标签:__ xor reverse holy int v11 v3 v4 进阶
前言
继续ctf的旅程
攻防世界Reverse高手进阶区的2分题
本篇是reverse-for-the-holy-grail-350的writeup
发现攻防世界的题目分数是动态的
就仅以做题时的分数为准了
解题过程
PE查壳
扔进IDA
关键函数 stringMod
__int64 __fastcall stringMod(__int64 *a1)
{
__int64 v1; // r9
__int64 v2; // r10
__int64 v3; // rcx
signed int v4; // er8
int *v5; // rdi
int *v6; // rsi
signed int v7; // ecx
signed int v8; // er9
int v9; // er10
unsigned int v10; // eax
int v11; // esi
int v12; // esi
int v14[24]; // [rsp+0h] [rbp-60h]
int _48[24]; // [rsp+48h] [rbp-18h]
memset(v14, 0, 0x48uLL);
v1 = a1[1];
if ( v1 )
{
v2 = *a1;
v3 = 0LL;
v4 = 0;
do
{
v12 = *(char *)(v2 + v3);
v14[v3] = v12;
if ( 3 * ((unsigned int)v3 / 3) == (_DWORD)v3 && v12 != firstchar[(unsigned int)v3 / 3] ) //3的倍数对应firstchar
v4 = -1;
++v3;
}
while ( v3 != v1 );
}
else
{
v4 = 0;
}
v5 = v14;
v6 = v14;
v7 = 666;
do
{
*v6 = v7 ^ *(unsigned __int8 *)v6; //异或
v7 += v7 % 5;
++v6;
}
while ( _48 != v6 ); //18次
v8 = 1;
v9 = 0;
v10 = 1;
v11 = 0;
do
{
if ( v11 == 2 )
{
if ( *v5 != thirdchar[v9] )
v4 = -1;
if ( v10 % *v5 != masterArray[v9] )
v4 = -1;
++v9;
v10 = 1;
v11 = 0;
}
else
{
v10 *= *v5;
if ( ++v11 == 3 )
v11 = 0;
}
++v8;
++v5;
}
while ( v8 != 19 );
return (unsigned int)(v7 * v4);
}
firstchar = [0x41, 0x69, 0x6e, 0x45, 0x6f, 0x61]
thirdchar = [0x2ef, 0x2c4, 0x2dc, 0x2c7, 0x2de, 0x2fc]
masterarray = [0x1d7, 0xc, 0x244, 0x25e, 0x93, 0x6c]
xor_number=0x29a
xor_array=[]
for i in range(18):
xor_array.append(xor_number)
xor_number += xor_number % 5
flag=""
for i in range(6):
one=firstchar[i]
three=thirdchar[i] ^ xor_array[(i*3) + 2]
for j in range(256):
if masterarray[i]==(j^xor_array[i*3+1])*(one^xor_array[i*3])%thirdchar[i]:
flag+=chr(one)+chr(j)+chr(three)
break
print("tuctf{" + flag + "}")
得到flag:tuctf{AfricanOrEuropean?}
结语
简单题
标签:__,xor,reverse,holy,int,v11,v3,v4,进阶 来源: https://blog.csdn.net/weixin_44604541/article/details/111868596
本站声明: 1. iCode9 技术分享网(下文简称本站)提供的所有内容,仅供技术学习、探讨和分享; 2. 关于本站的所有留言、评论、转载及引用,纯属内容发起人的个人观点,与本站观点和立场无关; 3. 关于本站的所有言论和文字,纯属内容发起人的个人观点,与本站观点和立场无关; 4. 本站文章均是网友提供,不完全保证技术分享内容的完整性、准确性、时效性、风险性和版权归属;如您发现该文章侵犯了您的权益,可联系我们第一时间进行删除; 5. 本站为非盈利性的个人网站,所有内容不会用来进行牟利,也不会利用任何形式的广告来间接获益,纯粹是为了广大技术爱好者提供技术内容和技术思想的分享性交流网站。