babyxor
dword_435DC0=[102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
dword_435DF8=[55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
dword_435E30=[26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]
sub_40108C()
化成代码:
a1 = unk_435DC0
char *v3
v3 = malloc(56>>2) // 56>>2 = 14
for(i = 0; i <14 ; ++i)
sprintf(&v3[i],"%c",i^*(a1 + 4*i))
a1 = [102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
解这个函数:
a1 = [102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
flag = ''
for i in range(14):
flag += chr(a1[i]^i)
sub_401041(unk_435DC0,dword_435DF8,56)
char *v5;
v5 = malloc(56);
printf("%c",*a2[0])
for (i = 1;i<14;++i)
sprintf(&v5[i],"%c",*(a1 + 4* i)^*(a2 + 4*i)^*(a1+ 4*i -4))
解:
a2 = [55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
temp = []
flag += chr(a2[0])
temp.append(a2[0])
for i in range (1,14):
x = (a1[i]^a2[i]^a1[i-1])
flag += chr(x)
temp.append(x)
第三个函数
解:
a3 = [26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]
for i in range(13):
x += chr(a3[i+1]^temp[i]^i)
flag += chr(a3[i]^a2[i]) + x
完整的代码:
a1 = [102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
a2 = [55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
a3 = [26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]
temp=[]
flag=''
for i in range(14):
flag+=chr(a1[i]^i)
flag+=chr(a2[0])
temp.append(a2[0])
for i in range(1,14):
x=a1[i]^a2[i]^a1[i-1]
flag+=chr(x)
temp.append(x)
x=''
for i in range(13):
x+=chr(a3[i+1]^(temp[i])^i)
flag+= chr(a3[0] ^ a2[0]) + x
print(flag)
# flag{2378b077-7d6e-4564-bdca-7eec8eede9a2}
第三步没咋看懂为什么 x 在 chr(a3[0] + a2[0]) 后面,一开始把x放在前面,打印出来的字符串:
flag{2378b077-7d6e-4564-bdca7eec8eede9a2}-
但是放在后面的话就是正确的flag了