20210927gfsj_re_no_strings_attached

最新推荐文章于 2024-11-05 14:48:36 发布

v5le0n9

最新推荐文章于 2024-11-05 14:48:36 发布

阅读量118

点赞数

文章标签： php javascript html5

本文链接：https://blog.csdn.net/Leong_Vinson/article/details/123757955

版权

题目描述：菜鸡听说有的程序运行就能拿Flag？

拿进IDA，看到main函数调用了很多函数

int __cdecl main(int argc, const char **argv, const char **envp)
{
  setlocale(6, &locale);
  banner();
  prompt_authentication();
  authenticate();
  return 0;
}

一个一个看下来，发现flag应该是藏在了authenticate()中

void authenticate()
{
  wchar_t ws[8192]; // [esp+1Ch] [ebp-800Ch]
  wchar_t *s2; // [esp+801Ch] [ebp-Ch]

  s2 = (wchar_t *)decrypt(&s, &dword_8048A90);
  if ( fgetws(ws, 0x2000, stdin) )
  {
    ws[wcslen(ws) - 1] = 0;
    if ( !wcscmp(ws, s2) )
      wprintf((int)&unk_8048B44);		//成功
    else
      wprintf((int)&unk_8048BA4);		//失败
  }
  free(s2);
}

wchar_t *__cdecl decrypt(wchar_t *s, wchar_t *a2)
{
  size_t v2; // eax
  signed int v4; // [esp+1Ch] [ebp-1Ch]
  signed int i; // [esp+20h] [ebp-18h]
  signed int v6; // [esp+24h] [ebp-14h]
  signed int v7; // [esp+28h] [ebp-10h]
  wchar_t *dest; // [esp+2Ch] [ebp-Ch]

  v6 = wcslen(s);
  v7 = wcslen(a2);
  v2 = wcslen(s);
  dest = (wchar_t *)malloc(v2 + 1);
  wcscpy(dest, s);
  while ( v4 < v6 )
  {
    for ( i = 0; i < v7 && v4 < v6; ++i )
      dest[v4++] -= a2[i];
  }
  return dest;
}

点进s，查看s数据，将它们复制下来，注意小端序，还要改变顺序。

s = [0x143A, 0x1436, 0x1437, 0x143B, 0x1480, 0x147A,
0x1471, 0x1478, 0x1463,
 0x1466, 0x1473, 0x1467, 0x1462, 0x1465, 0x1473,
0x1460, 0x146B, 0x1471,
 0x1478, 0x146A, 0x1473, 0x1470, 0x1464, 0x1478,
0x146E, 0x1470, 0x1470,
 0x1464, 0x1470, 0x1464, 0x146E, 0x147B, 0x1476,
0x1478, 0x146A, 0x1473,
 0x147B, 0x1480]

注意：两个参数的类型都是 wchar_t 类型（长度 16 位或 32 位）由于有大量的 0，所以不能用 char 类型的数组，否则读到第三位直接结束。此外，删除后面 4 个字节的 0，因为字符串的结尾默认加 0。

同样方法看dword_8048A90

a2 = [0x1401, 0x1402, 0x1403, 0x1404, 0x1405]

编写脚本

s = [0x143A, 0x1436, 0x1437, 0x143B, 0x1480, 0x147A,
0x1471, 0x1478, 0x1463,
 0x1466, 0x1473, 0x1467, 0x1462, 0x1465, 0x1473,
0x1460, 0x146B, 0x1471,
 0x1478, 0x146A, 0x1473, 0x1470, 0x1464, 0x1478,
0x146E, 0x1470, 0x1470,
 0x1464, 0x1470, 0x1464, 0x146E, 0x147B, 0x1476,
0x1478, 0x146A, 0x1473,
 0x147B, 0x1480]
a2 = [0x1401, 0x1402, 0x1403, 0x1404, 0x1405]
dest = s
v4 = 0
flag = ''
v6 = len(s)
v7 = len(a2)
while v4 < v6:
 	i = 0
 	while i < v7 and v4 < v6:
 		dest[v4] -= s2[i]
 		flag += chr(dest[v4])
 		v4 += 1
 		i += 1
print(flag)
#9447{you_are_an_international_mystery}