BUUCTF RE [MRCTF2020]Transform1

查壳 无壳64位

扔进IDA(64) 找到main F5

代码分析

flag为33位，主要看16-23行

将dword_40F040[i]作为Str的下标赋值给了byte_414040[i]，然后进行异或加密，再与byte_40F0E0[j]进行比较。

思路

将byte_414040与dword_40F040进行异或就能得到第一次赋值的byte_414040的值

Str[dword_40F040]=byte_414040就能得到flag

脚本

#include <stdio.h>
int main()
{
int i;
char c[33];
char a[]={0x09,0x0a,0x0f,0x17,0x07,0x18,0x0c,0x06,0x01,0x10,0x03,0x11,0x20,0x1d,0x0b,0x1e,0x1b,0x16,0x04,0x0d,0x13,0x14,0x15,0x02,0x19,0x05,0x1f,0x08,0x12,0x1a,0x1c,0x0e,0} ;
char b[]={0x67,0x79,0x7b,0x7f,0x75,0x2b,0x3c,0x52,0x53,0x79,0x57,0x5e,0x5d,0x42,0x7b,0x2d,0x2a,0x66,0x42,0x7e,0x4c,0x57,0x79,0x41,0x6b,0x7e,0x65,0x3c,0x5c,0x45,0x6f,0x62,0x4d};
for(i=0;i<=32;i++)
{
	b[i]=b[i]^a[i];
}
for(i=0;i<=32;i++)
{
	c[a[i]]=b[i];
}
for(i=0;i<=32;i++)
{
	printf("%c",c[i]);
}
}

flag{Tr4nsp0sltiON_Clph3r_1s_3z}