[网鼎杯 2020 青龙组]jocker

ida32位；

打开之后发现关键信息：

key = [0x66, 0x00, 0x00, 0x00, 0x6B, 0x00, 0x00, 0x00, 0x63, 0x00,
       0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0x7F, 0x00, 0x00, 0x00,
       0x61, 0x00, 0x00, 0x00, 0x67, 0x00, 0x00, 0x00, 0x64, 0x00,
       0x00, 0x00, 0x3B, 0x00, 0x00, 0x00, 0x56, 0x00, 0x00, 0x00,
       0x6B, 0x00, 0x00, 0x00, 0x61, 0x00, 0x00, 0x00, 0x7B, 0x00,
       0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x3B, 0x00, 0x00, 0x00,
       0x50, 0x00, 0x00, 0x00, 0x63, 0x00, 0x00, 0x00, 0x5F, 0x00,
       0x00, 0x00, 0x4D, 0x00, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00,
       0x71, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x37, 0x00,
       0x00, 0x00, 0x66]
print(len(key))
flag = []
for i in range(len(key)):
    if key[i]==0:
        pass
    else:
        flag.append(key[i])
print(flag)
# [print(chr(flag[i]),end="") for i in range(len(flag))]
for i in range(len(flag)):
    k = flag[i]
    if i&1!=0:
        print(chr(k+i),end="")
    else:
        print(chr(k^i),end="")

错误flag：

        flag{fak3_alw35_sp_me!!}

使用快捷键将代码修复；

Buffer 为：hahahaha_do_you_find_me?

exp如下：

key = [0x66, 0x00, 0x00, 0x00, 0x6B, 0x00, 0x00, 0x00, 0x63, 0x00,
  0x00, 0x00, 0x64, 0x00, 0x00, 0x00, 0x7F, 0x00, 0x00, 0x00,
  0x61, 0x00, 0x00, 0x00, 0x67, 0x00, 0x00, 0x00, 0x64, 0x00,
  0x00, 0x00, 0x3B, 0x00, 0x00, 0x00, 0x56, 0x00, 0x00, 0x00,
  0x6B, 0x00, 0x00, 0x00, 0x61, 0x00, 0x00, 0x00, 0x7B, 0x00,
  0x00, 0x00, 0x26, 0x00, 0x00, 0x00, 0x3B, 0x00, 0x00, 0x00,
  0x50, 0x00, 0x00, 0x00, 0x63, 0x00, 0x00, 0x00, 0x5F, 0x00,
  0x00, 0x00, 0x4D, 0x00, 0x00, 0x00, 0x5A, 0x00, 0x00, 0x00,
  0x71, 0x00, 0x00, 0x00, 0x0C, 0x00, 0x00, 0x00, 0x37, 0x00,
  0x00, 0x00, 0x66]
# print(len(key))
flag = []
for i in range(len(key)):
    if key[i]==0:
        pass
    else:
        flag.append(key[i])
# print(flag)
# [print(chr(flag[i]),end="") for i in range(len(flag))]
for i in range(len(flag)):
    k = flag[i]
    if i&1!=0:
        print(chr(k+i),end="")
    else:
        print(chr(k^i),end="")
#输出flag是错误的
print()
key = [  0x0E, 0x00, 0x00, 0x00, 0x0D, 0x00, 0x00, 0x00, 0x09, 0x00,
  0x00, 0x00, 0x06, 0x00, 0x00, 0x00, 0x13, 0x00, 0x00, 0x00,
  0x05, 0x00, 0x00, 0x00, 0x58, 0x00, 0x00, 0x00, 0x56, 0x00,
  0x00, 0x00, 0x3E, 0x00, 0x00, 0x00, 0x06, 0x00, 0x00, 0x00,
  0x0C, 0x00, 0x00, 0x00, 0x3C, 0x00, 0x00, 0x00, 0x1F, 0x00,
  0x00, 0x00, 0x57, 0x00, 0x00, 0x00, 0x14, 0x00, 0x00, 0x00,
  0x6B, 0x00, 0x00, 0x00, 0x57, 0x00, 0x00, 0x00, 0x59, 0x00,
  0x00, 0x00, 0x0D]
kin = []
sing = "hahahaha_do_you_find_me?"
for i in range(len(key)):
    if key[i]==0:
        pass
    else:
        kin.append(key[i])
# print(kin)
flag = ""
for i in range(len(kin)):
    flag+=chr(ord(sing[i])^kin[i])
# print(len(kin))
print(flag)    #前一部分的flag
s = "%tp&:"
for i in range(127):
    if chr(ord(':')^i) =="}":#尝试爆破一下看不能把出flag；
        print(i)   #输出位71
    else:
        pass
for i in range(len(s)):
    flag+=chr(ord(s[i])^71)
print(flag)     #flag是正确的

flag为：flag{d07abccf8a410cb37a}