debug

直接运行，需要输入正确的flag，否则提示错误

查壳发现是.NET程序，头一回遇

尝试IDA和OD都用不了，后来下了个分析.NET用的dnSpy
dnSpy打开

找不到关键代码在哪，尝试运行，在入口处中断

来到关键代码处

using System;
using System.Security.Cryptography;
using System.Text;

internal class ᜅ
{
	private static int ᜀ(int A_0, int A_1)  //加密函数
	{
		return (new int[]
		{
			2,
			3,  //1 
			5,
			7,
			11,
			13,
			17,
			19,
			23,
			29,
			31,
			37,
			41,
			43,
			47, //14
			53, 
			59,
			61,
			67,
			71,
			73,
			79,
			83,
			89,
			97,
			101,
			103,
			107,
			109,
			113
		})[A_1] ^ A_0;  //与下标为1~14的数进行异或
	}

	private static string ᜀ(string A_0)
	{
		byte[] bytes = Encoding.ASCII.GetBytes(A_0);
		return "flag{" + BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(bytes)).Replace("-", "") + "}";
	}  //md5解密

	private static void ᜀ(string A_0, int A_1, ref string A_2)
	{
		int num = 0;
		if (0 < A_0.Length)
		{
			do
			{
				char c = A_0[num];  //遍历a_每个字符
				int num2 = 1;
				do
				{
					c = Convert.ToChar(ᜅ.ᜀ(Convert.ToInt32(c), num2));
					num2++;
				}
				while (num2 < 15);  //执行加密操作14次
				A_2 += c;  //存放加密后的字符
				num++;
			}
			while (num < A_0.Length);
		}
		A_2 = ᜅ.ᜀ(A_2);
	}

	private static void ᜀ(string[] A_0)  //主函数
	{
		string b = null;
		string value = string.Format("{0}", DateTime.Now.Hour + 1);
		string a_ = "CreateByTenshine";
		ᜅ.ᜀ(a_, Convert.ToInt32(value), ref b);  //字符串a_加密后存放到b
		string a = Console.ReadLine();  //输入flag
		if (a == b)  //输入的flag与加密后的_a比较
		{
			Console.WriteLine("u got it!");
			Console.ReadKey(true);
		}
		else
		{
			Console.Write("wrong");
		}
		Console.ReadKey(true);
	}
}

Exp

import hashlib
a_ = 'CreateByTenshine'
s = [3, 5, 7, 11, 13, 17, 19, 23, 29, 31, 37, 41, 43, 47]
result = ''
for i in a_:
    x = i
    for j in range(14):
        x = chr(int(ord(x)) ^ s[j])
    result += x
b = hashlib.md5()
b.update(result.encode())
print("flag{" + b.hexdigest().upper() + "}")  #不知道为什么正确flag是大写的

输出flag{967DDDFBCD32C1F53527C221D9E40A0B}

既然已经知道输入的flag需要与b进行比较，且b为定值，我们可以在判断处断点，查看b的值
验证一下