[SUCTF2018]babyre

有两个很长的数组

通过计算，就是一个超大的数组

可以在v7双击进去按下*键将其的数组长度改到v7和v8长度的总和216，使其成为同一个数组。

不会改，直接插入了一个216数组好像。

注意有个反调试，可以直接nop 或者让其 retn

输入的 key 被确定在范围内，然后就是运算加密

然后就直接爆破了

#include <stdio.h>
#include <string.h>
int __cdecl main(int argc, const char** argv, const char** envp)
{
    char* v3; // rdi
    __int64 i; // rcx
    char v6; // [rsp+0h] [rbp-20h] BYREF
    char v7[216]; // [rsp+30h] [rbp+10h] BYREF
    char v8[60]; // [rsp+108h] [rbp+E8h] BYREF
    int v9[8]; // [rsp+144h] [rbp+124h] BYREF
    int j; // [rsp+164h] [rbp+144h]
    int v11; // [rsp+234h] [rbp+214h]
    int v_temp; // [rsp+238h] [rbp+218h]

    /*v3 = &v6;
    for (i = 150i64; i; --i)
    {
        *(_DWORD*)v3 = -858993460;
        v3 += 4;
    }
    j___CheckForDebuggerJustMyCode(byte_7FF68A963035);*/
    v7[0] = 2;
    v7[1] = 3;
    v7[2] = 2;
    v7[3] = 1;
    v7[4] = 4;
    v7[5] = 7;
    v7[6] = 4;
    v7[7] = 5;
    v7[8] = 10;
    v7[9] = 11;
    v7[10] = 10;
    v7[11] = 9;
    v7[12] = 14;
    v7[13] = 15;
    v7[14] = 12;
    v7[15] = 13;
    v7[16] = 16;
    v7[17] = 19;
    v7[18] = 16;
    v7[19] = 17;
    v7[20] = 20;
    v7[21] = 23;
    v7[22] = 22;
    v7[23] = 19;
    v7[24] = 28;
    v7[25] = 25;
    v7[26] = 30;
    v7[27] = 31;
    v7[28] = 28;
    v7[29] = 25;
    v7[30] = 26;
    v7[31] = 31;
    memcpy(
        &v7[32],
        "$!\"'$!\"#().+$-&/81:;4=>7092;<567HIBBDDFGHIJJMMONPPRSUTVWYYZ[\\]^^``ccdeggiikklmnnpprstuwwxy{{}}",
        94);
    v7[126] = 0x7F;
    v7[127] = 0x7F;
    v7[128] = 0x81;
    v7[129] = 0x81;
    v7[130] = 0x83;
    v7[131] = 0x83;
    v7[132] = 0x8C;
    v7[133] = 0x8D;
    v7[134] = 0x8E;
    v7[135] = 0x8F;
    v7[136] = 0x88;
    v7[137] = 0x89;
    v7[138] = 0x8A;
    v7[139] = 0x8B;
    v7[140] = 0x8C;
    v7[141] = 0x8D;
    v7[142] = 0x8E;
    v7[143] = 0x87;
    v7[144] = 152;
    v7[145] = -111;
    v7[146] = 0x92;
    v7[147] = 147;
    v7[148] = 0x94;
    v7[149] = 0x95;
    v7[150] = 0x96;
    v7[151] = -105;
    v7[152] = -104;
    v7[153] = -103;
    v7[154] = -102;
    v7[155] = -102;
    v7[156] = -100;
    v7[157] = -100;
    v7[158] = -98;
    v7[159] = -98;
    v7[160] = -96;
    v7[161] = -96;
    v7[162] = -94;
    v7[163] = -94;
    v7[164] = -92;
    v7[165] = -92;
    v7[166] = -90;
    v7[167] = -90;
    v7[168] = -88;
    v7[169] = -88;
    v7[170] = -86;
    v7[171] = -86;
    v7[172] = -84;
    v7[173] = -84;
    v7[174] = -82;
    v7[175] = -82;
    v7[176] = 0xB0;
    v7[177] = 0xB1;
    v7[178] = 178;
    v7[179] = 179;
    for (int i = 0; i < 0x10000; i++) {
        v9[0] = i; // 看到最多是v9[0] %= 0x10000u; 则 枚举迭代v9[0]


        memset(v8, 0, 0x1Fui64);
        //sub_7FF68A951159(std::cout, "flag format: SUCTF{xxxxxxxxxxxxxxx}\n");
        //sub_7FF68A951159(std::cout, "Please Input Key:");
        //std::istream::operator>>(std::cin, v9);
        v9[0] %= 0x10000u;
        v8[30] = 8;
        while (v8[30])
        {
            --v8[30];
            for (j = 22; j; v8[j] |= v_temp << v8[30])
            {
                v11 = v7[22 * v8[30] + --j];
                v_temp = (v11 >> (((unsigned int)v9[0] >> (2 * v8[30])) & 3)) & 1;
            }
        }
        if (strstr(v8, "SUCTF{")!=NULL) {
            for (int vi = 0; vi < 22; vi++) {
                printf("%c", v8[vi]);
            }
            printf("\n");
        }
    }
    //sub_7FF68A951159(std::cout, v8);
    //system("pause");
    return 0;
    // SUCTF{Flag_8i7244980f}
}