baby_re

需要输入正确flag

IDAmain函数

int __cdecl main(int argc, const char **argv, const char **envp)
{
  char DstBuf[24]; // [rsp+20h] [rbp-20h] BYREF
  int v5; // [rsp+38h] [rbp-8h]
  int i; // [rsp+3Ch] [rbp-4h]

  _main(argc, argv, envp);
  printf("%s", string);
  init();
  v5 = read(0, DstBuf, 0x10u);		//DstBuf应该就是flag
  if ( v5 != 16 )			//flag长度为16
  {
    puts("length error");
    exit(0);
  }
  for ( i = 0; i < v5; ++i )		//对flag进行加密
    DstBuf[i] ^= DstBuf[(i + 1) % v5];
  if ( strcmp(DstBuf, string) == 1 )	//加密后flag==string
    puts("you get your flag");
  else
    puts("flag error");
  return 0;
}

查看init()

void init()
{
  FILE *v0; // rax
  FILE *v1; // rax
  FILE *v2; // rax

  v0 = __acrt_iob_func(0);
  setbuf(v0, 0i64);
  v1 = __acrt_iob_func(1u);
  setbuf(v1, 0i64);
  v2 = __acrt_iob_func(2u);
  setbuf(v2, 0i64);
  string[0] = 10;
  string[1] = 13;
  string[2] = 6;
  string[3] = 28;
  string[4] = 74;
  string[5] = 69;
  string[6] = 43;
  string[7] = 110;
  string[8] = 66;
  string[9] = 44;
  string[10] = 62;
  string[11] = 62;
  string[12] = 45;
  string[13] = 65;
  string[14] = 78;
  string[15] = 119;
}

Exp

#include<stdio.h>
int main()
{
	char a[16];
	char s[16];
	s[0] = 10;
	s[1] = 13;
	s[2] = 6;
	s[3] = 28;
	s[4] = 74;
	s[5] = 69;
	s[6] = 43;
	s[7] = 110;
	s[8] = 66;
	s[9] = 44;
	s[10] = 62;
	s[11] = 62;
	s[12] = 45;
	s[13] = 65;
	s[14] = 78;
	s[15] = 119;
	
	a[15] = s[15]^s[0];
	
	for (int i = 14; i >=0; --i)
		a[i] = s[i] ^ a[i + 1];
		
	for (int i = 0; i < 16; i++)
		printf("%c",a[i]);
		
	return 0;
}

验证一下