crackme

工具脱壳后查看反编译代码

int __cdecl main(int argc, const char **argv, const char **envp)
{
  int result; // eax
  int v4; // eax
  char Buffer; // [esp+4h] [ebp-38h] BYREF
  char v6[49]; // [esp+5h] [ebp-37h] BYREF

  Buffer = 0;
  memset(v6, 0, sizeof(v6));
  printf("Please Input Flag:");
  gets_s(&Buffer, 0x2Cu);
  if ( strlen(&Buffer) == 42 )
  {
    v4 = 0;
    while ( (*(&Buffer + v4) ^ byte_402130[v4 % 16]) == dword_402150[v4] )
    {
      if ( ++v4 >= 42 )
      {
        printf("right!\n");
        goto LABEL_8;
      }
    }
    printf("error!\n");
LABEL_8:
    result = 0;
  }
  else
  {
    printf("error!\n");
    result = -1;
  }
  return result;
}

Exp

byte_402130 = 'this_is_not_flag'
dword_402150 = [0x12, 0x04, 0x08, 0x14, 0x24, 0x5C, 0x4A,
                0x3D, 0x56, 0x0A, 0x10, 0x67, 0x00, 0x41,
                0x00, 0x01, 0x46, 0x5A, 0x44, 0x42, 0x6E,
                0x0C, 0x44, 0x72, 0x0C, 0x0D, 0x40, 0x3E,
                0x4B, 0x5F, 0x02, 0x01, 0x4C, 0x5E, 0x5B,
                0x17, 0x6E, 0x0C, 0x16, 0x68, 0x5B, 0x12,
                0x48, 0x0E]
flag = ''
for i in range(42):
    flag += chr(ord(byte_402130[i % 16]) ^ dword_402150[i])
print(flag)

输出：flag{59b8ed8f-af22-11e7-bb4a-3cf862d1ee75}