = n3_1;&nbsp; v3 = v2;&nbsp;&nbsp;sub_140001967();&nbsp;&nbsp;if&nbsp;( n3 <=&nbsp;1&nbsp;)&nbsp; {&nbsp; &nbsp;&nbsp;return&nbsp;1;&nbsp; }&nbsp;&nbsp;else&nbsp; {&nbsp; &nbsp; v4 = v59;&nbsp; &nbsp;&nbsp;for&nbsp;( i =&nbsp;130568; i; --i )&nbsp; &nbsp; &nbsp; *v4++ =&nbsp;0;&nbsp; &nbsp;&nbsp;if&nbsp;( n3 ==&nbsp;3&nbsp;&& !strcmp(*(const&nbsp;char&nbsp;**)(v3 +&nbsp;16),&nbsp;"--debug") )&nbsp; &nbsp; &nbsp; v66 =&nbsp;1;&nbsp; &nbsp; Stream =&nbsp;fopen(*(const&nbsp;char&nbsp;**)(v3 +&nbsp;8),&nbsp;"rb");&nbsp; &nbsp;&nbsp;if&nbsp;(&nbsp;fread(Buffer,&nbsp;1u,&nbsp;4u, Stream) !=&nbsp;4&nbsp;|| (v7 =&nbsp;memcmp(Buffer,&nbsp;"BVES",&nbsp;4u)) !=&nbsp;0&nbsp;)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; v8 =&nbsp;psub_140009620();&nbsp; &nbsp; &nbsp;&nbsp;sub_140002F80(v8,&nbsp;"bvessel error: %s\n",&nbsp;"invalid bvs");&nbsp; &nbsp; &nbsp;&nbsp;exit(1);&nbsp; &nbsp; }&nbsp; &nbsp; v9 = v59;&nbsp; &nbsp; n_3 =&nbsp;0;&nbsp; &nbsp; v59[0] =&nbsp;fgetc(Stream);&nbsp; &nbsp;&nbsp;fgetc(Stream);&nbsp; &nbsp; n_2 = (unsigned&nbsp;__int8)fgetc(Stream) >>&nbsp;1;&nbsp; &nbsp;&nbsp;while&nbsp;( n_3 < n_2 )&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; n62 =&nbsp;0;&nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;( j =&nbsp;0; ; v9[j +&nbsp;7] = n62_1 )&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; j_1 = j;&nbsp; &nbsp; &nbsp; &nbsp; n62_1 =&nbsp;fgetc(Stream);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n62_1 ==&nbsp;-1&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n62 ==&nbsp;62&nbsp;&& n62_1 ==&nbsp;62&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; j_1 = j -&nbsp;1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v67[4112&nbsp;* n_3 -&nbsp;522265&nbsp;+ (int)j] =&nbsp;0;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; ++j;&nbsp; &nbsp; &nbsp; &nbsp; n62 = n62_1;&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; ++n_3;&nbsp; &nbsp; &nbsp; v9 +=&nbsp;4112;&nbsp; &nbsp; &nbsp; *((_QWORD *)v9 -&nbsp;1) = j_1;&nbsp; &nbsp; }&nbsp; &nbsp; n512_1 =&nbsp;0;&nbsp; &nbsp; n512 =&nbsp;512;&nbsp; &nbsp; v62 = (char&nbsp;*)malloc(0x3800u);&nbsp; &nbsp;&nbsp;while&nbsp;(&nbsp;fread(&Buffer_,&nbsp;2u,&nbsp;1u, Stream) ==&nbsp;1&nbsp;)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n512_1 >= n512 )&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; Size =&nbsp;56&nbsp;* n512;&nbsp; &nbsp; &nbsp; &nbsp; n512 *=&nbsp;2LL;&nbsp; &nbsp; &nbsp; &nbsp; v62 = (char&nbsp;*)realloc(v62, Size);&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; v18 = &unk_14000B180;&nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;( k =&nbsp;0; k !=&nbsp;14; ++k )&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( *v18 == Buffer_ )&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v20 = (char&nbsp;*)&unk_14000B180 +&nbsp;16&nbsp;* k;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_29;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; v18 +=&nbsp;4;&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; v20 =&nbsp;0;LABEL_29:&nbsp; &nbsp; &nbsp; v21 =&nbsp;28&nbsp;* n512_1;&nbsp; &nbsp; &nbsp; v22 =&nbsp;0;&nbsp; &nbsp; &nbsp; v23 = &v62[28&nbsp;* n512_1];&nbsp; &nbsp; &nbsp; *(_DWORD *)v23 = Buffer_;&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v20 )&nbsp; &nbsp; &nbsp; &nbsp; v22 = v20[4];&nbsp; &nbsp; &nbsp; v23[4] = v22;&nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;( m =&nbsp;0; (unsigned&nbsp;__int8)v62[v21 +&nbsp;4] > (int)m; ++m )&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; v25 =&nbsp;2&nbsp;* m;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;fread(&v62[v21 +&nbsp;6&nbsp;+ v25],&nbsp;2u,&nbsp;1u, Stream);&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; ++n512_1;&nbsp; &nbsp; }&nbsp; &nbsp; n512_2 = n512_1;&nbsp; &nbsp;&nbsp;fclose(Stream);&nbsp; &nbsp;&nbsp;while&nbsp;(&nbsp;1&nbsp;)&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; n_8 = n_9;&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n_9 || n512_3 >= n512_2 )&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; v27 = &v62[28&nbsp;* n512_3++];&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !*((_DWORD *)v27 +&nbsp;6) )&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;switch&nbsp;( *(_DWORD *)v27 )&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;1:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_9 =&nbsp;1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_47;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;2:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_4 = *((_WORD *)v27 +&nbsp;3) &&nbsp;0x7FFF;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (int)n_4 < n_2 )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v41 =&nbsp;4112&nbsp;* n_4;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !v60[v41 +&nbsp;4104] )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; FileName = &v59[4112&nbsp;* (*((_WORD *)v27 +&nbsp;3) &&nbsp;0x7FFF) +&nbsp;8];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Stream_1 =&nbsp;fopen(FileName,&nbsp;"rb");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Stream_2 = Stream_1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( Stream_1 )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v45 =&nbsp;fread(FileName,&nbsp;1u,&nbsp;0xFFFu, Stream_1);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v60[v41 +&nbsp;4104] =&nbsp;1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; *(_QWORD *)&v60[v41 +&nbsp;4096] = v45;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v67[v41 -&nbsp;522264&nbsp;+ v45] =&nbsp;0;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;fclose(Stream_2);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;3:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v46 = *((_WORD *)v27 +&nbsp;4);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v46 >=&nbsp;0&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v47 =&nbsp;4112LL&nbsp;* (unsigned&nbsp;__int16)v46;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( !v60[v47 +&nbsp;4104] )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v48 = *((unsigned&nbsp;__int16 *)v27 +&nbsp;3);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; Destination = &v59[v47 +&nbsp;8];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (v48 &&nbsp;0x8000u) ==&nbsp;0LL&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;strcpy(Destination, &v59[4112&nbsp;* (unsigned&nbsp;__int16)v48 +&nbsp;8]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v50 = *(_QWORD *)&v60[4112&nbsp;* v48 +&nbsp;4096];&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v50 = (int)sub_140005C70(Destination,&nbsp;4096,&nbsp;"%u", v48 &&nbsp;0x7FFF);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; *(_QWORD *)&v60[v47 +&nbsp;4096] = v50;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;4:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v51 =&nbsp;0;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_60;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;5:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v51 =&nbsp;1;LABEL_60:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ((void&nbsp;(__fastcall *)(_BYTE *,&nbsp;char&nbsp;*, __int64))sub_14000174B)(v59, v27, v51);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;6:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n6 =&nbsp;6;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_63;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;7:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n6 =&nbsp;0;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_63;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;8:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n6 =&nbsp;2;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_63;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;9:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n6 =&nbsp;1;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_63;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;0xA:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n6 =&nbsp;3;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_63;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;0xB:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n6 =&nbsp;4;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;goto&nbsp;LABEL_63;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;0xC:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n6 =&nbsp;5;LABEL_63:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ((void&nbsp;(__fastcall *)(_BYTE *,&nbsp;char&nbsp;*, __int64))sub_1400017EF)(v59, v27, n6);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;case&nbsp;0xD:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; n_5 = *((unsigned&nbsp;__int16 *)v27 +&nbsp;3);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (n_5 &&nbsp;0x8000u) ==&nbsp;0LL&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( (unsigned&nbsp;__int16)n_5 < n_2 )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;puts(&v59[4112&nbsp;* n_5 +&nbsp;8]);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;else&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;sub_140005BF0("%u\n", n_5 &&nbsp;0x7FFF);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;default:&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v66 )&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; n_6 = n_2;&nbsp; &nbsp; &nbsp; &nbsp; psub_140009620 = psub_140009620;&nbsp; &nbsp; &nbsp; &nbsp; v30 =&nbsp;psub_140009620();&nbsp; &nbsp; &nbsp; &nbsp; n_7 = n_6;&nbsp; &nbsp; &nbsp; &nbsp; v32 = v59;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;sub_140002F80(v30,&nbsp;" &nbsp;vars (%d):\n", n_7);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;while&nbsp;( n_8 < n_2 )&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;mutable&nbsp;=&nbsp;"mutable";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( v32[4112] )&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;mutable&nbsp;=&nbsp;"frozen";&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v34 = *((_QWORD *)v32 +&nbsp;513);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v35 = ((__int64 (__fastcall *)(__int64))psub_140009620)(2);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v36 = v32 +&nbsp;8;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v37 = n_8++;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v32 +=&nbsp;4112;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;sub_140002F80(v35,&nbsp;" &nbsp; &nbsp;[%d] %s (len %zu, %s)\n", v37, v36, v34,&nbsp;mutable);&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; }LABEL_47:&nbsp; &nbsp; v38 = v60;&nbsp; &nbsp;&nbsp;for&nbsp;( n =&nbsp;0; n_2 > n; ++n )&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; v54 = v38;&nbsp; &nbsp; &nbsp; n_1 = n;&nbsp; &nbsp; &nbsp; v38 +=&nbsp;4112;&nbsp; &nbsp; &nbsp;&nbsp;sub_140005BF0("Var[%d]: %s\n", n_1, v54);&nbsp; &nbsp; }&nbsp; &nbsp;&nbsp;free(v62);&nbsp; }&nbsp;&nbsp;return&nbsp;v7;}

对于这个函数我们就找到了主要逻辑点了，

以下是参数校验，以及变量提取

sub_140002F40();&nbsp; n3 = n3_1; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 变量个数&nbsp; ______ = _______1; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 存储值-参数&nbsp;&nbsp;sub_140001967();&nbsp;&nbsp;if&nbsp;( n3 <=&nbsp;1&nbsp;) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 参数不够直接推&nbsp; {&nbsp; &nbsp;&nbsp;return&nbsp;1;&nbsp; }&nbsp;&nbsp;else&nbsp; {&nbsp; &nbsp; _____4 = _____2;&nbsp; &nbsp;&nbsp;for&nbsp;( i =&nbsp;130568; i; --i )&nbsp; &nbsp; &nbsp; *_____4++ =&nbsp;0;&nbsp; &nbsp;&nbsp;if&nbsp;( n3 ==&nbsp;3&nbsp;&& !strcmp(*(const&nbsp;char&nbsp;**)(______ +&nbsp;16),&nbsp;"--debug") )// 看第三个参数是否是--debug&nbsp; &nbsp; &nbsp; ____ =&nbsp;1; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 调试开关&nbsp; &nbsp; Stream =&nbsp;fopen(*(const&nbsp;char&nbsp;**)(______ +&nbsp;8),&nbsp;"rb");// 读取第二个参数-bvs文件&nbsp; &nbsp;&nbsp;if&nbsp;(&nbsp;fread(Buffer,&nbsp;1u,&nbsp;4u, Stream) !=&nbsp;4&nbsp;|| (v7 =&nbsp;memcmp(Buffer,&nbsp;"BVES",&nbsp;4u)) !=&nbsp;0&nbsp;)// 对应bvs四个字节 &nbsp; 检验魔数&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; v8 = ::psub_140009620();&nbsp; &nbsp; &nbsp;&nbsp;sub_140002F80(v8,&nbsp;"bvessel error: %s\n",&nbsp;"invalid bvs");&nbsp; &nbsp; &nbsp;&nbsp;exit(1);&nbsp; &nbsp; }&nbsp; &nbsp; _____1 = _____2; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 变量指针&nbsp; &nbsp; n_3 =&nbsp;0; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 变量个数-文件&nbsp; &nbsp; _____2[0] =&nbsp;fgetc(Stream); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 读一个字节对应01&nbsp; &nbsp;&nbsp;fgetc(Stream); &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 再读一个不处理&nbsp; &nbsp; n_2 = (unsigned&nbsp;__int8)fgetc(Stream) >>&nbsp;1; &nbsp;// 读取到06再右移一位到3&nbsp; &nbsp;&nbsp;while&nbsp;( n_3 < n_2 ) &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 参数读取循环三次&nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; n62 =&nbsp;0; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 上一个字符&nbsp; &nbsp; &nbsp;&nbsp;for&nbsp;( j =&nbsp;0; ; _____1[j +&nbsp;7] = n62_1 ) &nbsp; &nbsp;// 把当前读到的字符写进当前变量字符串区&nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; j_1 = j; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 保存当前索引&nbsp; &nbsp; &nbsp; &nbsp; n62_1 =&nbsp;fgetc(Stream);&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n62_1 ==&nbsp;-1&nbsp;)&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp;&nbsp;if&nbsp;( n62 ==&nbsp;'>'&nbsp;&& n62_1 ==&nbsp;'>'&nbsp;) &nbsp; &nbsp; &nbsp;&nbsp;// 读取到>>这个进入&nbsp; &nbsp; &nbsp; &nbsp; {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; j_1 = j -&nbsp;1; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 去掉前面那个多余的 >&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; v67[4112&nbsp;* n_3 -&nbsp;522265&nbsp;+ (int)j] =&nbsp;0;// 在字符串末尾补 \0&nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;break;&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; ++j;&nbsp; &nbsp; &nbsp; &nbsp; n62 = n62_1; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;// 把当前字符保存为“上一个字符”，供下一轮判断 >>&nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; ++n_3;&nbsp; &nbsp; &nbsp; _____1 +=&nbsp;4112; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;&nbsp;// 跳到下一个变量槽&nbsp; &nbsp; &nbsp; *((_QWORD *)_____1 -&nbsp;1) = j_1;&nbsp; &nbsp; }

这一整段读完后的结果

你的样本会得到：

Var[0] = "in.txt"Var[1] = "you failure"Var[2] = "you winner"

接下来

    n512_1 = 0;                                 // 当前指令数    n512 = 512;                                 // 初始容量    v62 = (char *)malloc(0x3800u);              // 分布内存    while ( fread(&Buffer_, 2u, 1u, Stream) == 1 )// 每次读 1 个元素每个元素 2 字节    {      if ( n512_1 >= n512 )                     // 扩容      {        Size = 56 * n512;        n512 *= 2LL;        v62 = (char *)realloc(v62, Size);      }      v18 = &unk_14000B180;                     // opcode 表查找，通过当前读取到的opcode对应指令      for ( k = 0; k != 14; ++k )      {        if ( *v18 == Buffer_ )        {          v20 = (char *)&unk_14000B180 + 16 * k;          goto LABEL_29;        }        v18 += 4;      }      v20 = 0;LABEL_29:                                       // 把当前指令保存到内部结构      v21 = 28 * n512_1;      v22 = 0;      v23 = &v62[28 * n512_1];      *(_DWORD *)v23 = Buffer_;      if ( v20 )        v22 = v20[4];      v23[4] = v22;      for ( m = 0; (unsigned __int8)v62[v21 + 4] > (int)m; ++m )// 读取指令参数      {        v25 = 2 * m;        fread(&v62[v21 + 6 + v25], 2u, 1u, Stream);      }      ++n512_1;                                 // 当前指令数加一    }

这里就是转换opcode到指令的核心部分了。其中opcode表如下

div.Section0{page:Section0;} unk_14000B180   db    0                 ; DATA XREF: sub_140009820:loc_1400099F5↑o.rdata:000000014000B181                 db    0.rdata:000000014000B182                 db    0.rdata:000000014000B183                 db    0.rdata:000000014000B184                 db    0.rdata:000000014000B185                 db    0.rdata:000000014000B186                 db    0.rdata:000000014000B187                 db    0.rdata:000000014000B188                 dq offset unk_14000B128.rdata:000000014000B190                 db    1.rdata:000000014000B191                 db    0.rdata:000000014000B192                 db    0.rdata:000000014000B193                 db    0.rdata:000000014000B194                 db    0.rdata:000000014000B195                 db    0.rdata:000000014000B196                 db    0.rdata:000000014000B197                 db    0.rdata:000000014000B198                 dq offset unk_14000B12C.rdata:000000014000B1A0                 db    2.rdata:000000014000B1A1                 db    0.rdata:000000014000B1A2                 db    0.rdata:000000014000B1A3                 db    0.rdata:000000014000B1A4                 db    1.rdata:000000014000B1A5                 db    0.rdata:000000014000B1A6                 db    0.rdata:000000014000B1A7                 db    0.rdata:000000014000B1A8                 dq offset aImpext       ; "IMPEXT".rdata:000000014000B1B0                 db    3.rdata:000000014000B1B1                 db    0.rdata:000000014000B1B2                 db    0.rdata:000000014000B1B3                 db    0.rdata:000000014000B1B4                 db    2.rdata:000000014000B1B5                 db    0.rdata:000000014000B1B6                 db    0.rdata:000000014000B1B7                 db    0.rdata:000000014000B1B8                 dq offset aMov          ; "MOV".rdata:000000014000B1C0                 db    4.rdata:000000014000B1C1                 db    0.rdata:000000014000B1C2                 db    0.rdata:000000014000B1C3                 db    0.rdata:000000014000B1C4                 db    2.rdata:000000014000B1C5                 db    0.rdata:000000014000B1C6                 db    0.rdata:000000014000B1C7                 db    0.rdata:000000014000B1C8                 dq offset aAdd          ; "ADD".rdata:000000014000B1D0                 db    5.rdata:000000014000B1D1                 db    0.rdata:000000014000B1D2                 db    0.rdata:000000014000B1D3                 db    0.rdata:000000014000B1D4                 db    2.rdata:000000014000B1D5                 db    0.rdata:000000014000B1D6                 db    0.rdata:000000014000B1D7                 db    0.rdata:000000014000B1D8                 dq offset aSub          ; "SUB".rdata:000000014000B1E0                 db    6.rdata:000000014000B1E1                 db    0.rdata:000000014000B1E2                 db    0.rdata:000000014000B1E3                 db    0.rdata:000000014000B1E4                 db    1.rdata:000000014000B1E5                 db    0.rdata:000000014000B1E6                 db    0.rdata:000000014000B1E7                 db    0.rdata:000000014000B1E8                 dq offset aJmp          ; "JMP".rdata:000000014000B1F0                 db    7.rdata:000000014000B1F1                 db    0.rdata:000000014000B1F2                 db    0.rdata:000000014000B1F3                 db    0.rdata:000000014000B1F4                 db    3.rdata:000000014000B1F5                 db    0.rdata:000000014000B1F6                 db    0.rdata:000000014000B1F7                 db    0.rdata:000000014000B1F8                 dq offset aJil          ; "JIL".rdata:000000014000B200                 db    9.rdata:000000014000B201                 db    0.rdata:000000014000B202                 db    0.rdata:000000014000B203                 db    0.rdata:000000014000B204                 db    3.rdata:000000014000B205                 db    0.rdata:000000014000B206                 db    0.rdata:000000014000B207                 db    0.rdata:000000014000B208                 dq offset aJig          ; "JIG".rdata:000000014000B210                 db    8.rdata:000000014000B211                 db    0.rdata:000000014000B212                 db    0.rdata:000000014000B213                 db    0.rdata:000000014000B214                 db    3.rdata:000000014000B215                 db    0.rdata:000000014000B216                 db    0.rdata:000000014000B217                 db    0.rdata:000000014000B218                 dq offset aJle          ; "JLE".rdata:000000014000B220                 db  0Ah.rdata:000000014000B221                 db    0.rdata:000000014000B222                 db    0.rdata:000000014000B223                 db    0.rdata:000000014000B224                 db    3.rdata:000000014000B225                 db    0.rdata:000000014000B226                 db    0.rdata:000000014000B227                 db    0.rdata:000000014000B228                 dq offset aJge          ; "JGE".rdata:000000014000B230                 db  0Bh.rdata:000000014000B231                 db    0.rdata:000000014000B232                 db    0.rdata:000000014000B233                 db    0.rdata:000000014000B234                 db    3.rdata:000000014000B235                 db    0.rdata:000000014000B236                 db    0.rdata:000000014000B237                 db    0.rdata:000000014000B238                 dq offset aJe           ; "JE".rdata:000000014000B240                 db  0Ch.rdata:000000014000B241                 db    0.rdata:000000014000B242                 db    0.rdata:000000014000B243                 db    0.rdata:000000014000B244                 db    3.rdata:000000014000B245                 db    0.rdata:000000014000B246                 db    0.rdata:000000014000B247                 db    0.rdata:000000014000B248                 dq offset aJne          ; "JNE".rdata:000000014000B250                 db  0Dh.rdata:000000014000B251                 db    0.rdata:000000014000B252                 db    0.rdata:000000014000B253                 db    0.rdata:000000014000B254                 db    1.rdata:000000014000B255                 db    0.rdata:000000014000B256                 db    0.rdata:000000014000B257                 db    0.rdata:000000014000B258                 dq offset aPrint        ; "PRINT".rdata:000000014000B260 TlsDirectory    dq offset TlsStart.rdata:000000014000B268 TlsEnd_ptr      dq offset TlsEnd.rdata:000000014000B270 TlsIndex_ptr    dq offset TlsIndex.rdata:000000014000B278 TlsCallbacks_ptr dq offset TlsCallbacks

到这里bvs文件里面的内容就转换成了

0: IMPEXT 01: JE 4, 420, Var[0]2: PRINT 13: JMP 54: PRINT 25: RET

到这里答案就已经出来了，后面的代码其实就是通过switch case跳到相关指令区域，执行指令

最后本题答案就是创建in.txt里面写入420如下

文章中使用到的工具，如有需要，在公众号私信回复 20260515 即可获取下载链接！

免责声明：

本文所载程序、技术方法仅面向合法合规的安全研究与教学场景，旨在提升网络安全防护能力，具有明确的技术研究属性。

任何单位或个人未经授权，将本文内容用于攻击、破坏等非法用途的，由此引发的全部法律责任、民事赔偿及连带责任，均由行为人独立承担，本站不承担任何连带责任。

本站内容均为技术交流与知识分享目的发布，若存在版权侵权或其他异议，请通过邮件联系处理，具体联系方式可点击页面上方的联系我。

本文转载自：网络安全研习社 小张 小张《BVES 虚拟逆向：从 Opcode 到 Flag 的完整分析》