【攻防世界】Reverse——xxxorrr writeup

先查看它的main函数代码：

__int64 __fastcall main(int a1, char **a2, char **a3)
{
  int i; // [rsp+Ch] [rbp-34h]
  char s[40]; // [rsp+10h] [rbp-30h] BYREF
  unsigned __int64 v6; // [rsp+38h] [rbp-8h]

  v6 = __readfsqword(0x28u);
  sub_A90(check, a2, a3);
  fgets(s, 35, stdin);
  for ( i = 0; i <= 33; ++i )
    s1[i] ^= s[i];
  return 0LL;
}

unsigned __int64 check()
{
  unsigned __int64 v1; // [rsp+8h] [rbp-8h]

  v1 = __readfsqword(0x28u);
  if ( !strcmp(s1, s2) )
    puts("Congratulations!");
  else
    puts("Wrong!");
  return __readfsqword(0x28u) ^ v1;
}

它的逻辑很简单，就是s1和输入做异或，回调函数调用check函数s1与s2做对比，相同则“Congratulations”。但这样得到的结果是不对的。在s1的定义处，CTRL + x，会发现在程序init的时候，也会对s1做处理：

unsigned __int64 sub_84A()
{
  int i; // [rsp+Ch] [rbp-14h]
  unsigned __int64 v2; // [rsp+18h] [rbp-8h]

  v2 = __readfsqword(0x28u);
  for ( i = 0; i <= 33; ++i )
    s1[i] ^= 2 * i + 65;
  return __readfsqword(0x28u) ^ v2;
}

用下面的python代码输出flag：

s1 = 'qasxcytgsasxcvrefghnrfghnjedfgbhn\0'
s2 = [0x56, 0x4e, 0x57, 0x58, 0x51, 0x51, 0x09, 0x46,
          0x17, 0x46, 0x54,
          0x5A, 0x59, 0x59, 0x1F, 0x48, 0x32, 0x5B, 0x6B,
          0x7C, 0x75, 0x6E, 0x7E, 0x6E, 0x2F, 0x77, 0x4F,
          0x7A, 0x71, 0x43, 0x2B, 0x26, 0x89, 0xFE]
result = []
for i in range(len(s1)):
    result.append(ord(s1[i]) ^(2 * i + 65) ^ s2[i])
flag = ''.join(chr(c) for c in result) 
print(flag)