reverse-for-the-holy-grail-350
Windows系统打不开,放进ida发现Linux系统下文件,查看main函数反汇编
int __cdecl main(int argc, const char **argv, const char **envp)
{
int v3; // ebx
int v4; // ebx
__int64 v5; // rbx
void *v7[2]; // [rsp+0h] [rbp-70h] BYREF
_BYTE v8[16]; // [rsp+10h] [rbp-60h] BYREF
void *v9[2]; // [rsp+20h] [rbp-50h] BYREF
_BYTE v10[16]; // [rsp+30h] [rbp-40h] BYREF
void *v11[2]; // [rsp+40h] [rbp-30h] BYREF
char v12[24]; // [rsp+50h] [rbp-20h] BYREF
v11[0] = v12;
v11[1] = 0LL;
v12[0] = 0;
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "What... is your name?", 21LL);
std::endl<char,std::char_traits<char>>(&std::cout);
std::operator>><char>(&std::cin, v11);
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "What... is your quest?", 22LL);
std::endl<char,std::char_traits<char>>(&std::cout);
std::istream::ignore((std::istream *)&std::cin);
std::getline<char,std::char_traits<char>,std::allocator<char>>(&std::cin, v11);
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "What... is the secret password?", 32LL);
std::endl<char,std::char_traits<char>>(&std::cout);
std::operator>><char>(&std::cin, &userIn[abi:cxx11]);
v7[0] = v8;
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::_M_construct<char *>(
v7,
userIn[abi:cxx11],
qword_601AE8 + userIn[abi:cxx11]);
v3 = validChars((__int64 *)v7); //输入v3
if ( v7[0] != v8 )
operator delete(v7[0]);
if ( v3 < 0 )
goto LABEL_8;
v9[0] = v10;
std::__cxx11::basic_string<char,std::char_traits<char>,std::allocator<char>>::_M_construct<char *>(
v9,
userIn[abi:cxx11],
qword_601AE8 + userIn[abi:cxx11]);
v4 = stringMod((__int64 *)v9); //主要这里的关键函数stringMod
if ( v9[0] != v10 ) //与上面的v7[0] != v8 相对应
operator delete(v9[0]);
if ( v4 < 0 )
{
LABEL_8:
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "Auuuuuuuugh", 11LL);
std::endl<char,std::char_traits<char>>(&std::cout);
}
else
{
std::__ostream_insert<char,std::char_traits<char>>(&std::cout, "Go on. Off you go. tuctf{", 25LL);
v5 = std::__ostream_insert<char,std::char_traits<char>>(&std::cout, userIn[abi:cxx11], qword_601AE8);
std::__ostream_insert<char,std::char_traits<char>>(v5, "}", 1LL);
std::endl<char,std::char_traits<char>>(v5);
} //最后输出的格式可以得到是Go on. Off you go. tuctf{}
if ( v11[0] != v12 )
operator delete(v11[0]);
return 0;
}
其中的stringMod函数非常关键
__int64 __fastcall stringMod(__int64 *a1)
{
__int64 v1; // r9
__int64 v2; // r10
__int64 v3; // rcx
int v4; // er8
int *v5; // rdi
int *v6; // rsi
int v7; // ecx
int v8; // er9
int v9; // er10
unsigned int v10; // eax
int v11; // esi
int v12; // esi
int v14[18]; // [rsp+0h] [rbp-60h] BYREF
__int64 v15; // [rsp+48h] [rbp-18h] BYREF
memset(v14, 0, sizeof(v14));
v1 = a1[1];
if ( v1 )
{
v2 = *a1;
v3 = 0LL;
v4 = 0;
do
{
v12 = *(char *)(v2 + v3);
v14[v3] = v12;
if ( 3 * ((unsigned int)v3 / 3) == (_DWORD)v3 && v12 != firstchar[(unsigned int)v3 / 3] )
v4 = -1; //前半段判断是否是3的倍数,如果是,那么V12的值就为firstchar[i/3](firstchar=[])
++v3;
}
while ( v3 != v1 );
}
else
{
v4 = 0;
}
v5 = v14;
v6 = v14;
v7 = 666; //注意这边V7赋值为666
do
{
*v6 = v7 ^ *(unsigned __int8 *)v6;
v7 += v7 % 5;
++v6; //必须要运行的循环处理
}
while ( &v15 != (__int64 *)v6 );
v8 = 1;
v9 = 0;
v10 = 1;
v11 = 0;
do
{
if ( v11 == 2 )
{
if ( *v5 != thirdchar[v9] )
v4 = -1;
if ( v10 % *v5 != masterArray[v9] ) //要对应下面else语句里面的 v10 *= *v5
v4 = -1;
++v9;
v10 = 1;
v11 = 0;
}
else
{
v10 *= *v5;
if ( ++v11 == 3 )
v11 = 0;
}
++v8;
++v5;
}
while ( v8 != 19 ); //循环范围是18
return (unsigned int)(v7 * v4);
}
写代码
firstchar=[0x41,0x69,0x6E,0x45,0x6F,0x61]
thirdchar=[0x2EF,0x2c4,0x2dc,0x2c7,0x2de,0x2fc]
masterarray=[0x1d7,0xc,0x244,0x25e,0x93,0x6c]
c=[]
v7=666
flag=[0 for i in range(18)]
for i in range(18):
c.append(v7)
v7+=v7%5 //用作加密
t=0
for i in range(0,18,3):
flag[i]=firstchar[t]
t+=1 //第一组数据不需要进行加密
t=0
for i in range(2,18,3):
flag[i]=thirdchar[t]^c[i]
t+=1 //第三组数据
t=0
for i in range(1,18,3):
for j in range(128):
if masterarray[t]==(j^c[i])*(flag[i-1]^c[i-1])%(flag[i+1]^c[i+1]):
flag[i]=j //第三组数据要进行判断,v10*v5%v5==masterarray根据前面的对thirdchar处理写代码
t+=1
break
for i in range(18):
print(chr(flag[i]),end='')
运行得到
AfricanOrEuropean?
最后提交时记得加上tuctf{}