2023華中pwn題逆向參考視頻教程

相關(guān)字節(jié)標(biāo)識(shí)

_WORD（1個(gè)字=2個(gè)字節(jié)=16位）
_DWORD（2個(gè)字=4個(gè)字節(jié)=32位）
_QWORD（4個(gè)字=8個(gè)字節(jié)=64位）
_OWORD（8個(gè)字=16個(gè)字節(jié)=128位

DB (Define Byte): 用于定義單字節(jié)（8位）的數(shù)據(jù)。
DW (Define Word): 用于定義字（Word）大小的數(shù)據(jù)，通常為2字節(jié)（16位）。
DD (Define Doubleword): 用于定義雙字（Doubleword）大小的數(shù)據(jù)，通常為4字節(jié)（32位）。
DQ (Define Quadword): 用于定義四字（Quadword）大小的數(shù)據(jù)，通常為8字節(jié)（64位）。

導(dǎo)入函數(shù)和導(dǎo)出函數(shù)

在C語言中，導(dǎo)入函數(shù)和導(dǎo)出函數(shù)是實(shí)現(xiàn)模塊化編程的關(guān)鍵技術(shù)，它們分別用于在不同模塊之間共享和使用函數(shù)。以下是具體分析：

• 導(dǎo)出函數(shù)：在C語言中，當(dāng)一個(gè)函數(shù)被聲明為導(dǎo)出時(shí)，它意味著這個(gè)函數(shù)可以在其他模塊中被調(diào)用。這通常通過特定的編譯器指令或關(guān)鍵字來實(shí)現(xiàn)，例如在Windows平臺(tái)的C/C++中使用__declspec(dllexport)來導(dǎo)出DLL中的函數(shù)。

• 導(dǎo)入函數(shù)：與導(dǎo)出函數(shù)相對(duì)應(yīng)，導(dǎo)入函數(shù)是指在當(dāng)前模塊中引用外部模塊定義的函數(shù)。在C語言中，導(dǎo)入函數(shù)通常涉及到包含相應(yīng)的頭文件，并且確保鏈接時(shí)包含了定義這些函數(shù)的目標(biāo)文件或庫文件。

找程序入口函數(shù)

export找到start，start中找到main

選項(xiàng)設(shè)置

重命名

CISCN2023華中賽區(qū)分區(qū)賽AWD

IDA源碼

main

__int64 __fastcall main(int a1, char **a2, char **a3)
{int v4; // [rsp+Ch] [rbp-14h]void *ptr; // [rsp+10h] [rbp-10h]void *v6; // [rsp+18h] [rbp-8h]setvbuf(stdin, 0LL, 2, 0LL);setvbuf(stdout, 0LL, 2, 0LL);setvbuf(stderr, 0LL, 2, 0LL);alarm(0x20u);qword_50E0 = sub_141B();*(_DWORD *)qword_50E0 = 0;qword_5150 = qword_50E0;*(_BYTE *)(qword_50E0 + 4) = 47;strncpy(dest, (const char *)(qword_50E0 + 4), 1uLL);do{printf("\x1B[36mmybash:%s$ \x1B[0m", dest);ptr = (void *)sub_25D5();v6 = (void *)sub_247F(ptr);v4 = sub_23CA(v6);free(ptr);free(v6);}while ( v4 );return 0LL;
}

構(gòu)造結(jié)構(gòu)體

sub_141B()

該函數(shù)對(duì)建立的堆的不同位置進(jìn)行變量設(shè)置，為了更方便的查看設(shè)置的位置，可以設(shè)置一個(gè)結(jié)構(gòu)體來替代

_QWORD *sub_141B()
{_QWORD *v1; // [rsp+8h] [rbp-8h]v1 = malloc(0x40uLL);if ( !v1 )_exit(0);memset((char *)v1 + 4, 0, 0x10uLL);v1[7] = 0LL;v1[5] = 0LL;v1[4] = 0LL;v1[6] = 0LL;return v1;
}

打開局部變量類型的視圖

增加變量類型

重新定義變量類型

然后代碼變?yōu)?/p>

SomeStruct *sub_141B()
{SomeStruct *v1; // [rsp+8h] [rbp-8h]v1 = (SomeStruct *)malloc(0x40uLL);if ( !v1 )_exit(0);memset(&v1->gap[4], 0, 0x10uLL);*(_QWORD *)&v1->gap[56] = 0LL;*(_QWORD *)&v1->gap[40] = 0LL;*(_QWORD *)&v1->gap[32] = 0LL;*(_QWORD *)&v1->gap[48] = 0LL;return v1;
}

發(fā)現(xiàn)在距離起始四個(gè)字節(jié)后的十六個(gè)字節(jié)都設(shè)置為0memset(&v1->gap[4], 0, 0x10uLL);

memset函數(shù)

memset函數(shù)是C語言標(biāo)準(zhǔn)庫中的一個(gè)用于內(nèi)存操作的函數(shù)，它主要用于將某一塊內(nèi)存空間的內(nèi)容設(shè)置為指定的值。

memset函數(shù)的原型為：

void *memset(void *s, int c, size_t n);

• void *s：指向要填充的內(nèi)存塊的指針。
• int c：需要設(shè)置的值，該值會(huì)被轉(zhuǎn)換為無符號(hào)字符后用來設(shè)置內(nèi)存塊。
• size_t n：要設(shè)置的內(nèi)存塊的字節(jié)數(shù)。

再次設(shè)置變量類型并重新定義

結(jié)果代碼

SomeStruct *sub_141B()
{SomeStruct *v1; // [rsp+8h] [rbp-8h]v1 = (SomeStruct *)malloc(0x40uLL);if ( !v1 )_exit(0);memset(v1->some_array, 0, sizeof(v1->some_array));*(_QWORD *)&v1->gap[36] = 0LL;*(_QWORD *)&v1->gap[20] = 0LL;*(_QWORD *)&v1->gap[12] = 0LL;*(_QWORD *)&v1->gap[28] = 0LL;return v1;
}

再次設(shè)置變量類型并重新定義

SomeStruct *sub_141B()
{SomeStruct *v1; // [rsp+8h] [rbp-8h]v1 = (SomeStruct *)malloc(0x40uLL);if ( !v1 )_exit(0);memset(v1->some_array, 0, sizeof(v1->some_array));*(_QWORD *)&v1->gap[24] = 0LL;*(_QWORD *)&v1->gap[8] = 0LL;*(_QWORD *)v1->gap = 0LL;*(_QWORD *)&v1->gap[16] = 0LL;return v1;
}

再次設(shè)置變量類型并重新定義

SomeStruct *sub_141B()
{SomeStruct *v1; // [rsp+8h] [rbp-8h]v1 = (SomeStruct *)malloc(0x40uLL);if ( !v1 )_exit(0);memset(v1->some_array, 0, sizeof(v1->some_array));v1->ptr56 = 0LL;v1->ptr40 = 0LL;v1->ptr32 = 0LL;v1->ptr48 = 0LL;return v1;
}

設(shè)置函數(shù)名

標(biāo)記已經(jīng)分析完

找到引用函數(shù)的各個(gè)地方

對(duì)變量重新定義變量類型

__int64 __fastcall main(int a1, char **a2, char **a3)
{int v4; // [rsp+Ch] [rbp-14h]void *ptr; // [rsp+10h] [rbp-10h]void *v6; // [rsp+18h] [rbp-8h]setvbuf(stdin, 0LL, 2, 0LL);setvbuf(stdout, 0LL, 2, 0LL);setvbuf(stderr, 0LL, 2, 0LL);alarm(0x20u);qword_50E0 = SomeStruct::CreateInstance();qword_50E0->unkown_0 = 0;qword_5150 = qword_50E0;qword_50E0->some_array[0] = 47;strncpy(dest, qword_50E0->some_array, 1uLL);do{printf("\x1B[36mmybash:%s$ \x1B[0m", dest);ptr = (void *)sub_25D5();v6 = (void *)sub_247F(ptr);v4 = sub_23CA(v6);free(ptr);free(v6);}while ( v4 );return 0LL;
}

轉(zhuǎn)換為字符

格式化字符串"\x1B[36mmybash:%s$ \x1B[0m"

字符串 “\x1B[36mmybash:%s$ \x1B[0m” 是一個(gè)包含ANSI轉(zhuǎn)義序列的字符串，用于在終端上顯示顏色文本。在這個(gè)字符串中：

\x1B[36m 是一個(gè)ANSI轉(zhuǎn)義序列，用于將隨后的文本顏色設(shè)置為青色（Cyan）。\x1B 是ESC字符的十六進(jìn)制表示，[ 表示轉(zhuǎn)義序列的開始，36 是選擇青色的顏色代碼，而 m 表示結(jié)束這個(gè)顏色設(shè)置。
mybash:%s$ 是實(shí)際要顯示的文本，其中 %s 可能是一個(gè)占位符，用于格式化字符串時(shí)替換為某個(gè)特定的值。
\x1B[0m 是另一個(gè)ANSI轉(zhuǎn)義序列，用于重置文本顏色到默認(rèn)設(shè)置。這里 0 表示默認(rèn)顏色，而 m 同樣表示結(jié)束這個(gè)設(shè)置。

sub_25D5()

_BYTE *sub_25D5()
{int v1; // [rsp+Ch] [rbp-14h]int v2; // [rsp+10h] [rbp-10h]int v3; // [rsp+14h] [rbp-Ch]_BYTE *ptr; // [rsp+18h] [rbp-8h]v1 = 528;v2 = 0;ptr = malloc(0x210uLL);if ( !ptr )_exit(0);while ( 1 ){v3 = getchar();if ( v3 == -1 || v3 == 10 )break;ptr[v2++] = v3;if ( v2 >= v1 && v1 <= 2147483639 ){v1 += 496;ptr = realloc(ptr, v1);if ( !ptr ){fwrite("mybash: allocation error\n", 1uLL, 0x19uLL, stderr);exit(1);}}}ptr[v2] = 0;return ptr;
}

-1轉(zhuǎn)換與相關(guān)變量與函數(shù)命名

設(shè)置sub_25D5()

這里根據(jù)每次輸入一個(gè)字符將分配得到的堆指針設(shè)置為字符指針類型

void __fastcall read_line()
{int high; // [rsp+Ch] [rbp-14h]int i; // [rsp+10h] [rbp-10h]int tmp_char; // [rsp+14h] [rbp-Ch]char *input_content_line; // [rsp+18h] [rbp-8h]high = 528;i = 0;input_content_line = (char *)malloc(0x210uLL);if ( !input_content_line )_exit(0);while ( 1 ){tmp_char = getchar();if ( tmp_char == (unsigned int)EOF || tmp_char == '\n' )break;input_content_line[i++] = tmp_char;if ( i >= high && high <= 2147483639 ){high += 496;input_content_line = (char *)realloc(input_content_line, high);if ( !input_content_line ){fwrite("mybash: allocation error\n", 1uLL, 0x19uLL, stderr);exit(1);}}}input_content_line[i] = 0;
}

sub_247F(char *a1)

_QWORD *__fastcall sub_247F(char *a1)
{int v2; // [rsp+10h] [rbp-20h]int v3; // [rsp+14h] [rbp-1Ch]_QWORD *ptr; // [rsp+18h] [rbp-18h]char *i; // [rsp+20h] [rbp-10h]_QWORD *v6; // [rsp+28h] [rbp-8h]v2 = 64;v3 = 0;v6 = malloc(0x200uLL);if ( !v6 )_exit(0);ptr = v6;for ( i = strtok(a1, " \t\r\n\a"); i; i = strtok(0LL, " \t\r\n\a") ){ptr[v3++] = i;if ( v3 >= v2 ){v2 += 64;ptr = realloc(ptr, 8LL * v2);if ( !ptr ){fwrite("mybash: allocation error\n", 1uLL, 0x19uLL, stderr);exit(1);}}}ptr[v3] = 0LL;return ptr;
}

設(shè)置sub_247F(char *a1)函數(shù)

這里i是地址，所以ptr應(yīng)該是雙指針

char **__fastcall split_string(char *content_line)
{int high; // [rsp+10h] [rbp-20h]int cur_pos; // [rsp+14h] [rbp-1Ch]char **split_content_ptr; // [rsp+18h] [rbp-18h]char *one_split_content_ptr; // [rsp+20h] [rbp-10h]char **temp_chunk_ptr; // [rsp+28h] [rbp-8h]high = 64;cur_pos = 0;temp_chunk_ptr = (char **)malloc(0x200uLL);if ( !temp_chunk_ptr )_exit(0);split_content_ptr = temp_chunk_ptr;for ( one_split_content_ptr = strtok(content_line, " \t\r\n\a");one_split_content_ptr;one_split_content_ptr = strtok(0LL, " \t\r\n\a") ){split_content_ptr[cur_pos++] = one_split_content_ptr;if ( cur_pos >= high ){high += 64;split_content_ptr = (char **)realloc(split_content_ptr, 8LL * high);if ( !split_content_ptr ){fwrite("mybash: allocation error\n", 1uLL, 0x19uLL, stderr);exit(1);}}}split_content_ptr[cur_pos] = 0LL;return split_content_ptr;
}

sub_23CA(const char **a1)

__int64 __fastcall sub_23CA(const char **a1)
{int i; // [rsp+1Ch] [rbp-4h]if ( !*a1 )return 1LL;for ( i = 0; i < (int)sub_1523(); ++i ){if ( !strcmp(*a1, (const char *)*(&off_5020 + i)) )return ((__int64 (__fastcall *)(const char **))funcs_2446[i])(a1);}printf("%s: ERROR\n", *a1);return 0LL;
}

設(shè)置sub_23CA(const char **a1)函數(shù)

__int64 __fastcall instruction_proccess(const char **split_content_ptr_array)
{int i; // [rsp+1Ch] [rbp-4h]if ( !*split_content_ptr_array )return 1LL;for ( i = 0; i < (int)return_7(); ++i ){if ( !strcmp(*split_content_ptr_array, struction_name_ptr_array[i]) )return struction_function_ptr_array[i](split_content_ptr_array);}printf("%s: ERROR\n", *split_content_ptr_array);return 0LL;
}

sub_1523()

__int64 sub_1523()
{return 7LL;
}

設(shè)置sub_1523()函數(shù)

__int64 return_7()
{return 7LL;
}

h更換數(shù)據(jù)形式

對(duì)應(yīng)的各個(gè)字符串

更改各個(gè)函數(shù)名

__int64 __fastcall command_touch(__int64 a1)

__int64 __fastcall command_touch(__int64 a1)
{int v2; // [rsp+1Ch] [rbp-14h]void *ptr56; // [rsp+20h] [rbp-10h]SomeStruct *Instance; // [rsp+28h] [rbp-8h]v2 = 1;if ( !*(_QWORD *)(a1 + 8) )fwrite("mybash: missing operand\n", 1uLL, 0x18uLL, stderr);while ( *(_QWORD *)(8LL * v2 + a1) ){ptr56 = qword_5150->ptr56;if ( (unsigned __int8)sub_13C9((__int64)ptr56, *(const char **)(8LL * v2 + a1)) != 1 ){++v2;}else{Instance = SomeStruct::CreateInstance();Instance->unkown_0 = 1;sub_166E(Instance, *(_QWORD *)(8LL * v2 + a1));if ( qword_5150->ptr56 )sub_1628(ptr56, Instance);elseqword_5150->ptr56 = Instance;++v2;}}return 1LL;
}

修改后的__int64 __fastcall command_touch(__int64 a1)

__int64 __fastcall command_touch(char **args)
{int parameter_position; // [rsp+1Ch] [rbp-14h]SomeStruct *main_save_instance_ptr_of_first_file_ptr; // [rsp+20h] [rbp-10h]SomeStruct *Instance_ptr; // [rsp+28h] [rbp-8h]parameter_position = 1;if ( !args[1] )fwrite("mybash: missing operand\n", 1uLL, 0x18uLL, stderr);while ( args[parameter_position] ){main_save_instance_ptr_of_first_file_ptr = main_save_instance_ptr->first_son;if ( (unsigned __int8)SomeStruct::Folder_Not_Eixst(main_save_instance_ptr_of_first_file_ptr,args[parameter_position]) != 1 ){++parameter_position;}else{Instance_ptr = SomeStruct::CreateInstance();Instance_ptr->isfile = 1;SomeStruct::set_some_array(Instance_ptr, args[parameter_position]);if ( main_save_instance_ptr->first_son )sub_1628(main_save_instance_ptr_of_first_file_ptr, Instance_ptr);elsemain_save_instance_ptr->first_son = Instance_ptr;++parameter_position;}}return 1LL;
}

__int64 __fastcall command_mkdir(__int64 a1)

__int64 __fastcall command_mkdir(__int64 a1)
{char v1; // alint v3; // [rsp+1Ch] [rbp-14h]void *ptr56; // [rsp+20h] [rbp-10h]SomeStruct *Instance; // [rsp+28h] [rbp-8h]v3 = 1;if ( !*(_QWORD *)(a1 + 8) )fwrite("mybash: missing operand\n", 1uLL, 0x18uLL, stderr);while ( *(_QWORD *)(8LL * v3 + a1) ){ptr56 = qword_5150->ptr56;((void (__fastcall *)())((char *)&sub_13C8 + 1))();if ( v1 != 1 ){fprintf(stderr, aMybashCannotCr, *(_QWORD *)(8LL * v3++ + a1));}else{Instance = SomeStruct::CreateInstance();Instance->unkown_0 = 0;Instance->ptr48 = qword_5150;sub_166E(Instance, *(_QWORD *)(8LL * v3 + a1));if ( qword_5150->ptr56 )sub_1628(ptr56, Instance);elseqword_5150->ptr56 = Instance;++v3;}}return 1LL;
}

void sub_13C8()
{JUMPOUT(0x13CALL);
}

修改后的__int64 __fastcall command_mkdir(const char **args)

__int64 __fastcall command_mkdir(const char **args)
{// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]parameter_position = 1;if ( !args[1] )fwrite("mybash: missing operand\n", 1uLL, 0x18uLL, stderr);while ( args[parameter_position] ){main_save_instance_ptr_of_first = main_save_instance_ptr->first_son;if ( (unsigned __int8)SomeStruct::Folder_Not_Eixst(main_save_instance_ptr_of_first, args[parameter_position]) != 1 ){fprintf(stderr, aMybashCannotCr, args[parameter_position++]);}else{mkdir_create_Instance_ptr = SomeStruct::CreateInstance();mkdir_create_Instance_ptr->isfile = 0;    // 0為目錄mkdir_create_Instance_ptr->parent = main_save_instance_ptr;SomeStruct::set_some_array(mkdir_create_Instance_ptr, args[parameter_position]);if ( main_save_instance_ptr->first_son )sub_1628(main_save_instance_ptr_of_first, mkdir_create_Instance_ptr);elsemain_save_instance_ptr->first_son = mkdir_create_Instance_ptr;++parameter_position;}}return 1LL;
}

此時(shí)發(fā)現(xiàn)void sub_13C8()函數(shù)又跳轉(zhuǎn)

Tab鍵：反編譯

先



最后得到的原void sub_13C8()函數(shù)

__int64 __fastcall sub_13C9(__int64 a1, const char *a2)
{while ( a1 ){if ( !strcmp((const char *)(a1 + 4), a2) )return 0LL;a1 = *(_QWORD *)(a1 + 40);}return 1LL;
}

注意

當(dāng)一個(gè)函數(shù)分析有點(diǎn)棘手時(shí)可以查看其他引用該函數(shù)的地方

修改后的__int64 __fastcall command_cat(const char **args)

__int64 __fastcall command_cat(const char **args)
{unsigned __int64 high_parament_length_16; // raxvoid *v2; // rsp_BYTE v4[8]; // [rsp+8h] [rbp-70h] BYREFconst char **args_save; // [rsp+10h] [rbp-68h]char v6; // [rsp+1Fh] [rbp-59h]int parament_longest_length_more1; // [rsp+20h] [rbp-58h]int parameter_position; // [rsp+24h] [rbp-54h]SomeStruct *first_son; // [rsp+28h] [rbp-50h]__int64 parament_longest_length_more; // [rsp+30h] [rbp-48h]char *cat_file_name; // [rsp+38h] [rbp-40h]unsigned __int64 v12; // [rsp+40h] [rbp-38h]args_save = args;v12 = __readfsqword(0x28u);parameter_position = 0;v6 = 0;parament_longest_length_more1 = 0;first_son = 0LL;while ( args_save[++parameter_position] ){if ( strlen(args_save[parameter_position]) > parament_longest_length_more1 )parament_longest_length_more1 = strlen(args_save[parameter_position]) + 1;}parament_longest_length_more = parament_longest_length_more1 - 1LL;high_parament_length_16 = 16 * ((parament_longest_length_more1 + 15LL) / 0x10uLL);while ( v4 != &v4[-(high_parament_length_16 & 0xFFFFFFFFFFFFF000LL)] );v2 = alloca(high_parament_length_16 & 0xFFF);if ( (high_parament_length_16 & 0xFFF) != 0 )*&v4[(high_parament_length_16 & 0xFFF) - 8] = *&v4[(high_parament_length_16 & 0xFFF) - 8];cat_file_name = v4;                           // 上面都沒啥用，v2，v4后面都沒用到parameter_position = 1;if ( !args_save[1] )fwrite("mybash: missing operand\n", 1uLL, 0x18uLL, stderr);while ( args_save[parameter_position] ){first_son = current_directory_ptr->first_son;strcpy(cat_file_name, args_save[parameter_position]);while ( first_son ){if ( !strcmp(cat_file_name, first_son->file_name) ){if ( first_son->file_content_ptr )puts(first_son->file_content_ptr);v6 = 1;break;}first_son = first_son->next_ptr;}if ( v6 != 1 )fprintf(stderr, "mybash: %s: No such file or directory\n", args_save[parameter_position]);++parameter_position;}return 1LL;
}

修改后的__int64 __fastcall command_rm(const char **args)

__int64 __fastcall command_rm(const char **args)
{// [COLLAPSED LOCAL DECLARATIONS. PRESS KEYPAD CTRL-"+" TO EXPAND]parameter_position = 1;if ( !args[1] )fwrite("mybash: missing operand\n", 1uLL, 0x18uLL, stderr);while ( args[parameter_position] ){son_file = current_directory_ptr->first_son;success_flag = 0;while ( son_file ){if ( !strcmp(son_file->file_name, args[parameter_position]) ){success_flag = 1;if ( IsFile(son_file) ){memset(son_file->file_name, 0, sizeof(son_file->file_name));if ( son_file->file_content_ptr )free(son_file->file_content_ptr);SomeStruct::unlink_file(son_file);}else{fprintf(stderr, "mybash: '%s': Is a directory\n", args[parameter_position]);}break;}son_file = son_file->next_ptr;}if ( success_flag != 1 )fprintf(stderr, "mybash: '%s': No such file or directory\n", args[parameter_position]);++parameter_position;}return 1LL;
}

修改后的__int64 __fastcall command_echo(char **args)

__int64 __fastcall command_echo(char **args)
{SomeStruct *v2; // rbxSomeStruct *v3; // rbxint parameter_position; // [rsp+14h] [rbp-3Ch]int i; // [rsp+14h] [rbp-3Ch]int content_length; // [rsp+18h] [rbp-38h]int last_parameter_position; // [rsp+1Ch] [rbp-34h]int input_content_length; // [rsp+24h] [rbp-2Ch]SomeStruct *current_son_file; // [rsp+28h] [rbp-28h] BYREFconst char *last_parameter_ptr; // [rsp+30h] [rbp-20h]unsigned __int64 v11; // [rsp+38h] [rbp-18h]v11 = __readfsqword(0x28u);parameter_position = 0;if ( args[1] ){do++parameter_position;while ( args[parameter_position] );last_parameter_position = parameter_position - 1;if ( Is_No_Echo_to_File(args[parameter_position - 2]) ){for ( i = 1; i < last_parameter_position; ++i )printf(args[i]);puts(args[last_parameter_position]);return 1LL;}else{current_son_file = current_directory_ptr->first_son;last_parameter_ptr = args[last_parameter_position];if ( Is_Exist_File(&current_son_file, last_parameter_ptr) != 1 ){fprintf(stderr, "mybash: %s: No such file\n", last_parameter_ptr);return 1LL;}else if ( IsFile(current_son_file) ){if ( current_son_file->file_content_ptr ){content_length = SomeStruct::Get_Content_length(current_son_file->file_content_ptr);}else{content_length = 0x1F0;v2 = current_son_file;v2->file_content_ptr = malloc(0x1F0uLL);if ( !current_son_file->file_content_ptr )_exit(0);}input_content_length = strlen(args[last_parameter_position - 2]);while ( input_content_length > content_length )content_length += 0x1F0;if ( content_length > SomeStruct::Get_Content_length(current_son_file->file_content_ptr) ){v3 = current_son_file;v3->file_content_ptr = realloc(current_son_file->file_content_ptr, content_length);}strncpy(current_son_file->file_content_ptr, args[last_parameter_position - 2], input_content_length);return 1LL;}else{fprintf(stderr, "mybash: %s: Is a directory\n", last_parameter_ptr);return 1LL;}}}else{putchar(10);return 1LL;}
}

修改后的__int64 __fastcall command_cd(char **arg)

__int64 __fastcall command_cd(char **arg)
{size_t dest_length; // rbxsize_t current_file_name_length; // raxint main_save_instance_ptr_file_name_length; // [rsp+18h] [rbp-38h]const char *after_dlim_para; // [rsp+20h] [rbp-30h]SomeStruct *current_file; // [rsp+28h] [rbp-28h]char delim[2]; // [rsp+36h] [rbp-1Ah] BYREFunsigned __int64 v8; // [rsp+38h] [rbp-18h]v8 = __readfsqword(0x28u);if ( arg[1] ){if ( arg[2] ){fwrite("mybash: too many arguments\n", 1uLL, 0x1BuLL, stderr);}else{strcpy(delim, "/");for ( after_dlim_para = strtok(arg[1], delim); after_dlim_para; after_dlim_para = strtok(0LL, delim) ){if ( strcmp(after_dlim_para, ".") ){if ( !strcmp(after_dlim_para, "..") ){if ( current_directory_ptr->parent ){main_save_instance_ptr_file_name_length = strlen(current_directory_ptr->file_name);current_directory_path[(strlen(current_directory_path) - 1 - main_save_instance_ptr_file_name_length)] = 0;current_directory_ptr = current_directory_ptr->parent;// 當(dāng)前目錄更新為之前目錄的父目錄}}else{current_file = current_directory_ptr->first_son;if ( SomeStruct::File_Not_Eixst(current_file, after_dlim_para) ){fprintf(stderr, "mybash: %s: No such file or directory\n", after_dlim_para);return 1LL;}while ( current_file && strcmp(current_file->file_name, after_dlim_para) )current_file = current_file->next_ptr;if ( !SomeStruct::IsDirectory(current_file) ){fwrite("something wrong happened\n", 1uLL, 0x19uLL, stderr);return 1LL;}current_directory_ptr = current_file;dest_length = strlen(current_directory_path);if ( dest_length + strlen(current_file->file_name) + 1 <= 0x4F ){current_file_name_length = strlen(current_file->file_name);strncat(current_directory_path, current_file->file_name, current_file_name_length);*&current_directory_path[strlen(current_directory_path)] = 47;}}}}}}else{fwrite("mybash: expected argument\n", 1uLL, 0x1AuLL, stderr);}return 1LL;
}