关于攻防世界-Reverse-game的三种解法的探讨

1.直接玩游戏

输入12345678即可出flag

2.动态调试

下载下来是一个exe文件，可以用IDA打开

这种题我更倾向于动调直接得到flag

我们查壳

没有保护壳，直接32打开

进入字符串界面，找到显示的那部分

int __cdecl main_0(int argc, const char **argv, const char **envp)
{
  int v4; // [esp+0h] [ebp-FCh]
  int i; // [esp+DCh] [ebp-20h]
  unsigned int v6; // [esp+F4h] [ebp-8h] BYREF
 
  sub_45A7BE(&unk_50B110);
  sub_45A7BE(&unk_50B158);
  sub_45A7BE(&unk_50B1A0);
  sub_45A7BE(&unk_50B1E8);
  sub_45A7BE(&unk_50B230);
  sub_45A7BE(&unk_50B278);
  sub_45A7BE(&unk_50B2C0);
  sub_45A7BE(&unk_50B308);
  sub_45A7BE(&unk_50AFD0);
  sub_45A7BE("|              by 0x61                                 |\n");
  sub_45A7BE("|                                                      |\n");
  sub_45A7BE("|------------------------------------------------------|\n");
  sub_45A7BE(
    "Play a game\n"
    "The n is the serial number of the lamp,and m is the state of the lamp\n"
    "If m of the Nth lamp is 1,it's on ,if not it's off\n"
    "At first all the lights were closed\n");
  sub_45A7BE("Now you can input n to change its state\n");
  sub_45A7BE(
    "But you should pay attention to one thing,if you change the state of the Nth lamp,the state of (N-1)th and (N+1)th w"
    "ill be changed too\n");
  sub_45A7BE("When all lamps are on,flag will appear\n");
  sub_457AB4("Now,input n \n");
  while ( 1 )
  {
    do
    {
      while ( 1 )
      {
        sub_457AB4("input n,n(1-8)\n");
        sub_459418();
        sub_45A7BE("n=");
        sub_4596D4("%d", &v6);
        sub_45A7BE("\n");
        if ( v6 < 9 )
          break;
        sub_457AB4("sorry,n error,try again\n");
      }
      if ( v6 )
      {
        sub_4576D6(v6 - 1);
      }
      else
      {
        for ( i = 0; i < 8; ++i )
        {
          if ( (unsigned int)i >= 9 )
            j____report_rangecheckfailure();
          byte_532E28[i] = 0;
        }
      }
      j__system("CLS");
      sub_458054();
    }
    while ( byte_532E28[0] != 1
         || byte_532E28[1] != 1
         || byte_532E28[2] != 1
         || byte_532E28[3] != 1
         || byte_532E28[4] != 1
         || byte_532E28[5] != 1
         || byte_532E28[6] != 1
         || byte_532E28[7] == 1 );
    sub_457AB4(v4);
  }
}

我们找，可以找到这个sub457ab4就是flag的函数

我们复制这个函数sub_457AB4

进入到这个界面，我们之间打这个输出的 sub45a7be函数给改为复制的函数

按住CTRL+ALT+K

复制成功是这样

然后我们保存一下

在edit里面选中patch，选最后一个apply

最后保存，再次运行就直接给flag了

3.正常搜锁代码解密


1. 对应地与 v59-v115 进行异或

2. 与 0x13 异或这里可以小小地猜测 flag 与 v2-v58 的字符变量有关（可以看出 v59-v115 并没有改变）

写个脚本

v59 = [18, 64, 98, 5, 2, 4, 6, 3, 6, 48, 49, 65, 32, 12, 48, 65, 31, 78, 62, 32,
       49, 32, 1, 57, 96, 3, 21, 9, 4, 62, 3, 5, 4, 1, 2, 3, 44,65, 78, 32, 16,
       97, 54, 16, 44, 52, 32, 64, 89, 45, 32, 65, 15, 34, 18, 16, 0]
v2 = [123, 32, 18, 98, 119, 108, 65, 41, 124, 80, 125, 38, 124, 111, 74, 49, 83, 108, 94,
      108, 84, 6, 96, 83, 44, 121, 104, 110, 32, 95, 117, 101, 99, 123, 127, 119, 96, 48,
      107, 71, 92, 29, 81, 107, 90, 85, 64, 12, 43, 76, 86, 13, 114, 1, 117, 126, 0]
flag = ' '
for i in range(56):
    v2[i] ^= v59[i]
    v2[i] ^= 0x13
    flag += chr(v2[i])
print(flag)

zsctf{T9is_tOpic_1s_v5ry_int7resting_b6t_others_are_n0t}