20211020gfsj_re_simplecheck100

给了3个文件，2个Linux和1个Windows，先看看Windows的

int __cdecl main(int argc, const char **argv, const char **envp)
{
  void *v3; // esp
  void *v4; // esp
  char *v6; // [esp+4h] [ebp-44h]
  char v7; // [esp+8h] [ebp-40h]
  char v8; // [esp+1Bh] [ebp-2Dh]
  char *v9; // [esp+1Ch] [ebp-2Ch]
  int v10; // [esp+20h] [ebp-28h]
  char v11; // [esp+25h] [ebp-23h]
  char v12; // [esp+26h] [ebp-22h]
  char v13; // [esp+27h] [ebp-21h]
  char v14; // [esp+28h] [ebp-20h]
  char v15; // [esp+29h] [ebp-1Fh]
  char v16; // [esp+2Ah] [ebp-1Eh]
  char v17; // [esp+2Bh] [ebp-1Dh]
  char v18; // [esp+2Ch] [ebp-1Ch]
  char v19; // [esp+2Dh] [ebp-1Bh]
  char v20; // [esp+2Eh] [ebp-1Ah]
  char v21; // [esp+2Fh] [ebp-19h]
  char v22; // [esp+30h] [ebp-18h]
  char v23; // [esp+31h] [ebp-17h]
  char v24; // [esp+32h] [ebp-16h]
  char v25; // [esp+33h] [ebp-15h]
  char v26; // [esp+34h] [ebp-14h]
  char v27; // [esp+35h] [ebp-13h]
  char v28; // [esp+36h] [ebp-12h]
  char v29; // [esp+37h] [ebp-11h]
  char v30; // [esp+38h] [ebp-10h]
  char v31; // [esp+39h] [ebp-Fh]
  char v32; // [esp+3Ah] [ebp-Eh]
  char v33; // [esp+3Bh] [ebp-Dh]
  char v34; // [esp+3Ch] [ebp-Ch]
  char v35; // [esp+3Dh] [ebp-Bh]
  char v36; // [esp+3Eh] [ebp-Ah]
  char v37; // [esp+3Fh] [ebp-9h]
  int *v38; // [esp+40h] [ebp-8h]

  v38 = &argc;
  __main();
  v8 = 84;
  v37 = -56;
  v36 = 126;
  v35 = -29;
  v34 = 100;
  v33 = -57;
  v32 = 22;
  v31 = -102;
  v30 = -51;
  v29 = 17;
  v28 = 101;
  v27 = 50;
  v26 = 45;
  v25 = -29;
  v24 = -45;
  v23 = 67;
  v22 = -110;
  v21 = -87;
  v20 = -99;
  v19 = -46;
  v18 = -26;
  v17 = 109;
  v16 = 44;
  v15 = -45;
  v14 = -74;
  v13 = -67;
  v12 = -2;
  v11 = 106;
  v10 = 19;
  v3 = alloca(32);
  v4 = alloca(32);
  v9 = &v7;
  printf("Key: ");
  v6 = v9;
  scanf("%s", v9);
  if ( check_key(v9) )
    interesting_function(&v8);
  else
    puts("Wrong");
  return 0;
}

用IDA可以看到调用了两个非系统函数，用OD将check_key()返回值修改为1得出字符串：潇g??礰*n:,=瀋?h肀t，并且是无论输入什么都显示这个字符串，将这个作为输入也不行啊…

换Linux环境试试。

gdb spc100		//将spc100加载进gdb
b main			//在main函数下断点
n				//步过一直到输入函数处，然后输入字符串
//继续n步过，到达call check_key的下一条指令test eax eax处
i r eax			//查看eax的值
set $eax=1		//将eax的值修改为1
i r eax			//查看是否修改成功
c				//一直运行到程序结束
//flag_is_you_know_cracking!!![Inferior 1 (process 2408) exited normally]