ida32位;
打开之后发现关键信息:
key = [0x66, 0x00, 0x00, 0x00, 0x6B, 0x00, 0x00, 0x00, 0x63, 0x00,
0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0x7F, 0x00, 0x00, 0x00,
0x61, 0x00, 0x00, 0x00, 0x67, 0x00, 0x00, 0x00, 0x64, 0x00,
0x00, 0x00, 0x3B, 0x00, 0x00, 0x00, 0x56, 0x00, 0x00, 0x00,
0x6B, 0x00, 0x00, 0x00, 0x61, 0x00, 0x00, 0x00, 0x7B, 0x00,
0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x3B, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x63, 0x00, 0x00, 0x00, 0x5F, 0x00,
0x00, 0x00, 0x4D, 0x00, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00,
0x71, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x37, 0x00,
0x00, 0x00, 0x66]
print(len(key))
flag = []
for i in range(len(key)):
if key[i]==0:
pass
else:
flag.append(key[i])
print(flag)
# [print(chr(flag[i]),end="") for i in range(len(flag))]
for i in range(len(flag)):
k = flag[i]
if i&1!=0:
print(chr(k+i),end="")
else:
print(chr(k^i),end="")
错误flag:
flag{fak3_alw35_sp_me!!}
使用快捷键将代码修复;
Buffer 为:hahahaha_do_you_find_me?
exp如下:
key = [0x66, 0x00, 0x00, 0x00, 0x6B, 0x00, 0x00, 0x00, 0x63, 0x00,
0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0x7F, 0x00, 0x00, 0x00,
0x61, 0x00, 0x00, 0x00, 0x67, 0x00, 0x00, 0x00, 0x64, 0x00,
0x00, 0x00, 0x3B, 0x00, 0x00, 0x00, 0x56, 0x00, 0x00, 0x00,
0x6B, 0x00, 0x00, 0x00, 0x61, 0x00, 0x00, 0x00, 0x7B, 0x00,
0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x3B, 0x00, 0x00, 0x00,
0x50, 0x00, 0x00, 0x00, 0x63, 0x00, 0x00, 0x00, 0x5F, 0x00,
0x00, 0x00, 0x4D, 0x00, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00,
0x71, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x37, 0x00,
0x00, 0x00, 0x66]
# print(len(key))
flag = []
for i in range(len(key)):
if key[i]==0:
pass
else:
flag.append(key[i])
# print(flag)
# [print(chr(flag[i]),end="") for i in range(len(flag))]
for i in range(len(flag)):
k = flag[i]
if i&1!=0:
print(chr(k+i),end="")
else:
print(chr(k^i),end="")
#输出flag是错误的
print()
key = [ 0x0E, 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x09, 0x00,
0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00,
0x05, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x56, 0x00,
0x00, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
0x0C, 0x00, 0x00, 0x00, 0x3C, 0x00, 0x00, 0x00, 0x1F, 0x00,
0x00, 0x00, 0x57, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
0x6B, 0x00, 0x00, 0x00, 0x57, 0x00, 0x00, 0x00, 0x59, 0x00,
0x00, 0x00, 0x0D]
kin = []
sing = "hahahaha_do_you_find_me?"
for i in range(len(key)):
if key[i]==0:
pass
else:
kin.append(key[i])
# print(kin)
flag = ""
for i in range(len(kin)):
flag+=chr(ord(sing[i])^kin[i])
# print(len(kin))
print(flag) #前一部分的flag
s = "%tp&:"
for i in range(127):
if chr(ord(':')^i) =="}":#尝试爆破一下看不能把出flag;
print(i) #输出位71
else:
pass
for i in range(len(s)):
flag+=chr(ord(s[i])^71)
print(flag) #flag是正确的
flag为:flag{d07abccf8a410cb37a}