Buuoj CTF rome

先查壳，无壳

拖进IDA，直奔main函数，发现主要函数在_func里面，进去看看

int func()
{
  int result; // eax@1
  int v1; // [sp+14h] [bp-44h]@8
  int v2; // [sp+18h] [bp-40h]@8
  int v3; // [sp+1Ch] [bp-3Ch]@8
  int v4; // [sp+20h] [bp-38h]@8
  unsigned __int8 v5; // [sp+24h] [bp-34h]@1
  unsigned __int8 v6; // [sp+25h] [bp-33h]@2
  unsigned __int8 v7; // [sp+26h] [bp-32h]@3
  unsigned __int8 v8; // [sp+27h] [bp-31h]@4
  unsigned __int8 v9; // [sp+28h] [bp-30h]@5
  int v10; // [sp+29h] [bp-2Fh]@8
  int v11; // [sp+2Dh] [bp-2Bh]@8
  int v12; // [sp+31h] [bp-27h]@8
  int v13; // [sp+35h] [bp-23h]@8
  unsigned __int8 v14; // [sp+39h] [bp-1Fh]@7
  char v15; // [sp+3Bh] [bp-1Dh]@1
  char v16; // [sp+3Ch] [bp-1Ch]@1
  char v17; // [sp+3Dh] [bp-1Bh]@1
  char v18; // [sp+3Eh] [bp-1Ah]@1
  char v19; // [sp+3Fh] [bp-19h]@1
  char v20; // [sp+40h] [bp-18h]@1
  char v21; // [sp+41h] [bp-17h]@1
  char v22; // [sp+42h] [bp-16h]@1
  char v23; // [sp+43h] [bp-15h]@1
  char v24; // [sp+44h] [bp-14h]@1
  char v25; // [sp+45h] [bp-13h]@1
  char v26; // [sp+46h] [bp-12h]@1
  char v27; // [sp+47h] [bp-11h]@1
  char v28; // [sp+48h] [bp-10h]@1
  char v29; // [sp+49h] [bp-Fh]@1
  char v30; // [sp+4Ah] [bp-Eh]@1
  char v31; // [sp+4Bh] [bp-Dh]@1
  int i; // [sp+4Ch] [bp-Ch]@8

  v15 = 81;
  v16 = 115;
  v17 = 119;
  v18 = 51;
  v19 = 115;
  v20 = 106;
  v21 = 95;
  v22 = 108;
  v23 = 122;
  v24 = 52;
  v25 = 95;
  v26 = 85;
  v27 = 106;
  v28 = 119;
  v29 = 64;
  v30 = 108;
  v31 = 0;
  printf("Please input:");
  scanf("%s", &v5);
  result = v5;
  if ( v5 == 'A' )
  {
    result = v6;
    if ( v6 == 'C' )
    {
      result = v7;
      if ( v7 == 'T' )
      {
        result = v8;
        if ( v8 == 'F' )
        {
          result = v9;
          if ( v9 == '{' )
          {
            result = v14;
            if ( v14 == '}' )
            {
              v1 = v10;
              v2 = v11;
              v3 = v12;
              v4 = v13;
              for ( i = 0; i <= 15; ++i )
              {
                if ( *((_BYTE *)&v1 + i) > 64 && *((_BYTE *)&v1 + i) <= 90 )
                  *((_BYTE *)&v1 + i) = (*((_BYTE *)&v1 + i) - 51) % 26 + 65;
                if ( *((_BYTE *)&v1 + i) > 96 && *((_BYTE *)&v1 + i) <= 122 )
                  *((_BYTE *)&v1 + i) = (*((_BYTE *)&v1 + i) - 79) % 26 + 97;
              }
              for ( i = 0; i <= 15; ++i )
              {
                result = (unsigned __int8)*(&v15 + i);
                if ( *((_BYTE *)&v1 + i) != (_BYTE)result )
                  return result;
              }
              result = printf("You are correct!");
            }
          }
        }
      }
    }
  }
  return result;
}

V15这一堆转化一下就是

v15 = 'Q';
  v16 = 's';
  v17 = 'w';
  v18 = '3';
  v19 = 's';
  v20 = 'j';
  v21 = '_';
  v22 = 'l';
  v23 = 'z';
  v24 = '4';
  v25 = '_';
  v26 = 'U';
  v27 = 'j';
  v28 = 'w';
  v29 = '@';
  v30 = 'l';
  v31 = '\0';

这个地方是对V1+i进行处理

for ( i = 0; i <= 15; ++i )
              {
                if ( *((_BYTE *)&v1 + i) > 64 && *((_BYTE *)&v1 + i) <= 90 )
                  *((_BYTE *)&v1 + i) = (*((_BYTE *)&v1 + i) - 51) % 26 + 65;
                if ( *((_BYTE *)&v1 + i) > 96 && *((_BYTE *)&v1 + i) <= 122 )
                  *((_BYTE *)&v1 + i) = (*((_BYTE *)&v1 + i) - 79) % 26 + 97;
              }

最后再进行比对赋值

 for ( i = 0; i <= 15; ++i )
              {
                result = (unsigned __int8)*(&v15 + i);
                if ( *((_BYTE *)&v1 + i) != (_BYTE)result )
                  return result;
              }

 因为不知道V1是多少，暴力破解

#include<iostream>
#include<stdio.h>
using namespace std;
int main()
{
    char flag[16] = { 0 };
    char V[16] = { 'Q','s','w','3','s','j', '_','l','z','4','_','U','j','w','@','l' };
    for (int k = 0; k < 16; k++)
    {
        for (int i = 0; i < 127; i++)
        {
            int z = 0;
            z = i;
            if (i > 64 && i <= 90)
                i = (i - 51) % 26 + 65;
            if (i > 96 && i <= 122)
                i = (i - 79) % 26 + 97;
            if (i == V[k])
                flag[k] = z;
        }
    }
    for (int i = 0; i < 16; i++)
        cout << flag[i];
    return 0;
}

Cae3ar_th4_Gre@t