攻防世界：elrond32

因为我的64位虚拟机运行不了 直接拖进IDA看看

去看main函数。只看access granted的部分。8048414和8048538两个函数。

 

 

可以发现，先用v2和a1[i%8]异或后输出。先提取8048760处的数据

至于a1需要我们计算一下，根据switch来猜测，是这样。 

直接把不符合条件的赋值0就可以，因为后面反正有i%8其实赋值几都无所谓没有影响。

最后结果 

#include <iostream>

int main()
{
    unsigned char unk_8048760[] =
    {
       15,   0,   0,   0,  31,   0,   0,   0,   4,   0,
    0,   0,   9,   0,   0,   0,  28,   0,   0,   0,
   18,   0,   0,   0,  66,   0,   0,   0,   9,   0,
    0,   0,  12,   0,   0,   0,  68,   0,   0,   0,
   13,   0,   0,   0,   7,   0,   0,   0,   9,   0,
    0,   0,   6,   0,   0,   0,  45,   0,   0,   0,
   55,   0,   0,   0,  89,   0,   0,   0,  30,   0,
    0,   0,   0,   0,   0,   0,  89,   0,   0,   0,
   15,   0,   0,   0,   8,   0,   0,   0,  28,   0,
    0,   0,  35,   0,   0,   0,  54,   0,   0,   0,
    7,   0,   0,   0,  85,   0,   0,   0,   2,   0,
    0,   0,  12,   0,   0,   0,   8,   0,   0,   0,
   65,   0,   0,   0,  10,   0,   0,   0,  20,   0,
    0,   0,  65,  99,  99, 101, 115, 115,  32, 103,
  114,  97, 110, 116, 101, 100,   0
    };

    char a2[120] = {};
    int z = 0;
    for (int i = 0; i < 32; i++) {
        if (z == 0) a2[i] = 105;
        else if (z == 1) a2[i] = 101;
        else if (z == 3) a2[i] = 110;
        else if (z == 4) a2[i] = 100;
        else if (z == 5) a2[i] = 97;
        else if (z == 6) a2[i] = 103;
        else if (z == 7) a2[i] = 115;
        else if (z == 9) a2[i] = 114;
        else  a2[i] = 0;
        z = 7 * (z + 1) % 11;
        printf("%d ", a2[i]);
    }
    printf("\n");
    int v2[33]; // [esp+18h] [ebp-A0h] BYREF
    int i; // [esp+9Ch] [ebp-1Ch]
    memcpy(v2, &unk_8048760, sizeof(v2));
    for (i = 0; i <= 32; ++i)
        putchar(v2[i] ^ *(char*)(a2 + i % 8));
    return putchar(10);
}