工具脱壳后查看反编译代码
int __cdecl main(int argc, const char **argv, const char **envp)
{
int result; // eax
int v4; // eax
char Buffer; // [esp+4h] [ebp-38h] BYREF
char v6[49]; // [esp+5h] [ebp-37h] BYREF
Buffer = 0;
memset(v6, 0, sizeof(v6));
printf("Please Input Flag:");
gets_s(&Buffer, 0x2Cu);
if ( strlen(&Buffer) == 42 )
{
v4 = 0;
while ( (*(&Buffer + v4) ^ byte_402130[v4 % 16]) == dword_402150[v4] )
{
if ( ++v4 >= 42 )
{
printf("right!\n");
goto LABEL_8;
}
}
printf("error!\n");
LABEL_8:
result = 0;
}
else
{
printf("error!\n");
result = -1;
}
return result;
}
Exp
byte_402130 = 'this_is_not_flag'
dword_402150 = [0x12, 0x04, 0x08, 0x14, 0x24, 0x5C, 0x4A,
0x3D, 0x56, 0x0A, 0x10, 0x67, 0x00, 0x41,
0x00, 0x01, 0x46, 0x5A, 0x44, 0x42, 0x6E,
0x0C, 0x44, 0x72, 0x0C, 0x0D, 0x40, 0x3E,
0x4B, 0x5F, 0x02, 0x01, 0x4C, 0x5E, 0x5B,
0x17, 0x6E, 0x0C, 0x16, 0x68, 0x5B, 0x12,
0x48, 0x0E]
flag = ''
for i in range(42):
flag += chr(ord(byte_402130[i % 16]) ^ dword_402150[i])
print(flag)
输出:flag{59b8ed8f-af22-11e7-bb4a-3cf862d1ee75}