20211031bugku_re_NoString

查壳，无壳，拿去IDA，搜索字符串却找不到有用的信息。

找到一个wmain函数

  v0 = strlen(aYelhzlGyOehnl3);//yelhzl)`gy|})|)oehnl3
  for ( i = 0; i < v0; ++i )
    aYelhzlGyOehnl3[i] ^= 9u;
  printf(aYelhzlGyOehnl3);
  v11 = 0;
  v13 = 0;
  _mm_storeu_si128((__m128i *)&v12, (__m128i)0i64);
  v2 = strlen(a80z);//,80z
  for ( j = 0; j < v2; ++j )
    a80z[j] ^= 9u;
  scanf(a80z, &v11);
  v4 = 0;
  do
  {
    *(&v11 + v4) ^= 9u;
    ++v4;
  }
  while ( v4 < 19 );
  v5 = strcmp(&v11, aOehnl3rHfCcgpt);//oehnl3r=<?=hF@CCGPt
  if ( v5 )
    v5 = -(v5 < 0) | 1;
  if ( v5 )
  {
    v6 = strlen(aLF);//l{{f{
    for ( k = 0; k < v6; ++k )
      aLF[k] ^= 9u;
    printf(aLF);
  }
  else
  {
    v8 = strlen(aNa);//{`na}
    for ( l = 0; l < v8; ++l )
      aNa[l] ^= 9u;
    printf(aNa);
  }
  printf("\r\n", *(_DWORD *)&v11);
  system("pause");
  return 0;
}

有很多奇奇怪怪的字符串，试跑一下是什么东西吧

char ss[22]="yelhzl)`gy|})|)oehnl3";
int i;
for(i=0; i<21; i++)
{
    ss[i] ^= 9;
    printf("%c",ss[i]);
}
//please input u flage:

神奇吧！输出的就是我们刚才运行看到的字符串。按照这个方法将字符串都转换一下。

  v0 = strlen(aYelhzlGyOehnl3);//yelhzl)`gy|})|)oehnl3
  for ( i = 0; i < v0; ++i )
    aYelhzlGyOehnl3[i] ^= 9u;
  printf(aYelhzlGyOehnl3);//please input u flage:
  v11 = 0;
  v13 = 0;
  _mm_storeu_si128((__m128i *)&v12, (__m128i)0i64);
  v2 = strlen(a80z);//,80z
  for ( j = 0; j < v2; ++j )
    a80z[j] ^= 9u;
  scanf(a80z, &v11);//输入字符串
  v4 = 0;
  do
  {
    *(&v11 + v4) ^= 9u;
    ++v4;
  }
  while ( v4 < 19 );//输入长度为19
  v5 = strcmp(&v11, aOehnl3rHfCcgpt);//oehnl3r=<?=hF@CCGPt
  if ( v5 )							//flage:{4564aOIJJNY}
    v5 = -(v5 < 0) | 1;
  if ( v5 )
  {
    v6 = strlen(aLF);//l{{f{
    for ( k = 0; k < v6; ++k )
      aLF[k] ^= 9u;
    printf(aLF);//error
  }
  else
  {
    v8 = strlen(aNa);//{`na}
    for ( l = 0; l < v8; ++l )
      aNa[l] ^= 9u;
    printf(aNa);//right
  }
  printf("\r\n", *(_DWORD *)&v11);
  system("pause");
  return 0;
}

将flag改为flag{4564aOIJJNY}提交即可。