攻防世界-Reversing-x64Elf-100

Reversing-x64Elf-100

18最佳Writeup由 yuchouxuan 提供

收藏

反馈

难度：1

方向：Reverse

题解数：15

解出人数：2460

题目来源:

题目描述: 暂无

note:

undefined8 FUN_004006fd(long param_1)

{
  int local_2c;
  char *local_28 [4];
  
  local_28[0] = "Dufhbmf";
  local_28[1] = "pG`imos";
  local_28[2] = "ewUglpt";
  local_2c = 0;
  while( true ) {
    if (0xb < local_2c) {
      return 0;
    }
    if ((int)local_28[local_2c % 3][(local_2c / 3) * 2] - (int)*(char *)(param_1 + local_2c) != 1)
    break;
    local_2c = local_2c + 1;
  }
  return 1;
}

signed __int64 __fastcall sub_4006FD(__int64 a1)
{
  signed int i; // [rsp+14h] [rbp-24h]
  const char *v3; // [rsp+18h] [rbp-20h]
  const char *v4; // [rsp+20h] [rbp-18h]
  const char *v5; // [rsp+28h] [rbp-10h]

  v3 = "Dufhbmf";
  v4 = "pG`imos";
  v5 = "ewUglpt";
  for ( i = 0; i <= 11; ++i )
  {
    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
      return 1LL;
  }
  return 0LL;
}

*(char *)(i + a1) =(&v3)[i % 3][2 * (i / 3)]-1

CcmbPZ[dd\ig

DepfU`blmfts____________CdoeT_aklesr____________67 100 111 101 84 95 97 107 108

101 115 114

wrong try!

#include<stdio.h>


int sub_4006FD(void)
{
  signed int i; // [rsp+14h] [rbp-24h]
  const char *v3; // [rsp+18h] [rbp-20h]
  const char *v4; // [rsp+20h] [rbp-18h]
  const char *v5; // [rsp+28h] [rbp-10h]
//int a1;
  v3 = "Dufhbmf";
  v4 = "pG`imos";
  v5 = "ewUglpt";
  
  
  for ( i = 0; i <= 11; ++i )
  {
  	printf("%c",(&v3)[i % 3][2 * (i / 3)]);
//    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
//      return 1LL;
  }
  for ( i = 0; i <= 11; ++i )
      {
      	printf("%s","-");
    //    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
    //      return 1LL;
      }
    for ( i = 0; i <= 11; ++i )
    {
    	printf("%c",(&v3)[i % 3][2 * (i / 3)]-1);
  //    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
  //      return 1LL;
    }
      for ( i = 0; i <= 11; ++i )
	      {
	      	printf("-");
	    //    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
	    //      return 1LL;
	      }
        for ( i = 0; i <= 11; ++i )
	    {
	    	printf("%d ",(&v3)[i % 3][2 * (i / 3)]-1);
	  //    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
	  //      return 1LL;
	    }
	    
	    
	    
  return 0LL;
}

int main(void){
	sub_4006FD();
	return 0;
}

DepfU`blmfts------------CdoeT_aklesr------------67 100 111 101 84 95 97 107 108

101 115 114

Process exited after 0.07565 seconds with return value 0
请按任意键继续. . .

┌──(kwkl㉿kwkl)-[~/HODL/adworld]
└─$ ./43ba593623a7434fa5437cdd5c7862a1.re  
Enter the password: CcmbPZ[dd\ig
Incorrect password!
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~/HODL/adworld]
└─$ ./43ba593623a7434fa5437cdd5c7862a1.re                                                                                                                                    1 ⨯
Enter the password: Code_Talkers
Nice!
                                                                                                                                                                                 
┌──(kwkl㉿kwkl)-[~/HODL/adworld]
└─$ 

Final try!

#include<stdio.h>

int  FUN_004006fd( void)
{
  int local_2c,n,i;
   char *local_28 [4];
  int param_1[11]={99};
  local_28[0] = "Dufhbmf";
  local_28[1] = "pG`imos";
  local_28[2] = "ewUglpt";
  local_2c = 0;
  for ( local_2c = 0; local_2c <= 11; ++local_2c ) {

    for (n=0;n<222;n++){
    if (local_28[local_2c % 3][(local_2c / 3) * 2] - (n + local_2c) == 1)
    	param_1[local_2c]=n;
    	
    }
    local_2c = local_2c + 1;
  }
 		for ( i = 0; i <= 11; ++i ){
 			printf("%c",param_1[i]);
 		}
 		printf("\n------------------------\n");
		  		for ( i = 0; i <= 11; ++i ){
		  			printf("%c",local_28[i % 3][(i / 3) * 2]-1);
		  		}      
  return 1;
}


int sub_4006FD(void)
{
   int i,n; // [rsp+14h] [rbp-24h]
  const char *v3; // [rsp+18h] [rbp-20h]
  const char *v4; // [rsp+20h] [rbp-18h]
  const char *v5; // [rsp+28h] [rbp-10h]
//int a1;
  v3 = "Dufhbmf";
  v4 = "pG`imos";
  v5 = "ewUglpt";
  
  int a1[11]={1};
  
//  for ( i = 0; i <= 11; ++i )
//  {
//  	printf("%c",(&v3)[i % 3][2 * (i / 3)]);
    if ( (&v3)[i % 3][2 * (i / 3)] - *(char *)(i + a1) != 1 )
      return 1LL;
//  }
//
//
//
//	      	printf("\n------------------------\n");
//
//
//        for ( i = 0; i <= 11; ++i )
//	    {
//	    	printf("%c",(&v3)[i % 3][2 * (i / 3)]-1);
//
//	    }
	    printf("\n------------------------\n");
        for ( i = 0; i <= 11; ++i )
	    {
	    //	printf("%c",(&v3)[i % 3][2 * (i / 3)]-1);
	            for ( n = 0; n < 222; n++)
		
		        {
		
		            if ((&v3)[i % 3][2 * (i / 3)]- n == 1)
		
		                a1[i] = n;
		
		        }

	    }	
		for ( i = 0; i <= 11; ++i ){
			printf("%c",a1[i]);
		}   
		printf("\n------------------------\n");
	    
	    
  return 0LL;
}

int main(void){
	sub_4006FD();
	FUN_004006fd();
	return 0;
}

Useful code:

int  FUN_004006fd( void)
{
  int local_2c,n,i;
   char *local_28 [4];
  int param_1[11]={99};
  local_28[0] = "Dufhbmf";
  local_28[1] = "pG`imos";
  local_28[2] = "ewUglpt";
  local_2c = 0;
  
 		printf("\n------------------------\n");
		  		for ( i = 0; i <= 11; ++i ){
		  			printf("%c",local_28[i % 3][(i / 3) * 2]-1);
		  		}      
  return 1;
}

  int local_2c,n,i;
   char *local_28 [4];
  int param_1[11]={99};
  local_28[0] = "Dufhbmf";
  local_28[1] = "pG`imos";
  local_28[2] = "ewUglpt";
  local_2c = 0;
  
 		printf("\n------------------------\n");
		  		for ( i = 0; i <= 11; ++i ){
		  			printf("%c",local_28[i % 3][(i / 3) * 2]-1);
		  		}  

https://www.freebuf.com/articles/network/327979.html算法分析丨Reversing-x64Elf-100逆向题

https://blog.csdn.net/czw2479/article/details/124996658

res = ""
word = ["Dufhbmf", "pG`imos", "ewUglpt"]
for i in range(12):
    res += chr(ord(word[i % 3][2 * (i // 3)]) - 1)
print(res)
 
"""output
Code_Talkers
"""

https://www.freebuf.com/articles/network/327979.html算法分析丨Reversing-x64Elf-100逆向题

res = “”
word = [“Dufhbmf”, “pG`imos”, “ewUglpt”]
for i in range(12):
res += chr(ord(word[i % 3][2 * (i // 3)]) - 1)
print(res)

“”“output
Code_Talkers
“””