攻防世界逆向练习--babyxor

babyxor

dword_435DC0=[102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
dword_435DF8=[55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
dword_435E30=[26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]

sub_40108C()

化成代码：

a1 = unk_435DC0
char *v3
v3 = malloc(56>>2)    // 56>>2 = 14
for(i = 0; i <14 ; ++i)
    sprintf(&v3[i],"%c",i^*(a1 + 4*i))

    a1 = [102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]

解这个函数：

a1 = [102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
flag = ''
for i in range(14):
    flag += chr(a1[i]^i)

sub_401041(unk_435DC0,dword_435DF8,56)

char *v5;
v5 = malloc(56);
printf("%c",*a2[0])
for (i = 1;i<14;++i)
    sprintf(&v5[i],"%c",*(a1 + 4* i)^*(a2 + 4*i)^*(a1+ 4*i -4))

解：

a2 = [55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
temp = []
flag += chr(a2[0])
temp.append(a2[0])
for i in range (1,14):
    x = (a1[i]^a2[i]^a1[i-1])
    flag += chr(x)
    temp.append(x)

第三个函数

解：

a3 = [26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]

for i  in range(13):
    x += chr(a3[i+1]^temp[i]^i)
    
flag +=  chr(a3[i]^a2[i]) + x 

完整的代码：

a1 = [102, 109, 99, 100, 127, 55, 53, 48, 48, 107, 58, 60, 59, 32 ]
a2 = [55, 111, 56, 98, 54, 124, 55, 51, 52, 118, 51, 98, 100, 122]
a3 = [26,0,0,81,5,17,84,86,85,89,29,9,93,18,0,0]
temp=[]
flag=''
for i in range(14):
    flag+=chr(a1[i]^i)

flag+=chr(a2[0])
temp.append(a2[0])
for i in range(1,14):
    x=a1[i]^a2[i]^a1[i-1]
    flag+=chr(x)
    temp.append(x)

x=''
for i in range(13):
    x+=chr(a3[i+1]^(temp[i])^i)
flag+= chr(a3[0] ^ a2[0]) + x
print(flag)

# flag{2378b077-7d6e-4564-bdca-7eec8eede9a2}

第三步没咋看懂为什么 x 在 chr(a3[0] + a2[0]) 后面，一开始把x放在前面，打印出来的字符串：

flag{2378b077-7d6e-4564-bdca7eec8eede9a2}-

但是放在后面的话就是正确的flag了