write up
这是一个PE32程序,打开IDA发现不能反编译
引用:.NET程序一般不直接生成本机(汇编)代码,出来的是IL代码, 实际汇编代码在运行期由CLR实时编译产生
发现.NET相关的DLL,然后上DnSPY
参考:
IL指令大全 https://www.cnblogs.com/zery/p/3368460.html
dnspy 使用总结 https://blog.csdn.net/yuqian123455/article/details/85038617
using System;
using System.Security.Cryptography;
using System.Text;
// Token: 0x02000003 RID: 3
internal class ᜅ
{
// Token: 0x06000005 RID: 5 RVA: 0x0000212B File Offset: 0x0000032B
private static int ᜀ(int A_0, int A_1)
{
return (new int[]
{
2,
3,
5,
7,
11,
13,
17,
19,
23,
29,
31,
37,
41,
43,
47,
53,
59,
61,
67,
71,
73,
79,
83,
89,
97,
101,
103,
107,
109,
113
})[A_1] ^ A_0;
}
// Token: 0x06000006 RID: 6 RVA: 0x00002144 File Offset: 0x00000344
private static string ᜀ(string A_0)
{
byte[] bytes = Encoding.ASCII.GetBytes(A_0);
return "flag{" + BitConverter.ToString(new MD5CryptoServiceProvider().ComputeHash(bytes)).Replace("-", "") + "}";
}
// Token: 0x06000007 RID: 7 RVA: 0x0000218C File Offset: 0x0000038C
private static void ᜀ(string A_0, int A_1, ref string A_2)
{
int num = 0;
if (0 < A_0.Length)
{
do
{
char c = A_0[num];
int num2 = 1;
do
{
c = Convert.ToChar(ᜅ.ᜀ(Convert.ToInt32(c), num2));
num2++;
}
while (num2 < 15);
A_2 += c;
num++;
}
while (num < A_0.Length);
}
A_2 = ᜅ.ᜀ(A_2);
}
// Token: 0x06000008 RID: 8 RVA: 0x000021F0 File Offset: 0x000003F0
private static void ᜀ(string[] A_0)
{
string b = null;
string value = string.Format("{0}", DateTime.Now.Hour + 1);
string a_ = "CreateByTenshine";
ᜅ.ᜀ(a_, Convert.ToInt32(value), ref b);
string a = Console.ReadLine();
if (a == b)
{
Console.WriteLine("u got it!");
Console.ReadKey(true);
}
else
{
Console.Write("wrong");
}
Console.ReadKey(true);
}
}
该程序从控制台读入了一个数a,然后与b比较,b经过了复杂的计算,但我们不用管他,直接在算完b的地方下断点,得到了b,也就是flag
# flag{967DDDFBCD32C1F53527C221D9E40A0B}