re学习笔记（94）第四届2021美团网络安全高校挑战赛 - Random

动调时候报错，除以0异常

在main函数这里手动制造了一个错误

查看导入表发现有SEH注册的函数

且这里多了个分支

根据交叉引用找到seh注册的异常

可以断定出现div 0异常后会执行loc_CA115D的逻辑

main函数是一个递归，根据dword_CA336C==43来结束递归，且不等于0时不输入字符

主功能就是将输入的字符和随机数进行异或，重点是找准srand的时机

三处下断点，发现main函数的流程就是执行两次srand(rand())后，再和rand()进行异或

exp为

#include <stdio.h>
#include "mycrypto.h"
#include <ctype.h>

int main() {
    char data[44] = {
    0x3E, 0xCD, 0xAA, 0x8E, 0x96, 0x1F, 0x89, 0xCD, 0xDB, 0xF1, 0x70, 0xF2, 0xA9, 0x9C, 0xC2, 0x8B,
    0xF2, 0xFE, 0xAD, 0x8B, 0x58, 0x7C, 0x2F, 0x03, 0x4A, 0x65, 0x31, 0x89, 0x76, 0x57, 0x88, 0xDF,
    0xB8, 0xE9, 0x01, 0xE9, 0xDE, 0xE5, 0x86, 0x68, 0x8F, 0x24, 0xD3, 0x5A
    };
    int nxor = 0;
    int s1 = 0;
    int s2 = 0;

    for (int i = 0; i < 44; ++i) {
        s1 = rand();
        printf("srand-1 =%02x\n", s1);
        srand(s1);

        s2 = rand();
        printf("srand-2 =%02x\n",i,s2);
        srand(s2);

        nxor = rand();
        printf("xor =%02x\n", nxor);
        data[i] ^= nxor;

    }
    printf("\n\n");

    puts(data);

}

运行得到

srand-1 =29
srand-2 =00
xor =258
srand-1 =53bd
srand-2 =01
xor =39a1
srand-1 =22e6
srand-2 =02
xor =74cb
srand-1 =4613
srand-2 =03
xor =49e9
srand-1 =6145
srand-2 =04
xor =49ed
srand-1 =641b
srand-2 =05
xor =682c
srand-1 =40d3
srand-2 =06
xor =11ec
srand-1 =ce1
srand-2 =07
xor =9fb
srand-1 =387a
srand-2 =08
xor =38e9
srand-1 =1ad5
srand-2 =09
xor =1ec4
srand-1 =34be
srand-2 =0a
xor =1116
srand-1 =12a8
srand-2 =0b
xor =4797
srand-1 =60ad
srand-2 =0c
xor =4399
srand-1 =b12
srand-2 =0d
xor =76b1
srand-1 =3db4
srand-2 =0e
xor =70a4
srand-1 =2781
srand-2 =0f
xor =3e9
srand-1 =03
srand-2 =10
xor =c3
srand-1 =7d7b
srand-2 =11
xor =54c6
srand-1 =2507
srand-2 =12
xor =b80
srand-1 =3516
srand-2 =13
xor =14bf
srand-1 =24a1
srand-2 =14
xor =73e
srand-1 =6dc6
srand-2 =15
xor =4f44
srand-1 =435f
srand-2 =16
xor =2d18
srand-1 =62fb
srand-2 =17
xor =5c2e
srand-1 =1605
srand-2 =18
xor =6b73
srand-1 =6737
srand-2 =19
xor =956
srand-1 =2c53
srand-2 =1a
xor =3752
srand-1 =7371
srand-2 =1b
xor =bb8
srand-1 =7ed9
srand-2 =1c
xor =635b
srand-1 =1afc
srand-2 =1d
xor =2066
srand-1 =32f2
srand-2 =1e
xor =7ded
srand-1 =3bbe
srand-2 =1f
xor =5bbc
srand-1 =5883
srand-2 =20
xor =6c8a
srand-1 =30e0
srand-2 =21
xor =67d8
srand-1 =560b
srand-2 =22
xor =5236
srand-1 =2dd9
srand-2 =23
xor =478f
srand-1 =3b92
srand-2 =24
xor =59e6
srand-1 =3a88
srand-2 =25
xor =4ed3
srand-1 =5eb7
srand-2 =26
xor =2eb1
srand-1 =3c14
srand-2 =27
xor =5f51
srand-1 =6e91
srand-2 =28
xor =57b9
srand-1 =11
srand-2 =29
xor =159
srand-1 =8d5
srand-2 =2a
xor =5ed3
srand-1 =61f7
srand-2 =2b
xor =515a


flag{3e625fe0-fb18-4f87-93c1-1ec217f86796}