[HNCTF 2022 WEEK3]Try2debugPlusPlus-入土为安的第二十一天

考点：tea,反调试

觉得不太一样的是：当调试到exit的时候，会退出，所以为了不让他退出，就nop掉

要nop3,4次

之后得到key的值

点入tea_encrypt,有tea加密过程

点enc有加密后的密文

那就开始写exp了，注意*(_DWORD *)的处理

#include <stdio.h>
#include <string.h>
#include <stdint.h>
int main(void)
{
    unsigned int a1[]={0x0DAD5B6C5, 0x0CE5F717, 0x8BE8AF6B, 0x0D74C6EB4, 0x0EEB8B5A0, 0x0A07618E0, 0x1B425FD0, 0x0C0B77641, 0x0A30FA9BE,0x0CB4F5089, 0x0EBF9EC1D, 0x0F870EF3D};
    int a2[] = {0x91,0x71,0x11,0xbb};
    unsigned int v0,v1,i;
    for (int k = 0; k < 12; k += 2)
    {
        v0 = a1[k];
        v1 = a1[k + 1];
        long delta = 0x79B99E37;
        long sum = (32 * delta);
        for (i = 0; i <= 31; ++i)
        {
            v1 -= (((v0 * 16) ^ (v0 >> 5)) + v0) ^ (sum + a2[(sum >> 11 ) & 3]);
            sum -= delta;
            v0 -= (((v1 * 16) ^ (v1 >> 5)) + v1) ^ (sum + a2[(sum & 3)]);
            
        }
        a1[k] = v0;
        a1[k+1] = v1;
    }
    for (i = 0; i < 12; i++)
    {
        printf("%c",a1[i]);
    }

}
// #_Ant!+Debu9