简单的ez fibonR WP

PE查壳，发现有upx壳

利用upx等工具脱壳

 利用64位的ida打开，找的main的函数，反编译后，看到是存储型的flag

  _main();
  v34 = 1;
  puts("please input your flag:");
  gets(Buffer);
  for ( i = 0; i <= 21; ++i )
    v29[i] = Buffer[i];
  if ( strlen(Buffer) == 22 )
  {
    v32 = 1;
    v31 = 1;
    for ( j = 0; j <= 21; ++j )
    {
      if ( j & 1 )
      {
        v31 += v32;
        v3 = (unsigned int)((v31 + j + v29[j]) >> 31) >> 26;
        v4 = ((_BYTE)v3 + (_BYTE)v31 + (_BYTE)j + LOBYTE(v29[j])) & 0x3F;
      }
      else
      {
        v32 += v31;
        v3 = (unsigned int)((v32 + j + v29[j]) >> 31) >> 26;
        v4 = ((_BYTE)v3 + (_BYTE)v32 + (_BYTE)j + LOBYTE(v29[j])) & 0x3F;
      }
      v29[j] = v4 - v3 + 64;
    }
    v6 = 100;
    v7 = 121;
    v8 = 110;
    v9 = 118;
    v10 = 70;
    v11 = 85;
    v12 = 123;
    v13 = 109;
    v14 = 64;
    v15 = 94;
    v16 = 109;
    v17 = 99;
    v18 = 116;
    v19 = 81;
    v20 = 109;
    v21 = 86;
    v22 = 83;
    v23 = 126;
    v24 = 119;
    v25 = 101;
    v26 = 110;
    v27 = 114;
    for ( j = 0; j <= 21; ++j )
    {
      if ( *(&v6 + j) != v29[j] )
        v34 = 0;
    }
    if ( !v34 )
      printf("wrong!");
    if ( v34 == 1 )
      printf("right flag!");
  }
  else
  {
    printf("wrong lenth!");
  }
  return 0;
}

我们的flag输入后经过第一个for循环后，得的的值与v6一样，写了语段遍历的脚本，脚本如下：

#include<stdio.h>
int main()
{
	int a[22]={100,121,110,118,70,85,123,109,64,94,109,99,116,81,109,86,83,126,119,101,110,114},b,i,j,v3,v4,v32=1,v31=1;
	   for ( j = 0; j <=21; ++j )
     {
      if ( j & 1 )
      {
        v31 += v32;
        for(i=64;i<=126;i++)
     	{ 	 
          v3 = (unsigned int)((v31 + j + i) >> 31) >> 26;
          v4 = (v3 +v31 + j + i) & 0x3F;
          if(a[j]==(v4-v3+64)) printf("%d  ",i); 
		}
      }
      else
      {
        v32 += v31;
        for(i=64;i<=128;i++)
        {
          v3 = (unsigned int)((v32 + j +i) >> 31) >> 26;
          v4 = (v3 +v32 + j + i) & 0x3F;
		  if(a[j]==(v4-v3+64)) printf("%d ",i);  	
		}
      }            
    }
} 

得到10进制的flag

 在线网址转换为ascii

删掉相关字符，得到flag