[GWCTF 2019]xxor

查壳 无壳64位

IDA64打开 找到main反编译

关键代码

16行 输入6个数

25行 进行了xxta加密

29行 z3进行比较

思路： 首先应该z3解密后拿到的数据进行xxta解密

进入sub_400770函数

 

 上脚本

from z3 import*
s=Solver()
a1=[0]*6
for i in range(6):
    a1[i]=Int('a1['+str(i)+']')
s.add(a1[2] - a1[3] == 2225223423)
s.add(a1[3] + a1[4] == 4201428739)
s.add(a1[2] - a1[4] == 1121399208)
s.add(a1[0] == -548868226)
s.add(a1[5] == -2064448480)
s.add(a1[1] == 550153460)
if s.check()==sat:
    print(s.model())

将得到的数据排序 [-548868226,550153460,3774025685,1548802262,2652626477,-2064448480]

进入sub_400686函数

 逻辑很简单

要注意的是 逆的时候要先将v5*64

然后先v4再v3后面要v5-=1166789954
逆向思维很重要

先查看a2数组应该是key

现在可以写脚本了

#include <stdio.h>
int main()
{
    int a1[6] = { 3746099070,550153460,3774025685,1548802262,2652626477,2230518816 };
    unsigned int a2[4] = { 2,2,3,4 };
    unsigned int v3;
    unsigned int v4;
    int v5;
    for (unsigned int j = 0; j < 5; j += 2)
    {
        v3 = a1[j];
        v4 = a1[j + 1];
        v5 = 1166789954 * 64;
        for (unsigned int i = 0; i < 64; i++)
        {
            v4 -= (v3 + v5 + 20) ^ ((v3 << 6) + a2[2]) ^ ((v3 >> 9) + a2[3]) ^ 0x10;
            v3 -= (v4 + v5 + 11) ^ ((v4 << 6) + *a2) ^ ((v4 >> 9) + a2[1]) ^ 0x20;
            v5 -= 1166789954;
        }
        a1[j] = v3;
        a1[j + 1] = v4;
    }//小端序
    for (unsigned int i = 0; i < 6; i++)
        printf("%c%c%c", *((char*)&a1[i] + 2), *((char*)&a1[i] + 1), *(char*)&a1[i]);
}

flag:   flag{re_is_great!}