需要输入正确flag
IDAmain函数
int __cdecl main(int argc, const char **argv, const char **envp)
{
char DstBuf[24]; // [rsp+20h] [rbp-20h] BYREF
int v5; // [rsp+38h] [rbp-8h]
int i; // [rsp+3Ch] [rbp-4h]
_main(argc, argv, envp);
printf("%s", string);
init();
v5 = read(0, DstBuf, 0x10u); //DstBuf应该就是flag
if ( v5 != 16 ) //flag长度为16
{
puts("length error");
exit(0);
}
for ( i = 0; i < v5; ++i ) //对flag进行加密
DstBuf[i] ^= DstBuf[(i + 1) % v5];
if ( strcmp(DstBuf, string) == 1 ) //加密后flag==string
puts("you get your flag");
else
puts("flag error");
return 0;
}
查看init()
void init()
{
FILE *v0; // rax
FILE *v1; // rax
FILE *v2; // rax
v0 = __acrt_iob_func(0);
setbuf(v0, 0i64);
v1 = __acrt_iob_func(1u);
setbuf(v1, 0i64);
v2 = __acrt_iob_func(2u);
setbuf(v2, 0i64);
string[0] = 10;
string[1] = 13;
string[2] = 6;
string[3] = 28;
string[4] = 74;
string[5] = 69;
string[6] = 43;
string[7] = 110;
string[8] = 66;
string[9] = 44;
string[10] = 62;
string[11] = 62;
string[12] = 45;
string[13] = 65;
string[14] = 78;
string[15] = 119;
}
Exp
#include<stdio.h>
int main()
{
char a[16];
char s[16];
s[0] = 10;
s[1] = 13;
s[2] = 6;
s[3] = 28;
s[4] = 74;
s[5] = 69;
s[6] = 43;
s[7] = 110;
s[8] = 66;
s[9] = 44;
s[10] = 62;
s[11] = 62;
s[12] = 45;
s[13] = 65;
s[14] = 78;
s[15] = 119;
a[15] = s[15]^s[0];
for (int i = 14; i >=0; --i)
a[i] = s[i] ^ a[i + 1];
for (int i = 0; i < 16; i++)
printf("%c",a[i]);
return 0;
}
验证一下