[buuctf]刮开有奖

逻辑分析

这道题是无壳32位的程序，利用ida打开，找到main函数。

int __stdcall WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance, LPSTR lpCmdLine, int nShowCmd)
{
  DialogBoxParamA(hInstance, (LPCSTR)0x67, 0, (DLGPROC)DialogFunc, 0);
  return 0;
}

之后进入DialogFunc中查看。

BOOL __userpurge DialogFunc@<eax>(int a1@<edi>, int a2@<esi>, HWND hDlg, UINT a4, WPARAM a5, LPARAM a6)
{
  const char *v6; // esi
  const char *v7; // edi
  int v9; // [esp+4h] [ebp-20030h]
  int v10; // [esp+8h] [ebp-2002Ch]
  int v11; // [esp+Ch] [ebp-20028h]
  int v12; // [esp+10h] [ebp-20024h]
  int v13; // [esp+14h] [ebp-20020h]
  int v14; // [esp+18h] [ebp-2001Ch]
  int v15; // [esp+1Ch] [ebp-20018h]
  int v16; // [esp+20h] [ebp-20014h]
  int v17; // [esp+24h] [ebp-20010h]
  int v18; // [esp+28h] [ebp-2000Ch]
  int v19; // [esp+2Ch] [ebp-20008h]
  CHAR String; // [esp+30h] [ebp-20004h]
  char v21; // [esp+31h] [ebp-20003h]
  char v22; // [esp+32h] [ebp-20002h]
  char v23; // [esp+33h] [ebp-20001h]
  char v24; // [esp+34h] [ebp-20000h]
  char v25; // [esp+10030h] [ebp-10004h]
  char v26; // [esp+10031h] [ebp-10003h]
  char v27; // [esp+10032h] [ebp-10002h]
  int v28; // [esp+20028h] [ebp-Ch]
  int v29; // [esp+2002Ch] [ebp-8h]

  __alloca_probe();
  if ( a4 == 272 )
    return 1;
  v29 = a2;
  v28 = a1;
  if ( a4 != 273 )
    return 0;
  if ( (_WORD)a5 == 1001 )
  {
    memset(&String, 0, 0xFFFFu);
    GetDlgItemTextA(hDlg, 1000, &String, 0xFFFF);
    if ( strlen(&String) == 8 )
    {
      v9 = 90;
      v10 = 74;
      v11 = 83;
      v12 = 69;
      v13 = 67;
      v14 = 97;
      v15 = 78;
      v16 = 72;
      v17 = 51;
      v18 = 110;
      v19 = 103;
      sub_4010F0(&v9, 0, 10);
      memset(&v25, 0, 0xFFFFu);
      v6 = (const char *)sub_401000(&v25, strlen(&v25));
      memset(&v25, 0, 0xFFFFu);
      v26 = v23;
      v25 = v22;
      v27 = v24;
      v7 = (const char *)sub_401000(&v25, strlen(&v25));
      if ( String == v9 + 34
        && v21 == v13
        && 4 * v22 - 141 == 3 * v11
        && v23 / 4 == 2 * (v16 / 9)
        && !strcmp(v6, "ak1w")
        && !strcmp(v7, "V1Ax") )
      {
        MessageBoxA(hDlg, "U g3t 1T!", "@_@", 0);
      }
    }
    return 0;
  }
  if ( (_WORD)a5 != 1 && (_WORD)a5 != 2 )
    return 0;
  EndDialog(hDlg, (unsigned __int16)a5);
  return 1;
}

之后开始分析逻辑，看图。

之后往下跟进sub_4010F0函数。

int __cdecl sub_4010F0(int a1, int a2, int a3)
{
  int result; // eax
  int i; // esi
  int v5; // ecx
  int v6; // edx

  result = a3;
  for ( i = a2; i <= a3; a2 = i )
  {
    v5 = 4 * i;
    v6 = *(_DWORD *)(4 * i + a1);
    if ( a2 < result && i < result )
    {
      do
      {
        if ( v6 > *(_DWORD *)(a1 + 4 * result) )
        {
          if ( i >= result )
            break;
          ++i;
          *(_DWORD *)(v5 + a1) = *(_DWORD *)(a1 + 4 * result);
          if ( i >= result )
            break;
          while ( *(_DWORD *)(a1 + 4 * i) <= v6 )
          {
            if ( ++i >= result )
              goto LABEL_13;
          }
          if ( i >= result )
            break;
          v5 = 4 * i;
          *(_DWORD *)(a1 + 4 * result) = *(_DWORD *)(4 * i + a1);
        }
        --result;
      }
      while ( i < result );
    }
LABEL_13:
    *(_DWORD *)(a1 + 4 * result) = v6;
    sub_4010F0(a1, a2, i - 1);
    result = a3;
    ++i;
  }
  return result;
}

利用c语言，进行改写，之后直接运行。

#include<stdio.h>
#include<string.h>
int __cdecl sub_4010F0(char* a1, int a2, int a3)
{
    int result; // eax
    int i; // esi
    int v5; // ecx
    int v6; // edx

    result = a3;
    for (i = a2; i <= a3; a2 = i)
    {
        v5 =i;
        v6 = a1[i];
        if (a2 < result && i < result)
        {
            do
            {
                if (v6 > a1[result])
                {
                    if (i >= result)
                        break;
                    ++i;
                    a1[v5] = a1[result];
                    if (i >= result)
                        break;
                    while (a1[i] <= v6)
                    {
                        if (++i >= result)
                            goto LABEL_13;
                    }
                    if (i >= result)
                        break;
                    v5 =i;
                    a1[result] = a1[i];
                }
                --result;
            } while (i < result);
        }
    LABEL_13:
        a1[result] = v6;
        sub_4010F0(a1, a2, i - 1);
        result = a3;
        ++i;
    }
    return result;
}
int main() {
    char str[] = "ZJSECaNH3ng";
    sub_4010F0(str, 0, 10);
    printf("%s", str);
    return 0;
}

可以获得结果是
3CEHJNSZagn
之后继续往下看sub_401000函数。

_BYTE *__cdecl sub_401000(int a1, int a2)
{
  int v2; // eax
  int v3; // esi
  size_t v4; // ebx
  _BYTE *v5; // eax
  _BYTE *v6; // edi
  int v7; // eax
  _BYTE *v8; // ebx
  int v9; // edi
  signed int v10; // edx
  int v11; // edi
  signed int v12; // eax
  signed int v13; // esi
  _BYTE *result; // eax
  _BYTE *v15; // [esp+Ch] [ebp-10h]
  _BYTE *v16; // [esp+10h] [ebp-Ch]
  int v17; // [esp+14h] [ebp-8h]
  int v18; // [esp+18h] [ebp-4h]

  v2 = a2 / 3;
  v3 = 0;
  if ( a2 % 3 > 0 )
    ++v2;
  v4 = 4 * v2 + 1;
  v5 = malloc(v4);
  v6 = v5;
  v15 = v5;
  if ( !v5 )
    exit(0);
  memset(v5, 0, v4);
  v7 = a2;
  v8 = v6;
  v16 = v6;
  if ( a2 > 0 )
  {
    while ( 1 )
    {
      v9 = 0;
      v10 = 0;
      v18 = 0;
      do
      {
        if ( v3 >= v7 )
          break;
        ++v10;
        v9 = *(unsigned __int8 *)(v3++ + a1) | (v9 << 8);
      }
      while ( v10 < 3 );
      v11 = v9 << 8 * (3 - v10);
      v12 = 0;
      v17 = v3;
      v13 = 18;
      do
      {
        if ( v10 >= v12 )
        {
          *((_BYTE *)&v18 + v12) = (v11 >> v13) & 0x3F;
          v8 = v16;
        }
        else
        {
          *((_BYTE *)&v18 + v12) = 64;
        }
        *v8++ = byte_407830[*((char *)&v18 + v12)];
        v13 -= 6;
        ++v12;
        v16 = v8;
      }
      while ( v13 > -6 );
      v3 = v17;
      if ( v17 >= a2 )
        break;
      v7 = a2;
    }
    v6 = v15;
  }
  result = v6;
  *v8 = 0;
  return result;
}

之后知道

.rdata:00407830 byte_407830     db 41h                  ; DATA XREF: sub_401000+C0↑r
.rdata:00407831 aBcdefghijklmno db 'BCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/=',0

所以这说明，这是一个base64
回到主函数，看这里。

可以算出来，第一位是U，第二位是J，第三位W，第四位P，之后base64出来，ak1w是jMp，V1Ax是WP1，之后就知道谁前谁后了，之后答案就出来了是UJWP1jMp
flag{UJWP1jMp}