[GXYCTF2019]luck_guy1和打印pe文件

void PrintfAllPeHeader(void* pFileBuffer)
{
    pFileBuffer = ReadPeFile(FileName);
    PIMAGE_DOS_HEADER pDosHeader = NULL;
    PIMAGE_NT_HEADERS pNTHeader = NULL;
    PIMAGE_FILE_HEADER pPEHeader = NULL;
    PIMAGE_OPTIONAL_HEADER32 pOptionHeader = NULL;
    PIMAGE_SECTION_HEADER pSectionHeader = NULL;
    pDosHeader = (PIMAGE_DOS_HEADER)pFileBuffer;
    pNTHeader = (PIMAGE_NT_HEADERS)((BYTE*)pFileBuffer + pDosHeader->e_lfanew);
    pPEHeader = (PIMAGE_FILE_HEADER)((BYTE*)pNTHeader + sizeof(DWORD));
    pOptionHeader = (PIMAGE_OPTIONAL_HEADER32)((BYTE*)pPEHeader + IMAGE_SIZEOF_FILE_HEADER);
    pSectionHeader = (PIMAGE_SECTION_HEADER)((BYTE*)pOptionHeader + pPEHeader->SizeOfOptionalHeader);
    cout << hex << "-----------IMAGE_DOS_HEADER_BASE---------" << endl;
    cout << hex << "|-e_magic                           = " << pDosHeader->e_magic << endl;
    cout << hex << "|-e_lfanew                          = " << pDosHeader->e_lfanew << endl;
    cout << hex << "|" << endl;
    cout << hex << "|------------------IMAGE_NT_HEADERS_BASE-----------------" << endl;
    cout << hex << "|-signature                         = " << IMAGE_NT_SIGNATURE << endl;
    cout << hex << "|" << endl;
    cout << hex << "|---------IMAGE_FILE_HEADER_BASE---------" << endl;
    cout << hex << "||-Machine                          = " << pPEHeader->Machine << endl;
    cout << hex << "||-NumberOfSections                 = " << pPEHeader->NumberOfSections << endl;
    cout << hex << "||-TimeDataStamp                    = " << pPEHeader->TimeDateStamp << endl;
    cout << hex << "||-PointerToSymbolicTable           = " << pPEHeader->PointerToSymbolTable << endl;
    cout << hex << "||-NumberOfSymbols                  = " << pPEHeader->NumberOfSymbols << endl;
    cout << hex << "||-SizeOfOptionalHeader             = " << pPEHeader->SizeOfOptionalHeader << endl;
    cout << hex << "||-Characteristics                  = " << pPEHeader->Characteristics << endl;
    cout << hex << "||" << endl;
    cout << hex << "||-----------IMAGE_OPTIONAL_HEADER---------" << endl;
    cout << hex << "||-Magic                            = " << pOptionHeader->Magic << endl;
    printf("||-MajorLinkerVersion               = %x\n", pOptionHeader->MajorLinkerVersion);
    printf("||-MinorLinkerVersion               = %x\n", pOptionHeader->MinorLinkerVersion);
    cout << hex << "||-SizeOfCode                       = " << pOptionHeader->SizeOfCode << endl;
    cout << hex << "||-SizeOfInitializedData            = " << pOptionHeader->SizeOfInitializedData << endl;
    cout << hex << "||-SizeOfUninitializedData          = " << pOptionHeader->SizeOfUninitializedData << endl;
    cout << hex << "||-AddressOfEntryPoint              = " << pOptionHeader->AddressOfEntryPoint << endl;
    cout << hex << "||-BaseOfCode                       = " << pOptionHeader->BaseOfCode << endl;
    cout << hex << "||-BaseOfData                       = " << pOptionHeader->BaseOfData << endl;
    cout << hex << "||" << endl;
    cout << hex << "||-----------NT 结构增加的领域---------" << endl;
    cout << hex << "||-ImageBase                        = " << pOptionHeader->ImageBase << endl;
    cout << hex << "||-SectionAlignment                 = " << pOptionHeader->SectionAlignment << endl;
    cout << hex << "||-FileAlignment                    = " << pOptionHeader->FileAlignment << endl;
    cout << hex << "||-MajorOperatingSystemVersion      = " << pOptionHeader->MajorOperatingSystemVersion << endl;
    cout << hex << "||-MinorOperatingSystemVersion      = " << pOptionHeader->MinorOperatingSystemVersion << endl;
    cout << hex << "||-MajorImageVersion                = " << pOptionHeader->MajorImageVersion << endl;
    cout << hex << "||-MinorImageVersion                = " << pOptionHeader->MinorImageVersion << endl;
    cout << hex << "||-MajorSubsystemVersion            = " << pOptionHeader->MajorSubsystemVersion << endl;
    cout << hex << "||-MinorSubsystemVersion            = " << pOptionHeader->MinorSubsystemVersion << endl;
    cout << hex << "||-Win32VersionValue                = " << pOptionHeader->Win32VersionValue << endl;
    cout << hex << "||-SizeOfImage                      = " << pOptionHeader->SizeOfImage << endl;
    cout << hex << "||-SizeOfHeaders                    = " << pOptionHeader->SizeOfHeaders << endl;
    cout << hex << "||-CheckSum                         = " << pOptionHeader->CheckSum << endl;
    cout << hex << "||-Subsystem                        = " << pOptionHeader->Subsystem << endl;
    cout << hex << "||-DllCharacteristics               = " << pOptionHeader->DllCharacteristics << endl;
    cout << hex << "||-SizeOfStackReserve               = " << pOptionHeader->SizeOfStackReserve << endl;
    cout << hex << "||-SizeOfStackCommit                = " << pOptionHeader->SizeOfStackCommit << endl;
    cout << hex << "||-SizeOfHeapReserve                = " << pOptionHeader->SizeOfHeapReserve << endl;
    cout << hex << "||-SizeOfHeapCommit                 = " << pOptionHeader->SizeOfHeapCommit << endl;
    cout << hex << "||-LoaderFlags                      = " << pOptionHeader->LoaderFlags << endl;
    cout << hex << "||-NumberOfRvaAndSizes              = " << pOptionHeader->NumberOfRvaAndSizes << endl;
    cout << hex << "|" << endl;
    cout << hex << "|-------PE结构大小----------------------" << endl;
    cout << hex << "|-sizeof(IMAGE_DOS_HEADER)          = " << sizeof(IMAGE_DOS_HEADER) << endl;
    cout << hex << "|-sizeof(IMAGE_FILE_HEADER)         = " << sizeof(IMAGE_FILE_HEADER) << endl;
    cout << hex << "|-sizeof(IMAGE_OPTIONAL_HEADER)     = " << sizeof(IMAGE_OPTIONAL_HEADER) << endl;
    cout << hex << "|-realSizeof(IMAGE_OPTIONAL_HEADER) = " << sizeof(IMAGE_OPTIONAL_HEADER) << endl;
    cout << hex << "|-sizeof(IMAGE_NT_HEADERS)          = " << sizeof(IMAGE_NT_HEADERS) << endl;
    cout << hex << "|" << endl;
    cout << hex << "|-------文件中PE头基址----------------------" << endl;
    cout << hex << "|-IMAGE_DOS_HEADER_BASE             = " << (void*)((BYTE*)pDosHeader - (BYTE*)pDosHeader) << endl;
    cout << hex << "|-IMAGE_NT_HEADERS_BASE             = " << (void*)((BYTE*)pNTHeader - (BYTE*)pDosHeader) << endl;
    cout << hex << "|-IMAGE_FILE_HEADER_BASE            = " << (void*)((BYTE*)pPEHeader - (BYTE*)pDosHeader) << endl;
    cout << hex << "|-IMAGE_OPTIONAL_HEADER_BASE        = " << (void*)((BYTE*)pOptionHeader - (BYTE*)pDosHeader) << endl;
    cout << hex << "|" << endl;
    for (int i = 0; i < pPEHeader->NumberOfSections;i++)
    {
        char* postion = (char*)((char*)pOptionHeader + pPEHeader->SizeOfOptionalHeader + (sizeof(IMAGE_SECTION_HEADER) *i));
        if (*postion == 0x00)
        {
            break;
            cout << "终止" << endl;
        }
            PIMAGE_SECTION_HEADER pSectionHeader = (PIMAGE_SECTION_HEADER)postion;
            cout << hex << "|----------------------------------------" << endl;
            cout << hex << "|---------------节表" << i + 1 << "--------------" << endl;
            cout << hex << "||-SectionName               = " << pSectionHeader->Name << endl;
            cout << hex << "||-BaseAddress               = " << (void*)((char*)postion - (char*)pDosHeader) << endl;
            cout << hex << "||-MemoryBaseAddress         = " << (void*)(char*)postion << endl;
            printf("||-VirtualSize               = %x\n", pSectionHeader->Misc);
            cout << hex << "||-VirtualAddress            = " << pSectionHeader->VirtualAddress << endl;
            cout << hex << "||-SizeOfRawData             = " << pSectionHeader->SizeOfRawData << endl;
            cout << hex << "||-PointerToRawData          = " << pSectionHeader->PointerToRawData << endl;
            cout << hex << "||-PointerToRelocations      = " << pSectionHeader->PointerToRelocations << endl;
            cout << hex << "||-PointerToLinenumbers      = " << pSectionHeader->PointerToLinenumbers << endl;
            cout << hex << "||-NumberOfRelocation        = " << pSectionHeader->NumberOfRelocations << endl;
            cout << hex << "||-NumberOfLinenumbers       = " << pSectionHeader->NumberOfLinenumbers << endl;
            cout << hex << "||-Characteristics           = " << pSectionHeader->Characteristics << endl;
        
    }
    cout << hex << "-------------------------------------" << endl;
}

rand()函数用来产生随机数，但是，rand()的内部实现是用线性同余法实现的，是伪随机数，由于周期较长，因此在一定范围内可以看成是随机的。

rand()会返回一个范围在0到RAND_MAX（至少是32767）之间的伪随机数（整数）。

rand() % 200，那取模之后就是0到200的随机数

case 1uLL:
        puts("OK, it's flag:");
        memset(&s, 0, 0x28uLL);
        strcat((char *)&s, f1);
        strcat((char *)&s, &f2);
        printf("%s", &s);
        break;

当随机数是1的时候，输出OK, it's flag:

memset(&s, 0, 0x28uLL);

将s进行了赋值

然后字符串后面加上f1，点击跟进f1,得到f1是'GXY{do_not_'
  

我们知道进行了5次switch操作，for ( i = 0; i <= 4; ++i )

case 5uLL:
        for ( j = 0; j <= 7; ++j )
        {
          if ( j % 2 == 1 )
            *(&f2 + j) -= 2;
          else
            --*(&f2 + j);
        }

case5也对f2进行了操作

#include<stdio.h>
int main(){
    char f1[]="GXY{do_not_";
    char f2[]="icug`of\x7F";
    for (int j = 0; j <= 7; ++j )//进行了一个for循环对f2进行了一个减法操作
        {
          if ( j % 2 == 1 )
           f2[j]=f2[j]-2;//j为奇数f2 -2
          else
           f2[j]=f2[j]-1;//--f2[j] j为偶数f2 -1
        }
    printf("f1=%s\n",f1);
    printf("f2=%s\n",f2);
    printf("flag=%s%s",f1,f2);
}

flag{do_not_hate_me}