20211009gfsj_re_六六六

IDA

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char s; // [rsp+0h] [rbp-1E0h]
  char v5; // [rsp+F0h] [rbp-F0h]

  memset(&s, 0, 0x1EuLL);//设置内存，等会存数据
  printf("Please Input Key: ", 0LL);
  __isoc99_scanf("%s", &v5);//用户输入存进v5
  encode(&v5, (__int64)&s);
  if ( strlen(&v5) == key )//v5长度等于12h
  {
    if ( !strcmp(&s, enflag) )//加密后的内容与enflag对比，enflag的内容为izwhroz""w"v.K".Ni
      puts("You are Right");
    else
      puts("flag{This_1s_f4cker_flag}");
  }
  return 0;
}

int __fastcall encode(const char *a1, __int64 a2)
{//将v5数据加密存到s中
  char v3[32]; // [rsp+10h] [rbp-70h]
  char v4[32]; // [rsp+30h] [rbp-50h]
  char v5[40]; // [rsp+50h] [rbp-30h]
  int v6; // [rsp+78h] [rbp-8h]
  int i; // [rsp+7Ch] [rbp-4h]

  i = 0;
  v6 = 0;
  if ( strlen(a1) != key )
    return puts("Your Length is Wrong");
  for ( i = 0; i < key; i += 3 )
  {
    v5[i] = key ^ (a1[i] + 6);//a[0]=18^(v5[0]+6)
    v4[i + 1] = (a1[i + 1] - 6) ^ key;//b[1]=18^(v5[1]-6)
    v3[i + 2] = a1[i + 2] ^ 6 ^ key;//c[2]=18^(v5[2]^6)
    *(_BYTE *)(a2 + i) = v5[i];//s[0]=18^(v5[0]+6)
    *(_BYTE *)(a2 + i + 1LL) = v4[i + 1];//s[1]=18^(v5[1]-6)
    *(_BYTE *)(a2 + i + 2LL) = v3[i + 2];//s[2]=18^(v5[2]^6)
  }
  return a2;
}

char enflag[] = {'i','z','w','h','r','o','z','"','"','w','"','v','.','K','"','.','N','i','\0'};
char v5[20]={0};
for(int i=0; i<18; i+=3)
{
	v5[i]=(enflag[i]^18)-6;
    v5[i+1]=(enflag[i+1]^18)+6;
    v5[i+2]=(enflag[i+2]^18)^6;
}
for(int i=0; i<18; i++)
	printf("%c",v5[i]);

//unctf{b66_6b6_66b}